joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10c3e4a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
imul eax, eax, 0xf
mov edi, edi
nop
clc
mov ebp, ebp
push eax
mov al, al
nop
movzx eax, byte [edi]
sub dword [esp], eax
lea edi, [edi + 1]
jmp 0x10c3d43
cmp eax, 0xffffff8c
cld
lea edi, [ebx]
add esi, dword [edx + 0x24]
add edi, dword [edx + 0x1c]
ret
lodsd eax, dword [esi]
inc ecx
lea edi, [eax + ebx]
jmp 0x10c3c93
xor eax, 0x702de991
mov bl, bl
cld
sbb eax, dword [esp + 4]
nop
mov edi, edi
jne 0x10c3c54
mov eax, eax
lea esi, [ebx]
jmp 0x10c3bfd
add edx, dword [eax + 0x78]
xchg ch, ch
push 0xffffffffffffffff
lea edi, [eax - 0x44]
xchg ecx, ecx
not ecx
add esi, dword [edx + 0x20]
pop ecx
jmp 0x10c3c54
cmp ecx, dword [edx + 0x18]
je 0x10c3c2b
mov eax, eax
push 0
pop eax
jmp 0x10bf000
cmp byte [edi], 1
pop eax
ja 0x10bf000
jmp 0x10c3c5e
mov edx, ebx
mov esi, ebx
mov eax, ebx
inc edi
xchg edi, edi
sbb ecx, esi
lea edi, [ecx]
add eax, dword [ebx + 0x3c]
jmp 0x10c3c7c
Function at 0x106be058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x106be1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x106be07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x106be06a
add dl, dl
jne 0x106be089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x106be0dc
xor eax, eax
add dl, dl
jne 0x106be096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x106be17d
add dl, dl
jne 0x106be0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x106be0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x106be0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x106be0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x106be0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x106be075
mov eax, 1
add dl, dl
jne 0x106be0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x106be0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x106be0e1
sub eax, ebx
mov ebx, 1
jne 0x106be128
mov ecx, 1
add dl, dl
jne 0x106be10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x106be119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x106be105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x106be075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x106be13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x106be14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x106be136
cmp eax, 0x7d00
jae 0x106be16d
cmp eax, 0x500
jb 0x106be168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x106be075
cmp eax, 0x7f
ja 0x106be170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x106be075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x106be19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x106be075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x404890
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x445664]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push eax
mov eax, 0x100
lea ebx, [ebp - 0x204]
call fcn.00402030
add esp, 4
cmp byte [0x448223], 0
pop ebx
je 0x40491a
push esi
push str.KmsRequests
lea ecx, [ebp - 0x204]
push 0
mov dword [ebp - 0x208], ecx
call dword [sym.imp.ADVAPI32.dll_OpenEventLogW]
mov esi, eax
test esi, esi
je 0x40490b
push 0
lea edx, [ebp - 0x208]
push edx
push 0
push 1
push 0
push 0x40000386
push 0
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseEventLog]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041900b
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x204]
push eax
push 0x43e330
call fcn.0041a469
mov ecx, dword [ebp - 4]
xor ecx, ebp
add esp, 8
call fcn.0041900b
mov esp, ebp
pop ebp
ret
Function at 0x4096b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x431c08
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x445664]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x44], ebx
je 0x4097d1
cmp byte [edi + 0x49], bl
je 0x4097d1
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
push 0xffffffffffffffff
call edx
cmp eax, 0xffffffff
je 0x4097c5
mov ecx, 0xf
xor eax, eax
mov byte [ebp - 0x2c], bl
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], 8
cmp ecx, 0x10
jae 0x409725
lea eax, [ebp - 0x2c]
mov byte [eax + 8], bl
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x2c]
mov ebx, dword [ebp - 0x18]
mov edx, eax
cmp ebx, 0x10
jae 0x40973d
lea edx, [ebp - 0x2c]
mov eax, edx
add edx, dword [ebp - 0x1c]
mov ecx, dword [edi + 0x44]
mov esi, dword [ecx]
lea ebx, [ebp - 0x30]
push ebx
push edx
push eax
lea eax, [edi + 0x4c]
push eax
mov eax, dword [esi + 0x18]
call eax
sub eax, 0
je 0x409766
dec eax
je 0x40976a
sub eax, 2
lea ecx, [ebp - 0x2c]
jne 0x4097c0
jmp 0x4097cc
mov byte [edi + 0x49], 0
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov ecx, eax
cmp ebx, 0x10
jae 0x40977a
lea ecx, [ebp - 0x2c]
mov esi, dword [ebp - 0x30]
sub esi, ecx
je 0x4097a3
cmp ebx, 0x10
jae 0x409789
lea eax, [ebp - 0x2c]
mov ecx, dword [edi + 0x54]
push ecx
push esi
push 1
push eax
call fcn.0041abbb
add esp, 0x10
cmp esi, eax
jne 0x4097bd
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
cmp byte [edi + 0x49], 0
je 0x4097c9
test esi, esi
jne 0x409731
push esi
push 8
lea ecx, [ebp - 0x2c]
call fcn.00408fb0
jmp 0x40972b
lea ecx, [ebp - 0x2c]
call fcn.00406f90
xor al, al
jmp 0x4097d3
lea ecx, [ebp - 0x2c]
call fcn.00406f90
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041900b
mov esp, ebp
pop ebp
ret
Function at 0x40b440
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4319eb
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x445664]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0041819c
push 4
mov dword [ebp - 4], 0
call fcn.0041b1d0
mov edi, eax
add esp, 4
test edi, edi
je 0x40b4c0
call fcn.00417fb9
mov dword [edi], eax
call fcn.00417d78
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.0041815d
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x40b4b6
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.00418185
jmp 0x40b4c2
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x414bf0
Capabilities:
Create new key via cryptacquirecontext
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0xf0000000
push 0x18
push 0
push 0
lea eax, [ebp - 8]
push eax
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x414c83
mov edx, dword [ebp - 8]
lea ecx, [ebp - 4]
push ecx
push 0
push 0
push 0x1c
push 0x436674
push edx
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
push 0
push eax
push 1
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
push 0x1ec
push edx
push eax
push 0
push 1
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov eax, dword [ebp - 4]
test eax, eax
je 0x414c73
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov eax, dword [ebp - 8]
test eax, eax
je 0x414c83
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov esp, ebp
pop ebp
ret

Function at 0x414c90
Capabilities:
Create new key via cryptacquirecontext
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0xf0000000
push 0x18
push 0
push 0
lea eax, [ebp - 8]
push eax
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x414d1e
mov edx, dword [ebp - 8]
lea ecx, [ebp - 4]
push ecx
push 0
push 0
push 0x1c
push 0x436674
push edx
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
push 0
push eax
push 1
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
push edx
push eax
push 0
push 1
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
mov eax, dword [ebp - 4]
test eax, eax
je 0x414d0e
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov eax, dword [ebp - 8]
test eax, eax
je 0x414d1e
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov esp, ebp
pop ebp
ret
Function at 0x414d30
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x445664]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
push ebx
mov dword [ebp - 0x14], ecx
mov ecx, dword [eax + 8]
push esi
mov dword [ebp - 0x10], edx
mov edx, dword [eax + 0xc]
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
lea ecx, [ebp - 0x14]
lea esi, [ebp - 0x13]
lea edi, [ebp - 0x12]
lea edx, [ebp - 0x11]
sub ecx, eax
sub esi, eax
sub edi, eax
sub edx, eax
mov dword [ebp - 0x18], 4
jmp 0x414d80
movzx ebx, byte [ecx + eax]
movzx ebx, byte [ebx + str.cw]
mov byte [eax], bl
movzx ebx, byte [esi + eax]
movzx ebx, byte [ebx + str.cw]
mov byte [eax + 1], bl
movzx ebx, byte [edi + eax]
movzx ebx, byte [ebx + str.cw]
mov byte [eax + 2], bl
movzx ebx, byte [edx + eax]
movzx ebx, byte [ebx + str.cw]
mov byte [eax + 3], bl
add eax, 4
dec dword [ebp - 0x18]
jne 0x414d80
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041900b
mov esp, ebp
pop ebp
ret

Function at 0x415130
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x445664]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
push ebx
mov dword [ebp - 0x14], ecx
mov ecx, dword [eax + 8]
push esi
mov dword [ebp - 0x10], edx
mov edx, dword [eax + 0xc]
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
lea ecx, [ebp - 0x14]
lea esi, [ebp - 0x13]
lea edi, [ebp - 0x12]
lea edx, [ebp - 0x11]
sub ecx, eax
sub esi, eax
sub edi, eax
sub edx, eax
mov dword [ebp - 0x18], 4
jmp 0x415180
movzx ebx, byte [ecx + eax]
movzx ebx, byte [ebx + 0x4467f0]
mov byte [eax], bl
movzx ebx, byte [esi + eax]
movzx ebx, byte [ebx + 0x4467f0]
mov byte [eax + 1], bl
movzx ebx, byte [edi + eax]
movzx ebx, byte [ebx + 0x4467f0]
mov byte [eax + 2], bl
movzx ebx, byte [edx + eax]
movzx ebx, byte [ebx + 0x4467f0]
mov byte [eax + 3], bl
add eax, 4
dec dword [ebp - 0x18]
jne 0x415180
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041900b
mov esp, ebp
pop ebp
ret
Function at 0x416150
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [0x448370]
push esi
push edi
mov edi, dword [0x448334]
test edi, edi
je 0x4161a5
mov esi, dword [0x448368]
lea ecx, [esi + 3]
lea eax, [ebx + 1]
sub esi, ebx
mov dword [ebp - 0xc], edi
lea ebx, [ebx]
movzx edx, byte [ecx - 3]
mov byte [eax - 1], dl
movzx edx, byte [esi + eax]
mov byte [eax], dl
movzx edx, byte [ecx - 1]
mov byte [eax + 1], dl
movzx edx, byte [ecx]
mov byte [eax + 2], dl
add ecx, 4
add eax, 4
dec dword [ebp - 0xc]
jne 0x416180
mov eax, dword [0x448338]
inc eax
imul eax, dword [0x448330]
mov esi, edi
mov dword [ebp - 0x14], eax
cmp edi, eax
jae 0x416297
mov dword [ebp - 0x10], ebx
xor edx, edx
mov eax, esi
div edi
mov ecx, dword [ebx + esi*4 - 4]
mov edx, eax
imul edx, edi
cmp edx, esi
jne 0x416230
mov edx, ecx
shr edx, 8
mov byte [ebp - 4], dl
mov edx, ecx
shr edx, 0x10
mov byte [ebp - 3], dl
mov edx, ecx
shr edx, 0x18
mov byte [ebp - 2], dl
movzx edx, byte [ebp - 4]
movzx edx, byte [edx + str.cw]
mov byte [ebp - 8], dl
movzx edx, byte [ebp - 3]
movzx edx, byte [edx + str.cw]
mov byte [ebp - 7], dl
movzx edx, byte [ebp - 2]
movzx edx, byte [edx + str.cw]
movzx ecx, cl
mov byte [ebp - 6], dl
movzx edx, byte [ecx + str.cw]
movzx ecx, byte [eax + 0x4466e0]
mov byte [ebp - 5], dl
xor ecx, dword [ebp - 8]
jmp 0x41627d
cmp edi, 6
jbe 0x41627d
mov eax, esi
sub eax, edx
cmp eax, 4
jne 0x41627d
movzx edx, cl
movzx eax, byte [edx + str.cw]
mov edx, ecx
mov byte [ebp - 0xc], al
shr edx, 8
movzx eax, dl
mov dl, byte [eax + str.cw]
mov eax, ecx
shr eax, 0x10
mov byte [ebp - 0xb], dl
movzx edx, al
movzx eax, byte [edx + str.cw]
shr ecx, 0x18
mov cl, byte [ecx + str.cw]
mov byte [ebp - 0xa], al
mov byte [ebp - 9], cl
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
xor edx, ecx
mov dword [ebx + esi*4], edx
inc esi
add eax, 4
mov dword [ebp - 0x10], eax
cmp esi, dword [ebp - 0x14]
jb 0x4161c2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x417130
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
or edi, 0xffffffff
lea eax, [edx + 1]
mov ecx, 0x200
sub edi, edx
nop
movzx ebx, byte [eax - 1]
lea edx, [edi + eax]
shl edx, 8
xor edx, ebx
movzx ebx, byte [eax]
xor edx, esi
movzx edx, byte [edx + 0x4367f0]
mov byte [eax - 1], dl
lea edx, [ecx - 0x100]
xor edx, ebx
movzx ebx, byte [eax + 2]
xor edx, esi
movzx edx, byte [edx + 0x4367f0]
mov byte [eax], dl
movzx edx, byte [eax + 1]
xor edx, ecx
xor edx, esi
movzx edx, byte [edx + 0x4367f0]
mov byte [eax + 1], dl
lea edx, [ecx + 0x100]
xor edx, ebx
xor edx, esi
movzx edx, byte [edx + 0x4367f0]
mov byte [eax + 2], dl
add eax, 4
lea edx, [edi + eax]
add ecx, 0x400
cmp edx, 0x10
jb 0x417140
pop edi
pop ebx
ret

Function at 0x4171b0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
inc eax
mov ecx, 4
jmp 0x4171c0
movzx edx, byte [eax - 1]
movzx edx, byte [edx + 0x4366f0]
mov byte [eax - 1], dl
movzx edx, byte [eax]
movzx edx, byte [edx + 0x4366f0]
mov byte [eax], dl
movzx edx, byte [eax + 1]
movzx edx, byte [edx + 0x4366f0]
mov byte [eax + 1], dl
movzx edx, byte [eax + 2]
movzx edx, byte [edx + 0x4366f0]
mov byte [eax + 2], dl
add eax, 4
dec ecx
jne 0x4171c0
ret

Function at 0x4173a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x445664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor eax, eax
mov ebx, ecx
and ecx, 0xf
push esi
shr ebx, 4
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x20], edx
mov byte [ebp - 0x14], al
mov dword [ebp - 0x13], eax
mov dword [ebp - 0xf], eax
mov dword [ebp - 0xb], eax
mov word [ebp - 7], ax
mov byte [ebp - 5], al
mov dword [ebp - 0x1c], esi
cmp ebx, eax
jbe 0x417433
lea esi, [edx + 1]
mov dword [ebp - 0x18], ebx
jmp 0x4173f0
lea eax, [edi + 1]
mov ecx, 4
jmp 0x417400
movzx edx, byte [esi - 1]
xor byte [eax - 1], dl
movzx edx, byte [esi]
xor byte [eax], dl
movzx edx, byte [esi + 1]
xor byte [eax + 1], dl
movzx edx, byte [esi + 2]
xor byte [eax + 2], dl
add esi, 4
add eax, 4
dec ecx
jne 0x417400
call fcn.00417200
dec dword [ebp - 0x18]
jne 0x4173f0
mov edx, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
shl ebx, 4
push esi
add ebx, edx
lea eax, [ebp - 0x14]
push ebx
push eax
call fcn.0041bcd0
mov byte [ebp + esi - 0x14], 0x80
lea ecx, [ebp - 0x14]
lea esi, [ebp - 0x13]
lea edx, [ebp - 0x12]
lea ebx, [ebp - 0x11]
add esp, 0xc
sub ecx, edi
sub esi, edi
sub edx, edi
sub ebx, edi
mov eax, edi
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], 4
jmp 0x417470
movzx ebx, byte [ecx + eax]
xor byte [eax], bl
movzx ebx, byte [esi + eax]
xor byte [eax + 1], bl
movzx ebx, byte [edx + eax]
xor byte [eax + 2], bl
mov ebx, dword [ebp - 0x1c]
movzx ebx, byte [ebx + eax]
xor byte [eax + 3], bl
add eax, 4
dec dword [ebp - 0x18]
jne 0x417470
call fcn.00417200
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041900b
mov esp, ebp
pop ebp
ret
Function at 0x4174b0
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0xf0000000
push 0x18
push 0
push 0
lea eax, [ebp - 8]
push eax
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0x20
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x417543
mov edx, dword [ebp - 8]
lea ecx, [ebp - 4]
push ecx
push 0
push 0
push 0x800c
push edx
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
push 0
push eax
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 4]
push 0
lea eax, [ebp - 0xc]
push eax
push ecx
push 2
push edx
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov eax, dword [ebp - 4]
test eax, eax
je 0x417533
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, dword [ebp - 8]
test eax, eax
je 0x417543
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov esp, ebp
pop ebp
ret

Function at 0x417550
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
xor eax, eax
push 0xf0000000
push 0x18
push eax
push eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 8]
push eax
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0x20
mov dword [ebp - 0x24], 0x800c
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x41763c
mov edx, dword [ebp - 8]
lea ecx, [ebp - 0xc]
push ecx
push 0
push 0
push 0x1c
push 0x4466c4
push edx
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
push eax
push 0
push ecx
push 0x8009
push edx
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
mov ecx, dword [ebp - 4]
push 0
lea eax, [ebp - 0x24]
push eax
push 5
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptSetHashParam]
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
push 0
push edx
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 4]
push 0
lea edx, [ebp - 0x10]
push edx
push eax
push 2
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x41761e
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov eax, dword [ebp - 4]
test eax, eax
je 0x41762c
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, dword [ebp - 8]
test eax, eax
je 0x41763c
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov esp, ebp
pop ebp
ret
Function at 0x4176a0
Capabilities:
Create new key via cryptacquirecontext
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x445664]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0xf0000000
push 0x18
push 0
mov edi, ecx
push 0
lea ecx, [ebp - 0x40]
push ecx
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x40], 0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x4176eb
mov eax, dword [ebp - 0x40]
lea edx, [ebp - 0x18]
push edx
push 0x10
push eax
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov eax, dword [ebp - 0x40]
test eax, eax
je 0x4176fb
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ecx, dword [ebp - 0x18]
mov eax, 0xaaaaaaab
mul ecx
shr edx, 1
lea edx, [edx + edx*2]
sub ecx, edx
mov dword [ebp - 0x44], ecx
lea ebx, [edi + 0x10]
mov ecx, 0x436644
mov edx, ebx
call fcn.00401fc0
test eax, eax
je 0x417730
cmp word [edi + 2], 6
jne 0x41775c
mov eax, 0x436620
jmp 0x417761
mov ecx, 0x436664
mov edx, ebx
call fcn.00401fc0
test eax, eax
je 0x417747
mov eax, 0x436638
jmp 0x417761
mov ecx, 0x436654
mov edx, ebx
call fcn.00401fc0
test eax, eax
mov eax, 0x43662c
jne 0x417761
mov eax, 0x436614
mov ecx, dword [eax + 4]
mov esi, dword [eax + 8]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x14]
sub esi, ecx
xor edx, edx
div esi
lea esi, [ecx + edx]
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
movzx edi, word [edi + 2]
mov dword [ebp - 0x4c], eax
cmp edi, 6
je 0x4177be
cmp dword [ebp - 0x44], 2
je 0x4177be
mov ecx, 0x436664
mov edx, ebx
call fcn.00401fc0
test eax, eax
je 0x4177a5
mov edi, 0x50881e90
jmp 0x4177c3
cmp edi, 5
je 0x4177b7
cmp dword [ebp - 0x44], 1
je 0x4177b7
mov edi, 0x4d5c0290
jmp 0x4177c3
mov edi, 0x50463390
jmp 0x4177c3
mov edi, 0x52601790
xor ebx, ebx
push ebx
call fcn.0041b4d8
mov ecx, dword [ebp - 0x10]
add esp, 4
sub eax, 0x15180
sbb edx, ebx
sub eax, edi
sbb edx, ebx
mov ebx, dword [ebp - 0xc]
push edx
push eax
and ebx, 0x7fffffff
push ebx
push ecx
call fcn.004272d0
mov ecx, eax
add ecx, edi
mov eax, 0
adc edx, eax
mov dword [ebp - 0x50], edx
lea edx, [ebp - 0x54]
push edx
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x54], ecx
call fcn.0041b250
mov ecx, dword [ebp - 0x28]
mov eax, 0x431bde83
imul esi
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [ebp - 0x20]
inc edx
add ecx, 0x76c
push ecx
mov ecx, dword [ebp - 0x44]
push edx
movzx edx, word [ecx*4 + 0x43660a]
push edx
mov edx, dword [ebp - 0x4c]
push edx
mov ebx, dword [ebp - 0x48]
mov edx, eax
imul edx, edx, 0xf4240
push 3
sub esi, edx
push esi
push eax
mov eax, dword [ebp - 0x40]
movzx edx, word [eax]
movzx eax, word [ecx*4 + 0x436608]
push edx
push eax
push str._05u__05u__03u__06u__02u__u__04u.0000__03d_04d
mov ecx, 0x40
call fcn.00417640
mov ecx, dword [ebp - 8]
add esp, 0x30
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041900b
mov esp, ebp
pop ebp
ret

Function at 0x41900b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x445664]
jne 0x419015
repz ret
jmp fcn.004204a9