joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412b00
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push ecx
push esi
push edi
call fcn.0041c9c0
cmp eax, 6
mov esi, str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider
jge 0x412b17
mov esi, str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider__Prototype_
mov edi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
push 0
push 0x18
push esi
push str.SEContainer
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], 0
call edi
test eax, eax
jne 0x412b63
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_GetLastError]
call ebx
push 8
push 0x18
push esi
push str.SEContainer
lea ecx, [esp + 0x1c]
push ecx
call edi
test eax, eax
jne 0x412b5a
call ebx
mov eax, dword [esp + 0xc]
pop ebx
pop edi
pop esi
pop ecx
ret
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret

Function at 0x412b70
Capabilities:
Encrypt data using aes via winapi

Disassembly:
sub esp, 0x3c
mov eax, dword [0x449250]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push esi
mov esi, ecx
push edi
mov ebx, edx
test esi, esi
jne 0x412b8e
mov esi, str.vc8v7vghw7v278vn2v8239vh29vh890m
test ebx, ebx
jne 0x412b97
mov ebx, str.aqkeezgxijvlm2op
xor eax, eax
mov ecx, 8
mov byte [esp + 0x18], cl
mov word [esp + 0x1a], ax
mov byte [esp + 0x19], 2
mov dword [esp + 0x1c], 0x6610
mov dword [esp + 0x20], 0x20
lea edi, [esp + 0x24]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0xc]
push ecx
push eax
push eax
mov eax, dword [esp + 0x58]
push 0x2c
lea edx, [esp + 0x28]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
mov eax, dword [esp + 0xc]
test eax, eax
je 0x412c21
mov esi, dword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
push 0
lea ecx, [esp + 0x14]
push ecx
push 4
mov edi, 1
push eax
mov dword [esp + 0x20], edi
call esi
mov eax, dword [esp + 0xc]
push 0
lea edx, [esp + 0x18]
push edx
push 3
push eax
mov dword [esp + 0x24], edi
call esi
mov ecx, dword [esp + 0xc]
push 0
push ebx
push edi
push ecx
call esi
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x44]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004223b0
add esp, 0x3c
ret
Function at 0x412c40
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
cmp dword [esp + 4], 0
je 0x412cf1
cmp dword [esp + 8], 0xffffffff
je 0x412cf1
push ebp
push esi
xor esi, esi
call fcn.00412b00
mov ebp, eax
test ebp, ebp
je 0x412cec
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
push ebx
push ebp
call fcn.00412b70
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x412ce2
mov eax, dword [esp + 0x14]
push edi
test al, 0xf
je 0x412c95
shr eax, 4
inc eax
shl eax, 4
mov edi, eax
jmp 0x412c98
lea edi, [eax + 0x10]
push edi
call fcn.0042239a
push edi
mov esi, eax
push 0
push esi
call fcn.00429980
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
push eax
push ecx
push esi
call fcn.00429cf0
add esp, 0x1c
push edi
lea edx, [esp + 0x1c]
push edx
push esi
push 0
push 1
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
push ebx
mov dword [ecx], eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
pop edi
push 0
push ebp
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop ebx
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
ret

Function at 0x412d00
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
cmp dword [esp + 4], 0
je 0x412db3
cmp dword [esp + 8], 0xffffffff
je 0x412db3
push ebp
push esi
push edi
xor esi, esi
call fcn.00412b00
mov ebp, eax
test ebp, ebp
je 0x412dad
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
push ebp
call fcn.00412b70
mov edi, eax
add esp, 4
test edi, edi
je 0x412da4
mov eax, dword [esp + 0x14]
push ebx
push eax
mov ebx, eax
call fcn.0042239a
push ebx
mov esi, eax
push 0
push esi
call fcn.00429980
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
push eax
push ecx
push esi
call fcn.00429cf0
add esp, 0x1c
lea edx, [esp + 0x18]
push edx
push esi
push 0
push 1
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
pop ebx
test eax, eax
jne 0x412d93
push esi
call fcn.00422fdb
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebp
ret
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
push edi
mov dword [ecx], eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push 0
push ebp
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop edi
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
ret
Function at 0x417160
Capabilities:
Encrypt or decrypt via wincrypt
Reference public rsa key

Disassembly:
sub esp, 0xc
push ebx
mov ebx, eax
push ebp
mov ebp, dword [esp + 0x20]
test ebx, ebx
je 0x4172fb
cmp dword [esp + 0x18], 0xffffffff
je 0x4172fb
push esi
push edi
xor esi, esi
call fcn.00412b00
mov edi, eax
mov dword [esp + 0x18], edi
test edi, edi
je 0x4172ea
lea eax, [esp + 0x10]
push eax
push esi
push esi
push 0x94
push 0x4400e8
push edi
mov dword [esp + 0x28], esi
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
je 0x4172d0
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
push ecx
lea edx, [esp + 0x18]
push edx
push esi
push esi
push 1
push esi
push eax
mov dword [esp + 0x30], esi
call edi
test eax, eax
je 0x4172a7
mov ecx, dword [esp + 0x14]
push ecx
call fcn.0042239a
mov edx, dword [esp + 0x24]
push edx
mov esi, eax
push ebx
push esi
call fcn.00429cf0
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
add esp, 0x10
push eax
lea ecx, [esp + 0x24]
push ecx
push esi
push 0
push 1
push 0
push edx
call edi
test eax, eax
je 0x417274
mov edi, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
mov dword [eax], edi
xor eax, eax
test edi, 0xfffffffe
jbe 0x4172ae
mov ecx, esi
mov bl, byte [ecx + edi - 1]
mov dl, byte [eax + esi]
mov byte [eax + esi], bl
mov edi, dword [esp + 0x20]
mov byte [ecx + edi - 1], dl
mov edi, dword [esp + 0x20]
mov edx, edi
inc eax
shr edx, 1
dec ecx
cmp eax, edx
jb 0x417232
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov edi, dword [esp + 0x18]
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
push esi
mov dword [ebp], 0xfffffff5
call fcn.00422fdb
mov eax, dword [esp + 0x14]
add esp, 4
push eax
xor esi, esi
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov edi, dword [esp + 0x18]
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov dword [ebp], 0xfffffff4
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov edi, dword [esp + 0x18]
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
push 0
push edi
mov dword [ebp], 0xfffffff3
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
pop edi
mov eax, esi
pop esi
mov dword [ebp], 0xfffffff2
pop ebp
pop ebx
add esp, 0xc
ret
mov dword [ebp], 0xfffffff6
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
Function at 0x417310
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push esi
mov esi, ecx
push edi
mov edi, eax
test esi, esi
je 0x417452
test ebp, ebp
je 0x417452
cmp dword [esp + 0x14], 0
je 0x417452
lea ecx, [edi + 2]
test ecx, ecx
jl 0x417452
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 0x40000000
jge 0x417452
cmp edi, 2
mov ecx, ebp
jle 0x4173df
lea edx, [edi - 3]
mov eax, 0xaaaaaaab
mul edx
shr edx, 1
inc edx
lea eax, [edx*4]
sub eax, edx
neg eax
add edi, eax
push ebx
movzx eax, byte [esi]
shr eax, 2
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
movzx eax, byte [esi]
movzx ebx, byte [esi + 1]
and eax, 3
shl eax, 4
shr ebx, 4
movzx eax, byte [eax + ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 1], al
movzx eax, byte [esi + 1]
movzx ebx, byte [esi + 2]
inc ecx
and eax, 0xf
shr ebx, 6
movzx eax, byte [ebx + eax*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
mov byte [ecx], al
movzx eax, byte [esi + 2]
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
mov byte [ecx], al
inc ecx
add esi, 3
sub edx, 1
jne 0x417380
pop ebx
test edi, edi
je 0x41743f
movzx edx, byte [esi]
shr edx, 2
mov al, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
inc ecx
cmp edi, 1
jle 0x417425
movzx edx, byte [esi]
movzx eax, byte [esi + 1]
and edx, 3
shl edx, 4
shr eax, 4
movzx edx, byte [edx + eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], dl
movzx eax, byte [esi + 1]
inc ecx
and eax, 0xf
movzx edx, byte [eax*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], dl
jmp 0x41743a
movzx eax, byte [esi]
and eax, 3
shl eax, 4
mov dl, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], dl
inc ecx
mov byte [ecx], 0x3d
inc ecx
mov byte [ecx], 0x3d
inc ecx
mov edx, dword [esp + 0x14]
mov eax, ecx
sub eax, ebp
pop edi
pop esi
mov dword [edx], eax
mov byte [ecx], 0
xor eax, eax
pop ebp
ret
pop edi
pop esi
or eax, 0xffffffff
pop ebp
ret

Function at 0x41a7a0
Capabilities:
Get thread local storage value

Disassembly:
cmp dword [0x44b760], 0
je 0x41a7f5
mov eax, dword [0x44b768]
push eax
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
test eax, eax
je 0x41a7f5
cmp dword [eax], 0xd
jbe 0x41a7f5
mov ecx, dword [eax + 8]
mov eax, dword [ecx + 0x34]
test eax, eax
je 0x41a7f5
push 0
push 0x44c02c
push 0x44c00c
push 0
push eax
call fcn.00435d5a
add esp, 0x14
test eax, eax
je 0x41a7f5
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 8]
call eax
mov ecx, dword [esp + 4]
mov dword [ecx], eax
mov al, 1
ret
xor al, al
ret
Function at 0x41a800
Capabilities:
Get thread local storage value

Disassembly:
cmp dword [0x44b760], 0
push esi
push edi
mov esi, eax
je 0x41a849
mov eax, dword [0x44b768]
mov edi, dword [sym.imp.KERNEL32.DLL_TlsGetValue]
push eax
call edi
test eax, eax
je 0x41a849
cmp dword [eax], 0xd
jbe 0x41a849
mov ecx, dword [eax + 8]
mov ecx, dword [ecx + 0x34]
test ecx, ecx
jne 0x41a876
push 8
call fcn.00423d6c
add esp, 4
test eax, eax
je 0x41a84e
mov dword [eax + 4], esi
mov dword [eax], vtable.t_visualDataItemPtr_class_t_perfManager_.0
mov esi, eax
jmp 0x41a850
pop edi
xor al, al
pop esi
ret
xor esi, esi
cmp dword [0x44b760], 0
je 0x41a87e
mov edx, dword [0x44b768]
push edx
call edi
test eax, eax
je 0x41a87e
cmp dword [eax], 0xd
jbe 0x41a87e
mov eax, dword [eax + 8]
mov dword [eax + 0x34], esi
pop edi
mov al, 1
pop esi
ret
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
push esi
call eax
pop edi
mov al, 1
pop esi
ret

Function at 0x41a9e0
Capabilities:
Hash data with md5
Read file on windows

Disassembly:
sub esp, 0x478
mov eax, dword [0x449250]
xor eax, esp
mov dword [esp + 0x474], eax
mov eax, dword [esp + 0x47c]
push esi
push edi
push 0x441d20
push eax
lea eax, [esp + 0x14]
push eax
mov edi, ecx
mov dword [esp + 0x18], 0
call fcn.00422485
mov eax, dword [esp + 0x18]
add esp, 0xc
test eax, eax
jne 0x41aa3b
xor al, al
pop edi
pop esi
mov ecx, dword [esp + 0x474]
xor ecx, esp
call fcn.004223b0
add esp, 0x478
ret
push eax
push 0x400
lea ecx, [esp + 0x80]
push 1
push ecx
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x28], 0x67452301
mov dword [esp + 0x2c], 0xefcdab89
mov dword [esp + 0x30], 0x98badcfe
mov dword [esp + 0x34], 0x10325476
call fcn.00426d5e
add esp, 0x10
test eax, eax
je 0x41aab5
lea edx, [esp + 0x78]
push edx
lea esi, [esp + 0x14]
call fcn.00420670
mov eax, dword [esp + 0x10]
push eax
push 0x400
lea ecx, [esp + 0x84]
push 1
push ecx
call fcn.00426d5e
add esp, 0x14
test eax, eax
jne 0x41aa87
lea eax, [esp + 0x10]
call fcn.00420780
mov edx, dword [esp + 0xc]
push edx
call fcn.00423c84
mov ecx, dword [esp + 0x480]
add esp, 4
pop edi
pop esi
xor ecx, esp
mov al, 1
call fcn.004223b0
add esp, 0x478
ret
Function at 0x41bd10
Capabilities:
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x4373ab
mov eax, dword fs:[0]
push eax
sub esp, 0x364
mov eax, dword [0x449250]
xor eax, esp
mov dword [esp + 0x35c], eax
push ebp
push esi
push edi
mov eax, dword [0x449250]
xor eax, esp
push eax
lea eax, [esp + 0x374]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x384]
lea esi, [esp + 0x14]
mov edi, ecx
call fcn.0040ea50
mov dword [esp + 0x14], vtable.t_fileWrite.0
mov dword [esp + method.t_fileWrite.1.virtual_0], vtable.t_fileWrite.1.0
xor esi, esi
mov dword [esp + 0x37c], esi
cmp byte [edi + 0x11c], 0
lea eax, [edi + 0xc]
jne 0x41bd87
mov eax, dword [edi + 8]
push 0x80
add eax, 4
push eax
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
push 1
push ebx
lea eax, [esp + 0x1c]
push eax
mov eax, edi
call fcn.0040eba0
test al, al
jne 0x41bdd4
mov dword [esp + 0x37c], 0xffffffff
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], vtable.t_fileWrite.0
mov dword [esp + method.t_byteStreamWrite.virtual_0], vtable.t_byteStreamWrite.0
call fcn.0040ead0
xor al, al
jmp 0x41be4a
push 2
push 0x44349c
push ebx
lea ecx, [esp + 0x374]
call fcn.0041c790
test al, al
je 0x41bda9
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 4]
push ecx
push edx
push ebx
lea ecx, [esp + 0x374]
call fcn.0041c790
test al, al
je 0x41bda9
lea edi, [esp + 0x14]
call fcn.0040edd0
mov eax, dword [ebp + 4]
push eax
call fcn.004229f3
mov dword [esp + 0x380], 0xffffffff
add esp, 4
mov ecx, edi
mov dword [ebp + 4], esi
mov dword [ebp + 8], esi
mov dword [ebp + 0xc], esi
mov dword [esp + 0x14], vtable.t_fileWrite.0
mov dword [esp + method.t_byteStreamWrite.virtual_0], vtable.t_byteStreamWrite.0
call fcn.0040ead0
mov al, 1
mov ecx, dword [esp + 0x374]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x35c]
xor ecx, esp
call fcn.004223b0
add esp, 0x370
ret 4
Function at 0x41c750
Capabilities:
Set file attributes

Disassembly:
push ecx
cmp byte [esi + 0x11c], 0
lea eax, [esi + 0xc]
jne 0x41c760
mov eax, dword [esi + 8]
push 0x80
add eax, 4
push eax
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
push 1
push eax
push ecx
mov eax, esi
call fcn.0040eba0
test al, al
setne al
pop ecx
ret 8

Function at 0x41c8e0
Capabilities:
Get file size

Disassembly:
push ecx
push esi
push 0
push eax
mov eax, dword [esp + 0x14]
push edi
call fcn.0040eba0
test al, al
jne 0x41c8f8
pop esi
pop ecx
ret 4
mov edx, dword [edi + 4]
lea ecx, [esp + 0xc]
push ecx
push edx
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x41c922
call dword [sym.imp.KERNEL32.DLL_GetLastError]
test eax, eax
je 0x41c922
xor esi, esi
mov dword [edi + 0x358], esi
mov al, 1
pop esi
pop ecx
ret 4
Function at 0x41c9c0
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x449250]
xor eax, esp
mov dword [esp + 0x114], eax
mov eax, dword [0x44c0fc]
cmp eax, 0xffffffff
jne 0x41cc21
push 0x110
lea eax, [esp + 8]
push 0
push eax
mov dword [0x44c0fc], 0xfffffc18
mov dword [esp + 0xc], 0x114
call fcn.00429980
add esp, 0xc
lea ecx, [esp]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetVersionExW]
test eax, eax
je 0x41cc1c
cmp dword [esp + 0x10], 2
jne 0x41cc1c
mov eax, dword [esp + 4]
cmp eax, 5
jne 0x41cb30
mov eax, dword [esp + 8]
test eax, eax
jne 0x41ca59
mov eax, 1
mov dword [0x44c0fc], eax
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.004223b0
add esp, 0x118
ret
cmp eax, 1
jne 0x41cb08
push 0x7f
lea edx, [esp + 0x18]
push edx
push 0x443f0c
call fcn.0042413e
add esp, 0xc
test eax, eax
jne 0x41ca99
mov eax, 3
mov dword [0x44c0fc], eax
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.004223b0
add esp, 0x118
ret
push 0x7f
lea eax, [esp + 0x18]
push eax
push str.Service_Pack_2
call fcn.0042413e
add esp, 0xc
test eax, eax
jne 0x41cad0
mov eax, 4
mov dword [0x44c0fc], eax
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.004223b0
add esp, 0x118
ret
push 0x7f
lea ecx, [esp + 0x18]
push ecx
push str.Service_Pack_3
call fcn.0042413e
add esp, 0xc
neg eax
sbb eax, eax
and eax, 0xfffffffd
add eax, 5
mov dword [0x44c0fc], eax
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.004223b0
add esp, 0x118
ret
cmp eax, 2
jne 0x41cc1c
mov eax, 6
mov dword [0x44c0fc], eax
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.004223b0
add esp, 0x118
ret
cmp eax, 6
jne 0x41cbfd
mov eax, dword [esp + 8]
sub eax, 0
je 0x41cb8e
sub eax, 1
je 0x41cb6f
sub eax, 1
jne 0x41cc1c
mov eax, 0xb
mov dword [0x44c0fc], eax
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.004223b0
add esp, 0x118
ret
mov eax, 0xa
mov dword [0x44c0fc], eax
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.004223b0
add esp, 0x118
ret
push 0x7f
lea edx, [esp + 0x18]
push edx
push 0x443f0c
call fcn.0042413e
add esp, 0xc
test eax, eax
jne 0x41cbc5
mov eax, 8
mov dword [0x44c0fc], eax
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.004223b0
add esp, 0x118
ret
push 0x7f
lea eax, [esp + 0x18]
push eax
push str.Service_Pack_2
call fcn.0042413e
add esp, 0xc
neg eax
sbb eax, eax
and eax, 0xfffffffe
add eax, 9
mov dword [0x44c0fc], eax
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.004223b0
add esp, 0x118
ret
mov eax, 0x3e8
mov dword [0x44c0fc], eax
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.004223b0
add esp, 0x118
ret
mov eax, dword [0x44c0fc]
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.004223b0
add esp, 0x118
ret
Function at 0x41cc40
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test ecx, ecx
jne 0x41cc47
xor eax, eax
ret
or eax, 0xffffffff
push esi
cmp edx, 8
jb 0x41cd24
mov esi, edx
shr esi, 3
push edi
lea ebx, [ebx]
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x43c4d8]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0x43c4d8]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0x43c4d8]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x43c4d8]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x43c4d8]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x43c4d8]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x43c4d8]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x43c4d8]
inc ecx
sub edx, 8
sub esi, 1
jne 0x41cc60
pop edi
test edx, edx
je 0x41cd4b
jmp 0x41cd30
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x43c4d8]
inc ecx
sub edx, 1
jne 0x41cd30
not eax
pop esi
ret

Function at 0x41dc10
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x435f08
mov eax, dword fs:[0]
push eax
mov eax, dword [0x449250]
xor eax, esp
push eax
lea eax, [esp + 4]
mov dword fs:[0], eax
mov eax, dword [esp + 0x14]
mov dword [eax + 8], edx
mov edx, dword [esp + 0x18]
xor ecx, ecx
mov byte [eax + 4], cl
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x20], fcn.00424233
mov dword [eax + 0x24], fcn.004245d8
mov dword [eax + 0x28], fcn.004229f3
mov dword [eax + 0x2c], ecx
mov ecx, dword [esp + 0x1c]
mov dword [eax], vtable.n_config::t_arraySection_class_t_configSignatureFile::t_signature_.0
mov dword [eax + 0x30], ecx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
pop ecx
add esp, 0xc
ret 0xc
Function at 0x41e1a0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
mov eax, ebx
call fcn.0041df00
test eax, eax
jl 0x41e3d8
mov edx, dword [ebx + 0xf0]
add edx, edx
push esi
add edx, edx
xor esi, esi
push edi
test edx, edx
jle 0x41e20d
lea ecx, [ebx + edx*4 + 8]
lea eax, [ebx + 8]
push ebp
lea esp, [esp]
mov ebp, dword [ecx - 8]
mov edi, dword [eax - 8]
mov dword [eax - 8], ebp
mov ebp, dword [ecx - 4]
mov dword [ecx - 8], edi
mov edi, dword [eax - 4]
mov dword [eax - 4], ebp
mov ebp, dword [ecx]
mov dword [ecx - 4], edi
mov edi, dword [eax]
mov dword [eax], ebp
mov ebp, dword [ecx + 4]
mov dword [ecx], edi
mov edi, dword [eax + 4]
mov dword [eax + 4], ebp
mov dword [ecx + 4], edi
add esi, 4
sub edx, 4
add eax, 0x10
sub ecx, 0x10
cmp esi, edx
jl 0x41e1d0
pop ebp
mov edx, 1
cmp dword [ebx + 0xf0], edx
jle 0x41e3d4
lea eax, [ebx + 2]
mov ecx, dword [eax + 0xe]
movzx edi, byte [eax + 0xf]
mov edi, dword [edi*4 + 0x43a690]
add eax, 0x10
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x43a690]
and esi, 0xff
mov esi, dword [esi*4 + 0x43b290]
and edi, 0xff
xor esi, dword [edi*4 + 0x43ba90]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x43a690]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x43be90]
movzx ecx, byte [eax]
mov ecx, dword [ecx*4 + 0x43a690]
movzx edi, byte [eax + 3]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x43b690]
mov ecx, dword [eax + 2]
mov dword [eax - 2], esi
mov edi, dword [edi*4 + 0x43a690]
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x43a690]
and esi, 0xff
mov esi, dword [esi*4 + 0x43b290]
and edi, 0xff
xor esi, dword [edi*4 + 0x43ba90]
movzx edi, byte [eax + 4]
mov edi, dword [edi*4 + 0x43a690]
and edi, 0xff
xor esi, dword [edi*4 + 0x43b690]
movzx edi, byte [eax + 7]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x43a690]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x43be90]
mov ecx, dword [eax + 6]
mov dword [eax + 2], esi
mov edi, dword [edi*4 + 0x43a690]
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x43a690]
and esi, 0xff
mov esi, dword [esi*4 + 0x43b290]
and edi, 0xff
xor esi, dword [edi*4 + 0x43ba90]
movzx edi, byte [eax + 8]
mov edi, dword [edi*4 + 0x43a690]
and edi, 0xff
xor esi, dword [edi*4 + 0x43b690]
movzx edi, byte [eax + 0xb]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x43a690]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x43be90]
mov ecx, dword [eax + 0xa]
mov dword [eax + 6], esi
mov edi, dword [edi*4 + 0x43a690]
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x43a690]
and esi, 0xff
mov esi, dword [esi*4 + 0x43b290]
and edi, 0xff
xor esi, dword [edi*4 + 0x43ba90]
movzx edi, byte [eax + 0xc]
mov edi, dword [edi*4 + 0x43a690]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x43a690]
and edi, 0xff
xor esi, dword [edi*4 + 0x43b690]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x43be90]
inc edx
mov dword [eax + 0xa], esi
cmp edx, dword [ebx + 0xf0]
jl 0x41e221
pop edi
xor eax, eax
pop esi
ret
Function at 0x41ef20
Capabilities:
Encode data using base64

Disassembly:
push esi
push edi
mov edi, eax
cmp edi, 3
mov esi, edx
jl 0x41efa5
mov eax, 0xaaaaaaab
mul edi
shr edx, 1
lea eax, [edx + edx*2]
sub edi, eax
push ebx
lea ebx, [ebx]
movzx eax, byte [esi]
shr eax, 2
movzx eax, byte [eax + 0x43a1c8]
mov byte [ecx], al
movzx eax, byte [esi]
movzx ebx, byte [esi + 1]
and eax, 3
shl eax, 4
shr ebx, 4
or eax, ebx
movzx eax, byte [eax + 0x43a1c8]
mov byte [ecx + 1], al
movzx eax, byte [esi + 1]
movzx ebx, byte [esi + 2]
inc ecx
and eax, 0xf
add eax, eax
add eax, eax
shr ebx, 6
or eax, ebx
movzx eax, byte [eax + 0x43a1c8]
inc ecx
mov byte [ecx], al
movzx eax, byte [esi + 2]
and eax, 0x3f
movzx eax, byte [eax + 0x43a1c8]
inc ecx
mov byte [ecx], al
inc ecx
add esi, 3
sub edx, 1
jne 0x41ef40
pop ebx
test edi, edi
jle 0x41f005
movzx edx, byte [esi]
shr edx, 2
movzx eax, byte [edx + 0x43a1c8]
mov byte [ecx], al
mov al, byte [esi]
and al, 3
inc ecx
shl al, 4
cmp edi, 1
jle 0x41efcd
mov dl, byte [esi + 1]
shr dl, 4
or al, dl
movzx eax, al
mov dl, byte [eax + 0x43a1c8]
mov byte [ecx], dl
inc ecx
cmp edi, 2
jge 0x41efef
mov eax, 0x3d
mov byte [ecx], al
inc ecx
mov byte [ecx], al
inc ecx
pop edi
mov byte [ecx], 0
pop esi
ret
movzx eax, byte [esi + 1]
and eax, 0xf
movsx eax, byte [eax*4 + 0x43a1c8]
mov byte [ecx], al
inc ecx
mov byte [ecx], 0x3d
inc ecx
pop edi
mov byte [ecx], 0
pop esi
ret