joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41a5e0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
mov edi, eax
mov ebx, ecx
mov ecx, 0x401
lea esi, [edi + 8]
mov dword [edi + 0x120], ecx
call fcn.00419a20
cmp byte [esi + 0x114], 0
je 0x41a60d
add esi, 4
jmp 0x41a60f
mov esi, dword [esi]
mov eax, dword [esp + 0x18]
mov ecx, dword [ebx + 4]
push 0x3ff
add esi, 4
push esi
push eax
push ecx
call dword [section..rdata]
mov esi, eax
call fcn.00418f80
test esi, esi
je 0x41a690
mov ecx, edi
call fcn.0041ebd0
cmp byte [ebx + 0x128], 0
je 0x41a647
add ebx, 0x18
jmp 0x41a64a
mov ebx, dword [ebx + 0x14]
mov ecx, ebp
call fcn.00417c00
mov edi, esi
mov esi, eax
call fcn.004185b0
mov ecx, ebp
call fcn.00417c00
mov esi, eax
push 0x55e1ac
push 0x55e008
mov edx, esi
call fcn.00419360
add ebx, 4
push ebx
push 0x55e008
mov edx, esi
call fcn.00419360
add esp, 0x10
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 8
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
ret 8
Function at 0x41d480
Capabilities:
Get file version info

Disassembly:
sub esp, 0x424
mov eax, dword [0x58057c]
xor eax, esp
mov dword [esp + 0x420], eax
push ebx
push ebp
mov ebp, dword [esp + 0x430]
push 0x206
xor ebx, ebx
lea ecx, [esp + 0x1e]
xor eax, eax
push ebx
push ecx
mov word [esp + 0x24], ax
call fcn.00503d40
add esp, 0xc
push 0x104
lea edx, [esp + 0x1c]
push edx
push ebx
call dword [0x531154]
test eax, eax
jne 0x41d4e7
pop ebp
xor al, al
pop ebx
mov ecx, dword [esp + 0x420]
xor ecx, esp
call fcn.004fdc2b
add esp, 0x424
ret
push esi
push 0x206
lea ecx, [esp + 0x22a]
xor eax, eax
push ebx
push ecx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x18], ebx
mov word [esp + 0x230], ax
call fcn.00503d40
add esp, 0xc
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x20]
push eax
call fcn.004b1e7a
mov esi, eax
cmp esi, ebx
jne 0x41d547
pop esi
pop ebp
xor al, al
pop ebx
mov ecx, dword [esp + 0x420]
xor ecx, esp
call fcn.004fdc2b
add esp, 0x424
ret
push edi
push esi
call fcn.004fe6e3
mov edi, eax
add esp, 4
cmp edi, ebx
jne 0x41d55e
xor al, al
jmp 0x41d609
mov ecx, dword [esp + 0x1c]
push edi
push esi
push ecx
lea edx, [esp + 0x2c]
push edx
call fcn.004b1e6e
test eax, eax
je 0x41d5fe
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x18]
push ecx
push str.VarFileInfoTranslation
push edi
call fcn.004b1e74
test eax, eax
je 0x41d5fe
cmp dword [esp + 0x10], 4
jb 0x41d5fe
mov eax, dword [esp + 0x14]
movzx edx, word [eax + 2]
movzx eax, word [eax]
push edx
push eax
lea ecx, [esp + 0x230]
push str.StringFileInfo_04x_04xCompanyName
push ecx
call fcn.00413240
add esp, 0x10
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x230]
push ecx
push edi
call fcn.004b1e74
test eax, eax
je 0x41d5fe
mov ecx, dword [esp + 0x10]
cmp ecx, 2
jbe 0x41d5fe
mov eax, dword [esp + 0x18]
cmp word [eax + ecx*2 - 2], bx
jne 0x41d5f2
mov edx, ebp
call fcn.00418b90
jmp 0x41d5fc
push eax
mov eax, ecx
mov ebx, ebp
call fcn.00418bf0
mov bl, 1
push edi
call fcn.004fe606
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x430]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004fdc2b
add esp, 0x424
ret
Function at 0x422700
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x52834b
mov eax, dword fs:[0]
push eax
sub esp, 0x130
mov eax, dword [0x58057c]
xor eax, esp
mov dword [esp + 0x12c], eax
push edi
mov eax, dword [0x58057c]
xor eax, esp
push eax
lea eax, [esp + 0x138]
mov dword fs:[0], eax
mov edi, 0x559058
call fcn.0041e510
mov al, byte [eax + 0x96f]
test al, al
je 0x422759
cmp al, 1
sete al
test al, al
jne 0x42285c
cmp byte [0x588e24], 0
jne 0x42285c
mov ecx, esi
call fcn.0041f740
test al, al
jne 0x4227b0
mov ecx, esi
call fcn.0041f700
test al, al
jne 0x4227b0
cmp byte [esi + 0x11c], al
lea eax, [esi + 0xc]
jne 0x42278a
mov eax, dword [esi + 8]
lea edi, [eax + 4]
call fcn.0042aad0
call fcn.0042aad0
cmp dword [eax + 0x124], 0
je 0x42285c
push 1
call fcn.0042afd0
jmp 0x42285c
mov ecx, 0x559058
mov eax, ecx
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4227dd
test dx, dx
je 0x4227d9
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4227dd
add eax, 4
add ecx, 4
test dx, dx
jne 0x4227b7
xor eax, eax
jmp 0x4227e2
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x42282f
lea ecx, [esp + 0xc]
call fcn.0041ee30
lea eax, [esp + 0xc]
push eax
mov ecx, esi
mov dword [esp + 0x144], 0
call fcn.00420e50
cmp dword [esp + 0x10], 0
jne 0x422811
xor edi, edi
jmp 0x422826
cmp byte [esp + 0x128], 0
lea eax, [esp + 0x18]
jne 0x422823
mov eax, dword [esp + 0x14]
lea edi, [eax + 4]
lea ecx, [esp + 0xc]
call fcn.00418b30
cmp byte [esi + 0x11c], 0
lea eax, [esi + 0xc]
jne 0x42283e
mov eax, dword [esi + 8]
push edi
add eax, 4
push ebx
push eax
call fcn.00421c50
add esp, 0xc
push eax
push 0
push 0x421d80
call fcn.00501ec2
add esp, 0xc
mov ecx, dword [esp + 0x138]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [esp + 0x12c]
xor ecx, esp
call fcn.004fdc2b
add esp, 0x13c
ret

Function at 0x422b50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
mov edi, eax
xor ebx, ebx
xor eax, eax
mov dword [esp + 0x10], ebx
cmp ax, word [edi]
je 0x422bdb
jmp 0x422b70
lea eax, [ebx + 1]
cmp eax, 0x201
jge 0x422beb
xor edx, edx
xor esi, esi
mov edi, edi
movzx ecx, word [edi]
xor eax, eax
cmp ax, cx
je 0x422beb
cmp cx, 0x61
jb 0x422b9e
cmp cx, 0x7a
ja 0x422b9e
movzx ecx, cx
sub ecx, 0x61
jmp 0x422bb0
cmp cx, 0x30
jb 0x422beb
cmp cx, 0x39
ja 0x422beb
movzx ecx, cx
sub ecx, 0x16
mov eax, ebx
and eax, 0x1f
shl edx, 5
xor eax, ecx
add eax, edx
inc esi
add edi, 2
cmp esi, 4
movzx edx, ax
jl 0x422b80
inc dword [esp + 0x10]
mov word [ebp], dx
xor ecx, ecx
inc ebx
add ebp, 2
cmp cx, word [edi]
jne 0x422b70
mov eax, dword [esp + 0x10]
pop edi
xor edx, edx
pop esi
mov word [ebp], dx
pop ebp
pop ebx
pop ecx
ret
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
pop ecx
ret
Function at 0x423d80
Capabilities:
Get file version info

Disassembly:
sub esp, 0x10
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
lea eax, [esp + 0xc]
xor ebx, ebx
push eax
push ebp
mov byte [esp + 0x13], bl
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
call fcn.004b1e7a
mov dword [esp + 0xc], eax
cmp eax, ebx
jne 0x423db6
pop ebp
xor al, al
pop ebx
add esp, 0x10
ret
push esi
push eax
call fcn.004fe6e3
mov ecx, dword [esp + 0x14]
add esp, 4
mov esi, eax
push esi
push ecx
push ebx
push ebp
call fcn.004b1e6e
test eax, eax
je 0x423e14
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x18]
push eax
push 0x55a960
push esi
call fcn.004b1e74
test eax, eax
je 0x423e14
mov eax, dword [esp + 0x14]
movzx ecx, word [eax + 0xa]
mov word [edi], cx
movzx edx, word [eax + 8]
mov word [edi + 2], dx
movzx ecx, word [eax + 0xe]
mov word [edi + 4], cx
movzx edx, word [eax + 0xc]
mov word [edi + 6], dx
mov byte [esp + 0xf], 1
cmp esi, ebx
je 0x423e21
push esi
call fcn.004fe606
add esp, 4
mov al, byte [esp + 0xf]
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x424e40
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x520473
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x58057c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
fld dword [0x56b950]
xor edi, edi
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], 0x11
mov dword [esi + 0x18], 0xffffffff
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], 0xa
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], ebx
fstp dword [esi + 0xc]
fld dword [0x56b94c]
mov ecx, esi
fstp dword [esi + 0x10]
fld dword [0x56b948]
fstp dword [esi + 0x14]
call fcn.004173e0
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4

Function at 0x4274d0
Capabilities:
Hash data with md5
Read file on windows

Disassembly:
sub esp, 0x478
mov eax, dword [0x58057c]
xor eax, esp
mov dword [esp + 0x474], eax
mov eax, dword [esp + 0x47c]
push esi
push edi
push 0x55e58c
push eax
lea eax, [esp + 0x14]
push eax
mov edi, ecx
mov dword [esp + 0x18], 0
call fcn.00501c7b
mov eax, dword [esp + 0x18]
add esp, 0xc
test eax, eax
jne 0x42752b
xor al, al
pop edi
pop esi
mov ecx, dword [esp + 0x474]
xor ecx, esp
call fcn.004fdc2b
add esp, 0x478
ret
push eax
push 0x400
lea ecx, [esp + 0x80]
push 1
push ecx
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x28], 0x67452301
mov dword [esp + 0x2c], 0xefcdab89
mov dword [esp + 0x30], 0x98badcfe
mov dword [esp + 0x34], 0x10325476
call fcn.005025e3
add esp, 0x10
test eax, eax
je 0x4275a5
lea edx, [esp + 0x78]
push edx
lea esi, [esp + 0x14]
call fcn.0042ebb0
mov eax, dword [esp + 0x10]
push eax
push 0x400
lea ecx, [esp + 0x84]
push 1
push ecx
call fcn.005025e3
add esp, 0x14
test eax, eax
jne 0x427577
lea eax, [esp + 0x10]
call fcn.0042ecc0
mov edx, dword [esp + 0xc]
push edx
call fcn.00501d45
mov ecx, dword [esp + 0x480]
add esp, 4
pop edi
pop esi
xor ecx, esp
mov al, 1
call fcn.004fdc2b
add esp, 0x478
ret

Function at 0x427600
Capabilities:
Encrypt data using aes

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
jmp fcn.0042ff50

Function at 0x427700
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x64
mov ecx, dword [esp + 0x70]
xor eax, eax
push ebx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x60], eax
push edi
mov edi, dword [esp + 0x70]
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0x10], 0x67452301
mov dword [esp + 0x14], 0xefcdab89
mov dword [esp + 0x18], 0x98badcfe
mov dword [esp + 0x1c], 0x10325476
call fcn.004277c0
mov byte [esp + 0xf], al
mov eax, dword [esp + 0x78]
add esp, 4
lea ebx, [esp + 0xc]
call fcn.0042f7a0
mov al, byte [esp + 0xb]
pop edi
pop ebx
add esp, 0x64
ret
Function at 0x427770
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x58], ecx
ret

Function at 0x428990
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x51e688
mov eax, dword fs:[0]
push eax
mov eax, dword [0x58057c]
xor eax, esp
push eax
lea eax, [esp + 4]
mov dword fs:[0], eax
mov eax, dword [esp + 0x14]
xor ecx, ecx
mov byte [eax + 4], cl
mov dword [eax + 8], 0x55fa64
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x20], fcn.004fe6e3
mov dword [eax + 0x24], fcn.004ff2b3
mov dword [eax + 0x28], fcn.004fe606
mov dword [eax + 0x2c], ecx
mov ecx, dword [esp + 0x18]
mov dword [eax], vtable.n_config::t_arraySection_class_t_configRuntimeFile::t_item_.0
mov dword [eax + 0x30], ecx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
pop ecx
add esp, 0xc
ret 8
Function at 0x42adc0
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x524d4f
mov eax, dword fs:[0]
push eax
sub esp, 0x13c
mov eax, dword [0x58057c]
xor eax, esp
mov dword [esp + 0x138], eax
push ebx
push edi
mov eax, dword [0x58057c]
xor eax, esp
push eax
lea eax, [esp + 0x148]
mov dword fs:[0], eax
mov ecx, esi
mov dword [esp + 0x18], esi
call fcn.00418990
xor ebx, ebx
mov dword [esp + 0x150], ebx
lea ecx, [esp + 0x1c]
mov dword [esi + 0x124], ebx
call fcn.00418990
mov byte [esp + 0x10], bl
mov dword [esp + 0xc], ebx
lea eax, [esp + 0x1c]
lea edi, [esp + 0xc]
mov byte [esp + 0x150], 2
call fcn.00424d20
test al, al
jne 0x42ae68
mov ecx, edi
call fcn.00417ba0
mov dword [esp + 0x1c], vtable.t_str.0
cmp byte [esp + 0x138], bl
jne 0x42af20
mov eax, dword [esp + 0x24]
lea ecx, [esp + 0x28]
cmp eax, ecx
jmp 0x42af15
lea eax, [esp + 0x28]
cmp byte [esp + 0x138], bl
jne 0x42ae79
mov eax, dword [esp + 0x24]
add eax, 4
mov edx, esi
call fcn.00418b90
push 0x55a960
push 0x55e008
mov edx, esi
call fcn.00419360
push str.verify.ini
push 0x55e008
mov edx, esi
call fcn.00419360
push 0x230
call fcn.004ff5fa
add esp, 0x14
mov dword [esp + 0x14], eax
mov byte [esp + 0x150], 3
cmp eax, ebx
je 0x42aed4
push 0x55fcb0
push eax
mov ecx, 5
call fcn.0042ac80
jmp 0x42aed6
xor eax, eax
push esi
push ebx
push 0x42b310
mov dword [esi + 0x128], eax
call fcn.00501ec2
add esp, 0xc
lea ecx, [esp + 0xc]
mov dword [esi + 0x124], eax
call fcn.00417ba0
mov dword [esp + 0x1c], vtable.t_str.0
cmp byte [esp + 0x138], bl
jne 0x42af20
mov eax, dword [esp + 0x24]
lea edx, [esp + 0x28]
cmp eax, edx
je 0x42af20
push eax
call fcn.004fe606
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x148]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [esp + 0x138]
xor ecx, esp
call fcn.004fdc2b
add esp, 0x148
ret
Function at 0x42c7f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov eax, dword [edi]
lea ecx, [esp]
push ecx
mov ecx, dword [esp + 0xc]
push esi
add eax, eax
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x18]
push 0
mov dword [edi], 0
mov edx, dword [ecx]
push eax
push edx
call dword [0x531060]
test eax, eax
jne 0x42c85e
mov eax, dword [esp + 0xc]
cmp eax, 1
je 0x42c82f
cmp eax, 2
jne 0x42c84a
mov eax, dword [esp]
test esi, esi
je 0x42c858
test eax, eax
je 0x42c853
test al, 1
jne 0x42c84a
mov ecx, eax
shr ecx, 1
cmp word [esi + ecx*2 - 2], 0
je 0x42c858
mov eax, 0xd
pop ecx
ret 8
xor edx, edx
mov word [esi], dx
shr eax, 1
mov dword [edi], eax
xor eax, eax
pop ecx
ret 8

Function at 0x42ca60
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x51f808
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x58057c]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
mov eax, dword [0x58057c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
xor eax, eax
mov word [esp + 0x14], ax
push 0x11
mov eax, str.SoftwareClasses_
lea esi, [esp + 0x14]
mov ebx, ecx
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], 0
call fcn.0042d2c0
mov eax, edi
mov dword [esp + 0x38], 0
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x42cac6
sub eax, edx
sar eax, 1
push eax
mov eax, edi
lea ecx, [esp + 0x14]
call fcn.0042d1e0
push 6
mov eax, str.Shell
lea ecx, [esp + 0x14]
call fcn.0042d1e0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x28], esp
xor edx, edx
push 0xffffffffffffffff
mov dword [ecx + 0x18], 7
mov dword [ecx + 0x14], 0
push edx
lea eax, [esp + 0x34]
mov word [ecx + 4], dx
call fcn.0042d130
push 0x80000001
push ebx
call fcn.0042cc50
add esp, 0x24
cmp dword [esp + 0x28], 8
mov bl, al
jb 0x42cb3e
mov eax, dword [esp + 0x14]
push eax
call fcn.004fdffb
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.004fdc2b
add esp, 0x30
ret
Function at 0x42cec0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5203b6
mov eax, dword fs:[0]
push eax
sub esp, 0x440
mov eax, dword [0x58057c]
xor eax, esp
mov dword [esp + 0x438], eax
push ebx
push esi
push edi
mov eax, dword [0x58057c]
xor eax, esp
push eax
lea eax, [esp + 0x450]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x20], eax
xor ebx, ebx
xor ecx, ecx
push 0x3e
mov eax, str.SoftwareMicrosoftWindowsShellAssociationsUrlAssociations_
lea esi, [esp + 0x2c]
mov dword [esp + 0x44], 7
mov dword [esp + 0x40], ebx
mov word [esp + 0x30], cx
call fcn.0042d2c0
mov eax, 0x55f298
mov dword [esp + 0x458], ebx
lea edx, [eax + 2]
jmp 0x42cf40
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x42cf40
sub eax, edx
sar eax, 1
push eax
mov eax, 0x55f298
lea ecx, [esp + 0x2c]
call fcn.0042d1e0
push 0xb
mov eax, str.UserChoice
lea ecx, [esp + 0x2c]
call fcn.0042d1e0
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x458], 1
cmp dword [esp + 0x40], 8
mov eax, dword [esp + 0x2c]
jae 0x42cf8d
lea eax, [esp + 0x2c]
lea edx, [esp + 0x14]
push edx
push 1
push ebx
push eax
push 0x80000001
mov dword [esp + 0x28], ebx
call dword [0x531054]
cmp eax, ebx
jne 0x42d060
mov eax, dword [esp + 0x14]
push 0x3fe
lea edx, [esp + 0x4a]
xor ecx, ecx
push ebx
push edx
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ebx
mov word [esp + 0x50], cx
call fcn.00503d40
add esp, 0xc
push str.Progid
lea eax, [esp + 0x1c]
push eax
lea edi, [esp + 0x2c]
lea esi, [esp + 0x4c]
mov dword [esp + 0x2c], 0x200
call fcn.0042c7f0
test eax, eax
jne 0x42d051
xor ecx, ecx
cmp cx, word [esp + 0x44]
je 0x42d051
mov edi, esi
mov esi, dword [esp + 0x20]
mov ecx, esi
call fcn.0042ca60
test al, al
jne 0x42d023
mov eax, edi
push eax
mov edi, esi
call fcn.0042cb60
add esp, 4
mov byte [esp + 0x13], al
jmp 0x42d028
mov byte [esp + 0x13], 1
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x42d037
push eax
call dword [0x531050]
cmp dword [esp + 0x40], 8
jb 0x42d04b
mov ecx, dword [esp + 0x2c]
push ecx
call fcn.004fdffb
add esp, 4
mov al, byte [esp + 0x13]
jmp 0x42d076
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x42d060
push eax
call dword [0x531050]
cmp dword [esp + 0x40], 8
jb 0x42d074
mov edx, dword [esp + 0x2c]
push edx
call fcn.004fdffb
add esp, 4
xor al, al
mov ecx, dword [esp + 0x450]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x438]
xor ecx, esp
call fcn.004fdc2b
mov esp, ebp
pop ebp
ret
Function at 0x430480
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
mov eax, ebx
call fcn.0042ff50
test eax, eax
jl 0x4306b8
mov edx, dword [ebx + 0xf0]
add edx, edx
push esi
add edx, edx
xor esi, esi
push edi
test edx, edx
jle 0x4304ed
lea ecx, [ebx + edx*4 + 8]
lea eax, [ebx + 8]
push ebp
lea esp, [esp]
mov ebp, dword [ecx - 8]
mov edi, dword [eax - 8]
mov dword [eax - 8], ebp
mov ebp, dword [ecx - 4]
mov dword [ecx - 8], edi
mov edi, dword [eax - 4]
mov dword [eax - 4], ebp
mov ebp, dword [ecx]
mov dword [ecx - 4], edi
mov edi, dword [eax]
mov dword [eax], ebp
mov ebp, dword [ecx + 4]
mov dword [ecx], edi
mov edi, dword [eax + 4]
mov dword [eax + 4], ebp
mov dword [ecx + 4], edi
add esi, 4
sub edx, 4
add eax, 0x10
sub ecx, 0x10
cmp esi, edx
jl 0x4304b0
pop ebp
mov edx, 1
cmp dword [ebx + 0xf0], edx
jle 0x4306b4
lea eax, [ebx + 2]
mov ecx, dword [eax + 0xe]
movzx edi, byte [eax + 0xf]
mov edi, dword [edi*4 + 0x556c20]
add eax, 0x10
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x556c20]
and esi, 0xff
mov esi, dword [esi*4 + 0x557820]
and edi, 0xff
xor esi, dword [edi*4 + 0x558020]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x556c20]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x558420]
movzx ecx, byte [eax]
mov ecx, dword [ecx*4 + 0x556c20]
movzx edi, byte [eax + 3]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x557c20]
mov ecx, dword [eax + 2]
mov dword [eax - 2], esi
mov edi, dword [edi*4 + 0x556c20]
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x556c20]
and esi, 0xff
mov esi, dword [esi*4 + 0x557820]
and edi, 0xff
xor esi, dword [edi*4 + 0x558020]
movzx edi, byte [eax + 4]
mov edi, dword [edi*4 + 0x556c20]
and edi, 0xff
xor esi, dword [edi*4 + 0x557c20]
movzx edi, byte [eax + 7]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x556c20]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x558420]
mov ecx, dword [eax + 6]
mov dword [eax + 2], esi
mov edi, dword [edi*4 + 0x556c20]
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x556c20]
and esi, 0xff
mov esi, dword [esi*4 + 0x557820]
and edi, 0xff
xor esi, dword [edi*4 + 0x558020]
movzx edi, byte [eax + 8]
mov edi, dword [edi*4 + 0x556c20]
and edi, 0xff
xor esi, dword [edi*4 + 0x557c20]
movzx edi, byte [eax + 0xb]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x556c20]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x558420]
mov ecx, dword [eax + 0xa]
mov dword [eax + 6], esi
mov edi, dword [edi*4 + 0x556c20]
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x556c20]
and esi, 0xff
mov esi, dword [esi*4 + 0x557820]
and edi, 0xff
xor esi, dword [edi*4 + 0x558020]
movzx edi, byte [eax + 0xc]
mov edi, dword [edi*4 + 0x556c20]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x556c20]
and edi, 0xff
xor esi, dword [edi*4 + 0x557c20]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x558420]
inc edx
mov dword [eax + 0xa], esi
cmp edx, dword [ebx + 0xf0]
jl 0x430501
pop edi
xor eax, eax
pop esi
ret
Function at 0x431200
Capabilities:
Encode data using base64

Disassembly:
push esi
push edi
mov edi, eax
cmp edi, 3
mov esi, edx
jl 0x431285
mov eax, 0xaaaaaaab
mul edi
shr edx, 1
lea eax, [edx + edx*2]
sub edi, eax
push ebx
lea ebx, [ebx]
movzx eax, byte [esi]
shr eax, 2
movzx eax, byte [eax + 0x556758]
mov byte [ecx], al
movzx eax, byte [esi]
movzx ebx, byte [esi + 1]
and eax, 3
shl eax, 4
shr ebx, 4
or eax, ebx
movzx eax, byte [eax + 0x556758]
mov byte [ecx + 1], al
movzx eax, byte [esi + 1]
movzx ebx, byte [esi + 2]
inc ecx
and eax, 0xf
add eax, eax
add eax, eax
shr ebx, 6
or eax, ebx
movzx eax, byte [eax + 0x556758]
inc ecx
mov byte [ecx], al
movzx eax, byte [esi + 2]
and eax, 0x3f
movzx eax, byte [eax + 0x556758]
inc ecx
mov byte [ecx], al
inc ecx
add esi, 3
sub edx, 1
jne 0x431220
pop ebx
test edi, edi
jle 0x4312e5
movzx edx, byte [esi]
shr edx, 2
movzx eax, byte [edx + 0x556758]
mov byte [ecx], al
mov al, byte [esi]
and al, 3
inc ecx
shl al, 4
cmp edi, 1
jle 0x4312ad
mov dl, byte [esi + 1]
shr dl, 4
or al, dl
movzx eax, al
mov dl, byte [eax + 0x556758]
mov byte [ecx], dl
inc ecx
cmp edi, 2
jge 0x4312cf
mov eax, 0x3d
mov byte [ecx], al
inc ecx
mov byte [ecx], al
inc ecx
pop edi
mov byte [ecx], 0
pop esi
ret
movzx eax, byte [esi + 1]
and eax, 0xf
movsx eax, byte [eax*4 + 0x556758]
mov byte [ecx], al
inc ecx
mov byte [ecx], 0x3d
inc ecx
pop edi
mov byte [ecx], 0
pop esi
ret

Function at 0x431460
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x5c
push ebx
push esi
mov esi, eax
xor eax, eax
cmp esi, eax
jne 0x431472
mov esi, 0x588dec
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x68]
push eax
mov eax, dword [esp + 0x70]
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.0042f500
add esp, 4
lea ebx, [esp + 8]
mov eax, esi
call fcn.0042f7a0
mov eax, esi
pop esi
pop ebx
add esp, 0x5c
ret