joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412c50
Capabilities:
Check if file exists
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56d096
mov eax, dword fs:[0]
push eax
sub esp, 0x814
mov eax, dword [0x5dccb4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x820]
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
call fcn.0042aa80
push esi
push edi
push ebx
lea ecx, [ebp - 0x820]
mov dword [ebp - 4], 0
call fcn.0042ae50
test eax, eax
jne 0x412cb2
xor esi, esi
jmp 0x412d5b
call fcn.0040cf00
mov ecx, eax
test ecx, ecx
je 0x412de1
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x814], eax
push 0
lea eax, [ebp - 0x814]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x820]
call fcn.0042b050
test eax, eax
je 0x412d37
push 0x800
lea eax, [ebp - 0x810]
push 0
push eax
call fcn.00516300
add esp, 0xc
lea eax, [ebp - 0x810]
push 0x58a964
push dword [ebp - 0x814]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x810]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x412d86
push str.file_KB931125.exe_is_not_exit
call fcn.0044ceb0
add esp, 4
xor esi, esi
mov edi, dword [ebp - 0x814]
or eax, 0xffffffff
mov byte [ebp - 4], 0
add edi, 0xfffffff0
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x412d5b
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
lea ecx, [ebp - 0x820]
call fcn.0042aaa0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b0a78
mov esp, ebp
pop ebp
ret 0xc
push 0x2710
push 0
push 1
push 0
push 0
push 0x58a9bc
lea eax, [ebp - 0x810]
push eax
call fcn.004299e0
mov esi, eax
test esi, esi
jne 0x412db7
push str.run_KB931125.exe_error
call fcn.0044ceb0
add esp, 4
lea eax, [ebp - 0x810]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x412d39
push 4
push eax
lea eax, [ebp - 0x810]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
jmp 0x412d39
push 0x80004005
call fcn.0040af40
int3
Function at 0x43afc0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2858
call fcn.004b0ed0
mov eax, dword [0x5dccb4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x804]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
push 0x800
push 0
push eax
call fcn.00516300
add esp, 0xc
cmp dword [ebp + 0x24], 0
je 0x43b074
test esi, esi
je 0x43b0a9
push 0x1000
lea eax, [ebp - 0x1804]
push 0
push eax
call fcn.00516300
add esp, 0xc
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
je 0x43b05d
push 0x800
lea eax, [ebp - 0x1804]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x1804]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push esi
lea eax, [ebp - 0x1804]
push eax
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea esi, [ebp - 0x1804]
push 0x400
lea eax, [ebp - 0x804]
push esi
push eax
call fcn.00544efa
add esp, 0xc
jmp 0x43b090
lea ecx, [ebp - 0x804]
sub ecx, esi
nop dword [eax]
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [ecx + esi - 2], ax
test ax, ax
jne 0x43b080
cmp dword [ebp + 0x20], 0
je 0x43b0bc
lea eax, [ebp - 0x804]
push eax
call fcn.004aa800
add esp, 4
test eax, eax
jne 0x43b0bc
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b0a78
mov esp, ebp
pop ebp
ret
xorps xmm0, xmm0
mov dword [ebp - 0x2858], 0x44
lea eax, [ebp - 0x2858]
movlpd qword [ebp - 0x2854], xmm0
push eax
movlpd qword [ebp - 0x284c], xmm0
movlpd qword [ebp - 0x2844], xmm0
movlpd qword [ebp - 0x283c], xmm0
movlpd qword [ebp - 0x2834], xmm0
movlpd qword [ebp - 0x282c], xmm0
movlpd qword [ebp - 0x2824], xmm0
movlpd qword [ebp - 0x281c], xmm0
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov ax, word [ebp + 0x14]
xorps xmm0, xmm0
push 0x1000
mov word [ebp - 0x2828], ax
lea eax, [ebp - 0x2804]
push 0
push eax
mov dword [ebp - 0x282c], 1
movups xmmword [ebp - 0x2814], xmm0
call fcn.00516300
add esp, 0xc
lea eax, [ebp - 0x804]
test edi, edi
je 0x43b16d
push edi
push eax
lea eax, [ebp - 0x2804]
push 0x58d19c
push eax
call fcn.00435b80
add esp, 0x10
jmp 0x43b182
push eax
lea eax, [ebp - 0x2804]
push 0x58d1ac
push eax
call fcn.00435b80
add esp, 0xc
lea eax, [ebp - 0x2814]
push eax
lea eax, [ebp - 0x2858]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x2804]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edi, eax
test edi, edi
je 0x43b1f0
cmp dword [ebp + 0x18], 0
je 0x43b1c6
push dword [ebp + 0x1c]
push dword [ebp - 0x2814]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
mov eax, dword [ebp + 0x28]
test eax, eax
je 0x43b1da
push eax
push dword [ebp - 0x2814]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x2810]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x2814]
call esi
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b0a78
mov esp, ebp
pop ebp
ret
Function at 0x442420
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2858
call fcn.004b0ed0
mov eax, dword [0x5dccb4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x804]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
push 0x800
push 0
push eax
call fcn.00516300
add esp, 0xc
cmp dword [ebp + 0x24], 0
je 0x4424d4
test esi, esi
je 0x442509
push 0x1000
lea eax, [ebp - 0x1804]
push 0
push eax
call fcn.00516300
add esp, 0xc
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
je 0x4424bd
push 0x800
lea eax, [ebp - 0x1804]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x1804]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push esi
lea eax, [ebp - 0x1804]
push eax
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea esi, [ebp - 0x1804]
push 0x400
lea eax, [ebp - 0x804]
push esi
push eax
call fcn.00544efa
add esp, 0xc
jmp 0x4424f0
lea ecx, [ebp - 0x804]
sub ecx, esi
nop dword [eax]
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [ecx + esi - 2], ax
test ax, ax
jne 0x4424e0
cmp dword [ebp + 0x20], 0
je 0x44251c
lea eax, [ebp - 0x804]
push eax
call fcn.004aa800
add esp, 4
test eax, eax
jne 0x44251c
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b0a78
mov esp, ebp
pop ebp
ret
xorps xmm0, xmm0
mov dword [ebp - 0x2858], 0x44
lea eax, [ebp - 0x2858]
movlpd qword [ebp - 0x2854], xmm0
push eax
movlpd qword [ebp - 0x284c], xmm0
movlpd qword [ebp - 0x2844], xmm0
movlpd qword [ebp - 0x283c], xmm0
movlpd qword [ebp - 0x2834], xmm0
movlpd qword [ebp - 0x282c], xmm0
movlpd qword [ebp - 0x2824], xmm0
movlpd qword [ebp - 0x281c], xmm0
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov ax, word [ebp + 0x14]
xorps xmm0, xmm0
push 0x1000
mov word [ebp - 0x2828], ax
lea eax, [ebp - 0x2804]
push 0
push eax
mov dword [ebp - 0x282c], 1
movups xmmword [ebp - 0x2814], xmm0
call fcn.00516300
add esp, 0xc
lea eax, [ebp - 0x804]
test edi, edi
je 0x4425cd
push edi
push eax
lea eax, [ebp - 0x2804]
push 0x58d19c
push eax
call fcn.00435b80
add esp, 0x10
jmp 0x4425e2
push eax
lea eax, [ebp - 0x2804]
push 0x58d1ac
push eax
call fcn.00435b80
add esp, 0xc
lea eax, [ebp - 0x2814]
push eax
lea eax, [ebp - 0x2858]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x2804]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edi, eax
test edi, edi
je 0x44263c
cmp dword [ebp + 0x18], 0
je 0x442626
push dword [ebp + 0x1c]
push dword [ebp - 0x2814]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
push dword [ebp - 0x2810]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x2814]
call esi
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b0a78
mov esp, ebp
pop ebp
ret
Function at 0x473b80
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x575726
mov eax, dword fs:[0]
push eax
sub esp, 0x818
mov eax, dword [0x5dccb4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x824]
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x818], eax
call fcn.0042aa80
push esi
push edi
push ebx
lea ecx, [ebp - 0x824]
mov dword [ebp - 4], 0
call fcn.0042ae50
test eax, eax
jne 0x473beb
xor edi, edi
jmp 0x473ce3
call fcn.0042e350
mov ecx, eax
test ecx, ecx
je 0x473d0e
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x814], eax
push 0
lea eax, [ebp - 0x814]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x824]
call fcn.0042b050
test eax, eax
je 0x473cbf
push 0x800
lea eax, [ebp - 0x810]
push 0
push eax
call fcn.00516300
add esp, 0xc
lea eax, [ebp - 0x810]
push 0x59a1c4
push dword [ebp - 0x814]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x810]
push eax
call fcn.004aa800
add esp, 4
test eax, eax
je 0x473cbf
lea eax, [ebp - 0x810]
push eax
call fcn.004b9310
mov ecx, dword [ebp - 0x818]
lea edx, [ebp - 0x810]
mov edi, eax
lea esi, [edx + 2]
lea ecx, [ecx + 0x260]
nop dword [eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x473c90
sub edx, esi
lea eax, [ebp - 0x810]
sar edx, 1
push edx
push eax
call fcn.0040da40
push 4
push 0
lea eax, [ebp - 0x810]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
jmp 0x473cc1
xor edi, edi
mov esi, dword [ebp - 0x814]
or eax, 0xffffffff
mov byte [ebp - 4], 0
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x473ce3
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
lea ecx, [ebp - 0x824]
call fcn.0042aaa0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b0a78
mov esp, ebp
pop ebp
ret 0x10
push 0x80004005
call fcn.0040af40
int3
Function at 0x473e70
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x575766
mov eax, dword fs:[0]
push eax
sub esp, 0x81c
mov eax, dword [0x5dccb4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x828]
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x81c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x818], eax
call fcn.0042aa80
push esi
push edi
push ebx
lea ecx, [ebp - 0x828]
mov dword [ebp - 4], 0
call fcn.0042ae50
test eax, eax
jne 0x473ee4
xor esi, esi
jmp 0x473fe9
call fcn.0042e350
mov ecx, eax
test ecx, ecx
je 0x474014
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x814], eax
push 1
lea eax, [ebp - 0x814]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x828]
call fcn.0042b050
test eax, eax
je 0x473fc5
push 0x800
lea eax, [ebp - 0x810]
push 0
push eax
call fcn.00516300
add esp, 0xc
lea eax, [ebp - 0x810]
push 0x59a018
push dword [ebp - 0x814]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x810]
push eax
call fcn.004aa800
add esp, 4
test eax, eax
je 0x473fc5
push 4
push 0
lea eax, [ebp - 0x810]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea eax, [ebp - 0x810]
push eax
push 0x400
push dword [ebp - 0x818]
call fcn.00541cac
lea ecx, [ebp - 0x810]
add esp, 0xc
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x473f96
sub ecx, edx
lea eax, [ebp - 0x810]
sar ecx, 1
push ecx
mov ecx, dword [ebp - 0x81c]
push eax
add ecx, 0x264
call fcn.00412a70
mov esi, 1
jmp 0x473fc7
xor esi, esi
mov edi, dword [ebp - 0x814]
or eax, 0xffffffff
mov byte [ebp - 4], 0
add edi, 0xfffffff0
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x473fe9
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
lea ecx, [ebp - 0x828]
call fcn.0042aaa0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b0a78
mov esp, ebp
pop ebp
ret 0x14
push 0x80004005
call fcn.0040af40
int3
Function at 0x474020
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5757a6
mov eax, dword fs:[0]
push eax
sub esp, 0x81c
mov eax, dword [0x5dccb4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x828]
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x81c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x818], eax
call fcn.0042aa80
push esi
push edi
push ebx
lea ecx, [ebp - 0x828]
mov dword [ebp - 4], 0
call fcn.0042ae50
test eax, eax
jne 0x474094
xor esi, esi
jmp 0x4741a3
call fcn.0042e350
mov ecx, eax
test ecx, ecx
je 0x4741ce
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x814], eax
push 1
lea eax, [ebp - 0x814]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x828]
call fcn.0042b050
test eax, eax
je 0x47417f
push 0x800
lea eax, [ebp - 0x810]
push 0
push eax
call fcn.00516300
add esp, 0xc
lea eax, [ebp - 0x810]
push 0x59a1d4
push dword [ebp - 0x814]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x810]
push eax
call fcn.004aa800
add esp, 4
test eax, eax
je 0x47417f
push 4
push 0
lea eax, [ebp - 0x810]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov eax, dword [ebp - 0x818]
test eax, eax
je 0x474142
lea ecx, [ebp - 0x810]
push ecx
push 0x400
push eax
call fcn.00541cac
add esp, 0xc
lea ecx, [ebp - 0x810]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x474150
sub ecx, edx
lea eax, [ebp - 0x810]
sar ecx, 1
push ecx
mov ecx, dword [ebp - 0x81c]
push eax
add ecx, 0x27c
call fcn.00412a70
mov esi, 1
jmp 0x474181
xor esi, esi
mov edi, dword [ebp - 0x814]
or eax, 0xffffffff
mov byte [ebp - 4], 0
add edi, 0xfffffff0
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x4741a3
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
lea ecx, [ebp - 0x828]
call fcn.0042aaa0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b0a78
mov esp, ebp
pop ebp
ret 0x14
push 0x80004005
call fcn.0040af40
int3
Function at 0x4741e0
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5757e6
mov eax, dword fs:[0]
push eax
sub esp, 0x81c
mov eax, dword [0x5dccb4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x828]
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x81c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x818], eax
call fcn.0042aa80
push esi
push edi
push ebx
lea ecx, [ebp - 0x828]
mov dword [ebp - 4], 0
call fcn.0042ae50
test eax, eax
jne 0x474254
xor esi, esi
jmp 0x474363
call fcn.0042e350
mov ecx, eax
test ecx, ecx
je 0x47438e
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x814], eax
push 1
lea eax, [ebp - 0x814]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x828]
call fcn.0042b050
test eax, eax
je 0x47433f
push 0x800
lea eax, [ebp - 0x810]
push 0
push eax
call fcn.00516300
add esp, 0xc
lea eax, [ebp - 0x810]
push 0x59a1f0
push dword [ebp - 0x814]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x810]
push eax
call fcn.004aa800
add esp, 4
test eax, eax
je 0x47433f
push 4
push 0
lea eax, [ebp - 0x810]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov eax, dword [ebp - 0x818]
test eax, eax
je 0x474302
lea ecx, [ebp - 0x810]
push ecx
push 0x400
push eax
call fcn.00541cac
add esp, 0xc
lea ecx, [ebp - 0x810]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x474310
sub ecx, edx
lea eax, [ebp - 0x810]
sar ecx, 1
push ecx
mov ecx, dword [ebp - 0x81c]
push eax
add ecx, 0x294
call fcn.00412a70
mov esi, 1
jmp 0x474341
xor esi, esi
mov edi, dword [ebp - 0x814]
or eax, 0xffffffff
mov byte [ebp - 4], 0
add edi, 0xfffffff0
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x474363
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
lea ecx, [ebp - 0x828]
call fcn.0042aaa0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b0a78
mov esp, ebp
pop ebp
ret 0x14
push 0x80004005
call fcn.0040af40
int3
Function at 0x4b6750
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57c096
mov eax, dword fs:[0]
push eax
sub esp, 0x108
mov eax, dword [0x5dccb4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, dword [ecx + 8]
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0xb4], ecx
mov dword [ebp - 4], 0
test esi, esi
je 0x4b683d
test edi, edi
je 0x4b6869
mov edx, dword [ebp + 0x10]
test edx, 0xf
jne 0x4b6895
lea eax, [edx - 0x10]
cmp dword [ebp + 0xc], eax
jbe 0x4b68c1
cmp byte [ecx + 0x10], 0
je 0x4b68ed
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], edx
push eax
push edi
push 0
push 1
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
mov ecx, eax
test ecx, ecx
je 0x4b6919
jmp 0x4b6815
mov eax, dword [ebp - 0x18]
mov dword [ebx], eax
test ecx, ecx
setne al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004b0a78
mov esp, ebp
pop ebp
ret 0x10
push 0x80090003
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str.Decrypt_1_:_Key_is_not_valid
lea ecx, [ebp - 0xc0]
call fcn.004b5ac0
push 0x5cd8f8
lea eax, [ebp - 0xc0]
push eax
call fcn.00516597
push 0x6f8
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str.Decrypt_1_:_Buffer_is_NULL
lea ecx, [ebp - 0xcc]
call fcn.004b5ac0
push 0x5cd8f8
lea eax, [ebp - 0xcc]
push eax
call fcn.00516597
push 0x80090005
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str.Decrypt_1_:_Data_size_is_not_a_multple_of_block_size
lea ecx, [ebp - 0xd8]
call fcn.004b5ac0
push 0x5cd8f8
lea eax, [ebp - 0xd8]
push eax
call fcn.00516597
push 0x80090028
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str.Decrypt_1_:_Buffer_is_too_small
lea ecx, [ebp - 0xe4]
call fcn.004b5ac0
push 0x5cd8f8
lea eax, [ebp - 0xe4]
push eax
call fcn.00516597
push 0x80090027
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str.Decrypt_1_:_IV_has_not_been_set
lea ecx, [ebp - 0xf0]
call fcn.004b5ac0
push 0x5cd8f8
lea eax, [ebp - 0xf0]
push eax
call fcn.00516597
push 0x98
lea ecx, [ebp - 0xb0]
call fcn.004b7c80
push 1
push 2
lea ecx, [ebp - 0xb0]
call fcn.004b5760
lea eax, [ebp - 0xb0]
mov byte [ebp - 4], 1
push str.Decrypt_1_:_CryptDecrypt_failed__
push eax
call fcn.004b54d0
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
add esp, 8
call esi
push eax
call fcn.004b7360
push eax
lea eax, [ebp - 0xb0]
push eax
call fcn.004b54d0
add esp, 0xc
lea eax, [ebp - 0xb0]
push 0x5a1f74
push eax
call fcn.004b54d0
add esp, 8
mov ecx, eax
push 0x4b7ca0
call fcn.004b6300
mov edi, eax
call esi
push eax
mov ecx, edi
call fcn.004b6040
push 0x5a1f70
push eax
call fcn.004b54d0
add esp, 8
mov dword [ebx], 0
lea eax, [ebp - 0x114]
lea ecx, [ebp - 0xb0]
push eax
call fcn.004b8350
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.0048fb49
push eax
lea ecx, [ebp - 0xfc]
call fcn.004b5ac0
push 0x5cd8f8
lea eax, [ebp - 0xfc]
push eax
call fcn.00516597
push 0
push 0
call fcn.00516597
int3
Function at 0x4b6d70
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57c116
mov eax, dword fs:[0]
push eax
sub esp, 0xfc
mov eax, dword [0x5dccb4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edx, dword [ecx + 8]
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0xb4], ecx
mov dword [ebp - 4], 0
test edx, edx
je 0x4b6e59
test esi, esi
je 0x4b6e85
mov ebx, dword [ebp + 0x10]
mov eax, ebx
and eax, 0xfffffff0
add eax, 0x10
cmp dword [ebp + 0xc], eax
jb 0x4b6eb1
cmp byte [ecx + 0x10], 0
je 0x4b6edd
push dword [ebp + 0xc]
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
push eax
push esi
push 0
push 1
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov ecx, eax
test ecx, ecx
je 0x4b6f09
jmp 0x4b6e31
mov eax, dword [ebp - 0x18]
mov dword [edi], eax
test ecx, ecx
setne al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004b0a78
mov esp, ebp
pop ebp
ret 0x10
push 0x80090003
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str.Encrypt_1_:_Key_is_not_valid
lea ecx, [ebp - 0xc0]
call fcn.004b5ac0
push 0x5cd8f8
lea eax, [ebp - 0xc0]
push eax
call fcn.00516597
push 0x6f8
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str.Encrypt_1_:_Buffer_is_NULL
lea ecx, [ebp - 0xcc]
call fcn.004b5ac0
push 0x5cd8f8
lea eax, [ebp - 0xcc]
push eax
call fcn.00516597
push 0x80090028
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str.Encrypt_1_:_Buffer_is_too_small
lea ecx, [ebp - 0xd8]
call fcn.004b5ac0
push 0x5cd8f8
lea eax, [ebp - 0xd8]
push eax
call fcn.00516597
push 0x80090027
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str.Encrypt_1_:_IV_has_not_been_set
lea ecx, [ebp - 0xe4]
call fcn.004b5ac0
push 0x5cd8f8
lea eax, [ebp - 0xe4]
push eax
call fcn.00516597
push 0x98
lea ecx, [ebp - 0xb0]
call fcn.004b7c80
push 1
push 2
lea ecx, [ebp - 0xb0]
call fcn.004b5760
lea eax, [ebp - 0xb0]
mov byte [ebp - 4], 1
push str.Encrypt_1_:_CryptEncrypt_failed__
push eax
call fcn.004b54d0
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
add esp, 8
call esi
push eax
call fcn.004b7360
push eax
lea eax, [ebp - 0xb0]
push eax
call fcn.004b54d0
add esp, 0xc
lea eax, [ebp - 0xb0]
push 0x5a1f74
push eax
call fcn.004b54d0
add esp, 8
mov ecx, eax
push 0x4b7ca0
call fcn.004b6300
mov ebx, eax
call esi
push eax
mov ecx, ebx
call fcn.004b6040
push 0x5a1f70
push eax
call fcn.004b54d0
add esp, 8
mov dword [edi], 0
lea eax, [ebp - 0x108]
lea ecx, [ebp - 0xb0]
push eax
call fcn.004b8350
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.0048fb49
push eax
lea ecx, [ebp - 0xf0]
call fcn.004b5ac0
push 0x5cd8f8
lea eax, [ebp - 0xf0]
push eax
call fcn.00516597
push 0
push 0
call fcn.00516597
int3