joyce8/EMBER2024-capa huggingface dataset:
Function at 0x451910
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x314
mov ecx, dword [ebp + 0x14]
mov eax, 0x10624dd3
imul ecx
sar edx, 6
push ebx
push esi
mov ebx, dword [ebp + 8]
mov esi, edx
shr esi, 0x1f
add esi, edx
mov eax, esi
imul eax, eax, 0x3e8
push edi
mov edi, ecx
sub edi, eax
sub ecx, 0xffffffff
imul edi, edi, 0x3e8
neg ecx
sbb ecx, ecx
lea edx, [ebp - 8]
and ecx, edx
mov dword [ebp + 0x14], ecx
xor ecx, ecx
cmp dword [ebp + 0xc], ecx
mov eax, 1
mov dword [ebp - 0x10c], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x310], ebx
mov dword [ebp - 0x314], eax
je 0x451984
mov dword [ebp - 0x108], ebx
mov dword [ebp - 0x10c], eax
cmp dword [ebp + 0x10], ecx
je 0x451995
mov dword [ebp - 0x20c], ebx
mov dword [ebp - 0x210], eax
mov eax, dword [ebp + 0x14]
push eax
lea ecx, [ebp - 0x314]
push ecx
lea edx, [ebp - 0x210]
push edx
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebx + 1]
push eax
mov dword [ebp - 8], esi
mov dword [ebp - 4], edi
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
jne 0x4519d8
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0x2714
je 0x451954
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
test eax, eax
je 0x4519cf
lea ecx, [ebp - 0x314]
push ecx
push ebx
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
jne 0x4519cf
lea edx, [ebp - 0x10c]
push edx
push ebx
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x451a0a
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x210]
push eax
push ebx
call sub.WS2_32.dll___WSAFDIsSet
neg eax
pop edi
sbb eax, eax
pop esi
and eax, 2
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x456010
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x150
mov eax, dword [0x595c60]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, ecx
cmp edi, 0x40
mov dword [ebp - 0x150], eax
mov esi, edx
jle 0x45606c
lea ecx, [ebp - 0x14c]
push ecx
call fcn.00411580
push edi
lea edx, [ebp - 0x14c]
push esi
push edx
call fcn.00411d00
lea eax, [ebp - 0x14c]
push eax
lea ecx, [ebp - 0x14]
push ecx
call fcn.00411e10
add esp, 0x18
lea esi, [ebp - 0x14]
mov edi, 0x10
push 0x41
lea edx, [ebp - 0x58]
push 0
push edx
call fcn.0050be90
push 0x41
lea eax, [ebp - 0x9c]
push 0
push eax
call fcn.0050be90
push edi
lea ecx, [ebp - 0x58]
push esi
push ecx
call fcn.0050b730
push edi
lea edx, [ebp - 0x9c]
push esi
push edx
call fcn.0050b730
add esp, 0x30
pop edi
xor eax, eax
pop esi
lea esp, [esp]
xor byte [ebp + eax - 0x58], 0x36
xor byte [ebp + eax - 0x9c], 0x5c
add eax, 1
cmp eax, 0x40
jl 0x4560b0
lea eax, [ebp - 0xf4]
push eax
call fcn.00411580
push 0x40
lea ecx, [ebp - 0x58]
push ecx
lea edx, [ebp - 0xf4]
push edx
call fcn.00411d00
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x150]
push eax
push ecx
lea edx, [ebp - 0xf4]
push edx
call fcn.00411d00
lea eax, [ebp - 0xf4]
push eax
push ebx
call fcn.00411e10
lea ecx, [ebp - 0xf4]
push ecx
call fcn.00411580
push 0x40
lea edx, [ebp - 0x9c]
push edx
lea eax, [ebp - 0xf4]
push eax
call fcn.00411d00
push 0x10
lea ecx, [ebp - 0xf4]
push ebx
push ecx
call fcn.00411d00
add esp, 0x40
lea edx, [ebp - 0xf4]
push edx
push ebx
call fcn.00411e10
mov ecx, dword [ebp - 4]
xor ecx, ebp
add esp, 8
call fcn.00506c7d
mov esp, ebp
pop ebp
ret

Function at 0x45ad00
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop ebp
ret
Function at 0x4602c0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov esi, eax
xor edi, edi
test esi, esi
je 0x4602d9
mov eax, dword [esi]
test eax, eax
je 0x4602d9
cmp dword [esi + 4], edi
jne 0x4602e3
mov edi, 1
mov eax, reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 4]
push ecx
push 0x20019
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x460303
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
test edi, edi
je 0x46030e
mov esi, str.SOFTWAREMcAfeeGTI
jmp 0x460311
mov esi, dword [esi + 4]
mov edx, dword [ebp - 4]
push esi
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
mov eax, dword [ebp - 4]
neg esi
sbb esi, esi
push eax
add esi, 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x460340
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov esi, ecx
xor edi, edi
test esi, esi
je 0x460353
cmp byte [esi], 0
jne 0x46035b
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
test eax, eax
je 0x46036c
mov ecx, dword [eax]
test ecx, ecx
je 0x46036c
mov edx, dword [eax + 4]
test edx, edx
jne 0x4603df
xor eax, eax
mov edx, str.SOFTWAREMcAfeeGTI
mov ecx, reloc.OLEAUT32.dll_SysReAllocString
push ebx
push 0
lea ebx, [ebp - 4]
push ebx
push eax
push 2
push 0
push 0
push 0
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
pop ebx
jne 0x4603c7
lea edi, [eax + 1]
mov eax, esi
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4603a0
sub eax, edx
add eax, 1
push eax
mov eax, dword [ebp - 4]
push esi
push 1
push 0
push str.pipename
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x4603e4
xor esi, esi
test edi, edi
je 0x4603d7
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [eax + 8]
jmp 0x460378
mov ecx, dword [ebp - 4]
push ecx
mov esi, edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x460400
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, eax
xor eax, eax
push edi
xor edi, edi
cmp dword [ebp + 8], eax
mov dword [ebp - 4], eax
je 0x4604c0
cmp esi, 1
jbe 0x4604c0
push ebx
push esi
call fcn.00507c0d
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x460490
lea eax, [esi*4 + 1]
push eax
call fcn.00507c0d
mov edi, eax
add esp, 4
test edi, edi
je 0x460490
push 0xf0000040
push 1
push 0
push 0
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x460490
mov ecx, dword [ebp - 8]
push ebx
push esi
push ecx
mov dword [ebp - 4], 1
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x460490
lea eax, [esi*4 + 1]
push eax
push edi
push esi
push ebx
call fcn.00411230
add esp, 0x10
cmp eax, esi
jae 0x4604c6
xor esi, esi
cmp dword [ebp - 4], esi
je 0x4604a3
mov edx, dword [ebp - 8]
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
test ebx, ebx
je 0x4604b0
push ebx
call fcn.005074d4
add esp, 4
test edi, edi
pop ebx
je 0x4604be
push edi
call fcn.005074d4
add esp, 4
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
lea edx, [esi - 1]
push edx
push edi
push eax
call fcn.0050b730
mov ecx, dword [ebp + 8]
mov byte [ecx + esi - 1], 0
add esp, 0xc
mov esi, 1
jmp 0x460497
Function at 0x460e20
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
cmp ebx, esi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
jne 0x460e44
cmp dword [ebp + 0x10], esi
jne 0x460e44
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push edi
push 0x100
call fcn.00507c0d
mov edi, eax
add esp, 4
cmp edi, esi
je 0x460f12
mov eax, dword [ebp + 0x14]
cmp eax, esi
je 0x460e70
mov ecx, dword [eax]
cmp ecx, esi
je 0x460e70
mov eax, dword [eax + 4]
cmp eax, esi
jne 0x460e7a
mov eax, str.SOFTWAREMcAfeeGTI
mov ecx, reloc.OLEAUT32.dll_SysReAllocString
lea edx, [ebp - 0xc]
push edx
push 0x20019
push esi
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x460f12
mov edx, dword [ebp - 0xc]
lea eax, [ebp + 8]
push eax
push edi
lea ecx, [ebp - 0x10]
push ecx
push 0
push str.pipename
mov esi, 1
push edx
mov dword [ebp - 8], esi
mov dword [ebp + 8], 0x100
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x460f12
cmp dword [ebp - 0x10], esi
jne 0x460f12
cmp byte [edi], al
je 0x460f12
mov eax, edi
lea edx, [eax + 1]
nop
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x460ed0
mov ecx, dword [ebp + 8]
sub eax, edx
add eax, 1
cmp eax, ecx
jne 0x460f12
xor eax, eax
add ecx, 0xffffffff
je 0x460efc
lea esp, [esp]
test byte [eax + edi], 0x80
jne 0x460f12
add eax, esi
cmp eax, ecx
jb 0x460ef0
mov ecx, dword [ebp + 0xc]
push edi
lea eax, [ebp - 4]
push eax
push ecx
push ebx
call fcn.004604f0
add esp, 0x10
test eax, eax
jne 0x460f14
xor esi, esi
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x460f20
mov edx, dword [ebp - 4]
mov dword [eax], edx
test edi, edi
je 0x460f2d
push edi
call fcn.005074d4
add esp, 4
cmp dword [ebp - 8], 0
pop edi
je 0x460f3e
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x460f50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x460fa2
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x460f66
cmp eax, 1
jne 0x460fa2
mov edx, dword [ebp + 0xc]
xor eax, eax
cmp edx, 4
push esi
mov esi, 0xa5a5a5a5
jb 0x460f87
push edi
xor dword [eax + ecx], esi
add eax, 4
mov edi, edx
sub edi, eax
cmp edi, 4
jae 0x460f77
pop edi
cmp eax, edx
pop esi
jae 0x460f9b
lea esp, [esp]
xor byte [eax + ecx], 0xa5
add eax, 1
cmp eax, edx
jb 0x460f90
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x461800
Capabilities:
Write file on windows

Disassembly:
push esi
push edi
mov edi, ecx
test edi, edi
mov esi, eax
jne 0x46180f
pop edi
xor eax, eax
pop esi
ret
test ebx, ebx
je 0x46180a
mov eax, dword [ebx + 8]
mov ecx, dword [ebx + 4]
push 0
push eax
push ecx
call fcn.00460f50
add esp, 0xc
test eax, eax
je 0x46180a
mov eax, dword [ebx]
mov ecx, dword [ebx + 8]
lea edx, [eax + 0x68]
mov eax, dword [eax + 4]
push edx
mov edx, dword [ebx + 4]
push 0
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x461863
mov ecx, dword [ebx]
mov edx, dword [ebx + 8]
mov dword [ecx + 0x60], edx
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
mov dword [eax + 0x5c], ecx
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx]
mov dword [edx + 0x64], eax
xor eax, eax
jmp 0x4618b6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
je 0x461886
cmp eax, 0x3e5
jne 0x4618b1
mov ecx, dword [ebx]
pop edi
mov dword [ecx + 0x58], 1
mov eax, 1
pop esi
ret
push esi
mov esi, dword [ebx]
push 1
mov eax, 1
call fcn.00460a90
add esp, 8
test eax, eax
jne 0x46180a
mov edx, dword [ebx]
pop edi
mov dword [edx + 8], 3
mov eax, 1
pop esi
ret
call fcn.004606a0
push esi
mov esi, dword [ebx]
push eax
call fcn.00461790
add esp, 8
test eax, eax
jne 0x46180a
mov eax, dword [ebx]
mov ecx, dword [eax + 0x78]
push ecx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
test eax, eax
je 0x46180a
mov edx, dword [ebx]
mov eax, dword [edx + 0x5c]
push eax
call fcn.005074d4
mov ecx, dword [ebx]
add esp, 4
pop edi
mov dword [ecx + 0x5c], 0
mov eax, 1
pop esi
ret

Function at 0x461e40
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
xor ebx, ebx
push edi
mov edi, ecx
cmp edi, ebx
mov esi, eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
jne 0x461e5d
xor edi, edi
jmp 0x461edb
cmp esi, ebx
jne 0x461e65
xor edi, edi
jmp 0x461edb
call fcn.00460780
test eax, eax
jne 0x461e72
xor edi, edi
jmp 0x461edb
cmp dword [esi + 8], 2
mov dword [ebp - 8], 1
jne 0x461e9e
push 1
lea ebx, [ebp - 4]
mov eax, esi
mov ecx, edi
call fcn.00461c40
add esp, 4
test eax, eax
jne 0x461e98
xor edi, edi
jmp 0x461edb
cmp dword [ebp - 4], 0
jne 0x461ed6
mov edx, dword [esi + 0x3c]
lea eax, [esi + 0x44]
push eax
mov eax, dword [esi + 4]
lea ecx, [esi + 0x40]
push ecx
push 0x1000
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x461f17
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
je 0x461ef5
cmp eax, 0x3e5
jne 0x461f1b
mov dword [esi + 8], 2
mov edi, 1
test byte [ebp - 8], 1
je 0x461f33
push esi
call fcn.00460fb0
add esp, 4
test eax, eax
jne 0x461f33
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 1
push 1
mov eax, 1
call fcn.00460a90
add esp, 8
test eax, eax
je 0x461f0e
xor edi, edi
jmp 0x461edb
mov dword [esi + 8], 3
jmp 0x461ed6
xor eax, eax
jmp 0x461f20
call fcn.004606a0
push 1
push eax
call fcn.00461720
add esp, 8
test eax, eax
je 0x461ed6
xor edi, edi
jmp 0x461edb
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4644a0
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
xor edi, edi
cmp esi, edi
mov dword [ebp - 4], edi
je case.0x464531.3
cmp dword [ebp + 8], edi
je case.0x464531.3
cmp dword [ebp + 0xc], edi
je case.0x464531.3
lea ecx, [ebp - 4]
mov eax, esi
call fcn.00464480
test eax, eax
je case.0x464531.3
cmp dword [ebp - 4], edi
je case.0x464531.3
mov eax, dword [esi + 8]
cmp eax, 0xffffffff
je 0x464740
mov edx, eax
lea ecx, [eax + 1]
not edx
and ecx, edx
je case.0x464531.3
test ecx, eax
jne case.0x464531.3
cmp ecx, 0x10000
ja 0x464621
je 0x464617
cmp ecx, 0x100
ja 0x46458f
je 0x464585
lea eax, [ecx - 1]
cmp eax, 0x7f
ja case.0x464531.3
movzx eax, byte [eax + 0x464774]
jmp dword [eax*4 + 0x464750]
xor eax, eax
jmp 0x464724
mov eax, 1
jmp 0x464724
mov eax, 2
jmp 0x464724
mov eax, 3
jmp 0x464724
mov eax, 4
jmp 0x464724
mov eax, 5
jmp 0x464724
mov eax, 6
jmp 0x464724
mov eax, 7
jmp 0x464724
mov eax, 8
jmp 0x464724
cmp ecx, 0x1000
ja 0x4645dd
je 0x4645d3
cmp ecx, 0x200
je 0x4645c9
cmp ecx, 0x400
je 0x4645bf
cmp ecx, 0x800
jne case.0x464531.3
mov eax, 0xb
jmp 0x464724
mov eax, 0xa
jmp 0x464724
mov eax, 9
jmp 0x464724
mov eax, 0xc
jmp 0x464724
cmp ecx, 0x2000
je 0x46460d
cmp ecx, 0x4000
je 0x464603
cmp ecx, 0x8000
jne case.0x464531.3
mov eax, 0xf
jmp 0x464724
mov eax, 0xe
jmp 0x464724
mov eax, 0xd
jmp 0x464724
mov eax, 0x10
jmp 0x464724
cmp ecx, 0x1000000
ja 0x4646b4
je 0x4646ad
cmp ecx, 0x100000
ja 0x46467d
je 0x464673
cmp ecx, 0x20000
je 0x464669
cmp ecx, 0x40000
je 0x46465f
cmp ecx, 0x80000
jne case.0x464531.3
mov eax, 0x13
jmp 0x464724
mov eax, 0x12
jmp 0x464724
mov eax, 0x11
jmp 0x464724
mov eax, 0x14
jmp 0x464724
cmp ecx, 0x200000
je 0x4646a6
cmp ecx, 0x400000
je 0x46469f
cmp ecx, 0x800000
jne case.0x464531.3
mov eax, 0x17
jmp 0x464724
mov eax, 0x16
jmp 0x464724
mov eax, 0x15
jmp 0x464724
mov eax, 0x18
jmp 0x464724
cmp ecx, 0x10000000
ja 0x4646f2
je 0x4646eb
cmp ecx, 0x2000000
je 0x4646e4
cmp ecx, 0x4000000
je 0x4646dd
cmp ecx, 0x8000000
jne case.0x464531.3
mov eax, 0x1b
jmp 0x464724
mov eax, 0x1a
jmp 0x464724
mov eax, 0x19
jmp 0x464724
mov eax, 0x1c
jmp 0x464724
cmp ecx, 0x20000000
je 0x46471f
cmp ecx, 0x40000000
je 0x464718
cmp ecx, 0x80000000
je 0x464711
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
mov eax, 0x1f
jmp 0x464724
mov eax, 0x1e
jmp 0x464724
mov eax, 0x1d
mov edx, dword [esi]
push ebx
mov ebx, dword [esi + 4]
sub ebx, edx
cmp eax, ebx
pop ebx
ja 0x464740
add edx, eax
mov eax, dword [ebp + 0xc]
mov dword [eax], edx
or dword [esi + 8], ecx
mov edi, 1
mov ecx, dword [ebp + 8]
mov dword [ecx], edi
mov eax, 1
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x46a3a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push esi
xor esi, esi
push edi
mov edi, dword [ebp + 8]
cmp edi, esi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
je 0x46a4d7
cmp dword [edi], 0x43415348
jne 0x46a4d7
mov eax, dword [ebp + 0xc]
push 0x5764e8
push eax
call fcn.0050b250
add esp, 8
cmp eax, esi
mov dword [ebp - 0x28], eax
je 0x46a4d7
push ebx
lea ebx, [edi + 0xc]
push ebx
call fcn.00410be0
lea ecx, [ebp - 8]
push esi
push ecx
call fcn.00453900
lea esi, [ebp - 0x18]
call fcn.00469720
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], eax
call fcn.0047ad20
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov eax, dword [edi + 0x30]
mov dword [ebp - 0x48], eax
mov eax, dword [edi + 0x44]
mov dword [ebp - 0x50], ecx
mov ecx, dword [edi + 0x34]
mov dword [ebp - 0x4c], edx
mov edx, dword [edi + 0x40]
mov dword [ebp - 0x3c], eax
mov eax, dword [edi + 4]
mov dword [ebp - 0x44], ecx
mov ecx, dword [edi + 0x48]
mov dword [ebp - 0x40], edx
mov edx, dword [edi + 0x4c]
push eax
mov dword [ebp - 0x58], 0x43415348
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x34], edx
call fcn.00462af0
mov ecx, dword [ebp - 0x28]
push ecx
push 1
lea edx, [ebp - 0x58]
push 0x30
push edx
mov dword [ebp - 0x30], eax
call fcn.00509811
mov eax, dword [ebp - 0x10]
push eax
lea ecx, [ebp - 0x50]
push 0x28
push ecx
call fcn.00470ea0
lea edx, [ebp - 0x28]
push edx
mov dword [ebp - 0x10], eax
mov eax, dword [edi + 4]
push 0x469c70
push eax
call fcn.00462d30
mov ecx, dword [ebp - 0x10]
push ecx
mov esi, eax
call fcn.00470ee0
mov edx, dword [ebp - 0x28]
push 0
push 4
push edx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x54], eax
call fcn.0050b6aa
mov eax, dword [ebp - 0x28]
add esp, 0x48
push eax
push 1
lea ecx, [ebp - 0x54]
push 4
push ecx
call fcn.00509811
mov edx, dword [ebp - 0x28]
push edx
call fcn.005098ff
push ebx
call fcn.00410c00
add esp, 0x18
pop ebx
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x470e60
Capabilities:
Encode data using add xor sub operations
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
or eax, 0xffffffff
test ecx, ecx
je 0x470e91
push esi
mov esi, dword [ebp + 8]
movzx edx, byte [esi]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x594470]
sub ecx, 1
add esi, 1
test ecx, ecx
jne 0x470e71
pop esi
not eax
pop ebp
ret

Function at 0x470ea0
Capabilities:
Encode data using add xor sub operations
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
test ecx, ecx
mov eax, dword [ebp + 0x10]
je 0x470ed1
push esi
mov esi, dword [ebp + 8]
movzx edx, byte [esi]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x594470]
sub ecx, 1
add esi, 1
test ecx, ecx
jne 0x470eb1
pop esi
pop ebp
ret
Function at 0x473310
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push ebp
mov ebp, esp
push ecx
xor eax, eax
cmp dword [ebp + 8], eax
je 0x4733dd
push ebx
mov ebx, dword [ebp + 0x10]
neg ebx
sbb ebx, ebx
and ebx, 0x10000000
push esi
add ebx, 0xf0000000
mov dword [ebp - 4], eax
push edi
sub eax, 0
je 0x473369
sub eax, 1
je 0x473362
sub eax, 1
jne 0x4733c6
mov eax, 3
cmp dword [ebp + 0xc], eax
jne 0x473356
mov dword [ebp - 4], eax
jmp 0x4733c6
mov esi, str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
mov edi, 1
jmp 0x473373
mov esi, str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider__Prototype_
jmp 0x47336e
mov esi, str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider
mov edi, 0x18
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
push ebx
push edi
push esi
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x4733e1
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4733e1
cmp dword [ebp + 0x10], 0
je 0x4733c6
cmp eax, 0x80090019
je 0x4733a6
cmp eax, 0x80090016
jne 0x4733c6
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
push 8
push edi
push esi
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x4733e1
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4733e1
mov eax, dword [ebp - 4]
add eax, 1
cmp eax, 3
mov dword [ebp - 4], eax
jl 0x473338
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4733f0
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x590110
push 0x510630
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x595c60]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov edi, ecx
xor esi, esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 4], esi
lea eax, [ebp - 0x20]
push eax
push esi
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptGenKey]
cmp eax, esi
je 0x473580
mov dword [ebp - 0x1c], 4
push esi
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x30]
push ecx
push 9
mov edx, dword [ebp - 0x20]
push edx
mov ebx, dword [sym.imp.ADVAPI32.dll_CryptGetKeyParam]
call ebx
test eax, eax
je 0x473580
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov dword [ebp - 0x20], esi
lea ecx, [edi*8]
cmp ecx, dword [ebp - 0x30]
jne 0x473580
mov dword [ebp - 0x1c], 4
push esi
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x38]
push eax
push 7
mov ecx, dword [ebp + 0xc]
push ecx
call ebx
test eax, eax
je 0x473580
mov dword [ebp - 0x1c], 4
push esi
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x34]
push eax
push 9
mov ecx, dword [ebp + 0xc]
push ecx
call ebx
test eax, eax
je 0x473580
mov ebx, dword [ebp - 0x34]
shr ebx, 3
add ebx, 0xc
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
mov dword [ebp - 0x28], esi
test esi, esi
je 0x473580
mov byte [esi], 1
mov byte [esi + 1], 2
xor eax, eax
mov word [esi + 2], ax
mov edx, dword [ebp + 0x10]
mov dword [esi + 4], edx
lea ecx, [esi + 8]
mov edx, dword [ebp - 0x38]
mov dword [ecx], edx
add ecx, 4
mov dword [ebp - 0x24], eax
cmp eax, edi
jae 0x473523
mov edx, dword [ebp + 0x14]
sub edx, eax
mov dl, byte [edx + edi - 1]
mov byte [eax + ecx], dl
add eax, 1
jmp 0x47350b
mov eax, ebx
sub eax, edi
sub eax, 0xf
mov dword [ebp - 0x1c], eax
lea edi, [ecx + edi + 1]
push edi
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x473580
xor eax, eax
mov dword [ebp - 0x24], eax
cmp eax, dword [ebp - 0x1c]
jae 0x47355a
cmp byte [eax + edi], 0
jne 0x473555
mov byte [eax + edi], 1
add eax, 1
jmp 0x473543
mov byte [ebx + esi - 2], 2
mov ecx, dword [ebp + 0x18]
push ecx
push 0
mov edx, dword [ebp + 0xc]
push edx
push ebx
push esi
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
je 0x473580
mov dword [ebp - 0x2c], 1
mov dword [ebp - 4], 0xfffffffe
call fcn.004735ad
xor eax, eax
cmp dword [ebp - 0x2c], eax
setne al
lea eax, [eax + eax - 1]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret