joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41e3d5
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [0x47a008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x90
xor esi, esi
lea eax, [ebp - 0x9c]
push esi
push eax
mov edi, ecx
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0xa0], 0x94
lea eax, [ebp - 0xa0]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x41e438
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.004263e0
mov esi, eax
mov ecx, esi
call fcn.004298bc
jmp 0x41e45d
cmp dword [ebp - 0x90], 2
jne 0x41e459
cmp dword [ebp - 0x9c], 5
ja 0x41e454
jne 0x41e459
cmp dword [ebp - 0x98], esi
jbe 0x41e459
xor eax, eax
inc eax
jmp 0x41e45b
mov eax, esi
mov dword [edi], eax
mov ecx, esi
call fcn.004298d9
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.00459020
mov esp, ebp
pop ebp
ret
Function at 0x420023
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
xor eax, eax
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
xor esi, esi
and dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
cmp dword [ebp + 0x14], esi
jne 0x420055
mov ecx, 0x80070057
mov edi, ecx
call fcn.004298bc
jmp 0x420163
cmp dword [ebp + 0x18], esi
je 0x420044
mov edx, dword [ebp + 0xc]
lea eax, [ebp - 0xc]
push eax
call fcn.0041f6d0
mov edi, eax
test edi, edi
jns 0x420070
mov ecx, edi
jmp 0x42004b
cmp dword [ebp - 0xc], esi
je 0x42015a
mov edx, dword [ebp + 0xc]
lea eax, [ebp - 0xc]
and dword [ebp - 0xc], esi
push ecx
push eax
push dword [ebp + 0x10]
call fcn.0041fae0
mov edi, eax
test edi, edi
js 0x42006c
cmp dword [ebp - 0xc], esi
je 0x42015a
mov edx, dword [ebp + 0xc]
lea eax, [ebp - 8]
push ecx
push eax
push dword [ebp + 0x10]
call fcn.0041fc53
mov edi, eax
test edi, edi
jns 0x4200c0
mov ecx, edi
call fcn.004298bc
mov esi, dword [ebp - 8]
jmp 0x420163
mov esi, dword [ebp - 8]
lea edx, [ebp - 0x1c]
mov ecx, esi
call fcn.0041ffc3
mov edi, eax
test edi, edi
js 0x42006c
test esi, esi
je 0x4200e2
mov ecx, esi
call fcn.0042986c
and dword [ebp - 8], 0
movzx eax, byte [ebp - 0xd]
push eax
movzx eax, byte [ebp - 0xe]
push eax
movzx eax, byte [ebp - 0xf]
push eax
movzx eax, byte [ebp - 0x10]
push eax
movzx eax, byte [ebp - 0x11]
push eax
movzx eax, byte [ebp - 0x12]
push eax
movzx eax, byte [ebp - 0x13]
push eax
movzx eax, byte [ebp - 0x14]
push eax
movzx eax, word [ebp - 0x16]
push eax
movzx eax, word [ebp - 0x18]
push eax
push dword [ebp - 0x1c]
lea eax, [ebp - 8]
push 0x409970
push eax
call fcn.004271d1
mov edi, eax
add esp, 0x34
test edi, edi
js 0x4200b1
mov esi, dword [ebp - 8]
test esi, esi
je 0x42013a
mov ebx, dword [esi - 4]
jmp 0x42013c
xor ebx, ebx
xor ecx, ecx
call fcn.004298d9
xor edi, edi
mov ecx, esi
test ebx, ebx
je 0x42015a
mov edx, dword [ebp + 0x18]
mov ax, word [ecx]
lea ecx, [ecx + 2]
xor word [edx], ax
dec ebx
jne 0x42014e
mov ecx, dword [ebp + 0x14]
mov eax, esi
xor esi, esi
mov dword [ecx], eax
mov ecx, edi
call fcn.004298d9
test esi, esi
je 0x420175
mov ecx, esi
call fcn.0042986c
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x421cab
Capabilities:
Initialize winhttp library
Prepare http request
Receive http response

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
xor esi, esi
mov dword [esp + 0xc], ecx
and dword [esp + 0x10], esi
push edi
xor edi, edi
mov dword [esp + 0xc], esi
mov dword [esp + 0x18], edi
cmp dword [ebp + 8], esi
jne 0x421ce3
mov ecx, 0x80070057
mov ebx, ecx
call fcn.004298bc
jmp 0x421e29
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x421cd2
mov eax, dword [ebp + 0x14]
lea edx, [esp + 0x14]
and dword [eax], esi
call fcn.004275e9
mov ebx, eax
test ebx, ebx
jns 0x421d02
mov ecx, ebx
jmp 0x421cd9
xor eax, eax
push eax
push eax
push eax
push 1
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
push eax
lea ecx, [esp + 0x10]
call fcn.00421940
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x421d33
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.004263e0
mov ebx, eax
jmp 0x421cfe
push 0
push 0x50
push dword [ebp + 8]
push esi
call dword [sym.imp.WINHTTP.dll_WinHttpConnect]
push eax
lea ecx, [esp + 0x1c]
call fcn.00421940
mov edi, dword [esp + 0x18]
test edi, edi
je 0x421d22
xor eax, eax
push eax
push eax
push eax
push eax
push dword [esp + 0x24]
push 0x409bfc
push edi
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov dword [esp + 0xc], eax
test eax, eax
je 0x421d22
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
jne 0x421d9b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x421e0b
movzx ebx, bx
or ebx, 0x80070000
jmp 0x421e0b
mov ecx, dword [esp + 0x10]
and dword [esp + 0x18], 0
and dword [esp + 0x1c], 0
push ecx
lea eax, [ecx + 0x48]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], eax
call fcn.004229fd
mov eax, dword [esp + 0x10]
push dword [esp + 0xc]
cmp dword [eax + 0x20], 0
je 0x421dd5
lea ecx, [eax + 0x38]
push dword [ecx + 4]
call fcn.004219f5
jmp 0x421ddb
call dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
cmp dword [esp + 0x1c], 0
je 0x421dec
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0
push dword [esp + 0x10]
call dword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
test eax, eax
jne 0x421e12
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.004263e0
mov ebx, eax
mov ecx, ebx
call fcn.004298bc
push dword [esp + 0xc]
call dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
push dword [esp + 0xc]
mov ecx, dword [esp + 0x14]
call fcn.00421c3d
mov ecx, ebx
call fcn.004298d9
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x421e3d
call fcn.0042986c
test edi, edi
je 0x421e48
push edi
call dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
test esi, esi
je 0x421e53
push esi
call dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x422f71
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push esi
push ecx
mov esi, edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x422f8d
movzx eax, al
shr eax, 4
and eax, 1
jmp 0x422f8f
xor eax, eax
xor ecx, ecx
mov dword [esi], eax
call fcn.004298d9
xor ecx, ecx
call fcn.004298d9
xor eax, eax
pop esi
ret
Function at 0x422ff4
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x64c
mov eax, dword [0x47a008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x63c]
mov edx, 0x104
push eax
mov edi, ecx
call fcn.00427450
mov esi, eax
test esi, esi
js 0x423234
push edi
mov edx, 0x105
lea ecx, [ebp - 0x428]
call fcn.004248e3
mov esi, eax
test esi, esi
js 0x423234
mov edi, dword [ebp - 0x63c]
mov ecx, 0x80070216
lea eax, [edi - 1]
cmp eax, edi
ja 0x42305c
mov edi, eax
xor esi, esi
jmp 0x423063
mov esi, ecx
call fcn.004298bc
mov ecx, esi
call fcn.004298d9
test esi, esi
js 0x423234
add edi, edi
push 0x5c
pop ecx
cmp word [ebp + edi - 0x428], cx
jne 0x423097
cmp edi, 0x20a
jae 0x42325e
xor eax, eax
mov word [ebp + edi - 0x428], ax
xor eax, eax
lea edi, [ebp - 0x428]
and dword [ebp - 0x63c], eax
mov word [ebp - 0x218], ax
cmp word [ebp - 0x428], cx
jne 0x4230bb
lea edi, [ebp - 0x426]
push ecx
push edi
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
mov ebx, eax
mov edx, 0x105
mov dword [ebp - 0x640], ebx
pop ecx
lea ecx, [ebp - 0x638]
test ebx, ebx
jne 0x4230f8
push edi
call fcn.004248e3
mov esi, eax
test esi, esi
js 0x423234
mov dword [ebp - 0x63c], 1
jmp 0x423137
sub ebx, edi
sar ebx, 1
push ebx
push edi
call fcn.00422fa8
mov esi, eax
test esi, esi
js 0x423234
cmp dword [ebp - 0x640], edi
jb 0x423255
add ebx, ebx
cmp ebx, 0x20a
jae 0x42325e
xor eax, eax
mov word [ebp + ebx - 0x638], ax
mov ebx, dword [ebp - 0x640]
lea eax, [ebp - 0x648]
mov edx, 0x105
push eax
lea ecx, [ebp - 0x218]
call fcn.00427409
mov esi, eax
test esi, esi
js 0x423234
push 0x7ffffffe
lea eax, [ebp - 0x638]
mov edx, 0x105
push eax
mov eax, dword [ebp - 0x648]
sub edx, eax
push ecx
lea ecx, [ebp - 0x218]
lea ecx, [ecx + eax*2]
call fcn.00424897
mov esi, eax
test esi, esi
js 0x423234
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4231a0
test al, 0x10
jne 0x4231c5
push 0
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x423225
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x423225
test ebx, ebx
je 0x423214
lea edi, [ebx + 2]
mov ebx, 0x105
lea eax, [ebp - 0x644]
mov edx, ebx
push eax
lea ecx, [ebp - 0x218]
call fcn.00427409
mov esi, eax
test esi, esi
js 0x423234
mov eax, dword [ebp - 0x644]
mov edx, ebx
push 0x7ffffffe
push 0x406458
push ecx
lea ecx, [ebp - 0x218]
sub edx, eax
lea ecx, [ecx + eax*2]
call fcn.00424897
mov esi, eax
test esi, esi
js 0x423234
cmp dword [ebp - 0x63c], 0
jne 0x42323b
push 0x5c
pop ecx
jmp 0x4230bb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.004263e0
mov esi, eax
mov ecx, esi
call fcn.004298bc
mov ecx, esi
call fcn.004298d9
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00459020
mov esp, ebp
pop ebp
ret
mov ecx, 0x80070216
mov esi, ecx
jmp 0x423236
call fcn.00459235
int3
Function at 0x423269
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x47a008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 0x424], ecx
push 0x410
lea eax, [ebp - 0x418]
mov dword [ebp - 0x41c], esi
push esi
mov edi, esi
push eax
mov dword [ebp - 0x420], edi
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x418]
push 0x208
push eax
push 0x409d38
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x4232e2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.004263e0
mov ebx, eax
mov ecx, ebx
call fcn.004298bc
jmp 0x423388
lea eax, [ebp - 0x41c]
mov edx, 0x409c28
push eax
push ecx
lea ecx, [ebp - 0x418]
call fcn.00423d05
mov ebx, eax
test ebx, ebx
jns 0x42330f
mov ecx, ebx
call fcn.004298bc
mov esi, dword [ebp - 0x41c]
jmp 0x423388
mov esi, dword [ebp - 0x41c]
lea edx, [ebp - 0x41c]
mov ecx, esi
call fcn.00422f71
mov ebx, eax
test ebx, ebx
js 0x4232d6
cmp dword [ebp - 0x41c], edi
jne 0x42333d
mov ecx, esi
call fcn.00422ff4
mov ebx, eax
test ebx, ebx
js 0x4232d6
lea eax, [ebp - 0x420]
mov edx, 0x409c3c
push eax
push ecx
mov ecx, esi
call fcn.00423d05
mov ebx, eax
test ebx, ebx
jns 0x423366
mov ecx, ebx
call fcn.004298bc
mov edi, dword [ebp - 0x420]
jmp 0x423388
mov edi, dword [ebp - 0x420]
mov ecx, edi
call fcn.00450624
test eax, eax
je 0x4232c7
mov eax, dword [ebp - 0x424]
mov dword [eax + 8], 1
mov ecx, ebx
call fcn.004298d9
test edi, edi
je 0x42339a
mov ecx, edi
call fcn.0042986c
test esi, esi
je 0x4233a5
mov ecx, esi
call fcn.0042986c
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00459020
mov esp, ebp
pop ebp
ret

Function at 0x4239ad
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x47a008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
test esi, esi
jne 0x4239d0
mov esi, 0x80070057
jmp 0x423a25
push 0x410
lea eax, [ebp - 0x418]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x418]
push 0x208
push eax
push 0x409d38
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x423a12
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.004263e0
mov esi, eax
jmp 0x423a25
mov edx, esi
lea ecx, [ebp - 0x418]
call fcn.004275e9
mov esi, eax
test esi, esi
jns 0x423a2c
mov ecx, esi
call fcn.004298bc
mov ecx, esi
call fcn.004298d9
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00459020
mov esp, ebp
pop ebp
ret
Function at 0x42485e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push esi
push ecx
mov esi, edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x42487c
not al
movzx eax, al
shr eax, 4
and eax, 1
jmp 0x42487e
xor eax, eax
xor ecx, ecx
mov dword [esi], eax
call fcn.004298d9
xor ecx, ecx
call fcn.004298d9
xor eax, eax
pop esi
ret

Function at 0x424a1a
Capabilities:
Check mutex on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov eax, ecx
xor esi, esi
mov dword [ebp - 0xc], eax
mov ebx, edx
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
push edi
test eax, eax
jne 0x424a49
mov ecx, 0x80070057
mov esi, ecx
call fcn.004298bc
jmp 0x424af8
test ebx, ebx
je 0x424a38
mov dword [eax], esi
lea eax, [ebp - 4]
push esi
push eax
push 1
push 0x409fa4
mov dword [ebx], esi
call dword [sym.imp.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
test eax, eax
jne 0x424a7a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.004263e0
mov esi, eax
mov ecx, esi
jmp 0x424a3f
xor eax, eax
lea edi, [ebp - 0x18]
stosd dword es:[edi], eax
push 0x409fd0
push esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 0x18], 0xc
mov dword [ebp - 0x10], esi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
test eax, eax
je 0x424a67
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x424af2
cmp eax, 0x80
je 0x424af2
cmp eax, 0x102
je 0x424aeb
cmp eax, 0xffffffff
je 0x424ad2
mov esi, 0x80004005
jmp 0x424a76
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [ebp - 8]
mov ecx, eax
call fcn.00427846
mov esi, dword [ebp - 8]
test eax, eax
jne 0x424af8
jmp 0x424a76
mov esi, 0x800705b4
jmp 0x424a76
mov dword [ebx], 1
mov ecx, esi
call fcn.004298d9
cmp dword [ebp - 4], 0
je 0x424b0e
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x424cf5
Capabilities:
Get file size
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
or dword [ebp - 4], 0xffffffff
mov eax, edx
push ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 0x10], eax
xor edi, edi
test ecx, ecx
jne 0x424d22
mov ecx, 0x80070057
mov edi, ecx
call fcn.004298bc
jmp 0x424dd1
test eax, eax
je 0x424d11
cmp dword [ebp + 8], esi
je 0x424d11
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push eax
lea ecx, [ebp - 4]
call fcn.00424cbb
cmp dword [ebp - 4], 0xffffffff
jne 0x424d66
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.004263e0
mov edi, eax
mov ecx, edi
jmp 0x424d18
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x424d53
cmp dword [ebp - 8], esi
jne 0x424d11
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x424d9f
xor esi, esi
mov edi, 0x8007000e
jmp 0x424d62
push 0
lea ecx, [ebp - 0xc]
mov esi, eax
push ecx
push ebx
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x424d53
cmp dword [ebp - 0xc], ebx
je 0x424dc2
mov edi, 0x8000ffff
jmp 0x424d62
mov eax, dword [ebp - 0x10]
xor esi, esi
mov ecx, dword [ebp + 8]
mov dword [eax], ebx
mov eax, dword [ebp - 0x14]
mov dword [ecx], eax
mov ecx, edi
call fcn.004298d9
test esi, esi
je 0x424dec
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
lea ecx, [ebp - 4]
call fcn.00424c9a
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x424e04
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov esi, ebx
cmp dword [edi], ebx
je 0x424e22
push ebx
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov dword [edi], ebx
cmp dword [edi + 8], ebx
je 0x424e6b
push 0x30
push 0x18
push 0x40a100
push dword [edi + 4]
lea eax, [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x424e57
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.004263e0
mov esi, eax
mov ecx, esi
call fcn.004298bc
mov ecx, esi
call fcn.004298d9
test esi, esi
jns 0x424e6b
mov ecx, esi
call fcn.004298bc
jmp 0x424e7a
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x424e7a
call fcn.0042986c
mov dword [edi + 4], ebx
mov ecx, esi
call fcn.004298d9
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x424e8f
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov ebx, ecx
call fcn.00424e04
xor esi, esi
xor ecx, ecx
mov dword [ebp - 4], esi
call fcn.004298d9
cmp dword [ebp - 4], esi
je 0x424eba
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
push 0x28
push 0x18
push 0x40a100
push dword [ebp + 8]
push ebx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x424ee2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.004263e0
mov esi, eax
jmp 0x424ef8
cmp dword [ebp + 8], esi
je 0x424eff
mov ecx, dword [ebp + 8]
lea edx, [ebx + 4]
call fcn.004275e9
mov esi, eax
test esi, esi
jns 0x424eff
mov ecx, esi
call fcn.004298bc
mov ecx, esi
call fcn.004298d9
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4252df
Capabilities:
Encode data using base64

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, ecx
mov eax, edx
mov dword [ebp - 8], eax
push esi
push edi
test ebx, ebx
je 0x4252fb
cmp dword [ebp + 0x10], 0
jne 0x425305
mov ecx, 0x80070057
jmp 0x42549a
lea ecx, [ebp - 0x14]
push ecx
push 2
pop edx
mov ecx, eax
call fcn.004274d1
mov esi, eax
test esi, esi
js 0x4253a3
mov edi, dword [ebp - 0x14]
xor edx, edx
push 3
pop ecx
mov eax, edi
mov dword [ebp - 0xc], edi
div ecx
xor ecx, ecx
mov esi, ecx
test eax, eax
je 0x425355
mov edx, eax
shl edx, 2
mov ecx, edx
shr ecx, 2
cmp ecx, eax
je 0x425350
mov esi, 0x80070216
mov ecx, esi
call fcn.004298bc
jmp 0x425358
mov dword [ebp - 0xc], edx
jmp 0x425358
mov dword [ebp - 0xc], ecx
mov ecx, esi
call fcn.004298d9
test esi, esi
js 0x4253a3
mov edi, dword [ebp + 0xc]
xor edx, edx
mov ecx, dword [ebp - 0xc]
inc edx
test edi, edi
jne 0x425385
push dword [ebp + 0x10]
call fcn.004274d1
mov esi, eax
test esi, esi
js 0x4253a3
xor esi, esi
jmp 0x4254aa
lea eax, [ebp - 0x10]
push eax
call fcn.004274d1
mov esi, eax
test esi, esi
js 0x4253a3
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x10]
cmp dword [eax], ecx
jae 0x4253aa
mov esi, 0x8007007a
mov ecx, esi
jmp 0x42549c
lea edx, [edi + ecx*2]
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 8]
test edx, edx
jle 0x425490
lea ecx, [edi + 6]
mov dword [ebp - 0xc], ecx
xor eax, eax
mov word [ebp - 8], ax
mov ah, byte [ebx]
inc ebx
mov byte [ebp - 1], al
cmp edx, 1
jbe 0x4253e5
mov al, byte [ebx]
inc ebx
mov byte [ebp - 2], al
cmp edx, 2
jbe 0x4253eb
mov al, byte [ebx]
inc ebx
mov byte [ebp - 1], al
jmp 0x4253eb
mov al, byte [ebp - 7]
mov byte [ebp - 2], al
cmp ecx, dword [ebp - 0x14]
jae 0x425495
add dword [ebp - 0xc], 2
movzx ecx, ah
mov eax, ecx
shl ecx, 4
shr eax, 2
movzx eax, byte [eax + 0x40a170]
mov word [edi], ax
movzx eax, byte [ebp - 2]
mov dword [ebp - 0x18], eax
shr eax, 4
or eax, ecx
mov ecx, dword [ebp - 0xc]
and eax, 0x3f
add ecx, 2
mov dword [ebp - 0xc], ecx
movzx eax, byte [eax + 0x40a170]
mov word [edi + 2], ax
cmp edx, 1
jbe 0x425453
movzx ecx, byte [ebp - 1]
mov eax, dword [ebp - 0x18]
shr ecx, 6
shl eax, 2
or ecx, eax
and ecx, 0x3f
movzx eax, byte [ecx + 0x40a170]
mov ecx, dword [ebp - 0xc]
jmp 0x425456
push 0x3d
pop eax
mov word [edi + 4], ax
cmp edx, 2
jbe 0x42546f
movzx eax, byte [ebp - 1]
and eax, 0x3f
movzx eax, byte [eax + 0x40a170]
jmp 0x425472
push 0x3d
pop eax
mov word [edi + 6], ax
add ecx, 4
sub edx, 3
mov dword [ebp - 0xc], ecx
add edi, 8
test edx, edx
jg 0x4253c1
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x10]
cmp edi, dword [ebp - 0x14]
jb 0x4254a3
mov ecx, 0x8000ffff
mov esi, ecx
call fcn.004298bc
jmp 0x4254aa
xor edx, edx
mov word [edi], dx
mov dword [eax], ecx
mov ecx, esi
call fcn.004298d9
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x425c67
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
or dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x1c]
or dword [ebp - 0xc], 0xffffffff
and dword [ebp - 8], 0
and dword [ebp - 4], 0
push ebx
push esi
push edi
push eax
lea eax, [ebp - 8]
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
xor esi, esi
push eax
call fcn.00425b9c
mov edi, eax
test edi, edi
jns 0x425ca8
mov ecx, edi
call fcn.004298bc
jmp 0x425dbb
lea eax, [ebp - 4]
push eax
push 0
push 0
push dword [ebp - 0x1c]
push dword [ebp - 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
jne 0x425cd3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.004263e0
mov edi, eax
jmp 0x425c9c
cmp dword [ebp - 0xc], 0xffffffff
push 4
pop ebx
je 0x425cf0
push 0
lea eax, [ebp - 0xc]
push eax
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
test eax, eax
je 0x425cc2
cmp dword [ebp - 0x10], 0xffffffff
je 0x425d0b
push 0
lea eax, [ebp - 0x10]
push eax
push 3
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
test eax, eax
je 0x425cc2
push 0
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], ebx
push eax
lea eax, [ebp - 0x18]
push eax
push 8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptGetKeyParam]
test eax, eax
je 0x425cc2
cmp dword [ebp - 0x14], ebx
je 0x425d36
mov edi, 0x8000ffff
jmp 0x425c9c
mov eax, dword [ebp + 0x14]
shr dword [ebp - 0x18], 3
push eax
push 0
mov dword [ebp - 0x1c], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
jne 0x425d62
xor esi, esi
mov edi, 0x8007000e
jmp 0x425c9c
push dword [ebp + 0x14]
mov esi, ebx
push dword [ebp + 0x10]
push ebx
call sub.msvcrt.dll_memcpy
mov ecx, dword [ebp + 0x14]
add esp, 0xc
mov eax, dword [ebp - 0x1c]
sub eax, ecx
push eax
lea eax, [ebx + ecx]
push 0
push eax
call sub.msvcrt.dll_memset
mov eax, dword [ebp - 0x1c]
add esp, 0xc
mov dword [ebp + 0x14], eax
lea eax, [ebp + 0x14]
push eax
push ebx
push 0
push 1
push 0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x425cc2
mov eax, dword [ebp + 0x18]
xor esi, esi
mov ecx, dword [ebp + 0x1c]
mov dword [eax], ebx
mov eax, dword [ebp + 0x14]
mov dword [ecx], eax
mov ecx, edi
call fcn.004298d9
test esi, esi
je 0x425dd6
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp - 4], 0
je 0x425de9
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
and dword [ebp - 4], 0
lea ecx, [ebp - 8]
call fcn.0041f31d
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20