joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42b700
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49d6bc
mov eax, dword fs:[0]
push eax
sub esp, 0x8c
mov eax, dword [0x544070]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov eax, dword [0x56f400]
mov dword [ebp - 0x7c], 0x531ab0
cmp dword [eax], 0
je 0x42b77b
lea eax, [ebp - 0x60]
xorps xmm0, xmm0
push eax
movlpd qword [ebp - 0x60], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [ebp - 0x60]
push str._CI__::_CollectData___
push 0
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x5c]
push 0x4b10ad
push 0
mov dword [ebp - 0x80], eax
call fcn.00406440
add esp, 0x10
mov edx, esi
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x6c]
call fcn.0042aa20
push esi
lea edx, [ebp - 0x6c]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x98]
call fcn.0042b2a0
lea eax, [ebp - 0x98]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x58]
call fcn.00439ea0
mov byte [ebp - 4], 4
cmp byte [0x56f310], 0
je 0x42b7c8
push ecx
lea ecx, [ebp - 0x58]
call fcn.0043a090
cmp byte [0x56f311], 0
je 0x42b7da
push ecx
lea ecx, [ebp - 0x58]
call fcn.0043a3e0
cmp byte [0x56a7e4], 0
je 0x42b7ec
push ecx
lea ecx, [ebp - 0x58]
call fcn.0043a6c0
cmp byte [0x56a7e5], 0
je 0x42b800
sub esp, 8
lea ecx, [ebp - 0x58]
call fcn.0043a8f0
lea ecx, [ebp - 0x58]
call fcn.0043a000
lea ecx, [ebp - 0x98]
call fcn.004119c0
mov ecx, dword [ebp - 0x6c]
test ecx, ecx
je 0x42b850
push dword [ebp - 0x5c]
mov edx, dword [ebp - 0x68]
push ecx
call fcn.00430af0
mov eax, dword [ebp - 0x64]
add esp, 8
mov ecx, dword [ebp - 0x6c]
sub eax, ecx
sar eax, 3
push eax
push ecx
call fcn.0042dbc0
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x64], 0
mov dword [ebp - 4], 6
mov eax, dword [0x56f400]
cmp dword [eax], 0
je 0x42b8c8
mov esi, dword [0x56f404]
lea eax, [ebp - 0x74]
xorps xmm0, xmm0
push eax
movlpd qword [ebp - 0x74], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [ebp - 0x74]
sub ecx, dword [ebp - 0x84]
mov edx, dword [ebp - 0x70]
sbb edx, dword [ebp - 0x80]
call fcn.00499730
mov edx, dword [esi + 4]
mov ecx, dword [esi]
movsd qword [ebp - 0x60], xmm0
call fcn.00499730
movsd xmm1, qword [ebp - 0x60]
sub esp, 8
divsd xmm1, xmm0
cvtpd2ps xmm0, xmm1
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
push str._n____.6f___
push 0x531ab0
push 0
call fcn.00406440
add esp, 0x14
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0045bdad
mov esp, ebp
pop ebp
ret
Function at 0x42e650
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x42e681
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x42e670
pop edi
mov eax, edx
pop esi
pop ebp
ret 8

Function at 0x431c70
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49e168
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x544070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [ebp - 4], 0
lea ecx, [edi + 0xc]
mov dword [edi], vtable.cxxopts::values::standard_value_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___.0
call fcn.004335b0
mov eax, dword [edi + 0xc]
mov dword [edi + 0x14], eax
mov eax, edi
mov byte [edi + 0x18], 0
mov dword [edi + 0x30], 0xf
mov dword [edi + 0x2c], 0
mov byte [edi + 0x1c], 0
mov byte [edi + 0x34], 0
mov dword [edi + 0x4c], 0xf
mov dword [edi + 0x48], 0
mov byte [edi + 0x38], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x431d10
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49e168
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x544070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [ebp - 4], 0
lea ecx, [edi + 0xc]
mov dword [edi], vtable.cxxopts::values::standard_value_bool_.0
call fcn.00433660
mov eax, dword [edi + 0xc]
mov dword [edi + 0x14], eax
mov eax, edi
mov byte [edi + 0x18], 0
mov dword [edi + 0x30], 0xf
mov dword [edi + 0x2c], 0
mov byte [edi + 0x1c], 0
mov byte [edi + 0x34], 0
mov dword [edi + 0x4c], 0xf
mov dword [edi + 0x48], 0
mov byte [edi + 0x38], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x437ca0
Capabilities:
Enumerate pe sections

Disassembly:
push esi
mov esi, edx
mov eax, 0x40
push edi
mov edi, ecx
mov edx, dword [esi]
and edx, 0x3f
mov byte [edx + esi + 0x18], 0x80
inc edx
sub eax, edx
cmp eax, 8
jae 0x437ce1
push eax
lea eax, [esi + 0x18]
add eax, edx
push 0
push eax
call fcn.00475260
push 0x40
lea edx, [esi + 0x18]
mov ecx, esi
call fcn.00437220
add esp, 0x10
mov eax, 0x40
xor edx, edx
add eax, 0xfffffff8
push eax
lea eax, [esi + 0x18]
add eax, edx
push 0
push eax
call fcn.00475260
shl dword [esi], 3
lea edx, [esi + 0x18]
movzx eax, byte [esi]
mov ecx, esi
mov byte [esi + 0x50], al
mov eax, dword [esi]
shr eax, 8
mov byte [esi + 0x51], al
movzx eax, byte [esi + 2]
mov byte [esi + 0x52], al
movzx eax, byte [esi + 3]
mov byte [esi + 0x53], al
movzx eax, byte [esi + 4]
mov byte [esi + 0x54], al
mov eax, dword [esi + 4]
shr eax, 8
mov byte [esi + 0x55], al
movzx eax, byte [esi + 6]
mov byte [esi + 0x56], al
movzx eax, byte [esi + 7]
push 0x40
mov byte [esi + 0x57], al
call fcn.00437220
movzx eax, byte [esi + 8]
mov byte [edi], al
mov eax, dword [esi + 8]
shr eax, 8
mov byte [edi + 1], al
movzx eax, byte [esi + 0xa]
mov byte [edi + 2], al
movzx eax, byte [esi + 0xb]
mov byte [edi + 3], al
movzx eax, byte [esi + 0xc]
mov byte [edi + 4], al
mov eax, dword [esi + 0xc]
shr eax, 8
mov byte [edi + 5], al
movzx eax, byte [esi + 0xe]
mov byte [edi + 6], al
movzx eax, byte [esi + 0xf]
mov byte [edi + 7], al
movzx eax, byte [esi + 0x10]
mov byte [edi + 8], al
mov eax, dword [esi + 0x10]
shr eax, 8
mov byte [edi + 9], al
movzx eax, byte [esi + 0x12]
mov byte [edi + 0xa], al
movzx eax, byte [esi + 0x13]
mov byte [edi + 0xb], al
movzx eax, byte [esi + 0x14]
mov byte [edi + 0xc], al
mov eax, dword [esi + 0x14]
shr eax, 8
mov byte [edi + 0xd], al
movzx eax, byte [esi + 0x16]
push 0x98
mov byte [edi + 0xe], al
movzx eax, byte [esi + 0x17]
push 0
push esi
mov byte [edi + 0xf], al
call fcn.00475260
add esp, 0x1c
pop edi
pop esi
ret
Function at 0x439280
Capabilities:
Delete registry value
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x544070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
lea eax, [ebp - 0x418]
mov dword [ebp - 0x418], 0
push eax
push 2
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
mov bh, cl
xor bl, bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, eax
test ecx, ecx
je 0x4392eb
mov eax, dword [0x56f420]
cmp dword [eax], 0
je 0x43937e
push ecx
push str.RegOpenKeyEx_error__0x_08x_
push str._CI__::_RunOnStartup____
push 0
call fcn.00406440
add esp, 0x10
jmp 0x43937e
test bh, bh
je 0x439369
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push str.__s____start_dhcp
push eax
call fcn.0043be80
add esp, 0xc
lea eax, [eax*2 + 2]
push eax
lea eax, [ebp - 0x414]
push eax
push 1
push 0
push str.Bitdefender_CI
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, eax
test ecx, ecx
je 0x43937c
mov eax, dword [0x56f420]
cmp dword [eax], 0
je 0x43937e
push ecx
push str.RegSetValueEx_error__0x_08x_
push str._CI__::_RunOnStartup____
push 0
call fcn.00406440
add esp, 0x10
jmp 0x43937e
push str.Bitdefender_CI
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x439342
mov bl, 1
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.0045bdad
mov esp, ebp
pop ebp
ret

Function at 0x4393a0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x27c
mov eax, dword [0x544070]
xor eax, esp
mov dword [esp + 0x278], eax
push esi
push str.___start_dhcp
mov esi, ecx
lea eax, [esp + 0x74]
push esi
push str._s__s
push eax
call fcn.0043be80
push 0x44
lea eax, [esp + 0x3c]
push 0
push eax
call fcn.00475260
add esp, 0x1c
mov dword [esp + 0x28], 0x44
lea eax, [esp + 0x10]
xorps xmm0, xmm0
movaps xmmword [esp + 0x10], xmm0
push eax
lea eax, [esp + 0x2c]
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
lea eax, [esp + 0x90]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x43945c
mov eax, dword [0x56f420]
cmp dword [eax], 0
je 0x439447
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.___start_dhcp
push esi
push str.CreateProcess_error___s___s___0x_08x_
push str._CI__::_RunCommand____
push 0
call fcn.00406440
add esp, 0x18
xor al, al
pop esi
mov ecx, dword [esp + 0x278]
xor ecx, esp
call fcn.0045bdad
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x27c]
mov al, 1
pop esi
xor ecx, esp
call fcn.0045bdad
mov esp, ebp
pop ebp
ret
Function at 0x43abd0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49ea71
mov eax, dword fs:[0]
push eax
sub esp, 0xf8
mov eax, dword [0x544070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [0x56f400]
mov dword [ebp - 0x54], 0x53327c
cmp dword [eax], 0
je 0x43ac47
lea eax, [ebp - 0x30]
xorps xmm0, xmm0
push eax
movlpd qword [ebp - 0x30], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edi, dword [ebp - 0x30]
mov ebx, dword [ebp - 0x2c]
push str._CI__::_Dumper::_CompressJson___
push 0
push 0x4b10ad
push 0
mov dword [ebp - 0x5c], edi
mov dword [ebp - 0x58], ebx
call fcn.00406440
add esp, 0x10
jmp 0x43ac4d
mov ebx, dword [ebp - 0x58]
mov edi, dword [ebp - 0x5c]
mov dword [ebp - 4], 0
lea eax, [esi + 0x18]
cmp dword [eax + 0x14], 0x10
mov dword [ebp - 0x44], 0x43ade0
mov dword [ebp - 0x40], 0x43adf0
jb 0x43ac6d
mov eax, dword [eax]
mov dword [ebp - 0x68], eax
lea edx, [ebp - 0x44]
mov eax, dword [esi + 0x28]
mov ecx, edx
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], eax
lea eax, [esi + 0x30]
mov dword [ebp - 0x6c], 0x43ae00
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x4c], 0x43ae40
call fcn.0043f620
push ecx
lea ecx, [ebp - 0x6c]
push ecx
lea edx, [ebp - 0x4c]
mov ecx, eax
call fcn.0043f680
add esp, 8
mov esi, eax
neg esi
sbb esi, esi
add esi, 1
je 0x43ad45
cmp esi, 1
je 0x43ad45
sub esp, 8
lea ecx, [ebp - 0x104]
call fcn.00421570
mov edx, str.Lzma2Enc_Encode_error:
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x104]
call fcn.0040a420
push esi
lea ecx, [ebp - 0x104]
call fcn.00407110
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x104]
call fcn.00421490
mov byte [ebp - 4], 2
cmp dword [eax + 0x14], 0x10
jb 0x43ad0a
mov eax, dword [eax]
mov dword [ebp - 0x3c], eax
xorps xmm0, xmm0
lea eax, [ebp - 0x30]
mov dword [ebp - 0x34], vtable.std::exception.0
push eax
lea eax, [ebp - 0x3c]
movq qword [ebp - 0x30], xmm0
push eax
mov byte [ebp - 0x38], 1
call fcn.00472f3c
add esp, 8
mov dword [ebp - 0x34], vtable.std::runtime_error.0
lea eax, [ebp - 0x34]
push 0x54226c
push eax
call fcn.0047488d
mov dword [ebp - 4], 3
mov eax, dword [0x56f400]
cmp dword [eax], 0
je 0x43adb8
mov esi, dword [0x56f404]
lea eax, [ebp - 0x3c]
xorps xmm0, xmm0
push eax
movlpd qword [ebp - 0x3c], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x38]
sub ecx, edi
sbb edx, ebx
call fcn.00499730
mov edx, dword [esi + 4]
mov ecx, dword [esi]
movsd qword [ebp - 0x30], xmm0
call fcn.00499730
movsd xmm1, qword [ebp - 0x30]
sub esp, 8
divsd xmm1, xmm0
cvtpd2ps xmm0, xmm1
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
push str._n____.6f___
push 0x53327c
push 0
call fcn.00406440
add esp, 0x14
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045bdad
mov esp, ebp
pop ebp
ret
Function at 0x43ca10
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49eea8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x544070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
mov edi, eax
test edi, edi
jns 0x43ca9e
mov edx, 0x5333f8
mov ecx, 0x56e198
call fcn.00419540
mov edx, eax
test edx, edx
jne 0x43ca60
xor ecx, ecx
jmp 0x43ca67
mov eax, dword [edx]
mov ecx, dword [eax + 4]
add ecx, edx
mov eax, dword [ecx + 0x14]
and eax, 0xfffff9ff
or eax, 0x800
mov dword [ecx + 0x14], eax
mov ecx, edx
push edi
call fcn.00417470
push eax
call fcn.0043df00
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push 3
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
mov edi, eax
test edi, edi
jns 0x43cad5
mov edx, str.Failed_to_initialize_security._Error_code__0x
mov ecx, 0x56e198
call fcn.00419540
mov edx, eax
test edx, edx
jne 0x43ca60
xor ecx, ecx
jmp 0x43ca67
push esi
push 0x4a6b18
push 1
push 0
push 0x4a6b08
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov edi, eax
test edi, edi
jns 0x43cb1c
mov edx, str.Failed_to_create_IWbemLocator_object.
mov ecx, 0x56e198
call fcn.00419540
mov edx, str._Err_code__0x
mov ecx, eax
call fcn.0043dba0
mov edx, eax
test edx, edx
jne 0x43ca60
xor ecx, ecx
jmp 0x43ca67
push str.ROOTCIMV2
lea ecx, [ebp - 0x10]
call fcn.0043c910
mov dword [ebp - 4], 0
mov eax, dword [eax]
test eax, eax
je 0x43cb3a
mov edx, dword [eax]
jmp 0x43cb3c
xor edx, edx
mov ecx, dword [esi]
add esi, 4
push esi
push 0
push 0
mov eax, dword [ecx]
push 0
push 0
push 0
push 0
push edx
push ecx
call dword [eax + 0xc]
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
mov edi, eax
call fcn.0043c9b0
test edi, edi
jns 0x43cb89
push edi
mov edx, str.Could_not_connect._Error_code__0x
push ecx
mov ecx, 0x56e198
call fcn.00419540
mov ecx, eax
call fcn.00417610
mov ecx, eax
jmp 0x43ca7a
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push dword [esi]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
jns 0x43cbab
push eax
mov edx, str.Could_not_set_proxy_blanket._Error_code__0x
jmp 0x43cb70
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x43e850
Capabilities:
Decode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49f240
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x544070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov dword [ebp - 0x28], ecx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x20]
xor esi, esi
mov dword [ebp - 0x24], eax
lea edx, [ebp - 0x24]
mov dword [ebp - 0x20], esi
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x1c], esi
mov dword [ebx], esi
call fcn.0043ef20
mov dword [ebp - 4], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
push esi
push esi
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 1
push eax
push esi
push esi
push dword [edi + 4]
push dword [edi]
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
je 0x43e975
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x24]
call fcn.0043bec0
lea ecx, [ebp - 0x18]
cmp ecx, eax
je 0x43e8ef
mov ecx, dword [eax]
mov dword [eax], esi
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], ecx
test eax, eax
je 0x43e8ef
push eax
call fcn.0045c060
add esp, 4
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x43e8ff
push eax
call fcn.0045c060
add esp, 4
push 0
push 0
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x18]
push 0
push dword [edi + 4]
push dword [edi]
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
je 0x43e975
mov edi, dword [sym.imp.CRYPT32.dll_CryptDecodeObjectEx]
lea eax, [ebp - 0x1c]
push eax
push 0
push 0
push 0
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push 8
push 1
call edi
test eax, eax
je 0x43e975
push dword [ebp - 0x1c]
call fcn.0047bf17
add esp, 4
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0x1c]
push ecx
push eax
push 0
push 0
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push 8
push 1
call edi
test eax, eax
je 0x43e975
push ebx
push dword [ebp - 0x20]
push 1
push dword [ebp - 0x28]
call dword [sym.imp.CRYPT32.dll_CryptImportPublicKeyInfo]
test eax, eax
jne 0x43e97d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x43e98d
push eax
call fcn.0045c060
add esp, 4
cmp byte [ebp - 0x2c], 0
je 0x43e9a5
mov eax, dword [ebp - 0x30]
mov eax, dword [eax]
test eax, eax
je 0x43e9a5
push eax
call fcn.0047bf22
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045bdad
mov esp, ebp
pop ebp
ret
Function at 0x43e9d0
Capabilities:
Decode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49f280
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x544070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov dword [ebp - 0x28], ecx
mov ebx, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
push esi
push esi
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 1
push eax
push esi
push esi
mov dword [ebx], esi
push dword [edi + 4]
push dword [edi]
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
je 0x43eae8
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x24]
call fcn.0043bec0
lea ecx, [ebp - 0x18]
cmp ecx, eax
je 0x43ea5e
mov ecx, dword [eax]
mov dword [eax], esi
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], ecx
test eax, eax
je 0x43ea5e
push eax
call fcn.0045c060
add esp, 4
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x43ea6e
push eax
call fcn.0045c060
add esp, 4
push 0
push 0
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x18]
push 0
push dword [edi + 4]
push dword [edi]
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
je 0x43eae8
mov edi, dword [sym.imp.CRYPT32.dll_CryptDecodeObjectEx]
lea eax, [ebp - 0x1c]
push eax
push 0
push 0
push 0
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push 0x2b
push 1
call edi
test eax, eax
je 0x43eae8
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x20]
call fcn.0043b690
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x20]
push 0
push 0
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push 0x2b
push 1
call edi
test eax, eax
je 0x43eae8
push ebx
push 0
push 0
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
jne 0x43eaf0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x43eb00
push eax
call fcn.0045c060
add esp, 4
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x43eb10
push eax
call fcn.0045c060
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045bdad
mov esp, ebp
pop ebp
ret
Function at 0x43ed40
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49f308
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x544070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov dword [ebp - 0x28], edi
mov esi, ecx
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x24], eax
lea ecx, [ebp - 0x40]
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], eax
call fcn.0043ef20
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 0
lea edx, [ebp - 0x20]
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0x38]
call fcn.0043ef20
lea eax, [ebp - 0x14]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0x30]
call fcn.0043ef20
push 0xf0000000
push 1
push str.Microsoft_Base_Cryptographic_Provider_v1.0
push 0
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 2
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x43ee72
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push eax
mov edx, esi
call fcn.0043e9d0
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x43ee7a
mov eax, dword [edi]
lea ecx, [ebp - 0x1c]
push ecx
push 0x40
push dword [ebp - 0x18]
mov esi, dword [eax]
add eax, 8
push esi
push eax
push dword [ebp - 0x14]
mov dword [ebp - 0x20], esi
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
je 0x43ee72
mov edi, dword [edi + 4]
sub edi, esi
mov esi, dword [ebp - 0x24]
sub edi, 8
mov ecx, esi
push edi
call fcn.0043b690
mov eax, dword [ebp - 0x28]
add esi, 4
mov ecx, dword [ebp - 0x20]
add ecx, 8
push edi
mov eax, dword [eax]
mov edx, dword [esi]
add eax, ecx
mov ecx, dword [ebp - 0x24]
push eax
mov ecx, dword [ecx]
call fcn.0041aa00
mov eax, dword [ebp - 0x24]
add esp, 8
mov dword [esi], edi
push esi
push dword [eax]
push 0x40
push 1
push ebx
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
jne 0x43ee7a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp byte [ebp - 0x2c], 0
je 0x43ee92
mov eax, dword [ebp - 0x30]
mov eax, dword [eax]
test eax, eax
je 0x43ee92
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
cmp byte [ebp - 0x34], 0
mov esi, dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
je 0x43eeaa
mov eax, dword [ebp - 0x38]
mov eax, dword [eax]
test eax, eax
je 0x43eeaa
push eax
call esi
cmp byte [ebp - 0x3c], 0
je 0x43eebc
mov eax, dword [ebp - 0x40]
mov eax, dword [eax]
test eax, eax
je 0x43eebc
push eax
call esi
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045bdad
mov esp, ebp
pop ebp
ret