joyce8/EMBER2024-capa huggingface dataset:
Function at 0x51c400
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x563ff6
mov eax, dword fs:[0]
push eax
sub esp, 0x428
mov eax, dword [0x5c3678]
xor eax, esp
mov dword [esp + 0x420], eax
push ebx
push esi
push edi
mov eax, dword [0x5c3678]
xor eax, esp
push eax
lea eax, [esp + 0x438]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov esi, ecx
xor ecx, ecx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x440], ecx
mov dword [esp + 0x20], edx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x24], ecx
push 2
push ecx
push eax
mov byte [esp + 0x44c], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x51c485
call fcn.004207a0
mov esi, eax
jmp 0x51c553
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x51c49e
call fcn.004207a0
jmp 0x51c54a
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [esp + 0x14], eax
test eax, eax
jne 0x51c4b8
call fcn.004207a0
jmp 0x51c54a
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
lea eax, [ebx + 1]
cmp eax, ebx
jae 0x51c4ef
lea eax, [esp + 0x28]
cmp dword [esp + 0x24], eax
je 0x51c4dc
lea eax, [esp + 0x24]
call fcn.0051b2e0
lea esi, [esp + 0x18]
call fcn.0051b2c0
mov eax, 0x8007000e
jmp 0x51c572
lea esi, [esp + 0x24]
call fcn.0051ac60
mov dword [esp + 0x440], 1
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x51c512
mov esi, 0x8007000e
jmp 0x51c54c
mov ecx, dword [esp + 0x14]
push ebx
push eax
push ebx
push ecx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x51c52f
call fcn.004207a0
jmp 0x51c54a
mov ecx, dword [esp + 0x24]
xor edx, edx
mov word [ecx + eax*2], dx
mov edx, dword [ebp + 0x10]
mov ecx, dword [esp + 0x24]
push edx
lea edx, [esp + 0x20]
call fcn.0051c2a0
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [esp + 0x28]
cmp dword [esp + 0x24], eax
je 0x51c570
lea eax, [esp + 0x24]
call fcn.0051b2e0
jmp 0x51c570
mov eax, esi
mov ecx, dword [esp + 0x438]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x420]
xor ecx, esp
call fcn.0053c15d
mov esp, ebp
pop ebp
ret 0xc
Function at 0x5214c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x574501
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5c3678]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov eax, esi
call fcn.0046faa0
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
xor ebx, ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], eax
lea edi, [esi + 0x54]
mov dword [ebp - 4], ebx
push edi
mov dword [esi + 0x50], vtable.WTL::CMessageFilter.0
call fcn.004ac300
mov ecx, dword [ebp + 0xc]
mov dword [esi + method.boost::exception_detail::clone_base.virtual_0], vtable.CMenuItemSetter.0
mov dword [esi + method.IFontIconCBSimpleImpl_class_CSettingsPage_.virtual_0], vtable.IFontIconCBSimpleImpl_class_CSettingsPage_.0
mov dword [esi], vtable.CSettingsPage.0
mov dword [esi + 0x2c], vtable.CSettingsPage.1.0
mov dword [esi + 0x50], vtable.CSettingsPage.2.0
mov dword [edi], vtable.CSettingsPage.3.0
mov dword [esi + method.CSettingsPage.4.virtual_0], vtable.CSettingsPage.4.0
mov dword [esi + method.IFontIconCBSimpleImpl_class_CSettingsPage_.virtual_0], vtable.CSettingsPage.5.0
mov dword [esi + 0x1a8], ecx
mov dword [esi + 0x1ac], ebx
mov dword [esi + 0x1b0], ebx
mov dword [esi + 0x1b4], ebx
mov dword [esi + 0x1b8], ebx
mov dword [esi + 0x1bc], ebx
mov dword [esi + 0x1c0], ebx
mov dword [esi + 0x1c4], ebx
mov dword [esi + 0x1c8], ebx
mov byte [ebp - 4], 5
mov dword [esi + 0x1cc], 0x1f4
mov dword [esi + 0x1d0], ebx
mov byte [esi + 0x1d4], bl
mov edx, dword [0x5cc90c]
mov eax, dword [edx + 0xc]
mov ecx, 0x5cc90c
call eax
add eax, 0x10
mov dword [esi + 0x1d8], eax
mov byte [ebp - 4], 6
mov byte [esi + 0x1dc], bl
mov dword [esi + 0x1e0], ebx
mov byte [esi + 0x1e4], bl
mov byte [esi + 0x1e5], 1
mov byte [esi + 0x1e6], bl
mov byte [esi + 0x1e7], bl
mov edx, dword [0x5cc90c]
mov eax, dword [edx + 0xc]
mov ecx, 0x5cc90c
call eax
add eax, 0x10
mov dword [esi + 0x1e8], eax
lea ecx, [ebp + 0xc]
push ecx
mov byte [ebp - 4], 7
mov ecx, str.Account
mov dword [esi + 0x1ec], ebx
call fcn.00423950
lea edx, [ebp + 0xc]
push edx
lea eax, [esi + 0x1f0]
push eax
mov byte [ebp - 4], 8
call fcn.00481a10
mov byte [ebp - 4], 7
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x521658
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x5249d0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5718e0
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x5c3678]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0x1ac], 0
sete al
test al, al
jne 0x524b60
lea esi, [ebp - 0x18]
call fcn.00476bf0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x524b60
mov eax, dword [edi + 0x1ec]
test eax, eax
je 0x524a42
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x24]
push ecx
call eax
mov dword [edi + 0x1ec], 0
lea ecx, [ebp - 0xd]
push ecx
lea edx, [ebp - 0x14]
push edx
call fcn.0045c500
add esp, 8
mov byte [ebp - 4], 1
cmp byte [ebp + 8], 0
jne 0x524a9a
mov eax, dword [ebp - 0x14]
cmp dword [eax - 0xc], 0
je 0x524a9a
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x524a9a
mov ecx, dword [edi + 0x30]
mov esi, dword [ebp - 0x14]
lea eax, [ebp + 8]
push eax
push str.IDI_PROFILE_MASK
push ecx
mov dword [ebp + 8], 0x60
call fcn.00476e70
mov ecx, eax
add esp, 0xc
mov eax, esi
call fcn.00477030
jmp 0x524aad
mov edx, dword [edi + 0x30]
push 0
push str.IDI_PROFILE_DEF
push edx
call fcn.004779d0
add esp, 0xc
mov dword [edi + 0x1ec], eax
mov eax, dword [edi + 0x1ac]
test eax, eax
jne 0x524ac7
push 0x80004003
call fcn.0053c010
push 1
push 0xacb2
lea esi, [ebp + 8]
call fcn.0046fb00
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
call fcn.00483950
mov byte [ebp - 4], 4
mov eax, dword [ebp + 8]
test eax, eax
je 0x524af5
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov esi, dword [ebp - 0x1c]
test esi, esi
je 0x524b1b
mov edi, dword [edi + 0x1ec]
mov eax, dword [esi]
mov ecx, dword [eax + 0x108]
push edi
push esi
call ecx
mov edx, dword [esi]
mov eax, dword [edx + 0x9c]
push 1
push esi
call eax
mov byte [ebp - 4], 1
test esi, esi
je 0x524b2b
mov ecx, dword [esi]
mov edx, dword [ecx + 8]
push esi
call edx
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x524b4e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x525de0
Capabilities:
Copy file
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
call fcn.00424330
mov esi, eax
call fcn.004246f0
test eax, eax
setne al
mov byte [ebp - 8], al
mov ecx, dword [ebp - 8]
push ecx
lea edx, [ebp - 4]
push edx
call fcn.0045c820
mov eax, dword [ebp - 4]
add esp, 8
cmp dword [eax - 0xc], 0
je 0x525e54
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push eax
call ebx
mov eax, dword [ebp - 4]
mov ecx, dword [edi + 0x1d8]
push 0
lea esi, [edi + 0x1d8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
cmp byte [edi + 0x1dc], 0
je 0x525e45
mov edx, dword [esi]
push edx
call ebx
mov byte [edi + 0x1dc], 0
call fcn.00423a80
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x525e70
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x52c8c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
test eax, eax
jne 0x52c8ce
xor al, al
mov esp, ebp
pop ebp
ret
push esi
lea ecx, [ebp - 4]
push ecx
push 0
push eax
push 0x52c8a0
push 0
push 0
mov dword [ebp - 4], 0
call fcn.0053d041
mov esi, eax
add esp, 0x18
cmp esi, 0xffffffff
je 0x52c8f9
test esi, esi
jne 0x52c900
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 8]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x52c920
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
test edi, edi
jne 0x52c92e
xor al, al
mov esp, ebp
pop ebp
ret
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x52c933
sub eax, edx
sar eax, 1
xor ecx, ecx
inc eax
mov edx, 2
mul edx
seto cl
push 0x5cc9fe
neg ecx
or ecx, eax
push ecx
call fcn.0053d8d6
add esp, 8
test eax, eax
je 0x52c928
push esi
mov esi, eax
mov ecx, edi
sub esi, edi
lea esp, [esp]
movzx edx, word [ecx]
mov word [esi + ecx], dx
add ecx, 2
test dx, dx
jne 0x52c970
lea ecx, [ebp - 4]
push ecx
push 0
push eax
push 0x52c870
push 0
push 0
mov dword [ebp - 4], 0
call fcn.0053d041
add esp, 0x18
pop esi
cmp eax, 0xffffffff
je 0x52c928
test eax, eax
je 0x52c928
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x5308d0
Capabilities:
Create new key via cryptacquirecontext
Generate random numbers via winapi

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
push 0xf0000000
push 1
push 0
push 0
lea eax, [esp + 0x14]
push eax
call esi
test eax, eax
jne 0x530913
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090016
je 0x530900
xor al, al
pop esi
pop ecx
ret
push 8
push 1
push 0
push 0
lea ecx, [esp + 0x14]
push ecx
call esi
test eax, eax
je 0x5308fb
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 4]
push ebx
push edx
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov edx, dword [esp + 8]
push 0
test eax, eax
push edx
setne bl
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov al, bl
pop ebx
pop esi
pop ecx
ret

Function at 0x530d00
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
or eax, 0xffffffff
test ecx, ecx
je 0x530d2c
push esi
jmp 0x530d10
movsx esi, byte [edx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x5c52d0]
dec ecx
inc edx
test ecx, ecx
jne 0x530d10
pop esi
not eax
ret
Function at 0x530d30
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x54
mov eax, dword [0x5c3678]
xor eax, esp
mov dword [esp + 0x50], eax
mov eax, dword [esp + 0x5c]
push esi
push edi
mov edi, edx
mov edx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 8], edx
lea edx, [esp + 8]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
push edx
lea eax, [esp + 0x1c]
call fcn.00533500
mov esi, dword [esp + 0x64]
lea eax, [esp + 0x1c]
mov edx, eax
add esp, 4
xor ecx, ecx
sub esi, eax
sub edi, edx
mov edi, edi
lea eax, [esp + ecx + 0x18]
mov dl, byte [esi + eax]
xor dl, byte [eax]
inc ecx
cmp ecx, 0x30
mov byte [edi + eax], dl
jl 0x530d80
mov ecx, dword [esp + 0x58]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.0053c15d
add esp, 0x54
ret

Function at 0x530e70
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x80
push ebx
mov ebx, dword [esp + 0x88]
push ebp
push esi
push edi
push 0x583128
push ebx
mov ecx, 0x20
mov esi, ebx
lea edi, [esp + 0x18]
push ebx
rep movsd dword es:[edi], dword [esi]
call fcn.00530db0
mov ecx, dword [ebx + 0x7c]
shr ecx, 7
and ecx, 1
lea edi, [esp + 0x1c]
lea ebp, [esp + 0x20]
add esp, 0xc
neg ecx
xor edx, edx
sub edi, ebx
lea eax, [ebx + 8]
sub ebp, ebx
lea esp, [esp]
mov esi, dword [eax - 8]
mov ebx, dword [esp + edx*4 + 0x10]
xor ebx, esi
and ebx, ecx
xor ebx, esi
mov esi, dword [eax - 4]
mov dword [eax - 8], ebx
mov ebx, dword [esp + edx*4 + 0x14]
xor ebx, esi
and ebx, ecx
xor ebx, esi
mov esi, dword [eax]
mov dword [eax - 4], ebx
mov ebx, dword [edi + eax]
xor ebx, esi
and ebx, ecx
xor ebx, esi
mov esi, dword [eax + 4]
mov dword [eax], ebx
mov ebx, dword [eax + ebp]
xor ebx, esi
and ebx, ecx
xor ebx, esi
mov dword [eax + 4], ebx
add edx, 4
add eax, 0x10
cmp edx, 0x20
jb 0x530ec0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x80
ret

Function at 0x531a80
Capabilities:
Encrypt data using curve25519

Disassembly:
sub esp, 0x1a4
mov eax, dword [0x5c3678]
xor eax, esp
mov dword [esp + 0x1a0], eax
mov eax, dword [esp + 0x1a8]
push 0x20
push eax
lea ecx, [esp + 0x188]
push ecx
call fcn.00545f90
mov dl, byte [esp + 0x1ab]
and byte [esp + 0x18c], 0xf8
and dl, 0x3f
or dl, 0x40
add esp, 0xc
mov byte [esp + 0x19f], dl
xor eax, eax
lea esp, [esp]
movzx ecx, byte [eax + edi]
mov dword [esp + eax*4], ecx
inc eax
cmp eax, 0x20
jb 0x531ad0
lea edx, [esp + 0x180]
push edx
lea eax, [esp + 4]
push eax
call fcn.00531310
lea ecx, [esp + 0x88]
push ecx
mov eax, ecx
call fcn.00531690
lea edx, [esp + 0x8c]
push edx
lea eax, [esp + 0x110]
push eax
lea edx, [esp + 0x14]
call fcn.00530f20
lea ecx, [esp + 0x114]
push ecx
call fcn.00530e70
add esp, 0x18
xor eax, eax
lea esp, [esp]
mov dl, byte [esp + eax*4 + 0x100]
mov byte [esi + eax], dl
inc eax
cmp eax, 0x20
jb 0x531b30
mov ecx, dword [esp + 0x1a0]
xor ecx, esp
xor eax, eax
call fcn.0053c15d
add esp, 0x1a4
ret
Function at 0x531b60
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
sub esp, 0x44
push ebx
push esi
push edi
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [esp + 0xc], ecx
mov ecx, dword [eax + 8]
mov dword [esp + 0x10], edx
mov edx, dword [eax + 0xc]
mov dword [esp + 0x14], ecx
mov ecx, dword [eax + 0x10]
mov dword [esp + 0x18], edx
mov edx, dword [eax + 0x14]
mov dword [esp + 0x1c], ecx
mov ecx, dword [eax + 0x18]
mov dword [esp + 0x20], edx
mov edx, dword [eax + 0x1c]
mov dword [esp + 0x24], ecx
mov ecx, dword [eax + 0x20]
mov dword [esp + 0x28], edx
mov edx, dword [eax + 0x24]
mov dword [esp + 0x2c], ecx
mov ecx, dword [eax + 0x28]
mov dword [esp + 0x30], edx
mov edx, dword [eax + 0x2c]
mov dword [esp + 0x34], ecx
mov ecx, dword [eax + 0x30]
mov dword [esp + 0x38], edx
mov edx, dword [eax + 0x34]
mov dword [esp + 0x3c], ecx
mov ecx, dword [eax + 0x38]
mov dword [esp + 0x40], edx
mov edx, dword [eax + 0x3c]
mov dword [esp + 0x44], ecx
mov ecx, dword [eax + 0x40]
mov dword [esp + 0x48], edx
xor edx, edx
mov esi, 0x5830d0
mov dword [esp + 0x4c], ecx
mov ecx, eax
sub esi, eax
lea edi, [edx + 0x11]
lea ebx, [ebx]
mov ebx, dword [esi + ecx]
add ebx, dword [ecx]
add ecx, 4
add edx, ebx
movzx ebx, dl
mov dword [ecx - 4], ebx
shr edx, 8
sub edi, 1
jne 0x531bf0
mov edx, dword [eax + 0x40]
shr edx, 7
lea esi, [esp + 0xc]
neg edx
sub esi, eax
mov edi, 0x11
jmp 0x531c20
mov ecx, dword [eax]
mov ebx, dword [esi + eax]
xor ebx, ecx
and ebx, edx
xor ebx, ecx
mov dword [eax], ebx
add eax, 4
sub edi, 1
jne 0x531c20
pop edi
pop esi
pop ebx
add esp, 0x44
ret
Function at 0x5325d0
Capabilities:
Encode data using xor
Encrypt data using aes

Disassembly:
push esi
mov esi, ecx
test esi, esi
je 0x53276e
test eax, eax
je 0x53276e
mov dword [eax + 0xf0], 0xa
mov ecx, dword [esi]
push edi
mov edx, ecx
ror edx, 8
and edx, 0xff00ff00
rol ecx, 8
and ecx, 0xff00ff
or edx, ecx
mov dword [eax], edx
mov edx, dword [esi + 4]
mov edi, edx
ror edi, 8
and edi, 0xff00ff00
rol edx, 8
and edx, 0xff00ff
or edi, edx
mov dword [eax + 4], edi
mov edx, dword [esi + 8]
mov edi, edx
ror edi, 8
and edi, 0xff00ff00
rol edx, 8
and edx, 0xff00ff
or edi, edx
mov dword [eax + 8], edi
mov edx, dword [esi + 0xc]
lea ecx, [eax + 4]
mov esi, edx
ror esi, 8
and esi, 0xff00ff00
rol edx, 8
and edx, 0xff00ff
or esi, edx
mov dword [eax + 0xc], esi
mov edx, esi
shr edx, 0x10
and edx, 0xff
mov edx, dword [edx*4 + 0x5817a8]
xor edx, 0x1000000
mov edi, esi
shr edi, 8
and edi, 0xff
mov edi, dword [edi*4 + 0x581ba8]
and edi, 0xff0000
and edx, 0xff000000
xor edx, edi
mov edi, esi
shr edi, 0x18
movzx edi, byte [edi*4 + 0x5813a8]
xor edx, edi
mov edi, esi
and edi, 0xff
mov edi, dword [edi*4 + 0x580fa8]
and edi, 0xff00
xor edx, edi
xor edx, dword [eax]
mov edi, dword [ecx]
xor edi, edx
mov dword [eax + 0x10], edx
mov edx, dword [eax + 8]
xor edx, edi
mov dword [eax + 0x18], edx
xor edx, esi
mov dword [eax + 0x14], edi
mov dword [eax + 0x1c], edx
mov esi, 0x5830ac
jmp 0x5326e0
mov edx, dword [ecx + 0x18]
add ecx, 0x10
mov eax, edx
shr eax, 8
mov edi, edx
and eax, 0xff
mov eax, dword [eax*4 + 0x581ba8]
shr edi, 0x10
and edi, 0xff
mov edi, dword [edi*4 + 0x5817a8]
and eax, 0xff0000
and edi, 0xff000000
xor eax, edi
mov edi, edx
and edx, 0xff
mov edx, dword [edx*4 + 0x580fa8]
shr edi, 0x18
movzx edi, byte [edi*4 + 0x5813a8]
xor eax, edi
and edx, 0xff00
xor eax, edx
xor eax, dword [ecx - 4]
add esi, 4
xor eax, dword [esi - 4]
mov dword [ecx + 0xc], eax
mov edx, dword [ecx]
xor edx, eax
mov dword [ecx + 0x10], edx
mov eax, dword [ecx + 4]
xor eax, edx
mov dword [ecx + 0x14], eax
mov edx, dword [ecx + 8]
xor edx, eax
mov dword [ecx + 0x18], edx
cmp esi, 0x5830d0
jne 0x5326e0
pop edi
xor eax, eax
pop esi
ret
or eax, 0xffffffff
pop esi
ret
Function at 0x532780
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebx
mov ebx, dword [esp + 8]
mov eax, ebx
call fcn.005325d0
test eax, eax
jl 0x5329b8
mov edx, dword [ebx + 0xf0]
add edx, edx
push esi
add edx, edx
xor esi, esi
push edi
test edx, edx
jle 0x5327ed
lea ecx, [ebx + edx*4 + 8]
lea eax, [ebx + 8]
push ebp
mov edi, edi
mov ebp, dword [ecx - 8]
mov edi, dword [eax - 8]
mov dword [eax - 8], ebp
mov ebp, dword [ecx - 4]
mov dword [ecx - 8], edi
mov edi, dword [eax - 4]
mov dword [eax - 4], ebp
mov ebp, dword [ecx]
mov dword [ecx - 4], edi
mov edi, dword [eax]
mov dword [eax], ebp
mov ebp, dword [ecx + 4]
mov dword [ecx], edi
mov edi, dword [eax + 4]
mov dword [eax + 4], ebp
mov dword [ecx + 4], edi
add esi, 4
sub edx, 4
add eax, 0x10
sub ecx, 0x10
cmp esi, edx
jl 0x5327b0
pop ebp
mov edx, 1
cmp dword [ebx + 0xf0], edx
jle 0x5329b4
lea eax, [ebx + 2]
mov ecx, dword [eax + 0xe]
movzx edi, byte [eax + 0xf]
mov edi, dword [edi*4 + 0x5813a8]
add eax, 0x10
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x5813a8]
and esi, 0xff
mov esi, dword [esi*4 + 0x581fa8]
and edi, 0xff
xor esi, dword [edi*4 + 0x5827a8]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x5813a8]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x582ba8]
movzx ecx, byte [eax]
mov ecx, dword [ecx*4 + 0x5813a8]
movzx edi, byte [eax + 3]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x5823a8]
mov ecx, dword [eax + 2]
mov dword [eax - 2], esi
mov edi, dword [edi*4 + 0x5813a8]
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x5813a8]
and esi, 0xff
mov esi, dword [esi*4 + 0x581fa8]
and edi, 0xff
xor esi, dword [edi*4 + 0x5827a8]
movzx edi, byte [eax + 4]
mov edi, dword [edi*4 + 0x5813a8]
and edi, 0xff
xor esi, dword [edi*4 + 0x5823a8]
movzx edi, byte [eax + 7]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x5813a8]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x582ba8]
mov ecx, dword [eax + 6]
mov dword [eax + 2], esi
mov edi, dword [edi*4 + 0x5813a8]
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x5813a8]
and esi, 0xff
mov esi, dword [esi*4 + 0x581fa8]
and edi, 0xff
xor esi, dword [edi*4 + 0x5827a8]
movzx edi, byte [eax + 8]
mov edi, dword [edi*4 + 0x5813a8]
and edi, 0xff
xor esi, dword [edi*4 + 0x5823a8]
movzx edi, byte [eax + 0xb]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x5813a8]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x582ba8]
mov ecx, dword [eax + 0xa]
mov dword [eax + 6], esi
mov edi, dword [edi*4 + 0x5813a8]
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x5813a8]
and esi, 0xff
mov esi, dword [esi*4 + 0x581fa8]
and edi, 0xff
xor esi, dword [edi*4 + 0x5827a8]
movzx edi, byte [eax + 0xc]
mov edi, dword [edi*4 + 0x5813a8]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x5813a8]
and edi, 0xff
xor esi, dword [edi*4 + 0x5823a8]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x582ba8]
inc edx
mov dword [eax + 0xa], esi
cmp edx, dword [ebx + 0xf0]
jl 0x532801
pop edi
xor eax, eax
pop esi
pop ebx
ret
Function at 0x533e40
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x68
mov eax, dword [0x5c3678]
xor eax, esp
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x6c]
xor ecx, ecx
push esi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], ecx
push eax
mov eax, dword [esp + 0x78]
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.005379e0
add esp, 4
lea esi, [esp + 8]
mov ecx, edi
call fcn.00537a80
mov ecx, dword [esp + 0x64]
pop esi
xor ecx, esp
call fcn.0053c15d
add esp, 0x68
ret
Function at 0x533fb0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x14
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
push esi
push edi
mov esi, eax
lea eax, [esp + 0x1c]
push eax
push 0x20119
xor edi, edi
push edi
push str.SOFTWARE360MachineSignature
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x34], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x534143
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
lea ecx, [esp + 0x14]
push ecx
mov dword [esi + 0x10], eax
push ebx
mov dword [esi + 0x14], eax
lea edx, [esp + 0x20]
push edx
mov dword [esi + 0x18], eax
push eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov eax, dword [esp + 0x2c]
push str.Operator
mov edi, 0x400
push eax
mov dword [esp + 0x2c], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x534045
cmp dword [esp + 0x18], 1
jne 0x53412a
mov eax, dword [esp + 0x14]
sub edi, eax
mov dword [esi], ebx
lea ebx, [eax + ebx]
je 0x53412a
mov eax, dword [esp + 0x1c]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [esp + 0x14]
push ecx
push ebx
lea edx, [esp + 0x20]
push edx
push 0
push str.IssueDate
push eax
mov dword [esp + 0x2c], edi
call ebp
test eax, eax
jne 0x53408a
cmp dword [esp + 0x18], 1
jne 0x53412a
mov eax, dword [esp + 0x14]
mov dword [esi + 4], ebx
sub edi, eax
add ebx, eax
test edi, edi
je 0x53412a
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x14]
push ecx
push ebx
lea edx, [esp + 0x20]
push edx
push 0
push str.ExpirationDate
push eax
mov dword [esp + 0x2c], edi
call ebp
test eax, eax
jne 0x5340c1
cmp dword [esp + 0x18], 1
jne 0x53412a
mov eax, dword [esp + 0x14]
mov dword [esi + 8], ebx
sub edi, eax
add ebx, eax
test edi, edi
je 0x53412a
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x14]
push ecx
push ebx
lea edx, [esp + 0x20]
push edx
push 0
push str.SignData
push eax
mov dword [esp + 0x2c], edi
call ebp
test eax, eax
jne 0x53412a
cmp dword [esp + 0x18], 3
jne 0x53412a
mov eax, dword [esp + 0x14]
sub edi, eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], ebx
je 0x53412a
lea eax, [esi + 0xc]
call fcn.00533eb0
test eax, eax
je 0x53412a
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x2c]
mov ecx, 0x400
sub ecx, edi
push eax
mov dword [edx], ecx
mov esi, 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
mov eax, dword [esp + 0x1c]
mov esi, dword [esp + 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret