joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4173d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
sub esp, 4
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push ebp
push 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x4173fb
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x41741f
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
jne 0x41743a
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
mov edi, ebp
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov cl, ah
mov edx, eax
mov dword [esp + 0x10], 0
shl ecx, 8
shr edx, 0x10
mov byte [esp + 0x10], dl
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x28]
or ecx, edx
mov edx, eax
shr edx, 0x10
mov dword [ebp + 0x28], ecx
mov dword [esp + 0x10], 0
xor ecx, ecx
mov byte [esp + 0x10], dl
mov cl, ah
xor edx, edx
shl ecx, 8
mov dl, al
shl edx, 0x10
or ecx, dword [esp + 0x10]
or ecx, edx
mov eax, dword [esp + 0x24]
mov edx, eax
mov dword [ebp + 0x44], ecx
shr edx, 0x10
xor ecx, ecx
mov dword [esp + 0x10], 0
mov cl, ah
mov byte [esp + 0x10], dl
shl ecx, 8
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x2c]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x48], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x30]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x64], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x34]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x54], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
push 0
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
or ecx, edx
mov dword [ebp + 0x50], ecx
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push 0
push ebp
lea ecx, [ebp + 0x68]
push ecx
push 4
push ebp
push edi
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov esi, eax
push edi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
Function at 0x4197f2
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x432094
call fcn.0040a334
sub esp, 0x18
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], esi
mov eax, dword [esi + 0x48]
mov edi, dword [esi + 0x44]
mov dword [ebp - 0x18], eax
call fcn.0042ee08
cmp dword [esi + 0x40], 0
mov ebx, dword [eax + 0xc]
je 0x419831
call fcn.0042ee08
mov ebx, dword [eax + 0xc]
push 5
push dword [esi + 0x40]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x41983f
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x41984d
or eax, 0xffffffff
jmp 0x419935
mov ecx, esi
call fcn.00419768
mov dword [ebp - 0x14], eax
call fcn.0041b5b5
xor edi, edi
cmp dword [ebp - 0x14], edi
mov dword [ebp - 0x20], edi
je 0x419884
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x419884
push edi
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x20], 1
push esi
mov dword [ebp - 4], edi
call fcn.0041b569
push dword [ebp - 0x14]
call fcn.0041b09b
push ebx
push eax
push dword [ebp - 0x18]
mov ecx, esi
call fcn.00419500
cmp eax, edi
je 0x4198f7
test byte [esi + 0x24], 0x10
je 0x4198c5
push 4
mov ecx, esi
pop ebx
call fcn.0041a88d
test ah, 1
je 0x4198bd
push 5
pop ebx
push ebx
mov ecx, esi
call fcn.0041d646
cmp dword [esi + 0x1c], edi
je 0x4198f7
push 0x97
push edi
push edi
push edi
push edi
push edi
mov ecx, esi
call fcn.0041a9d5
jmp 0x4198f7
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x20], edi
je 0x41990b
push 1
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp dword [ebp - 0x14], edi
je 0x419924
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [esi + 0x1c]
jne 0x419924
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x58]
mov ecx, esi
call fcn.004197a2
mov eax, dword [esi + 0x2c]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0x41ba65
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x41ba9d
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0041ed39
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0041ed11
jmp 0x41baa9
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4
Function at 0x41d3ef
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x41d431
call fcn.0042ee08
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x41d431
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x41d428
xor eax, eax
jmp 0x41d439
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0041d43f
pop edi
pop esi
pop ebx
ret 4

Function at 0x42e814
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov dword [ebp - 8], ecx
call fcn.0042ee08
mov esi, dword [eax + 0xc]
push 0xf1
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x42e851
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x42e851
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x42e855
xor eax, eax
jmp 0x42e8d3
movzx eax, word [esi + 6]
push ebx
push edi
shl eax, 2
push eax
call fcn.0041a7e5
and dword [ebp - 4], 0
cmp word [esi + 6], 0
pop ecx
mov ebx, eax
jbe 0x42e88d
mov ecx, ebx
lea eax, [esi + 8]
movzx edx, word [eax]
inc dword [ebp - 4]
mov dword [ecx], edx
movzx edx, word [esi + 6]
inc eax
add ecx, 4
inc eax
cmp dword [ebp - 4], edx
jl 0x42e877
movzx eax, word [esi + 6]
mov ecx, dword [ebp - 8]
push eax
push ebx
call fcn.0042e9c4
push ebx
mov edi, eax
call fcn.0041a80e
test edi, edi
pop ecx
je 0x42e8cf
movzx ecx, word [esi + 4]
movzx eax, word [esi + 2]
lea esi, [ecx + 7]
push ecx
mov ecx, dword [ebp - 8]
lea edx, [eax + 7]
push eax
push esi
push edx
call fcn.0042e78d
push dword [ebp + 8]
mov ecx, dword [ebp - 8]
call fcn.0042e8d8
mov edi, eax
mov eax, edi
pop edi
pop ebx
pop esi
leave
ret 4
Function at 0xd93e5a
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push edi
xor ebx, ebx
push ebx
push 2
lea eax, [ebp - 4]
push eax
xor edi, edi
push 0x23
inc edi
call dword [0xd91150]
cmp byte [ebp - 4], bl
je 0xd9a620
push esi
push 0xda2229
call dword [fcn.00d9131c]
lea eax, [ebp - 8]
push eax
push 0x20019
push ebx
push 0xd96898
push 0x80000002
mov dword [ebp - 8], ebx
call dword [fcn.00d911d0]
test eax, eax
jne 0xd93ee4
push 4
pop esi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push 0xd93f30
push dword [ebp - 8]
mov dword [ebp - 0xc], esi
call dword [fcn.00d911c8]
test eax, eax
je 0xd9a637
push dword [ebp - 8]
call dword [fcn.00d911d4]
cmp edi, ebx
je 0xd93f24
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x20
call dword [0xd911a4]
mov esi, eax
mov eax, dword [0xda50c0]
cmp eax, 0xda50c0
je 0xd93f09
test byte [eax + 0x1c], 8
jne 0xd9a64d
push ebx
mov eax, 0xea60
push eax
push eax
xor eax, eax
cmp esi, ebx
setl al
dec eax
push eax
push dword [ebp + 8]
push ebx
call dword [0xd912e8]
pop esi
pop edi
xor eax, eax
pop ebx
leave
ret 4
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
cmp byte [eax + 2], bl
jne 0xd93e81
jmp 0xd93f25
cmp dword [ebp - 0x10], esi
jne 0xd93ed7
cmp dword [ebp - 0x14], ebx
sete al
mov edi, eax
jmp 0xd93ed7
cmp byte [eax + 0x19], 5
jb 0xd93f09
push esi
push 0xd9ab80
push 0x15
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.00d92f89
jmp 0xd93f09

Function at 0xd9c661
Capabilities:
Get token membership

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ebx
call dword [0xd911f0]
mov dword [ebp + 0xc], eax
cmp eax, ebx
jne 0xd9c740
push esi
lea eax, [ebp - 4]
push eax
xor esi, esi
inc esi
push esi
push 8
push 0xfffffffffffffffe
mov dword [ebp - 0xc], esi
call dword [0xd9117c]
cmp eax, ebx
jge 0xd9c6af
push eax
call dword [fcn.00d910ac]
mov dword [ebp + 0xc], eax
jmp 0xd9c73f
push edi
push 0x13
pop edi
lea eax, [ebp - 0x10]
push eax
push dword [0xda51c8]
push dword [ebp - 4]
call dword [0xda5028]
test eax, eax
je 0xd9c735
cmp dword [ebp - 0x10], ebx
je 0xd9c6d4
push 0x18
pop edi
xor ebx, ebx
and dword [ebp - 0x14], 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 4]
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], ebx
call dword [0xd91178]
test eax, eax
jge 0xd9c700
cmp eax, 0xc0000061
jne 0xd9c719
push dword [ebp - 8]
lea eax, [ebp - 0x24]
push eax
push 0
push dword [ebp - 4]
push 0
push 0xda517c
call dword [0xd91168]
test eax, eax
jge 0xd9c726
push eax
call dword [fcn.00d910ac]
jmp 0xd9c73b
cmp byte [ebp - 8], 0
jne 0xd9c73e
mov dword [ebp + 0xc], 5
jmp 0xd9c73e
call dword [fcn.00d913ac]
mov dword [ebp + 0xc], eax
pop edi
pop esi
cmp dword [ebp - 4], 0
pop ebx
je 0xd9c750
push dword [ebp - 4]
call dword [0xd910dc]
cmp dword [ebp - 0xc], 0
je 0xd9c75c
call dword [fcn.00d911ec]
mov eax, dword [ebp + 0xc]
leave
ret 8
Function at 0xd9dd91
Capabilities:
Get token membership

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
xor edi, edi
mov dword [ebp - 4], 0x57
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0xc], edi
cmp esi, edi
je 0xd9de00
mov edx, dword [esi + 4]
cmp edx, edi
jne 0xd9ddcf
xor eax, eax
cmp ax, word [esi]
jne 0xd9de03
cmp ax, word [esi + 2]
jmp 0xd9ddfe
movzx ecx, word [esi]
test cl, 1
jne 0xd9de03
mov eax, ecx
and eax, 0xfffe
mov ebx, 0x400
cmp ax, bx
jae 0xd9de03
movzx eax, word [esi + 2]
movzx ecx, cx
inc ecx
inc ecx
cmp ecx, eax
jne 0xd9de03
shr eax, 1
xor ecx, ecx
cmp cx, word [edx + eax*2 - 2]
jne 0xd9de03
mov dword [ebp - 4], edi
cmp dword [ebp + 0x10], 0x12cc0300
jb 0xd9de13
mov dword [ebp - 4], 0x57
cmp dword [ebp - 4], edi
jne 0xd9defd
push edi
call dword [0xd911f0]
mov ebx, dword [fcn.00d911ec]
mov dword [ebp - 4], eax
cmp eax, edi
jne 0xd9dee8
xor eax, eax
lea ecx, [ebp - 8]
push ecx
inc eax
push eax
push 0xc
push 0xfffffffffffffffe
mov dword [ebp - 0x14], eax
call dword [0xd9117c]
cmp eax, edi
jge 0xd9de5c
push eax
call dword [fcn.00d910ac]
mov dword [ebp - 4], eax
jmp 0xd9dee8
lea eax, [ebp - 0x10]
push eax
push dword [0xda51c8]
push dword [ebp - 8]
call dword [0xda5028]
test eax, eax
jne 0xd9de7b
call dword [fcn.00d913ac]
jmp 0xd9de54
cmp dword [ebp - 0x10], edi
jne 0xd9de99
lea eax, [ebp - 4]
push eax
push 4
lea eax, [ebp - 0x18]
push eax
push 0xc
push dword [ebp - 8]
call dword [0xda5038]
test eax, eax
je 0xd9de73
call ebx
mov dword [ebp - 4], eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
mov dword [ebp - 0x14], edi
call fcn.00d9c0db
mov eax, dword [ebp + 0x1c]
cmp eax, edi
je 0xd9deb9
mov eax, dword [eax + 4]
jmp 0xd9debb
xor eax, eax
push eax
push dword [ebp - 0xc]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
push dword [ebp - 0x10]
push dword [ebp - 8]
push dword [ebp - 0x18]
call fcn.00d9d113
mov dword [ebp - 4], eax
cmp dword [ebp - 0xc], edi
je 0xd9dee8
lea eax, [ebp - 0xc]
push eax
call fcn.00d9575d
cmp dword [ebp - 8], edi
je 0xd9def6
push dword [ebp - 8]
call dword [0xd910dc]
cmp dword [ebp - 0x14], edi
je 0xd9defd
call ebx
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x18
Function at 0xd9df0c
Capabilities:
Get token membership

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
xor ebx, ebx
push edi
push ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
xor edi, edi
mov dword [ebp - 8], ebx
call dword [0xd911f0]
mov esi, eax
cmp esi, ebx
jne 0xd9df98
lea eax, [ebp - 8]
push eax
inc edi
push edi
push 8
push 0xfffffffffffffffe
call dword [0xd9117c]
cmp eax, ebx
jge 0xd9df4e
push eax
call dword [fcn.00d910ac]
jmp 0xd9df6b
lea eax, [ebp - 0xc]
push eax
push dword [0xda51c8]
push dword [ebp - 8]
call dword [0xda5028]
test eax, eax
jne 0xd9df6f
call dword [fcn.00d913ac]
mov esi, eax
jmp 0xd9df98
cmp dword [ebp - 0xc], ebx
je 0xd9df7d
mov dword [ebp - 4], 1
jmp 0xd9df89
cmp byte [ebp + 0x14], bl
je 0xd9df89
mov dword [ebp - 4], 3
cmp byte [ebp + 0x18], bl
je 0xd9df94
or dword [ebp - 4], 4
jmp 0xd9df98
or dword [ebp - 4], 8
cmp dword [ebp - 8], ebx
je 0xd9dfa6
push dword [ebp - 8]
call dword [0xd910dc]
cmp edi, ebx
je 0xd9dfb0
call dword [fcn.00d911ec]
cmp esi, ebx
jne 0xd9dfc9
push ebx
push dword [ebp + 0x1c]
push dword [ebp - 4]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00d9dd91
mov esi, eax
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x18
Function at 0xda19ff
Capabilities:
Get token membership

Disassembly:
push 0x14
push 0xda1bd0
call fcn.00d917fb
xor esi, esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 4], esi
lea eax, [ebp - 0x20]
push eax
push esi
call dword [0xd91238]
cmp eax, esi
je 0xda1a66
mov ecx, dword [0xda50c0]
cmp ecx, 0xda50c0
je 0xda1b65
test byte [ecx + 0x1c], 1
je 0xda1b65
cmp byte [ecx + 0x19], 2
jb 0xda1b65
push eax
push 0xd9ab60
push 0xc
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.00d92f89
jmp 0xda1b65
cmp dword [ebp - 0x20], esi
jne 0xda1aa6
mov eax, dword [0xda50c0]
cmp eax, 0xda50c0
je 0xda1b65
test byte [eax + 0x1c], 1
je 0xda1b65
cmp byte [eax + 0x19], 2
jb 0xda1b65
push 0xd9ab60
push 0xd
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.00d915b6
jmp 0xda1b65
push esi
call dword [0xd911f0]
cmp eax, esi
je 0xda1ae4
mov ecx, dword [0xda50c0]
cmp ecx, 0xda50c0
je 0xda1b65
test byte [ecx + 0x1c], 1
je 0xda1b65
cmp byte [ecx + 0x19], 2
jb 0xda1b65
push eax
push 0xd9ab60
push 0xe
jmp 0xda1a56
xor ebx, ebx
inc ebx
mov dword [ebp - 0x24], ebx
lea eax, [ebp - 0x1c]
push eax
push 0xda1bc0
push esi
call dword [0xda5028]
test eax, eax
jne 0xda1b2c
mov eax, dword [0xda50c0]
cmp eax, 0xda50c0
je 0xda1b27
test byte [eax + 0x1c], bl
je 0xda1b27
cmp byte [eax + 0x19], 2
jb 0xda1b27
push 0xd9ab60
push 0xf
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.00d915b6
mov dword [ebp - 0x1c], esi
jmp 0xda1b65
mov eax, dword [0xda50c0]
cmp eax, 0xda50c0
je 0xda1b65
test byte [eax + 0x1c], bl
je 0xda1b65
cmp byte [eax + 0x19], 2
jb 0xda1b65
cmp dword [ebp - 0x1c], esi
mov ecx, 0xd93694
jne 0xda1b52
mov ecx, 0xd9368c
push ecx
push 0xd9ab60
push 0x10
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.00da190d
mov dword [ebp - 4], 0xfffffffe
call fcn.00da1b81
mov eax, dword [ebp - 0x1c]
call fcn.00d915e2
ret
Function at 0x1000b340
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x1000b34f
pop dword [ebp - 0x24]
mov eax, 0x1000b34f
sub dword [ebp - 0x24], eax
push 0x40
push 0x1000
push 0x63724
push 0
mov eax, 0x53a25918
sub eax, 0x43977824
add eax, dword [ebp - 0x24]
call dword [eax]
mov ecx, 0x4c58
xor ebx, ebx
add ebx, eax
mov edx, 0xd7f6337c
sub edx, 0xc7e3877c
add edx, dword [ebp - 0x24]
mov edi, 0xa558b8c9
sub edi, 0x200e379e
xor dword [ebp - 8], 0xd03315c4
mov esi, dword [edx]
sub dword [ebp - 8], 0x6d720a8f
xor esi, edi
mov dword [ebp - 0x10], 0x93c25cdf
mov dword [ebx], esi
sub dword [ebp - 0xc], ecx
add ebx, 0x96473852
sub ebx, 0x9647384e
add edx, 0x3a688e1e
sub edx, 0x3a688e1a
loop 0x1000b3a5
add eax, 0x74dcdaeb
sub eax, 0x74dbb6b8
xor ebx, ebx
add ebx, eax
add eax, 0x7683707a
sub eax, 0x76837075
mov ecx, sym.msoidcliL.dll_Ordinal_9
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x1000d320
Capabilities:
Encrypt data using des via winapi

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 8], ecx
mov ebx, 0xf0000048
mov dword [ebp - 0x18], str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider
mov dword [ebp - 0x14], 0x18
mov dword [ebp - 0x10], 0x100ba8a8
mov dword [ebp - 0xc], 1
mov dword [ebp - 4], edi
xor esi, esi
call fcn.10007370
test al, al
je 0x1000d37b
push dword [ebp + edi*8 - 0x14]
push dword [ebp + edi*8 - 0x18]
push str.Trying_Crypt_provider:__S__provider_type:__d
push str.d:_bt20572clientwlidsspwlidsvccorepassportclientlibrary.cpp_563
push 3
call fcn.1000b340
add esp, 0x14
push ebx
push dword [ebp + edi*8 - 0x14]
lea eax, [ebp - 4]
push dword [ebp + edi*8 - 0x18]
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x1000d460
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
cmp esi, 0x80090009
jne 0x1000d3e6
test bl, 0x40
je 0x1000d3e6
call fcn.10007370
test al, al
je 0x1000d3ca
push str.CryptAcquireContext_failed_with_CRYPT_SILENT_flag___trying_without.
push str.d:_bt20572clientwlidsspwlidsvccorepassportclientlibrary.cpp_583
push 0
call fcn.1000b340
add esp, 0xc
and ebx, 0xffffffbf
push ebx
push dword [ebp + edi*8 - 0x14]
lea eax, [ebp - 4]
push dword [ebp + edi*8 - 0x18]
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x1000d439
mov eax, dword [ebp - 4]
test eax, eax
jne 0x1000d3f7
inc edi
cmp edi, 2
jb 0x1000d354
test esi, esi
je 0x1000d463
call fcn.10007370
test al, al
je 0x1000d419
push esi
push str.Unable_to_acquire_cryptographic_provider__0x_x_.
push str.d:_bt20572clientwlidsspwlidsvccorepassportclientlibrary.cpp_607
push 0
call fcn.1000b340
add esp, 0x10
test esi, esi
jle 0x1000d426
movzx esi, si
or esi, 0x80070000
mov eax, 0x8004886b
test esi, esi
cmovns esi, eax
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.10007370
test al, al
je 0x1000d3fb
push dword [ebp + edi*8 - 0x14]
push dword [ebp + edi*8 - 0x18]
push str.Initialized_Crypt_provider:__S__provider_type:__d
push str.d:_bt20572clientwlidsspwlidsvccorepassportclientlibrary.cpp_593
push 3
call fcn.1000b340
add esp, 0x14
jmp 0x1000d3fb
mov eax, dword [ebp - 4]
test eax, eax
je 0x1000d3fb
mov esi, dword [ebp - 8]
mov dword [esi + 0x1bc], eax
call fcn.10007370
test al, al
je 0x1000d48d
push str.Initializing_random_key.
push str.d:_bt20572clientwlidsspwlidsvccorepassportclientlibrary.cpp_617
push 1
call fcn.1000b340
add esp, 0xc
mov eax, dword [0x1011169c]
mov ecx, dword [eax + 0x1bc]
lea eax, [esi + 0x1b8]
push eax
push 0xc00000
push 0x6603
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptGenKey]
test eax, eax
jne 0x1000d4c0
call fcn.10062d20
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10047e50
Capabilities:
Delete registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a56a9
mov eax, dword fs:[0]
push eax
sub esp, 0x128
mov eax, dword [0x1010df64]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x120], 0
mov dword [ebp - 0x134], 0
mov dword [ebp - 0x130], 0
mov dword [ebp - 0x12c], 0
mov eax, dword [0x1010df30]
mov ecx, 0x1010df30
mov byte [ebp - 4], 1
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x128], esi
lea ecx, [ebp + 8]
mov byte [ebp - 4], 2
mov dword [ebp - 0x124], 0
call fcn.10013bd0
mov ecx, eax
call fcn.10013cd0
mov eax, dword [ebp + 8]
mov edi, dword [eax - 0xc]
test edi, edi
jns 0x10047efa
push 0x80070057
call fcn.1000b340
mov ecx, dword [eax - 8]
mov edx, 1
sub edx, dword [eax - 4]
sub ecx, edi
or ecx, edx
jge 0x10047f17
push edi
lea ecx, [ebp + 8]
call fcn.1000b340
mov eax, dword [ebp + 8]
lea ecx, [edi + 1]
push ecx
push eax
call fcn.1000b340
mov eax, dword [ebp + 8]
add esp, 8
cmp edi, dword [eax - 8]
jg 0x10047ef0
mov dword [eax - 0xc], edi
mov eax, dword [ebp + 8]
xor ecx, ecx
mov word [eax + edi*2], cx
push dword [ebp + 8]
lea eax, [ebp - 0x120]
push str.wstrUserName_s
push str.IDCRL::DeleteUserAllExtendedProperties
push eax
push str.d:_bt20572clientwlidsspwlidsvccorecredentialbag.cpp_40
lea eax, [ebp - 0x11c]
push 2
push eax
call fcn.1000b340
add esp, 0x1c
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 3
cmp dword [eax - 0xc], 0
je 0x10048004
lea eax, [ebp - 0x124]
push eax
push 0x20006
call dword [sym.imp.ADVAPI32.dll_RegOpenCurrentUser]
mov edi, eax
test edi, edi
je 0x10047fa6
jg 0x10047f95
mov dword [ebp - 0x120], edi
jmp 0x1004800a
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0x120], edi
jmp 0x1004800a
push 0x39
push str.SoftwareMicrosoftMSOIdentityCRLUserExtendedProperties_
lea ecx, [ebp - 0x128]
call fcn.1000b340
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x128]
push dword [eax - 0xc]
push eax
call fcn.1000b340
mov esi, dword [ebp - 0x128]
push esi
push dword [ebp - 0x124]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
je 0x10047ff8
cmp eax, 2
je 0x10047ff8
test eax, eax
jle 0x10047ff2
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0x120], eax
push dword [ebp - 0x124]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 0x120]
lea ecx, [ebp - 0x11c]
mov byte [ebp - 4], 2
call fcn.1000b340
lea edx, [esi - 0x10]
or esi, 0xffffffff
mov byte [ebp - 4], 1
lea ecx, [edx + 0xc]
mov eax, esi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x10048039
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ebx, dword [ebp + 8]
add ebx, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea eax, [ebx + 0xc]
lock xadd dword [eax], esi
dec esi
test esi, esi
jg 0x1004805a
mov ecx, dword [ebx]
push ebx
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10001e17
mov esp, ebp
pop ebp
ret 4
Function at 0x1004bac0
Capabilities:
Write file on windows

Disassembly:
call fcn.1000b340
call fcn.1000ddf0
mov ecx, eax
call fcn.1000d310
mov ecx, dword [0x1011169c]
test ecx, ecx
je 0x1004bb06
push esi
call fcn.1000b340
mov esi, dword [0x1011169c]
test esi, esi
je 0x1004bafb
mov ecx, esi
call fcn.1000b340
push esi
call fcn.1000863f
add esp, 4
mov dword [0x1011169c], 0
pop esi
jmp fcn.1004de70