joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4040a0
Capabilities:
Get disk information
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1f4
mov eax, dword [0x417014]
xor eax, esp
mov dword [esp + 0x1f0], eax
push esi
push 0x80
lea eax, [esp + 0x174]
mov esi, ecx
push eax
push 0
push 0
lea eax, [esp + 0x14]
push eax
push 0x80
push 0x41b3c8
push 0x411cac
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
call fcn.00403d40
push eax
push dword [esp + 8]
call fcn.00403e40
push eax
lea eax, [esp + 0x7c]
push str._d_d_s
push eax
call fcn.0040c3f0
add esp, 0x14
test esi, esi
jne 0x404188
lea ecx, [esp + 0x70]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], esi
lea edx, [ecx + 1]
mov dword [esp + 8], 0x67452301
mov dword [esp + 0xc], 0xefcdab89
mov dword [esp + 0x10], 0x98badcfe
mov dword [esp + 0x14], 0x10325476
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x404140
sub ecx, edx
lea edx, [esp + 0x70]
push ecx
lea ecx, [esp + 0xc]
call fcn.004017a0
add esp, 4
lea edx, [esp + 8]
lea ecx, [esp + 0x60]
call fcn.00401870
mov edx, 0x10
lea ecx, [esp + 0x60]
call fcn.00403c10
pop esi
mov ecx, dword [esp + 0x1f0]
xor ecx, esp
call fcn.0040e8e5
mov esp, ebp
pop ebp
ret
push 0x80
push 0
push 0x41b3c8
call sub.VCRUNTIME140.dll_memset
lea edx, [esp + 0x7c]
add esp, 0xc
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x4041a3
sub edx, ecx
lea ecx, [esp + 0x70]
call fcn.00403c70
push eax
push 0x411cb8
push 0x41b3c8
call fcn.0040c410
mov ecx, dword [esp + 0x200]
add esp, 0xc
mov eax, 0x41b3c8
pop esi
xor ecx, esp
call fcn.0040e8e5
mov esp, ebp
pop ebp
ret

Function at 0x404260
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, dword [sym.imp.WS2_32.dll_ntohl]
push esi
mov esi, ecx
mov dword [ebp - 4], edx
push edi
push dword [esi]
call ebx
push dword [esi + 4]
mov dword [ebp - 8], eax
call ebx
mov edi, dword [ebp - 4]
mov ebx, eax
lea eax, [ebp - 0x18]
xor esi, esi
sub edi, eax
nop dword [eax]
lea eax, [edi + esi*4]
push dword [ebp + eax - 0x18]
call dword [sym.imp.WS2_32.dll_ntohl]
mov dword [ebp + esi*4 - 0x18], eax
inc esi
cmp esi, 4
jl 0x404290
mov edi, dword [ebp - 8]
xor edx, edx
lea esi, [edx + 0x10]
nop
mov ecx, ebx
lea edx, [edx - 0x61c88647]
shr ecx, 5
mov eax, ebx
add ecx, dword [ebp - 0x14]
shl eax, 4
add eax, dword [ebp - 0x18]
xor ecx, eax
lea eax, [edx + ebx]
xor ecx, eax
add edi, ecx
mov ecx, edi
mov eax, edi
shr ecx, 5
add ecx, dword [ebp - 0xc]
shl eax, 4
add eax, dword [ebp - 0x10]
xor ecx, eax
lea eax, [edx + edi]
xor ecx, eax
add ebx, ecx
sub esi, 1
jne 0x4042b0
mov esi, dword [sym.imp.WS2_32.dll_htonl]
push edi
call esi
mov edi, dword [ebp + 8]
push ebx
mov dword [edi], eax
call esi
mov dword [edi + 4], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x408200
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40fee1
mov eax, dword fs:[0]
push eax
mov eax, 0x1260
call fcn.0040f6e0
mov eax, dword [0x417014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
cmp dword [0x419230], 0
je 0x40842e
cmp dword [0x41924c], 0
je 0x40842e
mov ecx, 0x418dfc
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x408257
sub ecx, edx
cmp ecx, 5
jbe 0x40842e
push 0x810
lea eax, [ebp - 0x1224]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x100
lea eax, [ebp - 0x110]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x400
lea eax, [ebp - 0xa14]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x400
lea eax, [ebp - 0x614]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x104
lea eax, [ebp - 0x214]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push edi
lea eax, [ebp - 0x110]
push str._id_:__s_
push eax
call fcn.0040c3f0
add esp, 0x48
lea ecx, [ebp - 0x1254]
push 0x418dfc
call fcn.0040ba90
lea eax, [ebp - 0x1254]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x126c]
call fcn.0040c470
mov edx, eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x123c]
call fcn.0040c550
add esp, 4
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x1258]
cmp eax, 0x10
jb 0x408336
inc eax
push eax
push dword [ebp - 0x126c]
call fcn.0040c0e0
cmp dword [ebp - 0x1228], 0x10
lea ecx, [ebp - 0x1224]
push ecx
lea ecx, [ebp - 0x110]
mov dword [ebp - 0x1258], 0xf
lea eax, [ebp - 0x123c]
mov dword [ebp - 0x125c], 0
cmovae eax, dword [ebp - 0x123c]
push ecx
push eax
mov byte [ebp - 0x126c], 0
call dword [0x41924c]
lea ecx, [ebp - 0x1224]
add esp, 0xc
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x408386
sub ecx, edx
cmp ecx, 0x3e8
mov ecx, dword [0x418cf0]
jae 0x4083ad
push 0x412334
push 5
push esi
call dword [sym.imp.mfc140u.dll_CListCtrl::SetItemText]
jmp 0x408418
push 0x41233c
push 5
push esi
call dword [sym.imp.mfc140u.dll_CListCtrl::SetItemText]
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 5
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
push 0
push 0x10
lea eax, [ebp - 0x614]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [ebp - 0x614]
push eax
lea eax, [ebp - 0xa14]
push str._sSosoAppdata.ini
push eax
call fcn.0040c450
add esp, 0xc
lea eax, [ebp - 0xa14]
push eax
lea eax, [ebp - 0x1224]
push eax
push str.Soso
push edi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea ecx, [ebp - 0x123c]
call fcn.0040b9d0
lea ecx, [ebp - 0x1254]
call fcn.0040b9d0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040e8e5
mov esp, ebp
pop ebp
ret
Function at 0x40a860
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x417014]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
mov edi, esi
lea ecx, [edi + 2]
nop dword [eax]
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x40a880
sub edi, ecx
sar edi, 1
test esi, esi
jne 0x40a8a5
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040e8e5
mov esp, ebp
pop ebp
ret
cmp edi, 0x104
jge 0x40a893
push 0x20a
lea eax, [ebp - 0x210]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
lea ecx, [ebp - 0x210]
add esp, 0xc
sub ecx, esi
nop dword [eax + eax]
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [ecx + esi - 2], ax
test ax, ax
jne 0x40a8d0
add edi, edi
cmp edi, 0x20a
jae 0x40a9a5
xor eax, eax
mov word [ebp + edi - 0x210], ax
add edi, 2
cmp edi, 0x20a
jae 0x40a9a5
mov dword [ebp - 0x218], eax
xorps xmm0, xmm0
mov word [ebp + edi - 0x210], ax
mov ecx, 0x414
movq qword [ebp - 0x220], xmm0
mov ax, word [ebp - 0x220]
or ax, cx
mov dword [ebp - 0x21a], 0
movups xmmword [ebp - 0x230], xmm0
lea ecx, [ebp - 0x210]
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x228], ecx
mov ecx, 0xffbf
and ax, cx
mov dword [ebp - 0x216], 0
mov word [ebp - 0x220], ax
lea eax, [ebp - 0x230]
push eax
mov dword [ebp - 0x22c], 3
mov dword [ebp - 0x224], 0
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ecx, dword [ebp - 4]
neg eax
pop edi
sbb eax, eax
xor ecx, ebp
inc eax
pop esi
call fcn.0040e8e5
mov esp, ebp
pop ebp
ret
call fcn.0040eca7
int3

Function at 0x40c990
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1010
call fcn.0040f6e0
mov eax, dword [0x417014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 0x1010]
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
push eax
push 0x20019
push esi
push str.SOFTWARETencentQQ
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40ca79
push 0x1000
push eax
lea eax, [ebp - 0x1004]
mov dword [ebp - 0x1008], 3
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x100c], 0x400
lea eax, [ebp - 0x100c]
push eax
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0x1008]
push eax
push esi
push str.path
push dword [ebp - 0x1010]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40ca79
mov eax, dword [ebp - 0x100c]
push eax
mov dword [ebx], eax
call dword [sym.imp.mfc140u.dll_operator_1]
push dword [ebp - 0x100c]
mov esi, eax
push 0
push esi
call sub.VCRUNTIME140.dll_memset
push dword [ebp - 0x100c]
lea eax, [ebp - 0x1004]
push eax
push esi
call sub.VCRUNTIME140.dll_memcpy
push dword [ebp - 0x100c]
push esi
push edi
call sub.VCRUNTIME140.dll_memcpy
push esi
call dword [sym.imp.mfc140u.dll_operator_2]
add esp, 0x2c
mov esi, 1
push dword [ebp - 0x1010]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040e8e5
mov esp, ebp
pop ebp
ret
Function at 0x46d090
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x46d0be
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x46d0dc
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0046cff6
jmp 0x46d0dc
mov eax, dword [esi + 0x14]
test eax, eax
je 0x46d0dc
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0046cff6
test edi, edi
mov eax, edi
jne 0x46d0c6
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8

Function at 0x465639
Capabilities:
Encode data using xor

Disassembly:
push 0x53bea93d
xor ebx, edx
and ebx, 0xff
push 0x1008e298
mov ebx, dword [ebx*4 + 0x4e4110]
shr edx, 8
xor edx, ebx
add word [esp], 0x6c84
inc esi
call fcn.00467580
mov edx, ebx
invalid
mov ecx, dword [edi + 4]
mov dword [esp], 0xf21c2b28
inc esp
and al, 0
sub byte [ebx], ch
sbb al, 0xf2
inc dword [esp]
add edi, 4
xor edx, edx
sal byte [esp + 2], 0xe2
jns 0x498c16
or al, 0x51
arpl word [edx], cx
daa
xor al, 0x90
leave
push ss
jns 0x46563e
cli
mov al, byte [0x477d6201]
outsb dx, byte [esi]
mov esp, 0x22f9addc
sub bl, byte [ebx]
sbb ebx, eax
sal cl, 0x89
sbb cl, byte [esi + 7]
add esi, dword [edi]
syscall
call fcn.00463eec
call fcn.0047ccb9
jmp 0x465613
jmp 0x460c41
not edx
call fcn.0046df59
mov esi, 0x9e20231a
dec si
shl esi, 0xeb
mov esi, edi
sbb edi, 1
jmp 0x4c94e9
push 0x6c0e3526
mov dword [esp], ebx
movzx ebx, byte [esi]
jmp 0x468d60
jmp 0x4dedfd
jp 0x47cd42
test ecx, ecx
lea esp, [esp + 4]
je 0x46dff2
jmp 0x47430d
jmp 0x4e52be
mov word [edi], ax
lea esp, [esp + 0x14]
jmp fcn.0047f775
push 0xf58f588a
mov word [edi], si
push 0xe2add2a4
push 0xe284cd1a
lea esp, [esp + 0xc]
jmp 0x468c98

Function at 0x4e6908
Capabilities:
Encode data using xor

Disassembly:
push dword [esp + 0x20]
popfd
lea esp, [esp + 0x2c]
call fcn.004e97e8
push ds
mov bh, 0xd4
mov esi, dword [ecx - 0x2d20393c]
lodsd eax, dword [esi]
jno 0x4e697a
out 0xa0, eax
push cs
das
insd dword es:[edi], dx
cld
movsb byte es:[edi], byte [esi]
mov al, 0xae
dec esp
pop eax
invalid
push cs
int1
sbb al, 0x6b
push 0x3f
add byte [edx - 0x16a997fc], ah
rol dword [eax - 0x72], 1
xor byte [esi - 0x62], bl
sahf
into
push eax
adc byte [edx + 0x79], ch
fstp qword [ebx + esi*2 - 0x6c2571c4]
out 3, eax
cli
retf
Function at 0xad8082
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0xad80ce
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0xad80c8
mov ecx, dword [0xb187f8]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0xad80bc
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0xad80a1
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov al, 1
jmp 0xad80ca
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0xad9c53
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
add ecx, 0xf8
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
add eax, dword [edx + 0x78]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x1c]
add edx, dword [ecx + 0x20]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c]
add ecx, dword [eax + 0x24]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x1c]
add eax, dword [edx + 0x1c]
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0
jmp 0xad9cbf
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
cmp eax, dword [edx + 0x18]
jae 0xad9d08
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x28]
push edx
call fcn.00af3100
add esp, 8
test eax, eax
jne 0xad9d06
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x20]
xor edx, edx
mov dx, word [ecx + eax*2]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x1c]
add ecx, dword [eax + edx*4]
mov eax, ecx
jmp 0xad9d0a
jmp 0xad9cb6
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0xae28fa
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2cc
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call fcn.00adc337
add esp, 4
and eax, 0xff
test eax, eax
je 0xae2983
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push 0x2cc
push 0
lea eax, [ebp - 0x2cc]
push eax
call fcn.00aed820
add esp, 0xc
mov dword [ebp - 0x2cc], 0x10001
lea ecx, [ebp - 0x2cc]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0xae2981
mov ecx, dword [ebp - 0x214]
cmp ecx, dword [ebp + 0xc]
jne 0xae2981
jmp 0xae2983
jmp 0xae2903
mov esp, ebp
pop ebp
ret

Function at 0xae2df3
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
movsx eax, byte [0xb19404]
test eax, eax
jne 0xae2e07
call fcn.00ae2d24
xor ecx, ecx
mov cl, byte [0xb19401]
test ecx, ecx
jne 0xae2e8e
xor edx, edx
mov dl, byte [0xb19400]
test edx, edx
jne 0xae2e8e
cmp dword [0xb1960c], 0
je 0xae2e69
mov eax, dword [ebp + 0xc]
push eax
push 0
push 0x180
mov ecx, dword [0xb1960c]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [ebp - 4], eax
push 0
mov edx, dword [ebp - 4]
push edx
push 0x186
mov eax, dword [0xb1960c]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [0xb1960c]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
jmp 0xae2e8e
push 0x10001
push 0xb19404
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 2
jne 0xae2e8e
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esp, ebp
pop ebp
ret
Function at 0xae5f9a
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0xae5faa
xor eax, eax
jmp 0xae6173
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
mov dword [ebp + 8], eax
cmp dword [ebp + 0x10], 8
jb 0xae612b
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0xb16eac]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0xb16eac]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0xb16eac]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0xb16eac]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0xb16eac]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0xb16eac]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0xb16eac]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0xb16eac]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0x10]
sub ecx, 8
mov dword [ebp + 0x10], ecx
jmp 0xae5fb3
cmp dword [ebp + 0x10], 0
je 0xae616d
mov edx, dword [ebp + 0xc]
xor eax, eax
mov al, byte [edx]
mov ecx, dword [ebp + 8]
xor ecx, eax
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
mov eax, dword [ecx*4 + 0xb16eac]
xor eax, edx
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0x10]
sub edx, 1
mov dword [ebp + 0x10], edx
cmp dword [ebp + 0x10], 0
jne 0xae6131
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
pop ebp
ret
Function at 0xaef9b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0xb144c8
cmp edx, dword [eax]
je 0xaef9d2
add eax, 8
inc ecx
cmp eax, 0xb14558
jl 0xaef9c3
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0xb144c8]
jne 0xaefb00
mov eax, dword [0xb19688]
cmp eax, 1
je 0xaefada
test eax, eax
jne 0xaefa03
cmp dword [0xb14204], 1
je 0xaefada
cmp edx, 0xfc
je 0xaefb00
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0xaefa3a
lea eax, [ebp - 0x1a4]
push 0xb182c8
push eax
call fcn.00aed980
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00aedb30
inc eax
pop ecx
cmp eax, 0x3c
jbe 0xaefa7d
lea eax, [ebp - 0x1a4]
push eax
call fcn.00aedb30
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0xb182c4
push edi
call fcn.00aedbb0
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0xb182a8
push eax
call fcn.00aed980
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00aed990
lea eax, [ebp - 0xa0]
push 0xb182a4
push eax
call fcn.00aed990
push dword [esi + 0xb144cc]
lea eax, [ebp - 0xa0]
push eax
call fcn.00aed990
push 0x12010
lea eax, [ebp - 0xa0]
push 0xb1827c
push eax
call fcn.00af1f78
add esp, 0x2c
pop edi
jmp 0xaefb00
lea eax, [ebp + 8]
lea esi, [esi + 0xb144cc]
push 0
push eax
push dword [esi]
call fcn.00aedb30
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x403cc0
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x5d51c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0x20
lea eax, [ebp - 0x24]
mov dword [ebp - 0x60], 0x208
push eax
lea eax, [ebp - 0x54]
mov dword [ebp - 0x5c], 0x6610
push eax
mov ebx, edx
mov dword [ebp - 0x58], 0x20
mov esi, ecx
mov dword [ebp - 0x24], 0xe274bf91
mov dword [ebp - 0x20], 0xf910e678
mov dword [ebp - 0x1c], 0x28ddc4
mov dword [ebp - 0x18], 0x1ff7c577
mov dword [ebp - 0x14], 0xc9b22157
mov dword [ebp - 0x10], 0x1459d4b8
mov dword [ebp - 0xc], 0xc061536c
mov dword [ebp - 8], 0xdf7c977e
mov dword [ebp - 0x34], 0x28ddc4
mov dword [ebp - 0x30], 0x1ff7c577
mov dword [ebp - 0x2c], 0x17502482
mov dword [ebp - 0x28], 0xe6399091
call fcn.00550b70
add esp, 0xc
lea eax, [ebp - 0x6c]
push 0xf0000000
push 0x18
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x403dc0
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0x80090016
jne 0x403e7b
push 0xf0000008
push 0x18
push str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
push str.NVCryptoTestContainer
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x403e7b
call esi
push eax
push str.Error_in_AcquireContext_0x_08x__n
call fcn.0054af9e
add esp, 8
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0054a22c
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x64]
push eax
push 0
push 0
push 0x2c
lea eax, [ebp - 0x60]
push eax
push dword [ebp - 0x6c]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
je 0x403e7b
push 0
lea eax, [ebp - 0x34]
push eax
push 1
push dword [ebp - 0x64]
call dword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
test eax, eax
je 0x403e72
mov ecx, esi
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x403e00
sub ecx, edx
sar ecx, 1
push 0x200
lea eax, [ecx + ecx]
mov dword [ebp - 0x68], eax
lea eax, [ebp - 0x68]
push eax
push esi
push 0
push 1
push 0
push dword [ebp - 0x64]
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
jne 0x403e3a
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x403e72
push dword [ebp - 0x68]
mov edx, esi
lea ecx, [ebp - 0x1c]
call fcn.00403750
cmp dword [ebp - 8], 8
lea eax, [ebp - 0x1c]
cmovae eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0xc]
inc eax
push eax
push ebx
call fcn.0054b04d
add esp, 0x10
cmp dword [ebp - 8], 8
jb 0x403e72
push dword [ebp - 0x1c]
call fcn.0041f7c3
add esp, 4
push dword [ebp - 0x64]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0054a22c
mov esp, ebp
pop ebp
ret
Function at 0x4052a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4052b5
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4052f4
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x4052f0
lea ebx, [ebx]
cmp esi, edx
jae 0x4052f4
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec ecx
jne 0x4052e0
cmp esi, edx
jb 0x4052f9
xor eax, eax
pop esi
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret