joyce8/EMBER2024-capa huggingface dataset:
Function at 0x429cb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, eax
xor ebx, ebx
push edi
mov dword [ebp - 4], 0
mov dword [esi + 0x6af80], 2
cmp dword [esi + 0x6af90], ebx
je 0x429ece
lea ebx, [ebx]
cmp dword [esi + 0x6af90], 3
jb 0x429d37
mov ecx, dword [esi + 0x6af84]
movzx eax, byte [ecx + esi + 0x1af72]
mov edx, dword [esi + 0x6af7c]
shl edx, 5
xor eax, edx
and eax, 0x7fff
mov dword [esi + 0x6af7c], eax
mov eax, dword [esi + eax*4 + 0x4af70]
and ecx, 0x7fff
mov dword [esi + ecx*4 + 0x2af70], eax
mov ecx, dword [esi + 0x6af84]
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x6af7c]
mov dword [esi + eax*4 + 0x4af70], ecx
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x429d77
mov edx, dword [esi + 0x6af84]
sub edx, ecx
cmp edx, 0x7efa
ja 0x429d77
mov eax, dword [esi + 0x6af90]
cmp dword [esi + 0x6afa0], eax
jbe 0x429d62
mov dword [esi + 0x6afa0], eax
mov eax, ecx
call fcn.004299d0
mov ebx, eax
mov eax, dword [esi + 0x6af90]
cmp ebx, eax
jbe 0x429d77
mov ebx, eax
mov eax, dword [esi + 0x6af84]
mov ecx, esi
cmp ebx, 3
jb 0x429e5b
sub eax, dword [esi + 0x6af88]
lea edx, [ebx - 3]
call fcn.00429180
sub dword [esi + 0x6af90], ebx
mov ecx, dword [esi + 0x6af90]
mov dword [ebp - 8], eax
cmp ebx, dword [esi + 0x6af98]
ja 0x429e24
cmp ecx, 3
jb 0x429e24
mov edi, 1
sub ebx, edi
lea esp, [esp]
add dword [esi + 0x6af84], edi
mov edx, dword [esi + 0x6af84]
movzx ecx, byte [esi + edx + 0x1af72]
mov eax, dword [esi + 0x6af7c]
shl eax, 5
xor ecx, eax
and ecx, 0x7fff
mov dword [esi + 0x6af7c], ecx
mov ecx, dword [esi + ecx*4 + 0x4af70]
and edx, 0x7fff
sub ebx, edi
mov dword [esi + edx*4 + 0x2af70], ecx
mov edx, dword [esi + 0x6af84]
mov dword [ebp - 4], ecx
mov ecx, dword [esi + 0x6af7c]
mov dword [esi + ecx*4 + 0x4af70], edx
jne 0x429dc0
add dword [esi + 0x6af84], edi
mov eax, dword [ebp - 8]
jmp 0x429e76
add dword [esi + 0x6af84], ebx
mov edx, dword [esi + 0x6af84]
movzx ecx, byte [edx + esi + 0x1af70]
mov dword [esi + 0x6af7c], ecx
movzx edx, byte [edx + esi + 0x1af71]
shl ecx, 5
xor edx, ecx
xor ebx, ebx
and edx, 0x7fff
mov dword [esi + 0x6af7c], edx
jmp 0x429e76
movzx edx, byte [eax + esi + 0x1af70]
xor eax, eax
call fcn.00429180
dec dword [esi + 0x6af90]
inc dword [esi + 0x6af84]
test eax, eax
je 0x429eb0
mov eax, dword [esi + 0x6af74]
test eax, eax
js 0x429e8d
lea ecx, [eax + esi + 0x1af70]
jmp 0x429e8f
xor ecx, ecx
mov edi, dword [esi + 0x6af84]
push 0
sub edi, eax
push ecx
mov eax, esi
call fcn.00428fc0
mov ecx, dword [esi + 0x6af84]
add esp, 8
mov dword [esi + 0x6af74], ecx
cmp dword [esi + 0x6af90], 0x106
jae 0x429ec1
call fcn.00429b70
cmp dword [esi + 0x6af90], 0
jne 0x429ce0
mov eax, dword [esi + 0x6af74]
test eax, eax
js 0x429ee1
lea ecx, [eax + esi + 0x1af70]
jmp 0x429ee3
xor ecx, ecx
mov edi, dword [esi + 0x6af84]
push 1
sub edi, eax
push ecx
mov eax, esi
call fcn.00428fc0
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42aad0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test ecx, ecx
jne 0x42aad7
xor eax, eax
ret
push esi
not eax
cmp edx, 8
jb 0x42abad
mov esi, edx
shr esi, 3
push edi
lea esp, [esp]
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x450b18]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x450b18]
movzx edi, byte [ecx + 2]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x450b18]
movzx edi, byte [ecx + 3]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x450b18]
movzx edi, byte [ecx + 4]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x450b18]
movzx edi, byte [ecx + 5]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x450b18]
movzx edi, byte [ecx + 6]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x450b18]
movzx edi, byte [ecx + 7]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x450b18]
add ecx, 8
sub edx, 8
dec esi
jne 0x42aaf0
pop edi
test edx, edx
je 0x42abca
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x450b18]
inc ecx
dec edx
jne 0x42abb1
not eax
pop esi
ret
Function at 0x42b080
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [esi + 0x18], 0
je 0x42b14c
mov eax, dword [esi + 0x1c]
mov ecx, dword [esi + 0x20]
push ebx
push edi
mov edi, dword [ebp + 0xc]
add eax, edi
cmp eax, ecx
jb 0x42b12b
add ecx, ecx
cmp ecx, eax
jbe 0x42b0b0
mov edi, ecx
mov dword [ebp - 4], edi
jmp 0x42b0b5
mov dword [ebp - 4], eax
mov edi, eax
push 0
push edi
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ebx, eax
test ebx, ebx
je 0x42b0ea
push edi
push 0
push 0
push 0xf001f
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
test edi, edi
jne 0x42b0f7
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, 0x300
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [esi + 0x20]
mov edx, dword [esi + 0x18]
push ecx
push edx
push edi
call fcn.00432ab0
mov eax, dword [esi + 0x18]
add esp, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 4]
mov dword [esi + 0x18], edi
mov edi, dword [ebp + 0xc]
mov dword [esi + 0x20], edx
mov dword [esi + 4], ebx
mov ecx, dword [esi + 0x1c]
mov eax, dword [ebp + 8]
add ecx, dword [esi + 0x18]
push edi
push eax
push ecx
call fcn.00432ab0
add esp, 0xc
add dword [esi + 0x1c], edi
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [esi]
test eax, eax
je 0x42b177
mov ecx, dword [ebp + 0xc]
push 0
lea edx, [ebp - 4]
push edx
mov edx, dword [ebp + 8]
push ecx
push edx
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8
mov dword [esi + 0xc], 0x1000000
xor eax, eax
mov esp, ebp
pop ebp
ret 8

Function at 0x42b400
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [esi + 0x58]
push edi
test ecx, ecx
je 0x42b447
mov eax, dword [esi + 0x60]
mov edi, dword [esi + 0x5c]
cmp eax, edi
jae 0x42b484
sub edi, eax
cmp edi, edx
jbe 0x42b41e
mov edi, edx
push edi
add eax, ecx
push eax
push ebx
call fcn.00432ab0
mov eax, dword [esi + 0x4c]
add dword [esi + 0x60], edi
add dword [esi + 0x48], edi
add esp, 0xc
mov edx, edi
mov ecx, ebx
call fcn.0042aad0
mov dword [esi + 0x4c], eax
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x50]
test eax, eax
je 0x42b47d
push 0
lea ecx, [ebp - 4]
push ecx
push edx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x42b484
mov edi, dword [ebp - 4]
mov eax, dword [esi + 0x4c]
add dword [esi + 0x48], edi
mov edx, edi
mov ecx, ebx
call fcn.0042aad0
mov dword [esi + 0x4c], eax
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
mov dword [esi + 0xc], 0x1000000
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x42b5d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, eax
push edi
mov dword [ebp - 4], 0
lea ebx, [esi + 0x68]
mov ecx, dword [esi + 0x58]
test ecx, ecx
je 0x42b617
mov eax, dword [esi + 0x60]
mov edi, dword [esi + 0x5c]
cmp eax, edi
jae 0x42b66a
sub edi, eax
cmp edi, 0x4000
jbe 0x42b605
mov edi, 0x4000
push edi
add eax, ecx
push eax
push ebx
call fcn.00432ab0
add esp, 0xc
add dword [esi + 0x60], edi
jmp 0x42b638
mov eax, dword [esi + 0x50]
test eax, eax
je 0x42b663
push 0
lea ecx, [ebp - 8]
push ecx
push 0x4000
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x42b66a
mov edi, dword [ebp - 8]
mov eax, dword [esi + 0x4c]
add dword [esi + 0x48], edi
mov edx, edi
mov ecx, ebx
call fcn.0042aad0
mov dword [esi + 0x4c], eax
test edi, edi
je 0x42b66a
cmp edi, 0xffffffff
je 0x42b66a
push edi
push ebx
call fcn.0042b080
cmp eax, edi
jne 0x42b679
add dword [ebp - 4], edi
jmp 0x42b5e5
mov dword [esi + 0xc], 0x1000000
mov edx, dword [ebp - 4]
pop edi
mov dword [esi + 0x64], edx
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0x60000
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42d940
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ecx + 0x44], 0xffffffff
mov dword [ebp - 4], ecx
jne 0x42d958
mov eax, 0x80040101
mov esp, ebp
pop ebp
ret 8
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
cmp edi, esi
je 0x42d9c6
cmp dword [ebp + 8], esi
je 0x42d9c6
push ebx
mov dword [ebp + 0xc], esi
cmp edi, esi
jbe 0x42d99e
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x42d97b
mov ecx, dword [ebp - 4]
push 0
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
mov edx, edi
sub edx, esi
push edx
lea edx, [esi + eax]
mov eax, dword [ecx + 0x44]
push edx
push eax
call ebx
test eax, eax
je 0x42d9a9
add esi, dword [ebp + 0xc]
cmp esi, edi
jb 0x42d978
xor eax, eax
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x42d9a0
pop ebx
and eax, 0xffff
pop edi
or eax, 0x80070000
pop esi
mov esp, ebp
pop ebp
ret 8
pop edi
mov eax, 0x80070057
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x42dd60
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x448fe7
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x45e274]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xor edi, edi
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [ebp - 4], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov eax, dword [0x45e020]
mov edx, dword [eax + 0xc]
mov ecx, 0x45e020
mov byte [ebp - 4], 2
call edx
add eax, 0x10
mov dword [esi + 0x40], eax
lea ecx, [esi + 0x50]
mov byte [ebp - 4], 3
mov dword [esi + 0x44], 0xffffffff
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], 0x10400
call fcn.0042ec40
lea eax, [esi + 0x5c]
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
push edi
mov dword [eax + 0x10], ecx
push eax
mov byte [ebp - 4], 4
mov dword [eax + 0x14], ecx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
test eax, eax
jne 0x42de38
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x42de30
and eax, 0xffff
or eax, 0x80070000
cmp eax, edi
jge 0x42de38
push eax
call fcn.00403700
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x42e1c0
Capabilities:
Check if file exists
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x449060
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x45e274]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [0x45e020]
mov edx, dword [eax + 0xc]
mov ecx, 0x45e020
call edx
add eax, 0x10
mov dword [ebp - 0x14], eax
mov eax, dword [0x45e020]
mov edx, dword [eax + 0xc]
mov ecx, 0x45e020
mov dword [ebp - 4], 0
call edx
add eax, 0x10
mov dword [ebp - 0x10], eax
mov ecx, ebx
mov byte [ebp - 4], 1
call fcn.0042dfc0
mov esi, dword [ebx + 0x34]
dec esi
mov edi, eax
test esi, esi
jle 0x42e295
lea ecx, [ebp - 0x14]
lea eax, [esi - 1]
push ecx
push eax
mov ecx, ebx
mov dword [ebp - 0x18], eax
call fcn.0042de50
mov edi, eax
test edi, edi
js 0x42e28e
lea edx, [ebp - 0x10]
push edx
push esi
mov ecx, ebx
call fcn.0042de50
mov edi, eax
test edi, edi
js 0x42e28e
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
push 1
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x42e28e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x42e28e
cmp eax, 3
je 0x42e28e
test eax, eax
jle 0x42e28c
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
mov esi, dword [ebp - 0x18]
test esi, esi
jg 0x42e230
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
mov byte [ebp - 4], 0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x42e2b8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42e2de
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42e5c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4490f0
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x45e274]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [0x45e020]
mov edx, dword [eax + 0xc]
mov ecx, 0x45e020
call edx
add eax, 0x10
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x34]
mov dword [ebp - 4], 0
call fcn.0042f0b0
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.0042e1c0
lea eax, [ebp - 0x10]
push eax
push 0
mov ecx, esi
call fcn.0042de50
mov ebx, dword [ebp - 0x10]
mov edi, eax
test edi, edi
js 0x42e6da
lea ecx, [ebp - 0x10]
push ecx
mov ecx, esi
call fcn.0042e300
mov edi, eax
test edi, edi
js 0x42e6da
push 0
push 0x80000080
push 2
lea ecx, [ebp - 0x34]
call fcn.0042f120
push eax
push 5
push 0xc0000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 0x44], eax
cmp eax, 0xffffffff
je 0x42e6da
cmp dword [esi + 0x30], 0
jne 0x42e697
push 0
lea edx, [ebp - 0x14]
push edx
push 2
lea ecx, [ebp - 0x18]
push ecx
push eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0xfeff
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0
call fcn.0042f0d0
lea eax, [ebx - 0x10]
mov dword [ebp - 4], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x42e6c6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, edi
and ecx, 0x80000000
cmp ecx, 0x80000000
je 0x42e700
test eax, eax
jle 0x42e6fe
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0
call fcn.0042f0d0
lea eax, [ebx - 0x10]
mov dword [ebp - 4], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x42e72f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42eca0
Capabilities:
Check os version
Create new key via cryptacquirecontext

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x45e274]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x110
lea eax, [ebp - 0x114]
push 0
push eax
mov esi, ecx
mov dword [ebp - 0x118], 0x114
call fcn.004317a0
add esp, 0xc
lea ecx, [ebp - 0x118]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x42ed76
cmp dword [ebp - 0x114], 5
push edi
jne 0x42ed03
cmp dword [ebp - 0x110], 1
mov edi, str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider__Prototype_
je 0x42ed08
mov edi, str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
push 0
push 0x18
push edi
push 0
push esi
call ebx
test eax, eax
jne 0x42ed63
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090016
jne 0x42ed3e
push 8
push 0x18
push edi
push 0
push esi
call ebx
test eax, eax
jne 0x42ed63
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], 0
test eax, eax
jle 0x42ed52
and eax, 0xffff
or eax, 0x80070000
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042f25f
mov esp, ebp
pop ebp
ret
pop ebx
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042f25f
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x42ed54
mov ecx, dword [ebp - 4]
and eax, 0xffff
xor ecx, ebp
or eax, 0x80070000
pop esi
call fcn.0042f25f
mov esp, ebp
pop ebp
ret
Function at 0x42ee00
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x449160
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x45e274]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 0x14], edi
mov esi, dword [ebp + 8]
test esi, esi
je 0x42ef80
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x42ef80
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x42ef80
cmp dword [esi], 0
je 0x42ef67
mov ecx, dword [eax]
test ecx, ecx
je 0x42ef67
mov eax, dword [ebx]
test eax, eax
je 0x42ef67
push eax
lea eax, [ebp + 8]
push eax
push 0
push 0
push 1
mov dword [ebp + 8], ecx
mov ecx, dword [edi + 8]
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
jne 0x42eec1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp + 0xc]
mov dword [edx], 0
test eax, eax
jle 0x42ef85
and eax, 0xffff
or eax, 0x80070000
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp + 8]
cmp eax, dword [ebx]
jbe 0x42ef09
push eax
mov dword [ebp - 4], 0
call fcn.0042c8b5
mov edx, dword [esi]
mov edi, eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov eax, dword [ebp + 8]
add esp, 4
push ecx
push edx
push eax
push edi
mov dword [ebp - 4], 0xffffffff
call fcn.0042f39b
mov ecx, dword [esi]
push ecx
call fcn.0042f33f
mov edx, dword [ebp + 8]
mov dword [esi], edi
mov edi, dword [ebp - 0x14]
add esp, 0x14
mov dword [ebx], edx
mov eax, dword [ebx]
mov ecx, dword [ebp + 0xc]
mov edx, dword [esi]
push eax
mov eax, dword [edi + 8]
push ecx
push edx
push 0
push 1
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
jne 0x42ef51
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x42ee9b
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, 0x80070057
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, 0x80004003
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x42efa0
Capabilities:
Encrypt data using aes via winapi

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
test eax, eax
je 0x42f09f
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x42f09f
push edi
lea edi, [esi + 8]
push edi
push 1
mov dword [eax], 0
mov eax, dword [esi]
push 0x660e
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.ADVAPI32.dll_CryptGenKey]
test eax, eax
je 0x42f030
mov ecx, dword [esi + 4]
mov edx, dword [edi]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_CryptExportKey]
push 0
push 0x40
push 1
push ecx
push edx
call ebx
test eax, eax
je 0x42f030
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
push ecx
lea ecx, [ebp - 4]
call fcn.00402da0
test al, al
jne 0x42f017
mov esi, 0x8007000e
jmp 0x42f046
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
mov ecx, dword [esi + 4]
push edx
mov edx, dword [edi]
push eax
push 0x40
push 1
push ecx
push edx
call ebx
test eax, eax
jne 0x42f082
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x42f044
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
mov eax, dword [edi]
test eax, eax
je 0x42f059
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov dword [edi], 0
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
mov dword [eax], 0
push edx
mov dword [ecx], 0
call fcn.0042f33f
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
push 0
mov dword [ecx], eax
call fcn.0042f33f
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
pop esi
mov eax, 0x80004003
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x42f25f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x45e274]
jne 0x42f269
repz ret
jmp fcn.00434901
Function at 0x442432
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x45e274]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0043745a
and dword [ebp - 0x14], 0
cmp dword [0x461380], 0
mov dword [ebp - 0x18], eax
jne 0x4424e5
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x44258d
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x450914
push ebx
call edi
test eax, eax
je 0x44258d
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x461380], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x461384], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x461388], eax
call edi
push eax
call esi
mov dword [0x461390], eax
test eax, eax
je 0x4424e5
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x46138c], eax
mov eax, dword [0x46138c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x44253e
cmp dword [0x461390], ecx
je 0x44253e
push eax
call esi
push dword [0x461390]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x44253e
test ebx, ebx
je 0x44253e
call edi
test eax, eax
je 0x442535
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x442535
test byte [ebp - 8], 1
jne 0x44253e
or dword [ebp + 0x10], 0x200000
jmp 0x442571
mov eax, dword [0x461384]
cmp eax, dword [ebp - 0x18]
je 0x442571
push eax
call esi
test eax, eax
je 0x442571
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x442571
mov eax, dword [0x461388]
cmp eax, dword [ebp - 0x18]
je 0x442571
push eax
call esi
test eax, eax
je 0x442571
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x461380]
call esi
test eax, eax
je 0x44258d
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x44258f
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042f25f
leave
ret