joyce8/EMBER2024-capa huggingface dataset:
Function at 0x413b4c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 0x1c], edx
push edi
mov dword [ebp - 8], ebx
xor edi, edi
or esi, 0xffffffff
test edi, edi
jne 0x413b77
cmp dword [0x6e498c], edi
je 0x413c9e
push 2
pop ebx
jmp 0x413b95
cmp edi, 1
jne 0x413c9e
test byte [ebx + 0x10], 0x10
jne 0x413b93
call fcn.0056d061
test eax, eax
jne 0x413c9e
xor ebx, ebx
cmp dword [0x6e4b28], 0
mov dword [ebp - 0x14], ebx
mov byte [ebp - 1], 0
je 0x413bb4
push 0x6cee28
mov byte [ebp - 1], 1
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp - 8]
and dword [ebp - 0xc], 0
and dword [ebp - 0x10], 0
push 0
movzx eax, word [eax + 0x10]
shr eax, 1
and eax, 0x10
or eax, ebx
mov ebx, dword [ebp - 8]
jmp 0x413c37
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov ebx, dword [ebp - 0xc]
mov dword [ecx], eax
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x413be5
mov eax, dword [ebx]
push ecx
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x18]
push ecx
push 0
push dword [ebp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
mov ecx, esi
call fcn.004129b9
test eax, eax
je 0x413c4f
mov eax, dword [ebp - 8]
xor esi, esi
push ebx
mov eax, dword [eax + 0xc]
movzx eax, word [eax + 6]
and eax, 0xf
imul eax, eax, 0xc
mov dword [eax + 0x6c2310], esi
call fcn.00412b66
mov ebx, dword [ebp - 8]
mov dword [ebp - 0xc], esi
push esi
movzx eax, word [ebx + 0x10]
shr eax, 1
and eax, 0x10
or eax, dword [ebp - 0x14]
mov ecx, dword [ebx + 0xc]
lea edx, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00412cfe
mov esi, eax
test esi, esi
je 0x413bd1
jmp 0x413c84
mov ecx, ebx
call fcn.00412c70
mov ebx, dword [ebp - 8]
test esi, esi
jne 0x413c84
movzx ecx, word [ebx + 0x10]
mov eax, ecx
and eax, 0xf
cmp dword [ebp - 0x18], eax
je 0x413cb3
cmp dword [ebp - 0x18], 3
jne 0x413c81
mov eax, dword [ebp + 0xc]
cmp dword [eax], 4
jne 0x413c81
and cl, 0xf
cmp cl, 4
je 0x413cb3
push 2
pop esi
cmp dword [0x6e4b28], 0
je 0x413c9e
cmp byte [ebp - 1], 0
je 0x413c9e
push 0x6cee28
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
inc edi
cmp edi, 2
jl 0x413b5f
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp dword [0x6e4b28], 0
mov eax, dword [ebp + 0x14]
mov dword [eax], 1
je 0x413cd6
cmp byte [ebp - 1], 0
je 0x413cd6
push 0x6cee28
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
jmp 0x413caa
Function at 0x413ff7
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x10
mov eax, 0x5b872a
call fcn.00573e11
mov bh, dl
mov esi, ecx
test esi, esi
jne 0x414012
xor al, al
jmp 0x414118
test bh, bh
je 0x414020
xor eax, eax
cmp dword [0x6e498c], eax
jmp 0x41403a
test byte [esi + 0x10], 0x10
jne 0x414033
call fcn.0056d061
test eax, eax
je 0x414033
xor ecx, ecx
jmp 0x414036
xor ecx, ecx
inc ecx
xor eax, eax
test cl, cl
sete al
test eax, eax
jne 0x41400b
and dword [ebp - 0x14], eax
xor bl, bl
and dword [ebp - 0x18], eax
mov byte [ebp - 0xd], bl
cmp dword [0x6e4b28], eax
je 0x414064
inc bl
push 0x6cee28
mov byte [ebp - 0xd], bl
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
and dword [ebp - 4], 0
xor ecx, ecx
push 2
pop eax
test bh, bh
push 0
cmovne ecx, eax
movzx eax, word [esi + 0x10]
shr eax, 1
and eax, 0x10
mov dword [ebp - 0x1c], ecx
or eax, ecx
jmp 0x4140d9
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x414090
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push dword [esi]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
mov ecx, edi
call fcn.004129b9
test eax, eax
je 0x4140f1
mov eax, dword [esi + 0xc]
xor edi, edi
push dword [ebp - 0x14]
movzx eax, word [eax + 6]
and eax, 0xf
imul eax, eax, 0xc
mov dword [eax + 0x6c2310], edi
call fcn.00412b66
movzx eax, word [esi + 0x10]
shr eax, 1
and eax, 0x10
mov dword [ebp - 0x14], edi
or eax, dword [ebp - 0x1c]
push edi
mov ecx, dword [esi + 0xc]
lea edx, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.00412cfe
mov edi, eax
test edi, edi
je 0x414084
jmp 0x4140f9
mov ecx, dword [ebp - 0x14]
call fcn.00412c70
test edi, edi
sete bh
cmp dword [0x6e4b28], 0
je 0x414116
test bl, bl
je 0x414116
push 0x6cee28
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, bh
call fcn.00573dda
ret
Function at 0x4142f8
Capabilities:
Delete registry value

Disassembly:
push 0x10
mov eax, 0x5b872a
call fcn.00573e11
mov esi, ecx
mov dword [ebp - 0x14], esi
and dword [ebp - 0x18], 0
and dword [ebp - 0x1c], 0
xor bl, bl
cmp dword [0x6e4b28], 0
mov byte [ebp - 0xd], bl
je 0x41432f
inc bl
push 0x6cee28
mov byte [ebp - 0xd], bl
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
and dword [ebp - 4], 0
lea edx, [ebp - 0x18]
movzx eax, word [esi + 0x10]
mov ecx, dword [esi + 0xc]
shr eax, 1
push 0
and eax, 0x10
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00412cfe
mov edi, eax
test edi, edi
jne 0x4143db
cmp dword [esi], edi
mov eax, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x18]
jne 0x41436c
test eax, eax
jne 0x414368
mov eax, dword [esi]
push 0
jmp 0x414377
test eax, eax
jne 0x414372
mov eax, dword [esi]
mov ecx, dword [ebp - 0x14]
push dword [ecx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edi, eax
mov ecx, edi
call fcn.004129b9
test eax, eax
je 0x4143d4
mov eax, dword [ebp - 0x14]
push esi
mov eax, dword [eax + 0xc]
movzx eax, word [eax + 6]
and eax, 0xf
imul eax, eax, 0xc
and dword [eax + 0x6c2310], 0
call fcn.00412b66
and dword [ebp - 0x18], 0
cmp dword [0x6e4b28], 0
mov esi, dword [ebp - 0x14]
je 0x414311
test bl, bl
je 0x414311
push 0x6cee28
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x414311
mov ecx, esi
call fcn.00412c70
cmp dword [0x6e4b28], 0
je 0x4143f3
test bl, bl
je 0x4143f3
push 0x6cee28
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
call fcn.00573dda
ret

Function at 0x414433
Capabilities:
Delete registry key

Disassembly:
push 8
mov eax, 0x5b879e
call fcn.00573e11
mov esi, ecx
mov eax, dword [esi + 0xc]
test byte [eax + 6], 0xf
je 0x414454
mov eax, 0xa0
jmp 0x41452a
and dword [ebp - 0x14], 0
xor bl, bl
cmp dword [0x6e4b28], 0
mov byte [ebp - 0xd], bl
je 0x414476
inc bl
push 0x6cee28
mov byte [ebp - 0xd], bl
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
and dword [ebp - 4], 0
lea edx, [ebp - 0x14]
movzx eax, word [esi + 0x10]
mov ecx, dword [esi + 0xc]
shr eax, 1
push 0
and eax, 0x10
mov ecx, dword [ecx + 8]
push eax
push 0
call fcn.00412cfe
mov edi, eax
test edi, edi
jne 0x414510
mov eax, dword [esi + 0xc]
push dword [eax]
mov eax, dword [ebp - 0x14]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov edi, eax
mov ecx, edi
call fcn.004129b9
test eax, eax
je 0x4144fe
mov eax, dword [esi + 0xc]
push dword [ebp - 0x14]
movzx eax, word [eax + 6]
and eax, 0xf
imul eax, eax, 0xc
and dword [eax + 0x6c2310], 0
call fcn.00412b66
and dword [ebp - 0x14], 0
cmp dword [0x6e4b28], 0
je 0x414458
test bl, bl
je 0x414458
push 0x6cee28
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x414458
mov ecx, dword [ebp - 0x14]
call fcn.00412c70
push 0
push dword [esi + 0xc]
call fcn.00412b1e
cmp dword [0x6e4b28], 0
je 0x414528
test bl, bl
je 0x414528
push 0x6cee28
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
call fcn.00573dda
ret
Function at 0x4145a7
Capabilities:
Query or enumerate registry key

Disassembly:
push 0xc
mov eax, 0x5b87d4
call fcn.00573e7c
mov edi, edx
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
call fcn.0041411e
test eax, eax
jne 0x4145ca
push 2
pop eax
jmp 0x414629
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], ebx
push eax
lea edx, [ebp - 0x14]
mov ecx, esi
call fcn.004141c3
mov esi, eax
test esi, esi
je 0x4145f3
cmp dword [ebp - 0x14], ebx
je 0x4145ef
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x414629
mov esi, dword [ebp - 0x14]
push ebx
push ebx
push ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov edi, eax
test esi, esi
je 0x414615
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x414629
call fcn.00573dda
ret 0x18

Function at 0x414631
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xc
mov eax, 0x5b87ef
call fcn.00573e7c
mov edi, edx
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
call fcn.0041411e
test eax, eax
jne 0x414654
push 2
pop eax
jmp 0x4146b5
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], ebx
push eax
lea edx, [ebp - 0x14]
mov ecx, esi
call fcn.004141c3
mov esi, eax
test esi, esi
je 0x41467d
cmp dword [ebp - 0x14], ebx
je 0x414679
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x4146b5
mov esi, dword [ebp - 0x14]
push ebx
push ebx
push dword [ebp + 0x14]
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov edi, eax
test esi, esi
je 0x4146a1
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x4146b5
call fcn.00573dda
ret 0x18
Function at 0x414b8b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x6c10c8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor bl, bl
call fcn.0056cdae
test eax, eax
je 0x414cae
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x218]
push edi
push eax
push 0x20019
xor edi, edi
push edi
push str.SoftwareMicrosoftOffice16.0common_filespaths
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x218], edi
mov dword [ebp - 0x214], edi
call esi
test eax, eax
jne 0x414c80
lea eax, [ebp - 0x214]
push eax
push 0x20119
push edi
push str.SoftwareMicrosoftOffice16.0common_filespaths
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x414c80
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x210]
mov dword [ebp - 0x21c], 0x20a
push eax
lea eax, [ebp - 0x220]
push eax
push edi
push str.mso.dll
push dword [ebp - 0x218]
call esi
test eax, eax
jne 0x414c80
inc eax
cmp dword [ebp - 0x220], eax
jne 0x414c80
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x21c], 0x20a
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x220]
push eax
push edi
push str.mso.dll
push dword [ebp - 0x214]
call esi
test eax, eax
jne 0x414c80
inc eax
movzx ebx, bl
cmp dword [ebp - 0x220], eax
cmove ebx, eax
mov eax, dword [ebp - 0x214]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x414c99
push eax
mov dword [ebp - 0x214], edi
call esi
mov eax, dword [ebp - 0x218]
test eax, eax
je 0x414cac
push eax
mov dword [ebp - 0x218], edi
call esi
pop edi
pop esi
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.00573599
mov esp, ebp
pop ebp
ret
Function at 0x4157e0
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
and dword [ebp - 4], 0
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], 0x40
push 0x80
lea ecx, [ebp - 4]
mov edi, edx
call fcn.0040fa23
test al, al
mov eax, dword [ebp - 4]
je 0x415907
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push edi
call dword [sym.imp.Secur32.dll_GetUserNameExW]
test al, al
jne 0x4158d8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
je 0x415889
cmp eax, 0x534
je 0x4158f2
cmp eax, 0x54b
je 0x4158f2
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x14], vtable.Mso::Logging::StructuredObject_unsigned_int__1_.0
push eax
push str.GetUserNameExW_failed_1
push ecx
mov dword [ebp - 0x10], str.EXTENDED_NAME_FORMAT
mov ecx, 0x11ce1a1
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x1c], str.LastError
mov dword [ebp - 0x20], 0x6454d4
call fcn.004159d1
jmp 0x4158f2
mov eax, dword [ebp - 8]
lea ecx, [ebp - 4]
add eax, eax
push eax
call fcn.0040fa23
test al, al
je 0x4158f2
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push edi
call dword [sym.imp.Secur32.dll_GetUserNameExW]
test al, al
jne 0x415904
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], vtable.Mso::Logging::StructuredObject_unsigned_int__1_.0
push eax
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x1c], str.EXTENDED_NAME_FORMAT
mov dword [ebp - 0x18], edi
call fcn.00415509
push eax
push str.GetUserNameExW_failed_2
push ecx
mov ecx, 0x11ce1a2
jmp 0x415882
mov eax, dword [ebp - 8]
lea eax, [eax*2 + 2]
push eax
lea eax, [ebp - 4]
push eax
call fcn.0056eee3
pop ecx
pop ecx
test eax, eax
jne 0x415904
mov eax, dword [ebp - 4]
test eax, eax
je 0x415907
and dword [ebp - 4], 0
push eax
call fcn.0056eede
pop ecx
mov eax, dword [ebp - 4]
mov dword [esi], eax
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x415fe7
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x6c10c8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x208
xor esi, esi
lea eax, [ebp - 0x20c]
push esi
push eax
mov edi, ecx
call fcn.00576720
add esp, 0xc
xor eax, eax
mov word [edi], ax
lea eax, [ebp - 0x20c]
push esi
push 0x2b
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x416050
cmp word [ebp - 0x20c], si
je 0x416050
push ecx
push edi
mov edx, str.Microsoft_Shared
lea ecx, [ebp - 0x20c]
call fcn.00416062
mov esi, eax
test esi, esi
jne 0x416052
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00573599
mov esp, ebp
pop ebp
ret
Function at 0x446fd8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5bd4b0
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x6c10c8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 0x14]
xor ebx, ebx
mov ecx, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x1c]
mov dword [edi], 0x633618
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0xc]
push ecx
mov dword [edi + 8], ebx
lea ecx, [edi + 0x24]
mov dword [edi + 0xc], ebx
mov dword [edi + 0x20], eax
call fcn.00410e05
mov dword [ebp - 4], ebx
mov dword [edi + 0x2c], ebx
mov dword [edi + 0x30], ebx
mov ebx, dword [esi + 4]
mov esi, dword [esi]
test ebx, ebx
je 0x447050
lock inc dword [ebx + 4]
mov ecx, dword [edi + 0x30]
test ecx, ecx
je 0x44705c
call fcn.00411ee7
mov dword [edi + 0x30], ebx
mov dword [edi + 0x2c], esi
mov eax, dword [ebp - 0x24]
mov dword [ebp - 4], 1
and dword [edi + 0x34], 0
and dword [edi + 0x38], 0
mov esi, dword [eax + 4]
mov ebx, dword [eax]
test esi, esi
je 0x447081
lock inc dword [esi + 4]
mov ecx, dword [edi + 0x38]
test ecx, ecx
je 0x44708d
call fcn.00411ee7
push dword [ebp - 0x28]
or dword [ebp - 4], 0xffffffff
lea ecx, [edi + 0x3c]
mov dword [edi + 0x38], esi
mov dword [edi + 0x34], ebx
call fcn.00410e05
push dword [ebp - 0x2c]
lea ecx, [edi + 0x44]
call fcn.00410e05
mov ecx, dword [edi + 0x24]
xor eax, eax
mov byte [edi + 0x4c], al
test ecx, ecx
jne 0x4470c3
push 0x59c38b
call fcn.0056c1fd
cmp dword [edi + 0x2c], eax
jne 0x4470cf
push 0x6d348b
jmp 0x4470be
cmp dword [edi + 0x34], eax
jne 0x4470db
push 0x84f8d9
jmp 0x4470be
cmp dword [edi + 0x3c], eax
jne 0x4470e7
push 0x108e00a
jmp 0x4470be
cmp dword [edi + 0x44], eax
jne 0x4470f3
push 0x108989f
jmp 0x4470be
mov eax, dword [ecx]
lea edx, [ebp - 0x30]
push edx
call dword [eax + 0x30]
mov ecx, eax
mov eax, dword [ecx]
mov dword [edi + 0x10], eax
mov eax, dword [ecx + 4]
mov dword [edi + 0x14], eax
mov eax, dword [ecx]
mov dword [edi + 0x18], eax
mov eax, dword [ecx + 4]
mov ecx, edi
mov dword [edi + 0x1c], eax
lea eax, [ebp - 0x20]
push eax
call fcn.0044737c
cmp byte [ebp - 0x20], 0
je 0x447131
mov ecx, dword [ebp - 0x18]
mov dword [edi + 8], ecx
mov ecx, dword [ebp - 0x14]
mov dword [edi + 0xc], ecx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00573599
mov esp, ebp
pop ebp
ret 0x18
Function at 0x453de1
Capabilities:
Parse credit card information

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
mov bl, 1
xor cl, cl
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x453f45
mov edx, 0x10000000
cmp eax, 0x7c
je 0x453f45
cmp eax, 0x29
jne 0x453e1c
cmp dword [esi + 0x10], 0
jne 0x453f45
test dword [esi + 0x50], edx
je 0x453f4b
cmp eax, 0x2e
jne 0x453e37
push 5
lea ecx, [esi + 0x24]
call fcn.0045403b
mov ecx, esi
call fcn.00453dbc
jmp 0x453f2d
cmp eax, 0x5c
jne 0x453e94
mov ecx, esi
call fcn.00453dbc
mov eax, dword [esi + 0x50]
and eax, 0x80
je 0x453e6a
cmp word [esi + 0x48], 0x62
jne 0x453e6a
push 4
lea ecx, [esi + 0x24]
call fcn.0045403b
mov ecx, esi
call fcn.00453dbc
jmp 0x453f34
test eax, eax
je 0x453e88
cmp word [esi + 0x48], 0x42
jne 0x453e88
push 4
lea ecx, [esi + 0x24]
call fcn.0045403b
mov eax, dword [esi + 0x28]
xor dword [eax + 8], 1
jmp 0x453e5e
mov ecx, esi
call fcn.004544fb
jmp 0x453f2d
cmp eax, 0x5b
jne 0x453eb8
mov ecx, esi
call fcn.00453dbc
mov ecx, esi
call fcn.004544af
cmp dword [esi + 0x4c], 0x5d
je 0x453e2b
push 4
jmp 0x453f4d
cmp eax, 0x28
jne 0x453ed5
mov ecx, esi
call fcn.00453dbc
mov ecx, esi
call fcn.004545eb
cmp dword [esi + 0x4c], 0x29
mov bl, al
je 0x453f22
jmp 0x453f4b
cmp eax, 0x5e
jne 0x453ee1
push 2
jmp 0x453e56
cmp eax, 0x24
jne 0x453eed
push 3
jmp 0x453e56
cmp eax, 0x2a
je 0x453f41
cmp eax, 0x2b
je 0x453f41
cmp eax, 0x3f
je 0x453f41
cmp eax, 0x7b
je 0x453f41
cmp eax, 0x7d
jne 0x453f0b
test dword [esi + 0x50], edx
je 0x453f3d
cmp eax, 0x5d
jne 0x453f15
test dword [esi + 0x50], edx
je 0x453eb1
movzx eax, word [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.004547a1
mov ecx, esi
call fcn.00453dbc
test bl, bl
je 0x453f34
mov ecx, esi
call fcn.004546dd
mov cl, 1
mov bl, cl
jmp 0x453dea
push 6
jmp 0x453f4d
push 0xa
jmp 0x453f4d
pop esi
mov al, cl
pop ebx
pop ecx
ret
push 5
call fcn.0057022c
int3
Function at 0x4565f2
Capabilities:
Encode data using xor
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov esi, ecx
push edi
push 0x10
mov dword [ebp - 0x10], esi
lea ebx, [esi + 0x20]
mov ecx, ebx
pop edx
mov eax, dword [ecx]
bswap eax
mov dword [ecx], eax
lea ecx, [ecx + 4]
sub edx, 1
jne 0x456608
push 0x40
lea ecx, [esi + 0x28]
pop edx
mov eax, dword [ecx + 0x2c]
xor eax, dword [ecx + 0x18]
xor eax, dword [ecx - 8]
xor eax, dword [ecx]
lea ecx, [ecx + 4]
rol eax, 1
mov dword [ecx + 0x34], eax
sub edx, 1
jne 0x45661c
mov eax, dword [esi + 0xc]
mov ecx, eax
mov edx, dword [esi + 0x1c]
mov edi, dword [esi + 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 0x18]
mov esi, dword [ebp - 0x14]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov dword [ebp - 0x18], 0x14
jmp 0x456663
mov eax, dword [ebp - 4]
mov edx, ecx
mov ecx, esi
not ecx
rol edx, 5
and ecx, eax
mov eax, edi
and eax, esi
or ecx, eax
mov eax, dword [ebp - 8]
add edx, ecx
mov ecx, dword [ebp - 4]
add edx, dword [ebx]
lea ebx, [ebx + 4]
add eax, edx
mov dword [ebp - 8], ecx
mov edx, edi
mov edi, esi
mov esi, dword [ebp - 0xc]
rol edi, 0x1e
sub dword [ebp - 0x18], 1
lea ecx, [eax + 0x5a827999]
mov dword [ebp - 4], edx
mov dword [ebp - 0xc], ecx
jne 0x456660
mov eax, dword [ebp - 0x10]
mov ebx, esi
add eax, 0x70
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], 0x14
mov esi, eax
mov eax, ecx
mov ecx, edx
xor ecx, edi
rol eax, 5
add eax, dword [ebp - 8]
xor ecx, ebx
add ecx, 0x6ed9eba1
mov dword [ebp - 8], edx
mov edx, edi
add ecx, eax
add ecx, dword [esi]
mov edi, ebx
mov ebx, dword [ebp - 0xc]
lea esi, [esi + 4]
rol edi, 0x1e
sub dword [ebp - 0x18], 1
mov dword [ebp - 0xc], ecx
jne 0x4566b6
mov eax, dword [ebp - 0x10]
mov esi, edx
add eax, 0xc0
mov dword [ebp - 4], edx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], 0x14
mov edx, ecx
mov eax, edi
mov ecx, edi
rol edx, 5
add edx, dword [ebp - 8]
or ecx, ebx
and ecx, esi
mov dword [ebp - 8], esi
and eax, ebx
mov esi, edi
or ecx, eax
mov edi, ebx
mov eax, dword [ebp - 0x14]
add ecx, 0x8f1bbcdc
add dword [ebp - 0x14], 4
mov ebx, dword [ebp - 0xc]
rol edi, 0x1e
add ecx, dword [eax]
add ecx, edx
sub dword [ebp - 0x18], 1
mov dword [ebp - 0xc], ecx
jne 0x4566fe
mov eax, dword [ebp - 0x10]
mov edx, esi
add eax, 0x110
mov dword [ebp - 4], esi
push 0x14
mov dword [ebp - 0x14], eax
pop esi
mov eax, edx
rol ecx, 5
mov edx, dword [ebp - 0x14]
xor eax, edi
add dword [ebp - 0x14], 4
xor eax, ebx
add ecx, 0xca62c1d6
add ecx, dword [ebp - 8]
add eax, dword [edx]
mov edx, dword [ebp - 4]
add eax, ecx
mov dword [ebp - 8], edx
mov ecx, eax
mov edx, edi
mov edi, ebx
mov ebx, dword [ebp - 0xc]
rol edi, 0x1e
mov dword [ebp - 4], edx
mov dword [ebp - 0xc], eax
sub esi, 1
jne 0x45674c
mov esi, dword [ebp - 0x10]
add eax, dword [ebp - 0x1c]
add dword [esi + 0x10], ebx
add dword [esi + 0x14], edi
add dword [esi + 0x18], edx
mov dword [esi + 0xc], eax
mov eax, dword [ebp - 8]
add dword [esi + 0x1c], eax
add dword [esi], 0x200
pop edi
adc dword [esi + 4], 0
and dword [esi + 8], 0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x457636
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x194
mov eax, dword [0x6c10c8]
xor eax, esp
mov dword [esp + 0x190], eax
push ebx
xor ebx, ebx
mov dword [esp + 0x1c], 0x67452301
push esi
xorps xmm0, xmm0
mov dword [esp + 0x24], 0xefcdab89
mov edx, ebx
movlpd qword [esp + 0x14], xmm0
push edi
mov edi, ecx
mov dword [esp + 0x20], edx
mov dword [esp + 0x2c], 0x98badcfe
mov esi, ebx
mov dword [esp + 0x30], 0x10325476
mov dword [esp + 0x34], 0xc3d2e1f0
mov al, byte [esi + 0x635ef0]
mov byte [esp + edx + 0x38], al
mov edx, dword [esp + 0x20]
inc edx
mov dword [esp + 0x20], edx
cmp edx, 0x40
jne 0x4576b5
lea ecx, [esp + 0x18]
call fcn.004565f2
mov edx, dword [esp + 0x20]
inc esi
cmp esi, 0x10
jne 0x457690
cmp word [edi], bx
je 0x457771
mov esi, ebx
movzx edx, word [edi]
xor ecx, ecx
mov dword [esp + 0x14], 0x3ff
inc ecx
add edi, 2
lea eax, [edx + 0x2800]
cmp ax, word [esp + 0x14]
ja 0x457713
movzx eax, word [edi]
mov dword [esp + 0x14], 0xdc00
cmp word [esp + 0x14], ax
ja 0x457713
mov dword [esp + 0x14], 0xe000
cmp ax, word [esp + 0x14]
jae 0x457713
push 2
mov word [esp + esi*2 + 0x182], ax
add edi, 2
pop ecx
mov word [esp + esi*2 + 0x17c], dx
add esi, ecx
cmp word [edi], bx
sete al
mov byte [esp + 0x13], al
test al, al
jne 0x457730
cmp esi, 0xf
jb 0x4576c6
push ebx
push ebx
push ebx
push esi
lea eax, [esp + 0x18c]
push eax
push esi
push eax
push 0xa00
push 0x5edbac
call dword [sym.imp.KERNEL32.dll_LCMapStringEx]
lea eax, [esi + esi]
push eax
lea eax, [esp + 0x180]
push eax
lea ecx, [esp + 0x20]
call fcn.004565b9
cmp byte [esp + 0x13], bl
je 0x4576c4
mov edx, dword [esp + 0x20]
mov esi, edx
xor edi, edi
shl esi, 3
add esi, dword [esp + 0x18]
adc edi, dword [esp + 0x1c]
mov byte [esp + edx + 0x38], 0x80
jmp 0x45778b
mov byte [esp + eax + 0x38], bl
mov eax, dword [esp + 0x20]
inc eax
mov dword [esp + 0x20], eax
cmp eax, 0x40
jne 0x4577a6
lea ecx, [esp + 0x18]
call fcn.004565f2
mov eax, dword [esp + 0x20]
cmp eax, 0x38
jne 0x457787
bswap esi
bswap edi
lea ecx, [esp + 0x18]
mov dword [esp + 0x70], edi
mov dword [esp + 0x74], esi
call fcn.004565f2
mov eax, dword [esp + ebx*4 + 0x24]
bswap eax
mov dword [esp + ebx*4 + 0x24], eax
inc ebx
cmp ebx, 5
jne 0x4577c0
mov al, byte [esp + 0x2b]
lea esi, [esp + 0x24]
and al, 0xf
mov ecx, dword [esp + 0x19c]
or al, 0x50
mov byte [esp + 0x2b], al
mov eax, dword [ebp + 8]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00573599
mov esp, ebp
pop ebp
ret 4