joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405330
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
xor edi, edi
cmp dword [esp + 0x24], 0
je 0x405431
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x405431
push ebx
call fcn.0040d830
add esp, 4
test eax, eax
je 0x40538a
mov ecx, 0x1505
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebx + ebp]
test edx, edx
je 0x405391
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc ebp
mov ecx, esi
cmp eax, ebp
jne 0x405370
jmp 0x405393
mov esi, 0x1505
jmp 0x405393
mov esi, ecx
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov ebx, dword [ecx + 0x20]
lea ebp, [ebx - 1]
mov eax, ebx
sub eax, 1
mov dword [esp + 0xc], eax
jb 0x405431
and ebp, esi
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x4053c4
inc ebp
dec ebx
je 0x40542f
mov eax, ebp
and eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov edi, dword [edx + eax*4]
cmp edi, 0xffffffff
je 0x40542f
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x4053c0
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 4], eax
push eax
call fcn.0040d830
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x4053c0
push dword [esp]
push dword [esp + 8]
push dword [esp + 0x30]
call fcn.0040d850
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x4053c0
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
test eax, eax
je 0x40542f
cmp dword [eax + 4], 5
mov edi, 0
jne 0x405431
mov edi, dword [eax + 8]
jmp 0x405431
xor edi, edi
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4058c0
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4059df
mov ecx, dword [eax + 4]
cmp ecx, 2
je 0x4059d3
cmp ecx, 5
je 0x4059a3
cmp ecx, 4
jne 0x4059df
mov esi, dword [eax + 8]
cmp dword [esi + 0x18], 0
je 0x40592d
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esi + 0xc]
push dword [eax + edi*4]
call dword [0x59f004]
add esp, 4
mov eax, dword [esi + 0x10]
push dword [eax + edi*4]
call fcn.004058c0
add esp, 4
mov eax, edi
and eax, 1
xor edi, 1
lea edi, [edi + eax*2]
cmp edi, dword [esi + 0x18]
jb 0x405900
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
push dword [esi + 4]
call dword [0x59f004]
add esp, 4
push dword [esi + 0xc]
call dword [0x59f004]
add esp, 4
push dword [esi + 0x10]
call dword [0x59f004]
add esp, 4
push dword [esi + 0x14]
call dword [0x59f004]
add esp, 4
push dword [esi + 8]
call dword [0x59f004]
add esp, 4
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
mov dword [esi + 8], 0
mov dword [esi + 4], 0
jmp 0x4059d0
mov esi, dword [eax + 8]
cmp dword [esi + 8], 0
je 0x4059c4
xor edi, edi
nop
nop
mov eax, dword [esi + 4]
push dword [eax + edi*4]
call fcn.004058c0
add esp, 4
inc edi
cmp edi, dword [esi + 8]
jb 0x4059b0
push dword [esi + 4]
call dword [0x59f004]
add esp, 4
push esi
jmp 0x4059d6
push dword [eax + 8]
call dword [0x59f004]
add esp, 4
pop esi
pop edi
jmp dword [0x59f004]
Function at 0x405d10
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, 0xffffffff
cmp dword [esp + 0x24], 0
je 0x405e22
mov esi, dword [esp + 0x28]
test esi, esi
je 0x405e22
cmp dword [esp + 0x2c], 0
je 0x405e22
push esi
call fcn.0040d830
add esp, 4
test eax, eax
je 0x405d7a
mov ecx, 0x1505
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esi + edi]
test edx, edx
je 0x405d81
mov ebx, ecx
shl ebx, 5
add ebx, ecx
add ebx, edx
inc edi
mov ecx, ebx
cmp eax, edi
jne 0x405d60
jmp 0x405d83
mov ebx, 0x1505
jmp 0x405d83
mov ebx, ecx
mov ecx, dword [esp + 0x24]
mov esi, dword [ecx + 0x20]
lea edi, [esi - 1]
mov edx, esi
sub edx, 1
mov dword [esp + 8], edx
jae 0x405e2a
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x405de7
call fcn.00406ad0
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov ecx, dword [esp + 0x28]
jne 0x405e22
push ecx
call fcn.0040d830
add esp, 4
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov esi, dword [ecx + 0x20]
lea edi, [esi - 1]
mov eax, esi
sub eax, 1
mov dword [esp + 8], eax
jae 0x405e9d
mov ebp, 0xffffffff
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 0x18]
mov esi, dword [esp + 0x28]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 0x18]
mov dword [eax + ebp*4], edx
mov eax, dword [ecx + 0x10]
mov esi, dword [esp + 0x2c]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 0x14]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebp
mov eax, dword [ecx + 8]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebx
inc dword [ecx + 0x18]
mov eax, dword [ecx]
mov dword [esi], eax
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp], eax
and edi, ebx
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x405e48
inc edi
dec esi
je 0x405d9c
mov ebp, edi
and ebp, dword [esp + 8]
mov eax, dword [esp + 4]
mov eax, dword [eax + ebp*4]
cmp eax, 0xffffffff
je 0x405da1
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebx
jne 0x405e40
mov ecx, dword [ecx + 0xc]
mov ebp, dword [ecx + eax*4]
push ebp
call fcn.0040d830
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x405e40
push dword [esp]
push ebp
push dword [esp + 0x30]
call fcn.0040d850
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x405e40
mov eax, 0xffffffff
jmp 0x405e22
and edi, ebx
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x405eb8
inc edi
dec esi
je 0x405de2
mov ebp, edi
and ebp, dword [esp + 8]
mov eax, dword [esp + 4]
mov eax, dword [eax + ebp*4]
cmp eax, 0xffffffff
je 0x405de7
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebx
jne 0x405eb0
mov ecx, dword [ecx + 0xc]
mov eax, dword [ecx + eax*4]
mov dword [esp + 0xc], eax
push eax
call fcn.0040d830
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x405eb0
push dword [esp]
push dword [esp + 0x10]
push dword [esp + 0x30]
call fcn.0040d850
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x405eb0
jmp 0x405de7
Function at 0x406820
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, 0xffffffff
cmp dword [esp + 0x28], 0
je 0x406a0a
mov esi, dword [esp + 0x2c]
test esi, esi
je 0x406a0a
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x406a0a
cmp dword [ecx], 0
jne 0x406a0a
push esi
call fcn.0040d830
add esp, 4
test eax, eax
je 0x40688a
mov ecx, 0x1505
xor ebx, ebx
nop
nop
nop
nop
movzx edx, byte [esi + ebx]
test edx, edx
je 0x406891
mov edi, ecx
shl edi, 5
add edi, ecx
add edi, edx
inc ebx
mov ecx, edi
cmp eax, ebx
jne 0x406870
jmp 0x406893
mov edi, 0x1505
jmp 0x406893
mov edi, ecx
mov ecx, dword [esp + 0x28]
mov edx, dword [ecx + 0x20]
lea ebx, [edx - 1]
mov esi, edx
sub esi, 1
mov dword [esp + 0xc], esi
jae 0x406964
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x4068f1
call fcn.00406ad0
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov esi, dword [esp + 0x2c]
jne 0x406a0a
push esi
call fcn.0040d830
add esp, 4
mov edx, esi
lea esi, [esp + 0x10]
mov ecx, dword [esp + 0x28]
push esi
push edi
push eax
call fcn.00406a20
add esp, 0xc
mov ebp, eax
mov esi, dword [esp + 0x2c]
push esi
call fcn.0040d830
add esp, 4
mov ebx, eax
inc eax
push eax
call dword [0x59f008]
add esp, 4
test eax, eax
je 0x406a05
mov byte [eax + ebx], 0
push ebx
push esi
push eax
mov esi, eax
call fcn.0040d730
add esp, 0xc
mov edx, dword [esp + 0x28]
mov eax, dword [edx + 0xc]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 4]
mov ecx, dword [edx + 0x18]
mov dword [eax + ebp*4], ecx
mov eax, dword [edx + 0x10]
mov esi, dword [esp + 0x30]
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 0x14]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], ebp
mov eax, dword [edx + 8]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], edi
inc dword [edx + 0x18]
mov eax, dword [edx]
mov dword [esi], eax
xor eax, eax
jmp 0x406a0a
mov dword [esp], eax
and ebx, edi
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x406988
inc ebx
dec edx
je 0x4068ac
mov ebp, ebx
and ebp, dword [esp + 0xc]
mov eax, dword [esp + 8]
mov esi, dword [eax + ebp*4]
cmp esi, 0xffffffff
je 0x4068b1
mov eax, dword [ecx + 8]
cmp dword [eax + esi*4], edi
jne 0x406980
mov eax, dword [ecx + 0xc]
mov ebp, dword [eax + esi*4]
push ebp
mov dword [esp + 8], edx
call fcn.0040d830
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0x2c]
add esp, 4
cmp eax, dword [esp]
jne 0x406980
push dword [esp]
push ebp
push dword [esp + 0x34]
call fcn.0040d850
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x34]
add esp, 0xc
test eax, eax
jne 0x406980
mov eax, dword [ecx + 0x10]
push dword [eax + esi*4]
call fcn.004058c0
mov edx, dword [esp + 0x2c]
add esp, 4
mov eax, dword [edx + 0x10]
mov ecx, dword [esp + 0x30]
mov dword [eax + esi*4], ecx
mov esi, ecx
jmp 0x406959
mov eax, 0xffffffff
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x440560
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov ebp, dword [esp + 0x2c]
mov esi, dword [esp + 0x28]
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + ebx], 0
lea ebx, [ebx + 2]
jne 0x440580
mov dword [esp + 8], 0x8e8e881f
mov dword [esp + 0xc], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 7
ja 0x4405d6
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 8]
push dword [esp]
push eax
call fcn.00444540
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 8
jb 0x4405b0
cmp ebx, 2
je 0x4405fc
lea eax, [ebx - 2]
mov edx, eax
sar edx, 1
mov edi, dword [esp + 8]
mov ecx, edi
not ecx
test al, 2
mov dword [esp + 0x10], ecx
jne 0x440603
cmp ebx, 4
jne 0x440637
jmp 0x440690
mov eax, ebp
jmp 0x440690
dec edx
movzx eax, word [esi]
xor eax, ebp
mov ebp, eax
or ebp, edi
mov dword [esp + 4], ebp
mov ebp, eax
and ebp, edi
imul ebp, dword [esp + 4]
mov dword [esp + 4], ebp
mov ebp, eax
not ebp
and ebp, edi
and eax, ecx
imul eax, ebp
add eax, dword [esp + 4]
add esi, 2
mov ebp, eax
cmp ebx, 4
je 0x440690
xor ebx, ebx
mov eax, ebp
mov dword [esp + 4], edx
nop
movzx ebp, word [esi + ebx*2]
xor ebp, eax
mov eax, ebp
or eax, edi
mov ecx, ebp
and ecx, edi
imul ecx, eax
mov eax, ebp
not eax
and eax, edi
mov edx, esi
mov esi, dword [esp + 0x10]
and ebp, esi
imul ebp, eax
add ebp, ecx
movzx eax, word [edx + ebx*2 + 2]
xor eax, ebp
mov ecx, eax
or ecx, edi
mov ebp, eax
and ebp, edi
imul ebp, ecx
mov ecx, eax
not ecx
and ecx, edi
and eax, esi
mov esi, edx
imul eax, ecx
mov edx, dword [esp + 4]
add eax, ebp
add ebx, 2
cmp edx, ebx
jne 0x440640
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x404de0
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 8], 0
jne 0x404e04
lea eax, [esi + 0xc]
push eax
push 0
push esi
push 0x404ee0
push 0
push 0
call fcn.004a6cb5
add esp, 0x18
mov dword [esi + 8], eax
pop esi
ret
Function at 0x407320
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f9c03
mov eax, dword fs:[0]
push eax
sub esp, 0x108
mov eax, dword [0x53f300]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, dword [ecx + 8]
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x30], ecx
mov dword [ebp - 4], 0
test esi, esi
je 0x407401
test edi, edi
je 0x407427
mov edx, dword [ebp + 0x10]
test edx, 0xf
jne 0x40744d
lea eax, [edx - 0x10]
cmp dword [ebp + 0xc], eax
jbe 0x407473
cmp byte [ecx + 0x10], 0
je 0x407499
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], edx
push eax
push edi
push 0
push 1
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
mov ecx, eax
test ecx, ecx
je 0x4074bf
jmp 0x4073d9
mov eax, dword [ebp - 0x34]
mov dword [ebx], eax
test ecx, ecx
setne al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0045992a
mov esp, ebp
pop ebp
ret 0x10
push 0x80090003
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str.Decrypt_1_:_Key_is_not_valid
lea ecx, [ebp - 0x40]
call fcn.00405b00
push 0x52db58
lea eax, [ebp - 0x40]
push eax
call fcn.0049c654
push 0x6f8
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str.Decrypt_1_:_Buffer_is_NULL
lea ecx, [ebp - 0x4c]
call fcn.00405b00
push 0x52db58
lea eax, [ebp - 0x4c]
push eax
call fcn.0049c654
push 0x80090005
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str.Decrypt_1_:_Data_size_is_not_a_multple_of_block_size
lea ecx, [ebp - 0x58]
call fcn.00405b00
push 0x52db58
lea eax, [ebp - 0x58]
push eax
call fcn.0049c654
push 0x80090028
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str.Decrypt_1_:_Buffer_is_too_small
lea ecx, [ebp - 0x64]
call fcn.00405b00
push 0x52db58
lea eax, [ebp - 0x64]
push eax
call fcn.0049c654
push 0x80090027
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str.Decrypt_1_:_IV_has_not_been_set
lea ecx, [ebp - 0x70]
call fcn.00405b00
push 0x52db58
lea eax, [ebp - 0x70]
push eax
call fcn.0049c654
push 1
push 2
lea ecx, [ebp - 0x114]
call fcn.004056b0
lea eax, [ebp - 0x114]
mov byte [ebp - 4], 1
push str.Decrypt_1_:_CryptDecrypt_failed__
push eax
call fcn.00404f20
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
add esp, 8
call esi
push eax
call fcn.00407e00
push eax
lea eax, [ebp - 0x114]
push eax
call fcn.00404f20
add esp, 0xc
lea eax, [ebp - 0x114]
push str.__0x
push eax
call fcn.00404f20
add esp, 8
mov ecx, eax
push 0x40a600
call fcn.00406ba0
mov edi, eax
call esi
push eax
mov ecx, edi
call fcn.00406900
push 0x50aa94
push eax
call fcn.00404f20
add esp, 8
mov dword [ebx], 0
lea eax, [ebp - 0x2c]
lea ecx, [ebp - 0x114]
push eax
call fcn.0040ac40
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.00409ad0
push eax
lea ecx, [ebp - 0x7c]
call fcn.00405b00
push 0x52db58
lea eax, [ebp - 0x7c]
push eax
call fcn.0049c654
push 0
push 0
call fcn.0049c654
int3
Function at 0x4078a0
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f9c83
mov eax, dword fs:[0]
push eax
sub esp, 0xfc
mov eax, dword [0x53f300]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edx, dword [ecx + 8]
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0x30], ecx
mov dword [ebp - 4], 0
test edx, edx
je 0x40797d
test esi, esi
je 0x4079a3
mov ebx, dword [ebp + 0x10]
mov eax, ebx
and eax, 0xfffffff0
add eax, 0x10
cmp dword [ebp + 0xc], eax
jb 0x4079c9
cmp byte [ecx + 0x10], 0
je 0x4079ef
push dword [ebp + 0xc]
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], ebx
push eax
push esi
push 0
push 1
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov ecx, eax
test ecx, ecx
je 0x407a15
jmp 0x407955
mov eax, dword [ebp - 0x34]
mov dword [edi], eax
test ecx, ecx
setne al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0045992a
mov esp, ebp
pop ebp
ret 0x10
push 0x80090003
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str.Encrypt_1_:_Key_is_not_valid
lea ecx, [ebp - 0x40]
call fcn.00405b00
push 0x52db58
lea eax, [ebp - 0x40]
push eax
call fcn.0049c654
push 0x6f8
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str.Encrypt_1_:_Buffer_is_NULL
lea ecx, [ebp - 0x4c]
call fcn.00405b00
push 0x52db58
lea eax, [ebp - 0x4c]
push eax
call fcn.0049c654
push 0x80090028
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str.Encrypt_1_:_Buffer_is_too_small
lea ecx, [ebp - 0x58]
call fcn.00405b00
push 0x52db58
lea eax, [ebp - 0x58]
push eax
call fcn.0049c654
push 0x80090027
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str.Encrypt_1_:_IV_has_not_been_set
lea ecx, [ebp - 0x64]
call fcn.00405b00
push 0x52db58
lea eax, [ebp - 0x64]
push eax
call fcn.0049c654
push 1
push 2
lea ecx, [ebp - 0x108]
call fcn.004056b0
lea eax, [ebp - 0x108]
mov byte [ebp - 4], 1
push str.Encrypt_1_:_CryptEncrypt_failed__
push eax
call fcn.00404f20
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
add esp, 8
call esi
push eax
call fcn.00407e00
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.00404f20
add esp, 0xc
lea eax, [ebp - 0x108]
push str.__0x
push eax
call fcn.00404f20
add esp, 8
mov ecx, eax
push 0x40a600
call fcn.00406ba0
mov ebx, eax
call esi
push eax
mov ecx, ebx
call fcn.00406900
push 0x50aa94
push eax
call fcn.00404f20
add esp, 8
mov dword [edi], 0
lea eax, [ebp - 0x2c]
lea ecx, [ebp - 0x108]
push eax
call fcn.0040ac40
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.00409ad0
push eax
lea ecx, [ebp - 0x70]
call fcn.00405b00
push 0x52db58
lea eax, [ebp - 0x70]
push eax
call fcn.0049c654
push 0
push 0
call fcn.0049c654
int3
Function at 0x408210
Capabilities:
Encrypt data using aes via winapi

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f9d18
mov eax, dword fs:[0]
push eax
sub esp, 0x94
mov eax, dword [0x53f300]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov eax, dword [edi + 8]
lea ebx, [edi + 8]
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x48], ecx
test eax, eax
je 0x40826a
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov ecx, dword [ebp - 0x48]
mov dword [ebx], 0
mov byte [edi + 0x10], 0
cmp dword [edi + 4], 0
mov dword [ebp - 4], 0
je 0x408399
test ecx, ecx
je 0x4083b4
mov esi, dword [ebp + 0xc]
cmp esi, 0x10
je 0x408299
cmp esi, 0x18
je 0x408299
cmp esi, 0x20
jne 0x4083cf
push 0x2c
lea eax, [ebp - 0x40]
push 0
push eax
call fcn.0049bb00
add esp, 0xc
mov dword [ebp - 0x40], 0x208
mov byte [ebp - 4], 1
cmp esi, 0x10
je 0x4082e0
cmp esi, 0x18
je 0x4082d2
cmp esi, 0x20
jne 0x4083ea
mov dword [ebp - 0x3c], 0x6610
mov eax, esi
jmp 0x4082ec
mov dword [ebp - 0x3c], 0x660f
mov eax, 0x18
jmp 0x4082ec
mov dword [ebp - 0x3c], 0x660e
mov eax, 0x10
push esi
push dword [ebp - 0x48]
mov dword [ebp - 0x38], eax
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.0040af60
add esp, 0x10
test eax, eax
jne 0x408405
push ebx
push 0
push 0
lea eax, [esi + 0xc]
push eax
lea eax, [ebp - 0x40]
push eax
push dword [edi + 4]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
je 0x408426
push 0
lea eax, [ebp - 0x48]
mov dword [ebp - 0x48], 1
push eax
push 4
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
test eax, eax
je 0x408447
jmp 0x408363
mov al, 1
lea ecx, [ebp - 0x40]
mov edx, 4
nop dword [eax]
mov byte [ecx], 0
lea ecx, [ecx + 1]
sub edx, 1
jne 0x408370
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0045992a
mov esp, ebp
pop ebp
ret 8
push str.SetKey:_Provider_is_not_valid
lea ecx, [ebp - 0x58]
call fcn.00405b00
push 0x52db58
lea eax, [ebp - 0x58]
push eax
call fcn.0049c654
push str.SetKey:_Key_buffer_is_NULL
lea ecx, [ebp - 0x64]
call fcn.00405b00
push 0x52db58
lea eax, [ebp - 0x64]
push eax
call fcn.0049c654
push str.SetKey:_Key_size_is_not_valid
lea ecx, [ebp - 0x70]
call fcn.00405b00
push 0x52db58
lea eax, [ebp - 0x70]
push eax
call fcn.0049c654
push str.SetKey:_Key_size_is_not_valid
lea ecx, [ebp - 0x7c]
call fcn.00405b00
push 0x52db58
lea eax, [ebp - 0x7c]
push eax
call fcn.0049c654
push str.SetKey:_Unable_to_copy_key
lea ecx, [ebp - 0x88]
call fcn.00405b00
push 0x52db58
lea eax, [ebp - 0x88]
push eax
call fcn.0049c654
push str.SetKey:_Import_key_failed
lea ecx, [ebp - 0x94]
call fcn.00405b00
push 0x52db58
lea eax, [ebp - 0x94]
push eax
call fcn.0049c654
push str.SetKey:_Set_CBC_mode_failed
lea ecx, [ebp - 0xa0]
call fcn.00405b00
push 0x52db58
lea eax, [ebp - 0xa0]
push eax
call fcn.0049c654
push 0
push 0
call fcn.0049c654
int3
Function at 0x40c520
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x52dc60
push 0x49c120
mov eax, dword fs:[0]
push eax
sub esp, 0x848
mov eax, dword [0x53f300]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 0x1c]
mov dword [ebp - 4], 0
test esi, esi
je 0x40c694
cmp word [esi], 0
je 0x40c694
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40c580
sub ecx, edx
sar ecx, 1
cmp ecx, 0x104
ja 0x40c694
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40c694
push 0x800
push 0
lea eax, [ebp - 0x81c]
push eax
call fcn.0049bb00
push esi
push 0x50c4a0
push 0x3ff
lea eax, [ebp - 0x81c]
push eax
call fcn.0040c7f0
push 0x3c
push 0
lea eax, [ebp - 0x858]
push eax
call fcn.0049bb00
add esp, 0x28
mov dword [ebp - 0x858], 0x3c
lea eax, [ebp - 0x81c]
mov dword [ebp - 0x848], eax
mov dword [ebp - 0x84c], 0x50c4ac
mov dword [ebp - 0x844], ebx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x83c], eax
mov dword [ebp - 0x854], 0x440
cmp dword [ebp + 0x14], 0
je 0x40c633
push esi
call fcn.004543f0
add esp, 4
test eax, eax
je 0x40c694
lea eax, [ebp - 0x858]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov esi, eax
test esi, esi
je 0x40c65b
cmp dword [ebp + 0x18], 0
je 0x40c65b
push dword [ebp + 0x20]
push dword [ebp - 0x820]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test edi, edi
je 0x40c670
test esi, esi
je 0x40c680
push edi
push dword [ebp - 0x820]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test esi, esi
je 0x40c680
push dword [ebp - 0x820]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x40c69d
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0045992a
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x40cb10
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40cb69
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x40cb69
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x40cb5a
cmp esi, edx
jae 0x40cb69
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x40cb48
cmp esi, edx
jae 0x40cb69
cmp word [esi], 0
je 0x40cb69
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret