joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43f100
Capabilities:
Encode data using xor

Disassembly:
mov eax, 8
call fcn.00468d20
push ebx
push ebp
push esi
mov ebx, ecx
mov ecx, dword [esp + 0x18]
push edi
call fcn.00424be0
mov esi, eax
add esi, 0xfffffff9
mov ebp, edx
adc ebp, 0xffffffff
push esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], ebp
call fcn.004691cd
mov ecx, dword [esp + 0x20]
mov edi, eax
add esp, 4
test edi, edi
jne 0x43f14d
call fcn.0043a470
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
push ebp
push esi
push edi
push 0
push 7
call fcn.00424750
xor esi, esi
xor ebp, ebp
cmp dword [esp + 0x14], esi
jb 0x43f1b0
ja 0x43f170
cmp dword [esp + 0x10], esi
jbe 0x43f1b0
jmp 0x43f170
mov eax, dword [ebx + 0x54]
push 0
push eax
push ebp
push esi
call fcn.0046bae0
mov cl, byte [eax + ebx + 0x24]
xor byte [esi + edi], cl
mov edx, dword [ebx + 0x54]
push 0
push edx
push ebp
push esi
call fcn.0046bae0
mov al, byte [eax + ebx + 0x24]
add al, byte [esi + edi]
add esi, 1
mov byte [esi + edi - 1], al
adc ebp, 0
cmp ebp, dword [esp + 0x14]
jb 0x43f170
ja 0x43f1b0
cmp esi, dword [esp + 0x10]
jb 0x43f170
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov esi, dword [esp + 0x1c]
push ecx
push edx
push edi
push 0
push 0
mov ecx, esi
call fcn.00424860
push 0
push 7
mov ecx, esi
call fcn.00424c20
push edi
call fcn.004690f0
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
Function at 0x43f5f0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x14
call fcn.00468d20
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
push esi
mov dword [esp + 0x14], ecx
push edi
mov ecx, ebx
call fcn.00424be0
mov esi, edx
mov ebp, eax
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], esi
test esi, esi
ja 0x43f625
cmp ebp, 0x100000
jbe 0x43f63a
mov ebp, 0xffffe
mov dword [esp + 0x20], 0
mov esi, dword [esp + 0x20]
mov dword [esp + 0x1c], ebp
lea eax, [ebp + 2]
push eax
call fcn.004691cd
mov edi, eax
add esp, 4
mov ecx, ebx
test edi, edi
jne 0x43f65d
call fcn.0043a470
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 8
push esi
push ebp
push edi
push 0
mov byte [edi + ebp], 0
push 0
mov byte [edi + ebp + 1], 0
call fcn.00424750
mov ecx, ebp
add ecx, 0xfffffffc
adc esi, 0xffffffff
mov ebx, ecx
shrd ebx, esi, 2
xor eax, eax
shr esi, 2
lea esi, [edi + 4]
mov dword [esp + 0x14], eax
cmp ebx, eax
jbe 0x43f6e1
mov dword [esp + 0x10], eax
add eax, 5
cmp eax, ebx
jne 0x43f6a3
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esp + 0x10]
xor edx, edx
mov ebp, 0x61a8
div ebp
mov ecx, dword [esi]
mov eax, dword [esp + 0x18]
add dword [esp + 0x10], 4
bswap ecx
mov dword [esi], ecx
mov eax, dword [eax + 0x24]
add esi, 4
mov edx, dword [edx + eax]
mov eax, dword [esp + 0x14]
xor edx, ecx
ror edx, 5
inc eax
mov dword [esi - 4], edx
mov dword [esp + 0x14], eax
cmp eax, ebx
jb 0x43f694
mov ebp, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov eax, ebp
shrd eax, ecx, 1
shr ecx, 1
mov esi, eax
dec esi
mov ecx, 2
cmp esi, ecx
jbe 0x43f727
xor eax, eax
mov dword [esp + 0x14], eax
nop
xor edx, edx
mov ebx, 0x61a8
div ebx
mov eax, dword [esp + 0x18]
mov eax, dword [eax + 0x24]
inc ecx
mov edx, dword [edx + eax]
xor dword [edi + ecx*2 - 2], edx
mov eax, dword [esp + 0x14]
add eax, 4
mov dword [esp + 0x14], eax
cmp ecx, esi
jb 0x43f700
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
push eax
push ebp
push edi
push 0
push 0
call fcn.00424860
push edi
call fcn.004690f0
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 8
Function at 0x441750
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4da868
mov eax, dword fs:[0]
push eax
mov eax, 4
call fcn.00468d20
push esi
mov eax, dword [0x5808f0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
lea ecx, [esi + 4]
xor eax, eax
mov dword [ecx + 0x18], 7
mov dword [ecx + 0x14], eax
xor edx, edx
mov word [ecx + 4], dx
mov byte [esi + 0x20], al
mov dword [esi], vtable.Decryptor12950.0
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], eax
push 5
mov dword [esi + 0x4c], eax
push str..dcry
mov dword [esp + 0x1c], eax
mov dword [esi + 0x50], eax
call fcn.0041c510
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x4469c0
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffffffffff
push 0x4d96fb
mov eax, dword fs:[0]
push eax
mov eax, 0x828
call fcn.00468d20
mov eax, dword [0x5808f0]
xor eax, esp
mov dword [esp + 0x824], eax
push esi
push edi
mov eax, dword [0x5808f0]
xor eax, esp
push eax
lea eax, [esp + 0x834]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [esp + 0x844]
lea ecx, [esp + 0xc]
call fcn.00424cc0
push 0
push esi
lea ecx, [esp + 0x14]
mov dword [esp + 0x844], 0
call fcn.00424d40
lea ecx, [esp + 0xc]
call fcn.00424740
lea ecx, [esp + 0xc]
test al, al
jne 0x446a4e
mov dword [esp + 0x83c], 0xffffffff
call fcn.00424ce0
xor al, al
jmp 0x446aee
call fcn.00424be0
test edx, edx
jg 0x446a78
jl 0x446a60
cmp eax, 0x80c
jae 0x446a78
lea ecx, [esp + 0xc]
mov dword [esp + 0x83c], 0xffffffff
call fcn.00424ce0
xor al, al
jmp 0x446aee
push 0
push 0x800
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x18]
call fcn.00424be0
sub eax, 0x80c
sbb edx, 0
push edx
push eax
lea ecx, [esp + 0x20]
call fcn.00424750
xor eax, eax
xor byte [esp + eax + 0x30], 0xaa
inc eax
cmp eax, 0x800
jl 0x446aa2
cmp dword [edi + 0x2c], 0x800
jb 0x446a60
mov eax, dword [edi + 0x24]
lea edx, [esp + 0x30]
mov ecx, 0x800
sub edx, eax
mov esi, dword [edx + eax]
cmp esi, dword [eax]
jne 0x446a60
sub ecx, 4
add eax, 4
cmp ecx, 4
jae 0x446ac6
lea ecx, [esp + 0xc]
mov dword [esp + 0x83c], 0xffffffff
call fcn.00424ce0
mov al, 1
mov ecx, dword [esp + 0x834]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x824]
xor ecx, esp
call fcn.004690b5
add esp, 0x834
ret 4

Function at 0x448a10
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
push ebx
mov ebx, dword [ecx + 0x14]
cmp ebx, 0x10
push ebp
jle 0x448a23
mov ebx, 0x10
mov ebp, dword [esp + 0x10]
push edi
xor edi, edi
test ebx, ebx
jle 0x448a5f
push esi
nop
mov eax, dword [ecx + 0x14]
mov esi, eax
sub esi, edi
dec esi
cmp esi, eax
jbe 0x448a45
call fcn.00469df6
mov ecx, dword [esp + 0x14]
cmp dword [ecx + 0x18], 8
jb 0x448a50
mov eax, dword [ecx + 4]
jmp 0x448a53
lea eax, [ecx + 4]
mov al, byte [eax + esi*2]
mov byte [edi + ebp], al
inc edi
cmp edi, ebx
jl 0x448a30
pop esi
mov eax, 1
pop edi
mov cl, byte [eax + ebp]
mov dl, cl
xor dl, al
add dl, cl
mov byte [eax + ebp], dl
inc eax
cmp eax, 0x10
jl 0x448a65
cmp ebx, 0x10
jge 0x448a90
mov al, 0x10
sub al, bl
movzx eax, al
push eax
push eax
add ebx, ebp
push ebx
call fcn.00468ca0
add esp, 0xc
pop ebp
pop ebx
ret 8
Function at 0x44c590
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffffffffff
push 0x4d870b
mov eax, dword fs:[0]
push eax
mov eax, 0x144
call fcn.00468d20
mov eax, dword [0x5808f0]
xor eax, esp
mov dword [esp + 0x140], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5808f0]
xor eax, esp
push eax
lea eax, [esp + 0x158]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x168]
mov ebx, ecx
mov ecx, ebp
xor edi, edi
xor esi, esi
call fcn.00424be0
mov dword [esp + 0x14], eax
xor eax, eax
mov dword [esp + 0x18], edx
mov byte [esp + 0x124], 0
mov dword [esp + 0x125], eax
mov dword [esp + 0x129], eax
mov dword [esp + 0x12d], eax
mov word [esp + 0x131], ax
mov byte [esp + 0x133], al
mov dword [esp + 0x24], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x20], vtable.dwcl::AES.0
push 1
add ebx, 0x24
push 0x20
push ebx
lea ecx, [esp + 0x2c]
mov dword [esp + 0x16c], eax
mov dword [esp + 0x28], ebx
call fcn.00401b90
lea eax, [esp + 0x124]
mov ecx, eax
push eax
push ecx
lea ecx, [esp + 0x28]
call fcn.00401c00
push esi
push 0x20
push ebx
lea ecx, [esp + 0x2c]
call fcn.00401b90
cmp dword [esp + 0x2c], esi
jne 0x44c685
mov edx, dword [esp + 0x20]
mov eax, dword [edx]
lea ecx, [esp + 0x20]
call eax
push eax
call fcn.004691cd
add esp, 4
mov dword [esp + 0x2c], eax
mov edx, dword [esp + 0x20]
mov eax, dword [edx]
lea ecx, [esp + 0x20]
call eax
mov edx, dword [esp + 0x2c]
push eax
lea ecx, [esp + 0x128]
push ecx
push edx
call fcn.00468d50
mov ecx, dword [esp + 0x20]
mov ebx, dword [esp + 0x24]
mov eax, ecx
and eax, 0xfffffff0
add esp, 0xc
mov dword [esp + 0x144], eax
test ebx, ebx
jb 0x44c71e
ja 0x44c6c5
test eax, eax
jbe 0x44c71e
push 0
push 0x10
lea eax, [esp + 0x13c]
push eax
push esi
push edi
mov ecx, ebp
call fcn.00424750
push 0x10
lea ecx, [esp + 0x138]
push ecx
mov edx, ecx
push edx
lea ecx, [esp + 0x2c]
call fcn.00401a30
push 0
push 0x10
lea eax, [esp + 0x13c]
push eax
push esi
push edi
mov ecx, ebp
call fcn.00424860
add edi, 0x10
adc esi, 0
cmp esi, ebx
jb 0x44c6c5
ja 0x44c71a
cmp edi, dword [esp + 0x144]
jb 0x44c6c5
mov ecx, dword [esp + 0x14]
and ecx, 0xf
mov ebx, ecx
je 0x44c798
xor eax, eax
push eax
push ebx
lea ecx, [esp + 0x13c]
push ecx
push esi
push edi
mov ecx, ebp
call fcn.00424750
mov edx, dword [esp + 0x1c]
push 1
push 0x20
push edx
lea ecx, [esp + 0x2c]
call fcn.00401b90
mov ecx, dword [esp + 0x2c]
lea eax, [esp + 0x144]
push eax
push ecx
lea ecx, [esp + 0x28]
call fcn.00401c00
xor eax, eax
test ebx, ebx
jbe 0x44c783
jmp 0x44c770
mov dl, byte [esp + eax + 0x144]
xor byte [esp + eax + 0x134], dl
inc eax
cmp eax, ebx
jb 0x44c770
xor eax, eax
push eax
push ebx
lea eax, [esp + 0x13c]
push eax
push esi
push edi
mov ecx, ebp
call fcn.00424860
mov eax, dword [esp + 0x24]
mov dword [esp + 0x20], vtable.dwcl::AbstractCipher.0
test eax, eax
je 0x44c7b9
push eax
call fcn.004690f0
add esp, 4
mov dword [esp + 0x24], 0
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x44c7ca
push eax
call fcn.004690f0
add esp, 4
mov ecx, dword [esp + 0x158]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x140]
xor ecx, esp
call fcn.004690b5
add esp, 0x150
ret 8
Function at 0x44f230
Capabilities:
Encode data using xor
Encrypt data using xtea

Disassembly:
mov ecx, dword [esp + 4]
mov edx, dword [ecx]
mov ecx, dword [ecx + 4]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
mov edi, 0x20
mov eax, 0xc6ef3720
jmp 0x44f250
mov ebx, edx
shr ebx, 5
mov ebp, edx
shl ebp, 4
xor ebx, ebp
mov ebp, eax
shr ebp, 0xb
and ebp, 3
movzx ebp, byte [esi + ebp]
add ebp, eax
add ebx, edx
xor ebx, ebp
sub ecx, ebx
mov ebx, ecx
shr ebx, 5
mov ebp, ecx
shl ebp, 4
xor ebx, ebp
add eax, 0x61c88647
mov ebp, eax
and ebp, 3
movzx ebp, byte [esi + ebp]
add ebx, ecx
add ebp, eax
xor ebx, ebp
sub edx, ebx
sub edi, 1
jne 0x44f250
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
mov dword [eax], edx
mov dword [eax + 4], ecx
pop ebx
ret
Function at 0x455a70
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x14
call fcn.00468d20
push ebx
push ebp
push esi
mov esi, ecx
mov eax, dword [esi + 0x2c]
xor ebp, ebp
push eax
mov dword [esp + 0x10], esi
mov dword [esp + 0x1c], ebp
call fcn.004691cd
mov ebx, eax
add esp, 4
cmp ebx, ebp
jne 0x455aad
mov ecx, dword [esp + 0x24]
call fcn.0043a470
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 8
mov esi, dword [esi + 0x28]
cmp esi, ebp
jne 0x455ac9
mov esi, dword [esp + 0x24]
mov ecx, esi
call fcn.00424be0
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
jmp 0x455ad5
mov dword [esp + 0x10], esi
mov esi, dword [esp + 0x24]
mov dword [esp + 0x14], ebp
mov ecx, esi
call fcn.00424be0
cmp dword [esp + 0x14], edx
jb 0x455af9
ja 0x455aea
cmp dword [esp + 0x10], eax
jbe 0x455af9
mov ecx, esi
call fcn.00424be0
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
cmp dword [esp + 0x14], ebp
jb 0x455b9c
ja 0x455b0f
cmp dword [esp + 0x10], ebp
jbe 0x455b9c
push edi
mov edi, dword [esp + 0x14]
sub edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
mov ecx, dword [ecx + 0x2c]
sbb esi, ebp
xor eax, eax
cmp esi, eax
jb 0x455b35
ja 0x455b31
cmp edi, ecx
jbe 0x455b35
mov edi, ecx
mov esi, eax
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x28]
push esi
push edi
push ebx
push ebp
push edx
call fcn.00424750
xor eax, eax
test esi, esi
jb 0x455b6d
ja 0x455b53
test edi, edi
jbe 0x455b6d
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx + 0x24]
mov cl, byte [eax + edx]
xor byte [eax + ebx], cl
xor ecx, ecx
inc eax
cmp ecx, esi
jb 0x455b53
ja 0x455b6d
cmp eax, edi
jb 0x455b53
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x28]
push esi
push edi
push ebx
push ebp
push edx
call fcn.00424860
add dword [esp + 0x1c], edi
adc ebp, esi
cmp ebp, dword [esp + 0x18]
jb 0x455b10
ja 0x455b9b
mov eax, dword [esp + 0x14]
cmp dword [esp + 0x1c], eax
jb 0x455b10
pop edi
push ebx
call fcn.004690f0
add esp, 4
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 8

Function at 0x455d40
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov ecx, dword [esp + 4]
xor eax, eax
mov byte [eax + ecx], al
inc eax
cmp eax, 0x100
jl 0x455d46
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
mov edi, dword [esp + 0x1c]
mov byte [ecx + 0x101], 1
xor ebx, ebx
movzx esi, bl
xor edx, edx
mov eax, esi
div edi
mov byte [ecx + 0x100], bl
inc ebx
movzx eax, byte [edx + ebp]
add al, byte [esi + ecx]
add byte [ecx + 0x101], al
cmp ebx, 0x100
mov al, byte [ecx + 0x101]
mov dl, byte [esi + ecx]
movzx eax, al
movzx eax, byte [eax + ecx]
mov byte [esi + ecx], al
movzx eax, byte [ecx + 0x101]
mov byte [eax + ecx], dl
jl 0x455d66
pop edi
pop esi
pop ebp
mov byte [ecx + 0x100], 0
mov byte [ecx + 0x101], 0
pop ebx
ret 0xc
Function at 0x455dc0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, dword [esp + 0x10]
xor ecx, ecx
test ebp, ebp
jbe 0x455e3c
mov eax, dword [esp + 8]
push ebx
push esi
push edi
mov edi, dword [esp + 0x18]
jmp 0x455de0
inc byte [eax + 0x100]
movzx edx, byte [eax + 0x100]
lea esi, [edx + eax]
movzx edx, byte [esi]
add byte [eax + 0x101], dl
mov dl, byte [eax + 0x101]
mov bl, byte [esi]
movzx edx, dl
movzx edx, byte [edx + eax]
mov byte [esi], dl
movzx edx, byte [eax + 0x101]
mov byte [edx + eax], bl
movzx edx, byte [eax + 0x101]
movzx edx, byte [edx + eax]
movzx esi, byte [eax + 0x100]
add dl, byte [esi + eax]
inc ecx
movzx edx, dl
movzx edx, byte [edx + eax]
xor byte [ecx + edi - 1], dl
cmp ecx, ebp
jb 0x455de0
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x455e40
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
mov eax, 0x25c
call fcn.00468d20
mov eax, dword [0x5808f0]
xor eax, esp
mov dword [esp + 0x258], eax
push ebx
push esi
mov esi, dword [esp + 0x268]
push edi
push 0x255
lea eax, [esp + 0x11]
push 0
push eax
mov edi, ecx
mov byte [esp + 0x18], 0
call fcn.00468ca0
mov ebx, dword [esp + 0x27c]
add esp, 0xc
cmp ebx, 0x254
ja 0x455eee
push ebp
push ebx
lea ecx, [esp + 0x14]
push ecx
push esi
call fcn.0041aba0
mov ebp, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
add esp, 0xc
push 0x10
push 1
push str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
push 0
lea esi, [edi + 0x30]
push esi
call ebp
push 8
push 1
push str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
push 0
push esi
call ebp
pop ebp
test eax, eax
jne 0x455ef2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error_acquiring_context__0x_X__n
push 0x3ff
push 0x584090
call fcn.00469c7b
push 0x584090
call fcn.0041a5a0
add esp, 0x14
xor al, al
jmp 0x455f3b
mov eax, dword [esi]
add edi, 0x34
push edi
push 0
push 0
push ebx
lea edx, [esp + 0x1c]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
jne 0x455f39
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error_importing_key__0x_X__n
push 0x3ff
push 0x584090
call fcn.00469c7b
push 0x584090
call fcn.0041a5a0
add esp, 0x14
xor al, al
jmp 0x455f3b
mov al, 1
mov ecx, dword [esp + 0x264]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004690b5
add esp, 0x25c
ret 8
Function at 0x455f60
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x9c
call fcn.00468d20
mov eax, dword [0x5808f0]
xor eax, esp
mov dword [esp + 0x98], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor ebx, ebx
push 0x7f
mov dword [esp + 0x20], ecx
lea ecx, [esp + 0x25]
push ebx
push ecx
mov dword [esp + 0x24], eax
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x2c], bl
call fcn.00468ca0
mov eax, dword [ebp + 0xc]
add esp, 0xc
test al, 0x7f
je 0x455fd3
push str.Unknown_tail_block_size_n
call fcn.0041a700
add esp, 4
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x98]
xor ecx, esp
call fcn.004690b5
mov esp, ebp
pop ebp
ret 8
cmp eax, ebx
ja 0x455ff3
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x98]
xor ecx, esp
call fcn.004690b5
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 0xc]
mov edx, dword [esp + 0x18]
sub eax, ebx
mov dword [esp + 0x14], eax
lea esi, [edx + ebx]
mov edx, dword [esp + 0x1c]
mov ecx, 0x20
lea edi, [esp + 0x20]
lea eax, [esp + 0x14]
push eax
mov eax, dword [edx + 0x34]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x24]
push ecx
push 0
push 0xffffffffffffffff
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x45605d
mov esi, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov edi, dword [esp + 0x10]
push esi
lea ecx, [esp + 0x24]
push ecx
add edx, edi
push edx
call fcn.00468d50
add edi, esi
sub ebx, 0xffffff80
add esp, 0xc
mov dword [esp + 0x10], edi
cmp ebx, dword [ebp + 0xc]
jb 0x455ff0
jmp 0x455fd7
push str.Error_decrypting_tail_n
call fcn.0041a700
mov ecx, dword [esp + 0xa8]
add esp, 4
pop edi
pop esi
pop ebx
xor ecx, esp
xor al, al
call fcn.004690b5
mov esp, ebp
pop ebp
ret 8
Function at 0x456090
Capabilities:
Encrypt data using rc4 via winapi
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov eax, 0x28
call fcn.00468d20
mov eax, dword [0x5808f0]
xor eax, esp
mov dword [esp + 0x24], eax
xor eax, eax
push ebx
push ebp
mov ebp, dword [esp + 0x3c]
push esi
mov esi, dword [esp + 0x38]
mov dword [esp + 0x11], eax
mov dword [esp + 0x15], eax
mov dword [esp + 0x19], eax
mov dword [esp + 0x1d], eax
mov dword [esp + 0x21], eax
mov dword [esp + 0x25], eax
mov dword [esp + 0x29], eax
mov word [esp + 0x2d], ax
mov byte [esp + 0x2f], al
mov eax, dword [esp + 0x3c]
push eax
push esi
mov ebx, ecx
mov byte [esp + 0x18], 0
call fcn.00455f60
test al, al
je 0x456105
mov cl, byte [esi + 0x200]
cmp cl, 0x10
jbe 0x45611b
push str.Wrong_rndLen_n
call fcn.0041a700
add esp, 4
pop esi
pop ebp
xor al, al
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.004690b5
add esp, 0x28
ret 0xc
push edi
movzx edi, cl
xor eax, eax
test edi, edi
jle 0x456140
jmp 0x456130
mov cl, byte [esi + eax + 0x201]
mov byte [esp + eax*2 + 0x14], cl
inc eax
cmp eax, edi
jl 0x456130
mov eax, dword [ebx + 0x30]
lea edx, [esp + 0x10]
push edx
push 0
push 0
push 0x8004
push eax
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x456180
push str.Error_creating_hash_n
call fcn.0041a700
add esp, 4
pop edi
pop esi
pop ebp
xor al, al
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.004690b5
add esp, 0x28
ret 0xc
mov edx, dword [esp + 0x10]
push 0
push edi
lea ecx, [esp + 0x1c]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x4561c6
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push str.Error_hashing_n
call fcn.0041a700
add esp, 4
pop edi
pop esi
pop ebp
xor al, al
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.004690b5
add esp, 0x28
ret 0xc
mov ecx, dword [esp + 0x10]
mov edx, dword [ebx + 0x30]
push ebp
push 0
push ecx
push 0x6801
push edx
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
jne 0x456210
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push str.Error_deriving_key_n
call fcn.0041a700
add esp, 4
pop edi
pop esi
pop ebp
xor al, al
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.004690b5
add esp, 0x28
ret 0xc
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
mov al, 1
call fcn.004690b5
add esp, 0x28
ret 0xc
Function at 0x456dc0
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 8
call fcn.00468d20
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0xc]
push eax
push 0x20019
push 0
push ecx
push 0x80000002
mov dword [esp + 0x14], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x456e1e
mov eax, dword [esp + 0x14]
lea edx, [esp + 4]
push edx
mov edx, dword [esp + 0x14]
push eax
mov eax, dword [esp + 0x14]
lea ecx, [esp + 8]
push ecx
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 8
ret 0xc
Function at 0x457330
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push 0xffffffffffffffff
push 0x4da90b
mov eax, dword fs:[0]
push eax
mov eax, 0x240
call fcn.00468d20
mov eax, dword [0x5808f0]
xor eax, esp
mov dword [esp + 0x23c], eax
push ebp
push esi
push edi
mov eax, dword [0x5808f0]
xor eax, esp
push eax
lea eax, [esp + 0x250]
mov dword fs:[0], eax
mov edi, dword [esp + 0x260]
mov ebp, dword [esp + 0x264]
mov esi, ecx
lea ecx, [esp + 0x14]
call fcn.00424cc0
xor eax, eax
push 0xff
push eax
mov dword [esp + 0x145], eax
mov dword [esp + 0x149], eax
mov dword [esp + 0x14d], eax
mov word [esp + 0x151], ax
mov byte [esp + 0x153], al
mov byte [esp + 0x154], al
lea eax, [esp + 0x155]
push eax
mov dword [esp + 0x264], 0
mov byte [esp + 0x148], 0
call fcn.00468ca0
add esp, 0xc
cmp dword [edi + 0x18], 8
jb 0x4573e8
mov edi, dword [edi + 4]
jmp 0x4573eb
add edi, 4
push 0
push edi
lea ecx, [esp + 0x1c]
call fcn.00424d40
lea ecx, [esp + 0x14]
call fcn.00424740
test al, al
jne 0x457421
push str.Error_reading_file_for_test_n
call fcn.0041a700
add esp, 4
mov dword [esp + 0x258], 0xffffffff
jmp 0x45753e
lea ecx, [esp + 0x14]
call fcn.00424be0
test edx, edx
jg 0x45743e
jl 0x457437
cmp eax, 0x114
jae 0x45743e
push str.Test_file_is_too_small_n
jmp 0x457409
push 0
push 0x10
lea ecx, [esp + 0x144]
push ecx
push 0
push 0
lea ecx, [esp + 0x28]
call fcn.00424750
push 0
push 0x100
lea edx, [esp + 0x154]
push edx
lea ecx, [esp + 0x20]
call fcn.00424be0
sub eax, 0x100
sbb edx, 0
push edx
push eax
lea ecx, [esp + 0x28]
call fcn.00424750
push 0x254
add ebp, 8
push ebp
mov ecx, esi
call fcn.00455e40
test al, al
je 0x457411
movzx eax, byte [esp + 0x14c]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x151]
push edx
push 0
or edi, 0xffffffff
push edi
mov dword [esp + 0x20], eax
mov eax, dword [esi + 0x34]
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
jne 0x4574f3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error_decrypting_key__0x_X__n
push 0x3ff
push 0x584090
call fcn.00469c7b
push 0x584090
call fcn.0041a5a0
add esp, 0x14
jmp 0x457537
mov ecx, dword [esp + 0x10]
push ecx
lea edx, [esp + 0x151]
push edx
lea eax, [esp + 0x40]
push eax
mov ecx, esi
call fcn.00455d40
push 0x10
lea ecx, [esp + 0x140]
push ecx
lea edx, [esp + 0x40]
push edx
mov ecx, esi
call fcn.00455dc0
lea eax, [esp + 0x13c]
push 0x10
push eax
call fcn.0041a7a0
add esp, 8
mov byte [esi + 0x20], al
mov dword [esp + 0x258], edi
lea ecx, [esp + 0x14]
call fcn.00424ce0
mov ecx, dword [esp + 0x250]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x23c]
xor ecx, esp
call fcn.004690b5
add esp, 0x24c
ret 8