joyce8/EMBER2024-capa huggingface dataset:
Function at 0x506e48
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
push edi
mov esi, edx
lea edi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x14], ecx
mov edi, eax
mov ebx, dword [ebp + 0xc]
mov eax, edi
mov edx, dword [eax]
call dword [edx + 0x2c]
mov dword [ebp - 0x28], eax
mov eax, edi
mov edx, dword [eax]
call dword [edx + 0x20]
mov esi, eax
cmp esi, dword [ebp - 4]
jge 0x506e7d
mov dword [ebp - 4], esi
mov eax, dword [ebp - 0x14]
call fcn.00506ca0
mov dword [ebp - 0x18], eax
mov al, byte [ebp + 8]
mov byte [ebp - 0x15], al
lea ecx, [ebp - 0x24]
lea edx, [ebp - 0x1c]
mov eax, edi
call fcn.0051dea4
test al, al
je 0x506f6d
mov edx, dword [ebp - 0xc]
xor eax, eax
call fcn.0042af60
push eax
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.0042ae9c
dec eax
pop edx
sub eax, edx
jl 0x506f6d
inc eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x24]
imul dword [ebp - 0x30]
add eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 0x10]
xor eax, eax
call fcn.0042af60
push eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x28]
call fcn.0042ae9c
mov edi, eax
dec edi
pop eax
sub edi, eax
jl 0x506f61
inc edi
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x2c]
lea ecx, [eax + edx*4]
xor eax, eax
mov al, byte [ecx + 2]
xor edx, edx
mov dl, byte [ebp - 0x16]
sub eax, edx
mov esi, ebx
and esi, 0xff
imul esi
push ecx
mov ecx, 0x64
cdq
idiv ecx
pop ecx
sub byte [ecx + 2], al
xor eax, eax
mov al, byte [ecx + 1]
xor edx, edx
mov dl, byte [ebp - 0x17]
sub eax, edx
imul esi
push ecx
mov ecx, 0x64
cdq
idiv ecx
pop ecx
sub byte [ecx + 1], al
xor eax, eax
mov al, byte [ecx]
xor edx, edx
mov dl, byte [ebp - 0x18]
sub eax, edx
imul esi
mov esi, 0x64
cdq
idiv esi
sub byte [ecx], al
mov al, byte [ebp + 8]
mov byte [ecx + 3], al
inc dword [ebp - 0x2c]
dec edi
jne 0x506ef7
inc dword [ebp - 0x30]
dec dword [ebp - 0x34]
jne 0x506ec9
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x51da50
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc10
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x3f0], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x51db0a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004052dc
mov eax, dword [0x586de4]
cmp dword [eax], 2
jne 0x51dabf
push esi
call sub.user32.dll_GetWindowTextLengthW
mov edx, eax
inc edx
mov eax, ebx
call fcn.00405754
mov eax, dword [ebx]
call fcn.00405488
push eax
mov eax, dword [ebx]
call fcn.00405478
push eax
push esi
call sub.user32.dll_GetWindowTextW
mov eax, dword [ebx]
call fcn.00405488
mov edx, eax
dec edx
mov eax, ebx
call fcn.00405754
jmp 0x51daf1
lea eax, [ebp - 0x3e9]
push eax
push 0x3e8
push 0xd
push esi
call sub.user32.dll_SendMessageA
lea edx, [ebp - 0x3f0]
lea eax, [ebp - 0x3e9]
call fcn.0040a4b8
mov edx, dword [ebp - 0x3f0]
mov eax, ebx
call fcn.00405468
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51db11
lea eax, [ebp - 0x3f0]
call fcn.00404b94
ret
Function at 0x530144
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
add edi, 0xfffffffc
push 0xcc0020
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
inc eax
push eax
mov eax, dword [edi]
call fcn.00428ccc
call fcn.00424800
push eax
mov eax, dword [edi]
mov edx, dword [eax]
call dword [edx + 0x20]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
push eax
push 0
mov eax, dword [edi]
mov edx, dword [eax]
call dword [edx + 0x2c]
mov edx, dword [ebp + 8]
sub eax, dword [edx - 8]
push eax
mov eax, dword [edi]
call fcn.00428ccc
call fcn.00424800
push eax
call sub.gdi32.dll_BitBlt
mov eax, dword [ebp + 8]
mov ebx, dword [eax + 0x14]
dec ebx
test ebx, ebx
jl 0x5301f2
inc ebx
xor esi, esi
push 0xcc0020
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
push eax
mov eax, dword [edi]
call fcn.00428ccc
call fcn.00424800
push eax
mov eax, dword [edi]
mov edx, dword [eax]
call dword [edx + 0x20]
push eax
push 1
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
add eax, esi
inc eax
push eax
mov eax, dword [edi]
call fcn.00428ccc
call fcn.00424800
push eax
call sub.gdi32.dll_BitBlt
inc esi
dec ebx
jne 0x5301ab
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x53664c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5366f0
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 1
lea eax, [ebp - 8]
lea edx, [esi + esi*2]
mov ecx, dword [ebx + 0x1cc]
mov edx, dword [ecx + edx*8 + 0x14]
call fcn.00404c2c
cmp word [ebx + 0x1da], 0
je 0x5366a3
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 8]
mov edx, ebx
mov eax, dword [ebx + 0x1dc]
call dword [ebx + 0x1d8]
cmp dword [ebp - 8], 0
setne al
and al, byte [ebp - 1]
je 0x5366da
xor eax, eax
mov al, byte [ebx + 0x1d0]
push eax
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00405054
push eax
push 0x536700
mov eax, dword [0x586b7c]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5366f7
lea eax, [ebp - 8]
call fcn.00404b94
ret
Function at 0x560d5c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov ebp, edx
mov ebx, eax
xor eax, eax
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp], eax
call fcn.005608d4
test al, al
jne 0x560d87
push ebp
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [esp], eax
jmp 0x560dfd
test ebx, ebx
je 0x560dfd
lea eax, [ebx + 0x3c]
mov eax, dword [eax]
add eax, ebx
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
mov eax, dword [eax + 0x78]
add eax, ebx
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
mov edi, dword [eax + 0x18]
dec edi
test edi, edi
jl 0x560df6
inc edi
xor esi, esi
mov eax, dword [esp + 8]
mov eax, dword [eax + 0x20]
add eax, ebx
mov eax, dword [eax + esi*4]
add eax, ebx
mov edx, ebp
call fcn.0040a39c
test eax, eax
jne 0x560df2
mov eax, dword [esp + 8]
mov eax, dword [eax + 0x24]
add eax, ebx
movsx eax, word [eax + esi*2]
mov edx, dword [esp + 8]
mov edx, dword [edx + 0x1c]
add edx, ebx
mov eax, dword [edx + eax*4]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add eax, ebx
mov dword [esp + 0xc], eax
inc esi
dec edi
jne 0x560db2
mov eax, dword [esp + 0xc]
mov dword [esp], eax
mov eax, dword [esp]
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x564368
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
add esp, 0xfffff7f4
mov ebx, eax
mov eax, ebx
call fcn.00404b94
lea eax, [esp + 0xc]
xor ecx, ecx
mov edx, 0x800
call fcn.004034d0
mov dword [esp], 0xffffffff
push esp
push 0x20019
push 0
push 0x564404
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x5643f0
mov dword [esp + 8], 0x800
mov dword [esp + 4], 1
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0xc]
push eax
push 0
push 0x56441c
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x5643f0
cmp dword [esp + 4], 1
jne 0x5643f0
mov eax, ebx
lea edx, [esp + 0xc]
call fcn.00404d8c
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey_1
add esp, 0x80c
pop ebx
ret
Function at 0x568c18
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405044
xor eax, eax
push ebp
push 0x568cf8
push dword fs:[eax]
mov dword fs:[eax], esp
or esi, 0xffffffff
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00409df8
mov ebx, eax
cmp ebx, 0xffffffff
je 0x568ce2
xor esi, esi
lea edx, [ebp - 0x4a]
mov ecx, 0x40
mov eax, ebx
call fcn.00409e7c
cmp eax, 0x40
jne 0x568cdb
cmp word [ebp - 0x4a], 0x5a4d
jne 0x568cdb
xor ecx, ecx
mov edx, dword [ebp - 0xe]
mov eax, ebx
call fcn.00409ed4
cmp eax, dword [ebp - 0xe]
jne 0x568cdb
lea edx, [ebp - 8]
mov ecx, 4
mov eax, ebx
call fcn.00409e7c
cmp eax, 4
jne 0x568cdb
cmp dword [ebp - 8], 0x4550
jne 0x568cdb
lea edx, [ebp - 0xa]
mov ecx, 2
mov eax, ebx
call fcn.00409e7c
cmp eax, 2
jne 0x568cdb
mov ax, word [ebp - 0xa]
sub ax, 0x14c
je 0x568ccf
sub ax, 0xb4
je 0x568cd6
sub ax, 0x84
je 0x568cd6
sub ax, 0x83e0
je 0x568cd6
jmp 0x568cdb
mov esi, 0x20
jmp 0x568cdb
mov esi, 0x40
mov eax, ebx
call fcn.00409f18
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x568cff
lea eax, [ebp - 4]
call fcn.00404b94
ret
Function at 0x568d08
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x18], ebx
mov esi, ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x568ea9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00404b94
mov eax, ebx
call fcn.00404e54
mov edx, eax
lea eax, [ebp - 4]
call fcn.004051e0
mov eax, ebx
call fcn.00404e54
push eax
lea eax, [ebp - 4]
call fcn.004050ac
push eax
mov eax, ebx
call fcn.00405054
pop edx
pop ecx
call fcn.00402ce0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00405054
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x568e83
mov eax, ebx
call fcn.00402ac0
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x568e7c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00405054
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x568e66
lea eax, [ebp - 0x18]
mov edx, 0x568ec0
call fcn.00404c2c
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x568ecc
mov eax, dword [ebp - 8]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x568e19
lea eax, [ebp - 0x18]
push eax
mov ebx, dword [ebp - 0x10]
movzx eax, word [ebx]
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x2c], 0
movzx eax, word [ebx + 2]
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 0
lea edx, [ebp - 0x30]
mov ecx, 1
mov eax, 0x568ef0
call fcn.0040a9d0
xor eax, eax
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x568f04
push dword [ebp - 0x18]
push 0x568f20
push edi
lea eax, [ebp - 0x34]
mov edx, 4
call fcn.00404f14
mov eax, dword [ebp - 0x34]
call fcn.00405054
push eax
mov eax, dword [ebp - 8]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x568e66
mov eax, esi
mov edx, dword [ebp - 0x1c]
call fcn.00404d8c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x568e83
mov eax, dword [ebp - 8]
call fcn.00402af0
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x568eb0
lea eax, [ebp - 0x34]
call fcn.00404b94
lea eax, [ebp - 0x18]
call fcn.00404b94
lea eax, [ebp - 4]
call fcn.00404b94
ret
Function at 0x401e9c
Capabilities:
Print debug messages

Disassembly:
jmp 0x4c38a2
push esi
mov esi, ecx
call fcn.00405d76
mov eax, 0x400000
mov dword [esi], 0x38
lea ecx, [esi + 0x14]
mov dword [esi + 8], eax
mov dword [esi + 4], eax
mov dword [esi + 0xc], 0xe00
mov dword [esi + 0x10], 0x58e1e8
call fcn.00401208
test eax, eax
jns 0x4c38f1
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x4c38ea
push str.ERROR_:_Unable_to_initialize_critical_section_in_CAtlBaseModule_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov byte [0x5d0ed8], 1
mov eax, esi
pop esi
ret

Function at 0x402cd9
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x4c61d0
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x40
cmp dword [0x5d26e4], 1
jge 0x4c623f
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
test ecx, ecx
je 0x4c6215
mov edx, dword [ebx + 8]
movzx eax, word [edx]
movzx ecx, word [ebx + 0xc]
cmp eax, ecx
je 0x4c6215
mov edx, dword [ebx + 8]
add edx, 2
mov dword [ebx + 8], edx
jmp 0x4c61f2
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
movzx edx, word [ebx + 0xc]
cmp ecx, edx
jne 0x4c622b
mov eax, dword [ebx + 8]
mov dword [ebp - 4], eax
jmp 0x4c6232
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
jmp 0x4c632f
movzx ecx, word [ebx + 0xc]
movd xmm0, ecx
movaps xmmword [ebp - 0x30], xmm0
pshuflw xmm0, xmmword [ebp - 0x30], 0
movaps xmmword [ebp - 0x30], xmm0
pshufd xmm0, xmmword [ebp - 0x30], 0
movaps xmmword [ebp - 0x30], xmm0
mov edx, dword [ebx + 8]
and edx, 0xfff
cmp edx, 0xff0
ja 0x4c6300
mov eax, dword [ebx + 8]
movups xmm0, xmmword [eax]
movaps xmmword [ebp - 0x40], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pxor xmm0, xmmword [ebp - 0x20]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pcmpeqw xmm0, xmmword [ebp - 0x40]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x40]
pcmpeqw xmm0, xmmword [ebp - 0x30]
movaps xmmword [ebp - 0x40], xmm0
movaps xmm0, xmmword [ebp - 0x20]
por xmm0, xmmword [ebp - 0x40]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pmovmskb ecx, xmm0
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x4c62f5
bsf edx, dword [ebp - 8]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
add eax, dword [ebx + 8]
mov dword [ebx + 8], eax
mov ecx, dword [ebx + 8]
movzx edx, word [ecx]
movzx eax, word [ebx + 0xc]
cmp edx, eax
jne 0x4c62e9
mov ecx, dword [ebx + 8]
mov dword [ebp - 0xc], ecx
jmp 0x4c62f0
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
jmp 0x4c632f
mov edx, dword [ebx + 8]
add edx, 0x10
mov dword [ebx + 8], edx
jmp 0x4c632a
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
movzx edx, word [ebx + 0xc]
cmp ecx, edx
jne 0x4c6313
mov eax, dword [ebx + 8]
jmp 0x4c632f
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
test ecx, ecx
jne 0x4c6321
xor eax, eax
jmp 0x4c632f
mov edx, dword [ebx + 8]
add edx, 2
mov dword [ebx + 8], edx
jmp 0x4c625f
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x4056d2
Capabilities:
Query environment variable

Disassembly:
jmp 0x5488a3
mov edi, edi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x5488b7
xor edi, edi
jmp 0x5488fb
push ebx
push esi
call fcn.00548799
push 0x40
mov ebx, eax
push str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
sub ebx, esi
and ebx, 0xfffffffe
push 2
push ebx
call fcn.00406109
mov edi, eax
add esp, 0x14
test edi, edi
je 0x5488e8
push ebx
push esi
push edi
call fcn.004058a3
add esp, 0xc
push 2
push 0
call fcn.004069b0
pop ecx
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
pop ebx
mov eax, edi
pop edi
pop esi
ret

Function at 0x413350
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov dword [ebp - 4], 0xcccccccc
mov dword [ebp - 4], 0
mov esi, esp
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
cmp esi, esp
call fcn.00405079
cwde
test eax, eax
jge 0x413382
mov ecx, dword [ebp - 4]
or ecx, 8
mov dword [ebp - 4], ecx
mov esi, esp
push 2
call dword [sym.imp.USER32.dll_GetKeyState]
cmp esi, esp
call fcn.00405079
movsx edx, ax
test edx, edx
jge 0x4133a3
mov eax, dword [ebp - 4]
or eax, 1
mov dword [ebp - 4], eax
mov esi, esp
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
cmp esi, esp
call fcn.00405079
movsx ecx, ax
test ecx, ecx
jge 0x4133c4
mov edx, dword [ebp - 4]
or edx, 2
mov dword [ebp - 4], edx
mov esi, esp
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
cmp esi, esp
call fcn.00405079
cwde
test eax, eax
jge 0x4133e3
mov ecx, dword [ebp - 4]
or ecx, 4
mov dword [ebp - 4], ecx
mov esi, esp
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
cmp esi, esp
call fcn.00405079
movsx edx, ax
test edx, edx
jge 0x413404
mov eax, dword [ebp - 4]
or eax, 0x20
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop esi
add esp, 4
cmp ebp, esp
call fcn.00405079
mov esp, ebp
pop ebp
ret
Function at 0x49f120
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
cmp dword [ebp + 0x14], 0
push edi
mov edi, dword [ebp + 0x10]
jg 0x49f141
jl 0x49f139
test edi, edi
ja 0x49f141
mov eax, dword [ebp + 8]
pop edi
mov esp, ebp
pop ebp
ret
mov ecx, 1
mov dword [ebp - 0x80], 0xedb88320
mov eax, ecx
nop
mov dword [ebp + eax*4 - 0x80], ecx
inc eax
add ecx, ecx
cmp eax, 0x20
jl 0x49f150
push ebx
push esi
lea ebx, [ebp - 0x80]
lea eax, [ebp - 0x100]
call fcn.0049f0d0
lea ebx, [ebp - 0x100]
lea eax, [ebp - 0x80]
call fcn.0049f0d0
lea ebx, [ebx]
xor esi, esi
mov eax, dword [ebp + esi - 0x80]
xor edx, edx
lea ecx, [ebp - 0x80]
test eax, eax
je 0x49f19f
nop
test al, 1
je 0x49f196
xor edx, dword [ecx]
shr eax, 1
add ecx, 4
test eax, eax
jne 0x49f190
mov dword [ebp + esi - 0x100], edx
add esi, 4
cmp esi, 0x80
jl 0x49f182
mov eax, edi
and eax, 1
xor ecx, ecx
or eax, ecx
je 0x49f1e2
mov eax, dword [ebp + 8]
xor edx, edx
lea ecx, [ebp - 0x100]
test eax, eax
je 0x49f1df
jmp 0x49f1d0
test al, 1
je 0x49f1d6
xor edx, dword [ecx]
shr eax, 1
add ecx, 4
test eax, eax
jne 0x49f1d0
mov dword [ebp + 8], edx
mov edx, dword [ebp + 0x14]
mov eax, edi
mov cl, 1
call fcn.00405876
mov edi, eax
or eax, edx
je 0x49f273
xor eax, eax
jmp 0x49f200
mov ecx, dword [ebp + eax - 0x100]
xor ebx, ebx
lea esi, [ebp - 0x100]
test ecx, ecx
je 0x49f223
test cl, 1
je 0x49f21a
xor ebx, dword [esi]
shr ecx, 1
add esi, 4
test ecx, ecx
jne 0x49f213
mov dword [ebp + eax - 0x80], ebx
add eax, 4
cmp eax, 0x80
jl 0x49f200
mov ecx, edi
and ecx, 1
xor eax, eax
or ecx, eax
je 0x49f25b
mov ecx, dword [ebp + 8]
xor esi, esi
lea eax, [ebp - 0x80]
test ecx, ecx
je 0x49f258
test cl, 1
je 0x49f24f
xor esi, dword [eax]
shr ecx, 1
add eax, 4
test ecx, ecx
jne 0x49f248
mov dword [ebp + 8], esi
mov eax, edi
mov cl, 1
call fcn.00405876
mov edi, eax
mov ecx, edi
or ecx, edx
mov dword [ebp + 0x14], edx
jne 0x49f180
mov eax, dword [ebp + 8]
xor eax, dword [ebp + 0xc]
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x402db7
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push 0x7c
mov eax, 0x464628
call fcn.00463b54
mov ebx, ecx
mov dword [ebp - 0x74], ebx
xor eax, eax
mov dword [ebp - 0x78], ebx
mov dword [ebx], eax
mov dword [ebp - 4], eax
mov esi, str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider
push 0xd
pop ecx
lea edi, [ebp - 0x70]
rep movsd dword es:[edi], dword [esi]
push 0x2a
push eax
lea eax, [ebp - 0x3a]
push eax
movsw word es:[edi], word [esi]
call fcn.00441660
add esp, 0xc
call fcn.00403582
cmp eax, 0x5020000
jae 0x402e0b
push str.__Prototype_
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0xf0000040
push 0x18
lea eax, [ebp - 0x70]
push eax
push 0
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x402e46
mov ecx, dword [ebx]
mov eax, dword [ebp - 0x74]
mov dword [ebx], eax
test ecx, ecx
je 0x402e3a
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
or dword [ebp - 4], 0xffffffff
mov eax, ebx
call fcn.00463afe
ret
push str.Unable_to_acquire_cryptographic_provider_
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x88]
call fcn.0040350d
push 0x487dc8
lea eax, [ebp - 0x88]
push eax
call fcn.00442ed6
int3

Function at 0x403612
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [edx]
xor ebx, ebx
mov dword [ebp - 4], edx
mov eax, ecx
mov dword [ebp - 0xc], eax
push edi
mov edi, ebx
cmp esi, 0x40
jb 0x403729
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x403729
mov edx, dword [eax + 0x3c]
test edx, edx
js 0x403729
cmp esi, edx
jb 0x403729
sub esi, edx
lea ecx, [edx + eax]
cmp esi, 4
jb 0x403729
cmp dword [ecx], 0x4550
jne 0x403729
sub esi, 4
cmp esi, 0x14
jb 0x403729
movzx eax, word [ecx + 4]
sub esi, 0x14
mov dword [ebp - 8], 0x14c
cmp ax, word [ebp - 8]
jne 0x4036b6
cmp esi, 0xe0
jb 0x403729
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x403729
mov eax, dword [ecx + 0x98]
mov ecx, dword [ecx + 0x9c]
jmp 0x4036ef
mov dword [ebp - 8], 0x8664
cmp ax, word [ebp - 8]
je 0x4036d0
mov dword [ebp - 8], 0xaa64
cmp ax, word [ebp - 8]
jne 0x403729
cmp esi, 0xf0
jb 0x403729
mov eax, 0x20b
cmp word [ecx + 0x18], ax
jne 0x403729
mov eax, dword [ecx + 0xa8]
mov ecx, dword [ecx + 0xac]
mov ebx, dword [ebp - 4]
lea edi, [edx + 0x58]
lea edx, [ecx + eax]
mov esi, edi
push 0
cmp edx, dword [ebx]
pop ebx
ja 0x403729
cmp edx, eax
jb 0x403729
mov edx, dword [ebp - 4]
test eax, eax
jne 0x403711
test ecx, ecx
cmove eax, dword [edx]
mov ecx, dword [ebp - 0xc]
dec eax
cmp eax, dword [edx]
jae 0x403726
cmp byte [eax + ecx], 0
jne 0x403726
inc ebx
dec eax
cmp ebx, 8
jl 0x403715
inc eax
mov dword [edx], eax
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403cd3
Capabilities:
Get file size
Read file via mapping

Disassembly:
push 0x20
mov eax, 0x464905
call fcn.00463b20
mov ebx, edx
mov esi, ecx
lea eax, [ebp - 0x1c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x403d7b
xor eax, eax
cmp dword [ebp - 0x18], eax
jl 0x403d14
jg 0x403d08
cmp dword [ebp - 0x1c], 0x40000000
jbe 0x403d14
push str.Unable_to_process_files_over_1GB_
push 0xdf
jmp 0x403d87
push eax
push eax
push eax
push 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov esi, eax
test esi, esi
jne 0x403d2e
push str.Unable_to_open_file_mapping_
jmp 0x403d80
mov dword [ebp - 0x10], esi
xor eax, eax
mov dword [ebp - 4], eax
push eax
push eax
push eax
push 4
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
test edi, edi
je 0x403d27
mov dword [ebp - 0x14], edi
mov byte [ebp - 4], 1
mov ecx, edi
mov edx, dword [ebp - 0x1c]
push ebx
call fcn.00403c4f
pop ecx
mov bl, al
mov byte [ebp - 4], 0
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
or dword [ebp - 4], 0xffffffff
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
call fcn.00463ae9
ret
push str.Unable_to_determine_file_size_
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040350d
push 0x487dc8
lea eax, [ebp - 0x2c]
push eax
call fcn.00442ed6
int3