joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5333a0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x64b703
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xf4
push ebx
mov ebx, dword [esp + 0x108]
push ebp
push esi
mov esi, dword [esp + 0x114]
lea eax, [esp + 0x10]
push edi
push eax
lea ecx, [esp + 0x1c]
push 0
push ecx
push 0
mov ebp, 1
push esi
push ebx
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], ebp
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
mov byte [esp + 0x13], 0
test edi, edi
jne 0x53354b
mov eax, dword [esp + 0x14]
test eax, eax
je 0x5335af
push eax
call fcn.004f1e80
mov ebp, eax
add esp, 4
test ebp, ebp
jne 0x533425
xor al, al
jmp 0x5335b3
lea edx, [esp + 0x14]
lea eax, [esp + 0x18]
push edx
push ebp
push eax
push 0
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
test edi, edi
jne 0x5334e4
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
cmp eax, 4
jne 0x533479
cmp ecx, 4
jne 0x5334c3
mov ecx, dword [ebp]
push ecx
mov ecx, dword [esp + 0x120]
call fcn.004e49b0
push ebp
mov byte [esp + 0x17], 1
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
jmp 0x5335af
cmp eax, 1
jne 0x53349e
mov ecx, dword [esp + 0x11c]
push ebp
call fcn.004e5040
push ebp
mov byte [esp + 0x17], 1
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
jmp 0x5335af
cmp eax, 2
jne 0x5334c3
mov ecx, dword [esp + 0x11c]
push ebp
call fcn.004e5040
push ebp
mov byte [esp + 0x17], 1
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
jmp 0x5335af
push ecx
mov ecx, dword [esp + 0x120]
push ebp
call fcn.004e4440
push ebp
mov byte [esp + 0x17], 1
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
jmp 0x5335af
lea ecx, [esp + 0x1c]
call fcn.004e57f0
push edi
lea ecx, [esp + 0x20]
mov dword [esp + 0x110], 0
call fcn.004e9110
mov edi, dword [esp + 0x120]
lea ecx, [esp + 0x1c]
mov ebx, dword [edi]
call fcn.004dda00
push eax
push str.RegistryQueryError2
mov ecx, edi
call dword [ebx + 0x2c]
mov edx, dword [edi]
push esi
push str.ValueName
mov ecx, edi
call dword [edx + 0x2c]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x10c], 0xffffffff
call fcn.004e58d0
push ebp
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
jmp 0x5335af
lea ecx, [esp + 0x90]
call fcn.004e57f0
push edi
lea ecx, [esp + 0x94]
mov dword [esp + 0x110], ebp
call fcn.004e9110
mov edi, dword [esp + 0x120]
lea ecx, [esp + 0x90]
mov ebx, dword [edi]
call fcn.004dda00
push eax
push str.RegistryQueryError
mov ecx, edi
call dword [ebx + 0x2c]
mov eax, dword [edi]
push esi
push str.ValueName
mov ecx, edi
call dword [eax + 0x2c]
lea ecx, [esp + 0x90]
mov dword [esp + 0x10c], 0xffffffff
call fcn.004e58d0
mov al, byte [esp + 0x13]
mov ecx, dword [esp + 0x104]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x100
ret
Function at 0x533800
Capabilities:
Get common file path

Disassembly:
mov eax, 0x1808
call fcn.006433d0
lea eax, [esp + 0x804]
push eax
push 0x800
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x533849
lea ecx, [esp]
push ecx
push 0x800
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov ecx, dword [esp + 0x180c]
lea edx, [esp]
push edx
call fcn.004d9630
add esp, 0x1808
ret
mov ecx, dword [esp + 0x180c]
lea eax, [esp + 0x804]
push eax
call fcn.004d9aa0
add esp, 0x1808
ret

Function at 0x533890
Capabilities:
Move file

Disassembly:
push 0xffffffffffffffff
push 0x64b75c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x460
push ebx
lea ecx, [esp + 4]
call fcn.004d91b0
lea ecx, [esp + 0x11c]
mov dword [esp + 0x46c], 0
call fcn.004d91b0
mov eax, dword [esp + 0x474]
lea ecx, [esp + 4]
push eax
mov byte [esp + 0x470], 1
call fcn.004dbe60
mov ecx, dword [esp + 0x478]
push ecx
lea ecx, [esp + 0x120]
call fcn.004dbe60
push 0x5c
push 0x2f
lea ecx, [esp + 0xc]
call fcn.004dcb70
push 0x5c
push 0x2f
lea ecx, [esp + 0x124]
call fcn.004dcb70
lea ecx, [esp + 4]
call fcn.004dc460
test al, al
je 0x53395a
lea ecx, [esp + 0x11c]
call fcn.004dc460
test al, al
je 0x53395a
lea ecx, [esp + 0x11c]
call fcn.004d9b10
push eax
lea ecx, [esp + 8]
call fcn.004d9b10
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne bl
jmp 0x5339fd
lea ecx, [esp + 0x34c]
call fcn.004d91b0
lea ecx, [esp + 0x234]
mov byte [esp + 0x46c], 2
call fcn.004d91b0
lea edx, [esp + 0x34c]
push 0
lea eax, [esp + 8]
push edx
push eax
mov byte [esp + 0x478], 3
call fcn.00533a60
lea ecx, [esp + 0x240]
push 0
lea edx, [esp + 0x12c]
push ecx
push edx
call fcn.00533a60
add esp, 0x18
lea ecx, [esp + 0x234]
call fcn.004d9b10
push eax
lea ecx, [esp + 0x350]
call fcn.004d9b10
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
lea ecx, [esp + 0x234]
mov byte [esp + 0x46c], 2
setne bl
call fcn.004d9240
lea ecx, [esp + 0x34c]
mov byte [esp + 0x46c], 1
call fcn.004d9240
test bl, bl
jne 0x533a11
mov ecx, dword [esp + 0x47c]
test ecx, ecx
je 0x533a11
call fcn.004f01e0
lea ecx, [esp + 0x11c]
mov byte [esp + 0x46c], 0
call fcn.004d9240
lea ecx, [esp + 4]
mov dword [esp + 0x46c], 0xffffffff
call fcn.004d9240
mov ecx, dword [esp + 0x464]
mov al, bl
pop ebx
mov dword fs:[0], ecx
add esp, 0x46c
ret
Function at 0x533c60
Capabilities:
Check if file exists
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x64b7b1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x348
push ebx
push esi
lea ecx, [esp + 8]
call fcn.004d91b0
mov eax, dword [esp + 0x360]
lea ecx, [esp + 8]
push eax
mov dword [esp + 0x35c], 0
call fcn.004dbe60
push 0x5c
push 0x2f
lea ecx, [esp + 0x10]
call fcn.004dcb70
lea ecx, [esp + 8]
call fcn.004d9310
cmp eax, 0x104
jle 0x533d8a
lea ecx, [esp + 0x238]
call fcn.004d91b0
lea ecx, [esp + 0x238]
push 0
lea edx, [esp + 0xc]
push ecx
push edx
mov byte [esp + 0x364], 1
call fcn.00533790
add esp, 0xc
lea ecx, [esp + 0x120]
mov bl, al
call fcn.004d91b0
test bl, bl
mov byte [esp + 0x358], 2
je 0x533d19
push 0x6ebf04
lea ecx, [esp + 0x124]
call fcn.004db950
lea ecx, [esp + 0x238]
call fcn.004dbab0
push eax
lea ecx, [esp + 0x124]
call fcn.004db950
lea ecx, [esp + 0x120]
call fcn.004d9b10
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, eax
test esi, esi
jne 0x533d5d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x533d5b
mov esi, 1
test esi, esi
lea ecx, [esp + 0x120]
mov byte [esp + 0x358], 1
setne bl
call fcn.004d9240
lea ecx, [esp + 0x238]
mov byte [esp + 0x358], 0
call fcn.004d9240
jmp 0x533ddd
lea ecx, [esp + 8]
call fcn.004d9b10
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebx, eax
test ebx, ebx
jne 0x533dda
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [esp + 0x368]
mov edi, eax
test esi, esi
je 0x533dcd
push edi
mov ecx, esi
call fcn.004f0280
lea eax, [esp + 0xc]
mov ecx, esi
push eax
push str.failedToDeleteFilepath
call fcn.004efc60
cmp edi, 2
pop edi
jne 0x533dd8
mov ebx, 1
test ebx, ebx
setne bl
lea ecx, [esp + 8]
mov dword [esp + 0x358], 0xffffffff
call fcn.004d9240
mov ecx, dword [esp + 0x350]
mov al, bl
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x354
ret
Function at 0x534a80
Capabilities:
Get file attributes

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x64b866
push eax
mov dword fs:[0], esp
sub esp, 0x230
push ebx
push ebp
mov ebp, dword [esp + 0x250]
push esi
mov esi, dword [esp + 0x250]
push edi
mov edi, dword [esp + 0x250]
xor ebx, ebx
mov dword [ebp], ebx
mov ecx, edi
mov dword [esi], 0xffffffff
call fcn.004dc460
test al, al
je 0x534ae6
mov ecx, dword [esp + 0x25c]
cmp ecx, ebx
je 0x534adf
mov eax, dword [ecx]
push str.GetAttributes:_filename_is_empty
call dword [eax + 0x14]
xor al, al
jmp 0x534bb3
lea ecx, [esp + 0x10]
call fcn.004d91b0
push edi
lea ecx, [esp + 0x14]
mov dword [esp + 0x24c], ebx
call fcn.004dbe60
push 0x5c
push 0x2f
lea ecx, [esp + 0x18]
call fcn.004dcb70
lea ecx, [esp + 0x10]
call fcn.004d9310
cmp eax, ebx
jle 0x534b75
lea ecx, [esp + 0x128]
call fcn.004d91b0
mov ecx, dword [esp + 0x25c]
lea edx, [esp + 0x128]
push ecx
lea eax, [esp + 0x14]
push edx
push eax
mov byte [esp + 0x254], 1
call fcn.00533a60
add esp, 0xc
lea ecx, [esp + 0x128]
call fcn.004d9b10
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea ecx, [esp + 0x128]
mov dword [esi], eax
mov byte [esp + 0x248], bl
call fcn.004d9240
jmp 0x534b87
lea ecx, [esp + 0x10]
call fcn.004d9b10
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [esi], eax
cmp dword [esi], 0xffffffff
jne 0x534b9a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp], eax
mov eax, dword [esi]
cmp eax, 0xffffffff
lea ecx, [esp + 0x10]
mov dword [esp + 0x248], 0xffffffff
setne bl
call fcn.004d9240
mov al, bl
mov ecx, dword [esp + 0x240]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x23c
ret

Function at 0x534e10
Capabilities:
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x64b8e6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x230
push ebx
push esi
lea ecx, [esp + 8]
call fcn.004d91b0
mov eax, dword [esp + 0x248]
xor ebx, ebx
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 0x244], ebx
call fcn.004dbe60
push 0x5c
push 0x2f
lea ecx, [esp + 0x10]
call fcn.004dcb70
push ebx
lea ecx, [esp + 0xc]
push 1
push ecx
call fcn.00533e10
add esp, 0xc
lea ecx, [esp + 8]
call fcn.004dc460
test al, al
jne 0x534ed6
lea ecx, [esp + 0x120]
call fcn.004d91b0
lea edx, [esp + 0x120]
push ebx
lea eax, [esp + 0xc]
push edx
push eax
mov byte [esp + 0x24c], 1
call fcn.00533a60
mov ecx, dword [esp + 0x258]
add esp, 0xc
push ecx
lea ecx, [esp + 0x124]
call fcn.004d9b10
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea ecx, [esp + 0x120]
mov esi, eax
mov byte [esp + 0x240], bl
call fcn.004d9240
jmp 0x534ef0
mov edx, dword [esp + 0x24c]
lea ecx, [esp + 8]
push edx
call fcn.004d9b10
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov esi, eax
cmp esi, ebx
lea ecx, [esp + 8]
setne bl
mov dword [esp + 0x240], 0xffffffff
call fcn.004d9240
mov ecx, dword [esp + 0x238]
mov al, bl
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x23c
ret
Function at 0x535620
Capabilities:
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x64b9bb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x118
push ebx
lea ecx, [esp + 4]
call fcn.004d91b0
mov eax, dword [esp + 0x12c]
lea ecx, [esp + 4]
push eax
mov dword [esp + 0x128], 0
call fcn.004d9800
mov ecx, dword [esp + 0x130]
push ecx
lea ecx, [esp + 8]
call fcn.004d9b10
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
lea ecx, [esp + 4]
mov dword [esp + 0x124], 0xffffffff
setne bl
call fcn.004d9240
mov ecx, dword [esp + 0x11c]
mov al, bl
pop ebx
mov dword fs:[0], ecx
add esp, 0x124
ret

Function at 0x5356b0
Capabilities:
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x64b9db
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x118
push esi
lea ecx, [esp + 4]
call fcn.004d91b0
mov eax, dword [esp + 0x12c]
lea ecx, [esp + 4]
push eax
mov dword [esp + 0x128], 0
call fcn.004d9800
lea ecx, [esp + 4]
call fcn.004d9b10
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea ecx, [esp + 4]
mov esi, eax
mov dword [esp + 0x124], 0xffffffff
call fcn.004d9240
mov ecx, dword [esp + 0x11c]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x124
ret
Function at 0x53a400
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x64c228
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push edi
mov edi, ecx
cmp dword [edi + 4], 0x62cb09e3
je 0x53a438
xor al, al
pop edi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret 0x18
push esi
mov esi, dword [esp + 0x34]
test esi, esi
jne 0x53a446
mov esi, 0xfde9
lea ecx, [esp + 8]
call fcn.00507040
push edi
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0
call fcn.00507640
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x40]
push eax
mov eax, dword [esp + 0x40]
push ecx
mov ecx, dword [esp + 0x40]
push edx
push eax
push ecx
lea edx, [esp + 0x1c]
push esi
push edx
call fcn.005392f0
add esp, 0x1c
lea ecx, [esp + 8]
mov dword [esp + 0x2c], 0xffffffff
call fcn.00507070
mov ecx, dword [esp + 0x24]
pop esi
mov al, 1
pop edi
mov dword fs:[0], ecx
add esp, 0x28
ret 0x18

Function at 0x53d810
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x64c628
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [esp + 0x34]
mov ebx, ecx
push str.Pkcs7_EncryptedData
push edi
lea ecx, [esp + 0x14]
call fcn.004f0370
mov esi, dword [esp + 0x28]
push str.sequence
mov ecx, esi
mov dword [esp + 0x24], 0
call fcn.00592070
test al, al
jne 0x53d865
mov eax, dword [edi]
push str.PKCS7_EncryptedData_root_tag_must_be_a_sequence.
jmp 0x53d8e1
mov ecx, esi
call fcn.00595a50
test al, al
je 0x53d8d3
push 0x6e8618
mov ecx, esi
call fcn.00592070
test al, al
je 0x53d8d3
push str.1.2.840.113549.1.7.6
mov ecx, esi
call fcn.00592160
test al, al
je 0x53d8d3
mov ecx, esi
call fcn.00595730
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
push edi
push ecx
push edx
push esi
mov ecx, ebx
call fcn.0053dca0
lea ecx, [esp + 0xc]
mov bl, al
mov dword [esp + 0x20], 0xffffffff
call fcn.004f03e0
pop edi
mov al, bl
pop esi
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret 0x10
mov ecx, esi
call fcn.00595730
mov eax, dword [edi]
push str.PKCS7_EncryptedData____first_child_must_be_oid_with_1.2.840.113549.1.7.1
mov ecx, edi
call dword [eax + 0x14]
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], 0xffffffff
call fcn.004f03e0
mov ecx, dword [esp + 0x18]
pop edi
pop esi
xor al, al
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret 0x10
Function at 0x544af0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x64cfb8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
mov esi, dword [esp + 0x30]
push edi
mov edi, ecx
push str.unEnvelopeEncrypted
push esi
lea ecx, [esp + 0x10]
call fcn.004f0370
mov ecx, dword [edi + 0x34]
mov dword [esp + 0x1c], 0
test ecx, ecx
jne 0x544b60
mov eax, dword [esi]
push str.Not_enveloped__encrypted__data.
mov ecx, esi
call dword [eax + 0x14]
lea ecx, [esp + 8]
mov dword [esp + 0x1c], 0xffffffff
call fcn.004f03e0
pop edi
xor al, al
pop esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret 0x14
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
push ebx
push esi
push edx
mov edx, dword [esp + 0x34]
push eax
mov eax, dword [esp + 0x34]
push edx
push eax
call fcn.00544c30
lea ecx, [esp + 0xc]
mov bl, al
mov dword [esp + 0x20], 0xffffffff
call fcn.004f03e0
mov ecx, dword [esp + 0x18]
mov al, bl
pop ebx
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret 0x14

Function at 0x544bb0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x64cfd8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [esp + 0x34]
mov esi, ecx
push str.unOpaqueSign
push edi
lea ecx, [esp + 0x14]
call fcn.004f0370
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x30]
push edi
push eax
push ecx
push edx
mov ecx, esi
mov dword [esp + 0x30], 0
call fcn.00544a20
lea ecx, [esp + 0xc]
mov bl, al
mov dword [esp + 0x20], 0xffffffff
call fcn.004f03e0
mov ecx, dword [esp + 0x18]
pop edi
mov al, bl
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret 0x10

Function at 0x546940
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x64d2ce
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.004eead0
lea ebx, [esi + 0x20]
xor edi, edi
mov ecx, ebx
mov dword [esp + 0x18], edi
call fcn.004f5830
lea ecx, [esi + 0x40]
mov byte [esp + 0x18], 1
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
call fcn.00507040
lea ecx, [esi + 0x5c]
mov byte [esp + 0x18], 2
call fcn.00507040
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x78], edi
mov dword [esi], vtable.Pkcs7.1.0
mov eax, esi
pop edi
mov dword [ebx], vtable.Pkcs7.0
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x54d010
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x64da78
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
mov esi, ecx
push edi
push esi
lea ecx, [esp + 0xc]
call fcn.004eea40
mov edi, dword [esp + 0x24]
mov dword [esp + 0x1c], 0
mov ecx, edi
call fcn.004dd9e0
cmp dword [esi + 0x30], 3
jne 0x54d0c6
mov eax, dword [esi + 0x34]
test eax, eax
jne 0x54d07c
lea ecx, [esp + 8]
mov dword [esp + 0x1c], 0xffffffff
call fcn.004eea90
pop edi
mov al, 1
pop esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret 4
cmp eax, 4
ja 0x54d086
lea eax, [esi + 0x39]
jmp 0x54d093
mov ecx, dword [esi + 0x3c]
test ecx, ecx
je 0x54d0c6
call fcn.004dda10
inc eax
mov ecx, dword [esi + 0x34]
dec ecx
push ecx
push eax
mov ecx, edi
call fcn.004e1260
lea ecx, [esp + 8]
mov dword [esp + 0x1c], 0xffffffff
call fcn.004eea90
pop edi
mov al, 1
pop esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret 4
lea ecx, [esp + 8]
mov dword [esp + 0x1c], 0xffffffff
call fcn.004eea90
mov ecx, dword [esp + 0x14]
pop edi
xor al, al
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret 4

Function at 0x54d360
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x64daf0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push esi
mov esi, ecx
push esi
lea ecx, [esp + 8]
call fcn.004eea40
lea ecx, [esp + 0x10]
mov dword [esp + 0x34], 0
call fcn.004dfe70
lea eax, [esp + 0x10]
mov ecx, esi
push eax
mov byte [esp + 0x38], 1
call fcn.0054d740
lea ecx, [esp + 0x10]
call fcn.005a8750
test eax, eax
pop esi
jne 0x54d3e6
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], al
call fcn.004e0890
lea ecx, [esp]
mov dword [esp + 0x30], 0xffffffff
call fcn.004eea90
xor al, al
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
add esp, 0x34
ret 4
push ebx
lea ecx, [esp + 0x10]
call fcn.005a8750
push eax
lea ecx, [esp + 0x14]
call fcn.004dda10
mov ecx, dword [esp + 0x40]
push eax
push ecx
call fcn.00553320
add esp, 0xc
lea ecx, [esp + 0x10]
mov bl, al
mov byte [esp + 0x34], 0
call fcn.004e0890
lea ecx, [esp + 4]
mov dword [esp + 0x34], 0xffffffff
call fcn.004eea90
mov ecx, dword [esp + 0x2c]
mov al, bl
pop ebx
mov dword fs:[0], ecx
add esp, 0x34
ret 4
Function at 0x54d570
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x64db30
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push esi
mov esi, ecx
push esi
lea ecx, [esp + 8]
call fcn.004eea40
lea ecx, [esp + 0x10]
mov dword [esp + 0x34], 0
call fcn.004dfe70
lea eax, [esp + 0x10]
mov ecx, esi
push eax
mov byte [esp + 0x38], 1
call fcn.0054d670
test al, al
pop esi
jne 0x54d5cc
mov ecx, dword [esp + 0x3c]
push str.Failed_to_get_octet_string_from_ASN.1
mov edx, dword [ecx]
call dword [edx + 0x14]
jmp 0x54d5e7
lea ecx, [esp + 0xc]
call fcn.005a8750
test eax, eax
jne 0x54d619
mov ecx, dword [esp + 0x3c]
push str.ASN.1_is_empty.
mov eax, dword [ecx]
call dword [eax + 0x14]
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], 0
call fcn.004e0890
lea ecx, [esp]
mov dword [esp + 0x30], 0xffffffff
call fcn.004eea90
xor al, al
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
add esp, 0x34
ret 8
push ebx
lea ecx, [esp + 0x10]
call fcn.005a8750
push eax
lea ecx, [esp + 0x14]
call fcn.004dda10
mov ecx, dword [esp + 0x40]
push eax
push ecx
call fcn.00553320
add esp, 0xc
lea ecx, [esp + 0x10]
mov bl, al
mov byte [esp + 0x34], 0
call fcn.004e0890
lea ecx, [esp + 4]
mov dword [esp + 0x34], 0xffffffff
call fcn.004eea90
mov ecx, dword [esp + 0x2c]
mov al, bl
pop ebx
mov dword fs:[0], ecx
add esp, 0x34
ret 8
Function at 0x553700
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x64dfe8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
push edi
lea ecx, [esp + 8]
call fcn.0054f840
mov edi, dword [esp + 0x2c]
mov dword [esp + 0x24], 0
push edi
call fcn.005510e0
push eax
lea eax, [esp + 0x10]
push eax
call fcn.00551420
mov esi, eax
add esp, 0xc
test esi, esi
je 0x55376d
lea ecx, [esp + 8]
mov dword [esp + 0x24], 0xffffffff
call fcn.0054f980
mov eax, esi
pop edi
pop esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret
lea ecx, [esp + 8]
lea edx, [esp + 8]
push ecx
push edi
push edx
call fcn.0055ba00
mov esi, eax
add esp, 0xc
test esi, esi
je 0x5537aa
lea ecx, [esp + 8]
mov dword [esp + 0x24], 0xffffffff
call fcn.0054f980
mov eax, esi
pop edi
pop esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x24], 0xffffffff
mov ecx, dword [eax]
mov dword [edx], ecx
lea ecx, [esp + 8]
call fcn.0054f980
mov ecx, dword [esp + 0x1c]
pop edi
xor eax, eax
pop esi
mov dword fs:[0], ecx
add esp, 0x20
ret

Function at 0x55c670
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x64e388
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
mov ebx, dword [esp + 0x30]
test ebx, ebx
push edi
jne 0x55c6a5
pop edi
mov al, 1
pop ebx
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret
mov edi, dword [esp + 0x38]
test edi, edi
jne 0x55c6c0
pop edi
xor al, al
pop ebx
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret
lea ecx, [esp + 8]
call fcn.004dfe70
lea eax, [esp + 8]
mov dword [esp + 0x2c], 0
push eax
push ebx
call fcn.0055c750
add esp, 8
test al, al
jne 0x55c707
lea ecx, [esp + 8]
mov dword [esp + 0x2c], 0xffffffff
call fcn.004e0890
pop edi
xor al, al
pop ebx
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret
push esi
lea ecx, [esp + 0xc]
call fcn.004dda10
mov ecx, ebx
mov esi, eax
mov edx, ecx
mov dword [esp + 0x30], 0xffffffff
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0xc]
call fcn.004e0890
mov ecx, dword [esp + 0x28]
pop esi
pop edi
mov al, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret