joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43c6d0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x28
mov eax, dword [0x519bc0]
xor eax, esp
mov dword [esp + 0x24], eax
push ebx
mov ebx, dword [esp + 0x34]
push esi
push edi
mov edi, dword [esp + 0x38]
cmp dword [edi], 2
jne 0x43c781
mov eax, dword [edi + 4]
lea ecx, [esp + 0x10]
push ecx
push 4
lea edx, [esp + 0x14]
push edx
push 0x20
push ebx
mov dword [esp + 0x20], eax
call fcn.0043b670
xor edx, edx
mov dword [edi + 4], edx
mov eax, edx
lea esi, [edx - 2]
push ebp
jmp 0x43c720
movzx ebp, byte [esp + edx + 0x14]
mov ecx, edx
and ecx, 3
add ecx, ecx
add ecx, ecx
add ecx, ecx
shl ebp, cl
lea ecx, [esi - 1]
and ecx, 3
add ecx, ecx
add ecx, ecx
xor eax, ebp
movzx ebp, byte [esp + edx + 0x15]
add ecx, ecx
shl ebp, cl
mov ecx, esi
and ecx, 3
add ecx, ecx
xor eax, ebp
movzx ebp, byte [esp + edx + 0x16]
add ecx, ecx
add ecx, ecx
shl ebp, cl
lea ecx, [esi + 1]
and ecx, 3
add ecx, ecx
xor eax, ebp
movzx ebp, byte [esp + edx + 0x17]
add ecx, ecx
add ecx, ecx
shl ebp, cl
add edx, 4
add esi, 4
xor eax, ebp
cmp edx, 0x20
jb 0x43c720
mov dword [edi + 4], eax
pop ebp
cmp dword [edi], 3
jne 0x43c7a4
lea eax, [esp + 0x10]
push eax
push 0x20
add edi, 4
push edi
push 0x20
push ebx
call fcn.0043b670
mov ecx, 8
lea esi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x30]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004e6a64
add esp, 0x28
ret 8

Function at 0x43cc30
Capabilities:
Encode data using xor
Generate random numbers via winapi

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push 0xf0000040
push 1
xor esi, esi
push esi
push esi
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x20], esi
call dword [0x50101c]
mov ebp, dword [esp + 0x20]
test eax, eax
je 0x43cc7f
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0xc]
push ecx
push ebp
push edx
call dword [0x501018]
cmp eax, 1
mov eax, dword [esp + 0xc]
push esi
push eax
sete bl
call dword [0x501014]
test bl, bl
jne 0x43cce2
push edi
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], esi
call fcn.0046aa00
lea ecx, [esp + 0x14]
call fcn.0046a9e0
mov esi, eax
mov edi, edx
call fcn.004ea4aa
cdq
add esi, eax
adc edi, edx
xor ebx, ebx
test ebp, ebp
jbe 0x43cce1
mov edi, edi
mov ecx, ebx
and ecx, 7
add ecx, ecx
add ecx, ecx
add ecx, ecx
mov eax, esi
mov edx, edi
call fcn.004e95b0
mov edx, dword [esp + 0x20]
mov cl, al
mov eax, dword [0x52e934]
xor cl, bl
add cl, al
mov byte [ebx + edx], cl
inc eax
inc ebx
mov dword [0x52e934], eax
cmp ebx, ebp
jb 0x43ccb0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
Function at 0x43ced0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
mov edx, dword [esi]
push edi
mov edi, dword [esp + 0x18]
mov eax, dword [edi]
cmp eax, edx
jbe 0x43cf38
mov ebx, dword [esp + 0x14]
mov ecx, 1
cmp edx, ecx
jb 0x43cf14
mov edx, edi
sub edx, esi
lea eax, [esi + 4]
sub ebx, esi
lea ebx, [ebx]
mov ebp, dword [edx + eax]
xor ebp, dword [eax]
inc ecx
mov dword [ebx + eax], ebp
add eax, 4
cmp ecx, dword [esi]
jbe 0x43cf00
mov ebx, dword [esp + 0x14]
mov eax, dword [edi]
sub eax, dword [esi]
lea edx, [edi + ecx*4]
add eax, eax
add eax, eax
push eax
push edx
lea eax, [ebx + ecx*4]
push eax
call fcn.004e7600
mov ecx, dword [edi]
add esp, 0xc
pop edi
pop esi
pop ebp
mov dword [ebx], ecx
pop ebx
ret 0xc
jae 0x43cf88
mov ebx, dword [esp + 0x14]
mov ecx, 1
cmp eax, ecx
jb 0x43cf64
mov edx, edi
sub edx, esi
lea eax, [esi + 4]
sub ebx, esi
mov ebp, dword [eax + edx]
xor ebp, dword [eax]
inc ecx
mov dword [eax + ebx], ebp
add eax, 4
cmp ecx, dword [edi]
jbe 0x43cf50
mov ebx, dword [esp + 0x14]
mov edx, dword [esi]
sub edx, dword [edi]
lea eax, [esi + ecx*4]
add edx, edx
add edx, edx
push edx
push eax
lea ecx, [ebx + ecx*4]
push ecx
call fcn.004e7600
mov edx, dword [esi]
add esp, 0xc
pop edi
pop esi
pop ebp
mov dword [ebx], edx
pop ebx
ret 0xc
test eax, eax
jbe 0x43cfa2
mov edx, edi
lea ecx, [esi + eax*4]
sub edx, esi
mov ebx, dword [ecx + edx]
xor ebx, dword [ecx]
jne 0x43cfa2
dec eax
sub ecx, 4
test eax, eax
ja 0x43cf93
mov edx, dword [esp + 0x14]
mov dword [edx], eax
test eax, eax
jbe 0x43cfc3
sub edi, esi
lea ecx, [esi + eax*4]
sub edx, esi
mov esi, dword [ecx + edi]
xor esi, dword [ecx]
dec eax
mov dword [ecx + edx], esi
sub ecx, 4
test eax, eax
ja 0x43cfb3
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
Function at 0x43cfd0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x4c
push ebp
push esi
mov esi, dword [esp + 0x5c]
cmp dword [esi], 0
je 0x43d0fa
mov ebp, dword [esp + 0x60]
mov eax, dword [ebp]
test eax, eax
je 0x43d0fa
mov ecx, ebp
lea edx, [esp + 8]
sub ecx, edx
push edi
lea ebx, [ebx]
mov edi, dword [0x52e93c]
lea edx, [ecx + eax*4]
sub eax, 1
mov edx, dword [esp + edx + 0xc]
mov edx, dword [edi + edx*4]
mov dword [esp + eax*4 + 0x10], edx
jne 0x43d000
mov edi, dword [esp + 0x5c]
push ebx
push 0x90
push eax
push edi
call fcn.004e7970
mov ebx, dword [esi]
add esp, 0xc
test ebx, ebx
je 0x43d0a7
mov ebp, dword [0x52e938]
lea esp, [esp]
mov eax, dword [esi + ebx*4]
mov ecx, dword [0x52e93c]
mov esi, dword [ecx + eax*4]
cmp esi, 0x7fff
je 0x43d09a
mov edx, dword [esp + 0x68]
mov eax, dword [edx]
test eax, eax
je 0x43d09a
lea ecx, [ebx + eax]
lea edx, [edi + ecx*4 - 4]
jmp 0x43d070
mov ecx, dword [esp + eax*4 + 0x10]
cmp ecx, 0x7fff
je 0x43d092
add ecx, esi
cmp ecx, 0x7fff
jb 0x43d08c
add ecx, 0xffff8001
mov ecx, dword [ebp + ecx*4]
xor dword [edx], ecx
dec eax
sub edx, 4
test eax, eax
jne 0x43d070
sub ebx, 1
mov esi, dword [esp + 0x64]
jne 0x43d040
mov ebp, dword [esp + 0x68]
mov edx, dword [esi]
mov eax, dword [ebp]
lea ecx, [edx + eax - 1]
cmp ecx, 0x11
mov dword [edi], ecx
pop ebx
jle 0x43d0d7
lea eax, [edi + ecx*4 - 0x38]
lea edx, [ecx - 0x11]
nop
mov ecx, dword [eax + 0x38]
xor dword [eax - 0xc], ecx
xor dword [eax], ecx
mov dword [eax + 0x38], 0
sub eax, 4
sub edx, 1
jne 0x43d0c0
cmp dword [edi], 0x11
jbe 0x43d0f1
mov dword [edi], 0x11
mov eax, dword [edi]
cmp dword [edi + eax*4], 0
jne 0x43d0f1
dec eax
mov dword [edi], eax
test eax, eax
jne 0x43d0e2
pop edi
pop esi
pop ebp
add esp, 0x4c
ret 0xc
mov ecx, dword [esp + 0x58]
pop esi
mov dword [ecx], 0
pop ebp
add esp, 0x4c
ret 0xc
Function at 0x43d110
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
mov edi, dword [esp + 0x10]
mov eax, dword [edi]
xor ebp, ebp
cmp eax, ebp
je 0x43d1f5
mov ecx, dword [edi + eax*4]
push ebx
mov ebx, dword [0x52e93c]
mov ecx, dword [ebx + ecx*4]
push esi
cmp ecx, 0x7fff
je 0x43d15b
add ecx, ecx
cmp ecx, 0x7fff
jb 0x43d148
add ecx, 0xffff8001
mov edx, dword [0x52e938]
mov ecx, dword [edx + ecx*4]
mov esi, dword [esp + 0x14]
mov dword [esi + eax*8 - 4], ecx
jmp 0x43d163
mov esi, dword [esp + 0x14]
mov dword [esi + eax*8 - 4], ebp
mov ecx, dword [edi]
sub ecx, 1
je 0x43d1a8
lea edx, [esi + ecx*8 - 4]
mov edi, edi
mov dword [edx + 4], ebp
mov eax, dword [edi + ecx*4]
mov eax, dword [ebx + eax*4]
cmp eax, 0x7fff
je 0x43d19e
add eax, eax
cmp eax, 0x7fff
jb 0x43d18e
add eax, 0xffff8001
mov ebp, dword [0x52e938]
mov eax, dword [ebp + eax*4]
mov dword [edx], eax
xor ebp, ebp
jmp 0x43d1a0
mov dword [edx], ebp
dec ecx
sub edx, 8
cmp ecx, ebp
jne 0x43d170
mov eax, dword [edi]
lea ecx, [eax + eax - 1]
cmp ecx, 0x11
mov dword [esi], ecx
jle 0x43d1d3
lea eax, [esi + ecx*4 - 0x38]
lea edx, [ecx - 0x11]
lea esp, [esp]
mov ecx, dword [eax + 0x38]
xor dword [eax - 0xc], ecx
xor dword [eax], ecx
mov dword [eax + 0x38], ebp
sub eax, 4
sub edx, 1
jne 0x43d1c0
cmp dword [esi], 0x11
jbe 0x43d1ee
mov dword [esi], 0x11
mov edi, edi
mov eax, dword [esi]
cmp dword [esi + eax*4], ebp
jne 0x43d1ee
dec eax
mov dword [esi], eax
cmp eax, ebp
jne 0x43d1e0
pop esi
pop ebx
pop edi
pop ebp
ret 8
mov ecx, dword [esp + 0xc]
pop edi
mov dword [ecx], ebp
pop ebp
ret 8
Function at 0x445530
Capabilities:
Delete file

Disassembly:
xor eax, eax
sub esp, 0x20
cmp dword [ecx + 0x10], eax
jbe 0x445588
mov dword [ecx + 0x10], eax
mov ecx, dword [ecx]
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov dword [esp + 0x10], eax
mov dword [esp], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov word [esp + 0x1c], ax
lea edx, [esp]
mov eax, 0x54
push edx
mov dword [esp + 8], 3
mov word [esp + 0x14], ax
mov dword [esp + 0xc], ecx
call dword [0x501430]
neg eax
sbb eax, eax
inc eax
add esp, 0x20
ret
mov al, 1
add esp, 0x20
ret

Function at 0x44b520
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0xd4]
push 0x4000
push 0
push eax
call fcn.004e7970
add esp, 0xc
cmp byte [esp + 8], 0
je 0x44b611
cmp byte [esi + 0x6135], 0
jne 0x44b611
mov ecx, dword [esi + 0xe8]
mov eax, dword [esi + 0x6130]
shr ecx, 2
cmp eax, ecx
ja 0x44b611
xor edx, edx
test eax, eax
jbe 0x44b653
push ebx
push edi
jmp 0x44b580
mov eax, dword [esi + 0xd0]
movzx edi, byte [eax + edx + 1]
lea ecx, [eax + edx]
movzx eax, byte [ecx]
movzx ecx, byte [ecx + 2]
imul eax, eax, 0x2773
xor eax, edi
mov edi, dword [esi + 0xd8]
imul eax, eax, 0x2773
xor eax, ecx
mov ecx, eax
imul eax, eax, 0x2773
and ecx, 0x3ffff
xor ebx, ebx
mov word [edi + ecx*2], bx
mov ecx, dword [esi + 0xd0]
movzx ecx, byte [ecx + edx + 3]
mov edi, dword [esi + 0xdc]
xor ecx, eax
mov eax, ecx
imul ecx, ecx, 0x2773
and eax, 0x3ffff
mov dword [edi + eax*4], ebx
mov eax, dword [esi + 0xd0]
movzx eax, byte [eax + edx + 4]
xor eax, ecx
and eax, dword [esi + 0xec]
mov ecx, dword [esi + 0xe0]
inc edx
mov dword [ecx + eax*4], ebx
cmp edx, dword [esi + 0x6130]
jb 0x44b580
pop edi
pop ebx
pop esi
ret 4
mov edx, dword [esi + 0xd8]
push 0x80000
push 0
push edx
call fcn.004e7970
mov eax, dword [esi + 0xdc]
push 0x100000
push 0
push eax
call fcn.004e7970
mov ecx, dword [esi + 0xe8]
mov edx, dword [esi + 0xe0]
add ecx, ecx
add ecx, ecx
push ecx
push 0
push edx
call fcn.004e7970
add esp, 0x24
pop esi
ret 4
Function at 0x44db70
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xb4
mov eax, dword [0x519bc0]
xor eax, esp
mov dword [esp + 0xb0], eax
mov eax, dword [esp + 0xb8]
push ebx
mov ebx, dword [esp + 0xc0]
push ebp
xor edx, edx
push esi
add ebx, 0xffffff88
push edi
add eax, 2
lea edi, [esp + 0x20]
mov dword [esp + 0x28], edx
mov dword [esp + 0x24], edx
mov dword [esp + 0x20], edx
mov dword [esp + 0x18], edx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], edi
mov edi, edi
cmp edx, ebx
jge 0x44dcd3
lea eax, [esp + 0x48]
sub eax, 2
lea ecx, [eax + 3]
mov dword [esp + 0x34], ecx
lea ecx, [esp + 0x48]
sub ecx, eax
add ecx, 0xfffffffd
mov dword [esp + 0x3c], ecx
mov ecx, eax
neg ecx
lea esi, [esp + ecx + 0x48]
mov dword [esp + 0x44], esi
lea esi, [esp + ecx + 0x49]
mov dword [esp + 0x30], esi
lea esi, [esp + 0x48]
sub esi, eax
lea eax, [esp + ecx + 0x4a]
mov ecx, dword [esp + 0x14]
sub ebx, edx
mov dword [esp + 0x40], eax
dec ebx
mov eax, 0x88888889
mul ebx
dec esi
mov ebp, edx
shr ebp, 0xa
mov dword [esp + 0x2c], esi
mov esi, dword [edi]
mov dword [esp + 0x10], ecx
inc ebp
mov eax, dword [esp + 0x10]
xor edi, edi
lea ebx, [ebx]
movzx edx, byte [eax - 2]
mov cl, byte [eax - 1]
sub dl, cl
mov byte [esp + edi + 0x48], dl
movzx edx, byte [eax]
sub dl, cl
mov byte [esp + edi + 0x49], cl
mov byte [esp + edi + 0x4a], dl
add edi, 3
add eax, 3
cmp edi, 0x78
jl 0x44dc30
mov ecx, dword [esp + 0x34]
mov edi, 0x27
mov edi, edi
mov eax, dword [esp + 0x40]
movzx edx, byte [eax + ecx]
mov eax, dword [esp + 0x2c]
sub dl, byte [eax + ecx]
add ecx, 3
movsx eax, dl
cdq
mov ebx, eax
xor ebx, edx
sub ebx, edx
mov edx, dword [esp + 0x44]
mov al, byte [edx + ecx - 3]
mov edx, dword [esp + 0x3c]
sub al, byte [edx + ecx - 3]
movsx eax, al
cdq
xor eax, edx
sub eax, edx
add ebx, eax
mov eax, dword [esp + 0x30]
movzx edx, byte [eax + ecx - 3]
sub dl, byte [ecx - 3]
movsx eax, dl
cdq
xor eax, edx
sub eax, edx
add eax, esi
sub edi, 1
lea esi, [eax + ebx]
jne 0x44dc60
add dword [esp + 0x10], 0x780
sub ebp, 1
jne 0x44dc24
mov edi, dword [esp + 0x1c]
mov ebx, dword [esp + 0x38]
mov edx, dword [esp + 0x18]
mov dword [edi], esi
inc dword [esp + 0x14]
inc edx
add edi, 4
cmp edx, 2
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], edi
jle 0x44dbc0
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
pop ebx
cmp eax, ecx
ja 0x44dd1d
cmp eax, edx
ja 0x44dd1d
xor eax, eax
mov ecx, dword [esp + 0xb0]
xor ecx, esp
call fcn.004e6a64
add esp, 0xb4
ret 8
cmp edx, ecx
mov ecx, dword [esp + 0xb0]
sbb eax, eax
neg eax
xor ecx, esp
inc eax
call fcn.004e6a64
add esp, 0xb4
ret 8
Function at 0x452e10
Capabilities:
Get common file path

Disassembly:
sub esp, 8
call fcn.0049aed0
test al, al
jne 0x452e22
add esp, 8
ret 0xc
push ebx
push esi
lea eax, [esp + 0xc]
push eax
call dword [0x50144c]
mov esi, dword [esp + 0x14]
lea edx, [esp + 8]
push edx
push 0x1a
xor ecx, ecx
push 0
mov word [esi], cx
xor bl, bl
call dword [0x501450]
test eax, eax
jne 0x452e9e
mov eax, dword [esp + 8]
push esi
push eax
call dword [0x50140c]
test eax, eax
je 0x452e9e
cmp word [esi], 0
je 0x452e9e
push edi
mov edi, dword [esp + 0x1c]
push edi
push esi
call fcn.00452cf0
push edi
push 0x503120
push esi
call fcn.00469570
push esi
call fcn.00445500
mov bl, al
pop edi
test bl, bl
jne 0x452e9e
cmp byte [esp + 0x1c], 0
je 0x452e9e
push 0
push 0
push esi
call fcn.00445930
test eax, eax
sete bl
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x14]
call eax
pop esi
mov al, bl
pop ebx
add esp, 8
ret 0xc

Function at 0x453840
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
push edi
lea ecx, [esp + 0x10]
push ecx
push 1
xor eax, eax
push eax
push str.SoftwareWinRARPaths
push 0x80000001
mov word [esi], ax
call dword [0x501004]
mov edi, dword [esp + 0x14]
test eax, eax
jne 0x453898
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
push esi
lea eax, [esp + 0x10]
push eax
push 0
push str.AppData
push ecx
mov dword [esp + 0x2c], edi
call dword [section..rdata]
mov edx, dword [esp + 0x10]
push edx
call dword [0x501060]
cmp word [esi], 0
je 0x4538a8
push esi
call fcn.00445500
test al, al
jne 0x4538e5
mov eax, dword [esp + 0x18]
push eax
push edi
push esi
call fcn.00452e10
test al, al
jne 0x4538e5
push edi
push esi
push 0
call dword [0x501384]
push esi
call fcn.00453550
lea ecx, [esi + 4]
cmp eax, ecx
jb 0x4538e0
cmp word [esi + 2], 0x3a
jne 0x4538dd
add esi, 8
cmp eax, esi
jb 0x4538e0
sub eax, 2
xor edx, edx
mov word [eax], dx
pop edi
pop esi
pop ecx
ret 0xc
Function at 0x457e20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov esi, ecx
push edi
mov dword [esi + 4], 0
mov dword [esi], 0
mov eax, ebp
cmp ebp, 0x8000
jb 0x457e45
mov eax, 0x8000
mov edi, dword [esp + 0x10]
push ebx
push eax
mov eax, dword [esi + 0xc]
push edi
push eax
call fcn.004e7600
mov eax, 1
add esp, 0xc
xor bl, bl
cmp ebp, eax
jbe 0x457e6b
xor bl, byte [eax + edi]
inc eax
cmp eax, ebp
jb 0x457e63
push 8
mov ecx, esi
call fcn.00447970
mov esi, dword [esp + 0x1c]
mov dword [esi + 0x14], 0
cmp bl, byte [edi]
pop ebx
jne 0x457eac
push ebp
push edi
push 0xffffffffffffffff
call fcn.0043ab30
xor edx, edx
not eax
xor ecx, ecx
cmp dword [ecx + 0x5172f4], eax
jne 0x457ea3
cmp dword [ecx + 0x5172f0], ebp
je 0x457f1b
add ecx, 0xc
inc edx
cmp ecx, 0x48
jb 0x457e93
push 1
mov ecx, esi
call fcn.00457d90
mov eax, dword [esi + 0x14]
lea ecx, [eax + 1]
mov dword [esi + 0x14], ecx
lea edx, [eax + eax*4]
mov eax, dword [esi]
lea eax, [eax + edx*8]
lea ecx, [eax + 0xc]
mov dword [eax + 0x14], ecx
mov ecx, 3
mov dword [eax + 0x18], ecx
mov dword [eax + 8], ecx
lea edx, [eax + 0x1c]
xor ecx, ecx
mov dword [eax], 0x16
mov dword [eax + 0x24], edx
cmp dword [esi + 0x14], ecx
jle 0x457f15
xor edx, edx
lea esp, [esp]
mov eax, dword [esi]
add eax, edx
cmp dword [eax + 0x14], 0
jne 0x457f00
lea edi, [eax + 0xc]
mov dword [eax + 0x14], edi
cmp dword [eax + 0x24], 0
jne 0x457f0c
lea edi, [eax + 0x1c]
mov dword [eax + 0x24], edi
inc ecx
add edx, 0x28
cmp ecx, dword [esi + 0x14]
jl 0x457ef0
pop edi
pop esi
pop ebp
ret 0xc
lea ecx, [edx + edx*2]
mov edi, dword [ecx*4 + 0x5172f8]
test edi, edi
je 0x457eac
push 1
mov ecx, esi
call fcn.00457d90
mov eax, dword [esi + 0x14]
mov ecx, dword [esi]
lea edx, [eax + 1]
mov dword [esi + 0x14], edx
lea eax, [eax + eax*4]
lea eax, [ecx + eax*8]
lea ecx, [eax + 0xc]
mov dword [ecx], edi
pop edi
mov dword [eax + 0x14], ecx
mov ecx, 3
lea edx, [eax + 0x1c]
pop esi
mov dword [eax], 0x28
mov dword [eax + 0x24], edx
mov dword [eax + 0x18], ecx
mov dword [eax + 8], ecx
pop ebp
ret 0xc
Function at 0x463300
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x2010
call fcn.004e6a80
mov eax, dword [0x519bc0]
xor eax, esp
mov dword [esp + 0x200c], eax
push ebx
mov ebx, dword [esp + 0x2020]
push esi
mov esi, dword [esp + 0x201c]
push edi
mov edi, dword [esp + 0x2024]
cmp edi, esi
je 0x46333c
push ebx
push esi
push edi
call fcn.004694f0
lea eax, [esp + 0xc]
push eax
push 1
push 0
push str.SoftwareWinRARGeneral
push 0x80000001
call dword [0x501004]
test eax, eax
jne 0x46340d
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x463362
sub eax, edx
sar eax, 1
mov ecx, 0x7ff
sub ecx, eax
add ecx, ecx
lea edx, [esp + 0x10]
push edx
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x101c]
push eax
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x1c]
push ecx
push 0
push str.LanguageFolder
push edx
call dword [section..rdata]
test eax, eax
jne 0x463402
push 0x800
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x1020]
push edx
mov word [esp + 0x24], ax
call dword [0x501324]
push 0x800
lea eax, [esp + 0x1c]
push eax
call fcn.00452cf0
push 0x800
push esi
call fcn.00453550
push eax
lea ecx, [esp + 0x20]
push ecx
call fcn.00469570
lea edx, [esp + 0x18]
push edx
call fcn.00445500
test al, al
je 0x463402
push ebx
lea eax, [esp + 0x1c]
push eax
push edi
call fcn.004694f0
mov ecx, dword [esp + 0xc]
push ecx
call dword [0x501060]
mov ecx, dword [esp + 0x2018]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004e6a64
add esp, 0x2010
ret 0xc

Function at 0x463620
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x14
cmp dword [ebp + 0xc], 0
mov eax, dword [ebp + 8]
push ebx
mov edx, ecx
mov ecx, dword [ebp + 0x10]
movdqu xmm0, xmmword [edx + 8]
push esi
lea esi, [edx + 8]
push edi
mov dword [esp + 0x1c], esi
mov edi, eax
mov ebx, ecx
lea esi, [edx + 0x18]
jbe 0x4636b6
lea ecx, [ecx]
mov eax, edi
movdqu xmm1, xmmword [eax]
add edi, 0x10
cmp byte [edx + 1], 0
mov dword [esp + 0x18], edi
je 0x463669
pxor xmm0, xmm1
jmp 0x46366d
movdqa xmm0, xmm1
mov eax, dword [edx + 4]
cmp eax, 1
movdqu xmm1, xmmword [esi]
pxor xmm0, xmm1
jle 0x463698
lea ecx, [esi + 0x10]
lea edi, [eax - 1]
movdqu xmm1, xmmword [ecx]
add ecx, 0x10
sub edi, 1
aesenc xmm0, xmm1
jne 0x463683
mov edi, dword [esp + 0x18]
shl eax, 4
movdqu xmm1, xmmword [eax + esi]
add eax, esi
mov eax, ebx
add ebx, 0x10
sub dword [ebp + 0xc], 1
aesenclast xmm0, xmm1
movdqu xmmword [eax], xmm0
jne 0x463650
mov eax, dword [esp + 0x1c]
pop edi
pop esi
movdqu xmmword [eax], xmm0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4636d0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
push ecx
cmp dword [ebp + 0xc], 0
mov eax, dword [ebp + 0x10]
push ebx
mov edx, ecx
movdqu xmm2, xmmword [edx + 8]
push esi
lea ecx, [edx + 8]
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0xc], ecx
mov ebx, eax
lea esi, [edx + 0x18]
jbe 0x463763
lea esp, [esp]
mov eax, edi
movdqu xmm1, xmmword [eax]
mov eax, dword [edx + 4]
mov ecx, eax
shl ecx, 4
movdqu xmm0, xmmword [ecx + esi]
add ecx, esi
dec eax
add edi, 0x10
pxor xmm0, xmm1
test eax, eax
jle 0x463739
mov ecx, eax
shl ecx, 4
add ecx, esi
movdqu xmm3, xmmword [ecx]
dec eax
sub ecx, 0x10
aesdec xmm0, xmm3
test eax, eax
jg 0x463728
cmp byte [edx + 1], 0
movdqu xmm3, xmmword [esi]
aesdeclast xmm0, xmm3
je 0x46374c
pxor xmm0, xmm2
mov eax, ebx
add ebx, 0x10
sub dword [ebp + 0xc], 1
movdqa xmm2, xmm1
movdqu xmmword [eax], xmm0
jne 0x463700
mov ecx, dword [esp + 0xc]
pop edi
pop esi
movdqu xmmword [ecx], xmm2
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4639c0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
mov eax, dword [0x519bc0]
xor eax, esp
mov dword [esp + 0x10], eax
push ebp
push edi
mov ebp, ecx
mov edi, 1
cmp dword [ebp + 4], edi
jle 0x463afa
push ebx
push esi
lea esi, [ebp + 0x28]
lea ecx, [ebp + 0x2c]
jmp 0x4639f0
xor eax, eax
jmp 0x463a00
movzx edx, byte [ecx - 1]
movzx edx, byte [eax + edx*4 + 0x5341c0]
movzx ebx, byte [ecx - 2]
xor dl, byte [eax + ebx*4 + 0x5345c0]
movzx ebx, byte [ecx - 3]
xor dl, byte [eax + ebx*4 + 0x5349c0]
movzx ebx, byte [ecx - 4]
xor dl, byte [eax + ebx*4 + 0x534dc0]
movzx ebx, byte [ecx + 2]
mov byte [esp + eax + 0x10], dl
movzx edx, byte [ecx + 3]
movzx edx, byte [eax + edx*4 + 0x5341c0]
xor dl, byte [eax + ebx*4 + 0x5345c0]
movzx ebx, byte [ecx + 1]
xor dl, byte [eax + ebx*4 + 0x5349c0]
movzx ebx, byte [ecx]
xor dl, byte [eax + ebx*4 + 0x534dc0]
movzx ebx, byte [ecx + 6]
mov byte [esp + eax + 0x14], dl
movzx edx, byte [ecx + 7]
movzx edx, byte [eax + edx*4 + 0x5341c0]
xor dl, byte [eax + ebx*4 + 0x5345c0]
movzx ebx, byte [ecx + 5]
xor dl, byte [eax + ebx*4 + 0x5349c0]
movzx ebx, byte [ecx + 4]
xor dl, byte [eax + ebx*4 + 0x534dc0]
movzx ebx, byte [ecx + 0xa]
mov byte [esp + eax + 0x18], dl
movzx edx, byte [ecx + 0xb]
movzx edx, byte [eax + edx*4 + 0x5341c0]
xor dl, byte [eax + ebx*4 + 0x5345c0]
movzx ebx, byte [ecx + 9]
xor dl, byte [eax + ebx*4 + 0x5349c0]
movzx ebx, byte [ecx + 8]
xor dl, byte [eax + ebx*4 + 0x534dc0]
inc eax
cmp eax, 4
mov byte [esp + eax + 0x1b], dl
jl 0x463a00
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov dword [esi], eax
mov eax, dword [esp + 0x18]
mov dword [esi + 4], edx
mov edx, dword [esp + 0x1c]
mov dword [esi + 8], eax
mov dword [esi + 0xc], edx
inc edi
add ecx, 0x10
add esi, 0x10
cmp edi, dword [ebp + 4]
jl 0x4639f0
pop esi
pop ebx
mov ecx, dword [esp + 0x18]
pop edi
pop ebp
xor ecx, esp
call fcn.004e6a64
add esp, 0x14
ret