joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x433004]
jne 0x40100a
repz ret
jmp fcn.0040188b

Function at 0x406285
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00403652
and dword [ebp - 4], 0
cmp dword [0x435578], 0
mov ebx, eax
jne 0x406336
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4063e7
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4063e7
push eax
call fcn.004035e0
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x435578], eax
call esi
push eax
call fcn.004035e0
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x43557c], eax
call esi
push eax
call fcn.004035e0
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x435580], eax
call esi
push eax
call fcn.004035e0
pop ecx
mov dword [0x435588], eax
test eax, eax
je 0x406336
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004035e0
pop ecx
mov dword [0x435584], eax
mov eax, dword [0x435584]
cmp eax, ebx
je 0x40638e
cmp dword [0x435588], ebx
je 0x40638e
push eax
call fcn.0040365b
push dword [0x435588]
mov esi, eax
call fcn.0040365b
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40638e
test edi, edi
je 0x40638e
call esi
test eax, eax
je 0x406385
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x406385
test byte [ebp - 0xc], 1
jne 0x40638e
or dword [ebp + 0x10], 0x200000
jmp 0x4063c7
mov eax, dword [0x43557c]
cmp eax, ebx
je 0x4063c7
push eax
call fcn.0040365b
pop ecx
test eax, eax
je 0x4063c7
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4063c7
mov eax, dword [0x435580]
cmp eax, ebx
je 0x4063c7
push eax
call fcn.0040365b
pop ecx
test eax, eax
je 0x4063c7
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x435578]
call fcn.0040365b
pop ecx
test eax, eax
je 0x4063e7
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4063e9
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42f5c0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x82c
mov eax, dword [0x433004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x80c], eax
cmp ebx, 0x182
jne 0x42f5f5
lea ecx, [ebp - 0x82c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_BuildCommDCBA]
jmp 0x42f605
cmp ebx, 0x19f
jne 0x42f605
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
push edi
xor edi, edi
test ebx, ebx
jle 0x42f6a1
push esi
jmp 0x42f620
lea esi, [ebp - 0x808]
mov dword [ebp - 0x808], 0
call fcn.0042f5b0
mov dl, byte [ebp - 0x808]
mov eax, dword [ebp - 0x80c]
xor byte [eax + edi], dl
cmp ebx, 0xf
jne 0x42f69b
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaAvailableMemoryNode]
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0x804]
push ecx
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push str.lofumace
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoW]
push str.juhijit
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenJobObjectA]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_BackupRead]
inc edi
cmp edi, ebx
jl 0x42f620
pop esi
pop edi
cmp ebx, 0x2d
jne 0x42f6bb
mov dword [0x52b260], 0xa62e7790
mov dword [0x52b264], 0xffffffff
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401000
mov esp, ebp
pop ebp
ret

Function at 0x42f6d0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x433004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x52b12c]
push ebx
push esi
mov esi, dword [0x52af74]
mov ebx, eax
cmp eax, 0x5dd
jne 0x42f70d
push 0
lea eax, [ebp - 0x804]
push eax
push str.nutuxayizufecabepugeta
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
mov eax, dword [0x434320]
call fcn.0042f580
cmp dword [0x52b12c], 0x2f
jne 0x42f728
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
push esi
call fcn.0042f5c0
add esp, 4
cmp dword [0x52b12c], 0x568
pop esi
pop ebx
jne 0x42f75a
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapCreate]
mov ecx, dword [ebp - 0x808]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_GetNumaNodeProcessorMask]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401000
mov esp, ebp
pop ebp
ret
Function at 0x401190
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov word [esi + 0xc], ax
mov byte [esi], 0xe
mov byte [esi + 1], 6
mov byte [esi + 2], 0x34
mov byte [esi + 3], 0x30
mov al, byte [edi]
mov byte [esi + 4], al
mov eax, 0xffffffff
test ecx, ecx
je 0x4011dc
push ebx
lea esp, [esp]
movsx ebx, byte [edx]
xor ebx, eax
and ebx, 0xff
shr eax, 8
xor eax, dword [ebx*4 + 0x534bf0]
dec ecx
inc edx
test ecx, ecx
jne 0x4011c0
pop ebx
not eax
push eax
call dword [sym.imp.WS2_32.dll_htonl]
mov dword [esi + 6], eax
mov ax, word [0x539c34]
inc ax
movzx ecx, ax
push ecx
mov word [0x539c34], ax
call dword [sym.imp.WS2_32.dll_htons]
mov word [esi + 0xa], ax
mov dl, byte [edi + 0x84]
mov byte [esi + 0xc], dl
ret

Function at 0x401400
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, dword [esp + 0xc]
push edi
mov edi, eax
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov byte [esi], 0xc
mov byte [esi + 1], 0xb
mov byte [esi + 2], al
mov al, byte [ebp + 0x78]
mov byte [esi + 3], al
movzx ecx, word [ebp + 0x7c]
push ecx
call dword [sym.imp.WS2_32.dll_htons]
mov edx, dword [esp + 0xc]
mov word [esi + 4], ax
or eax, 0xffffffff
mov ecx, edi
test edi, edi
je 0x40145b
mov edi, edi
movsx edi, byte [edx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x534bf0]
dec ecx
inc edx
test ecx, ecx
jne 0x401440
not eax
push eax
call dword [sym.imp.WS2_32.dll_htonl]
mov dword [esi + 6], eax
mov byte [esi + 0xb], 0
mov dl, byte [ebp + 0x84]
pop edi
mov byte [esi + 0xa], dl
pop ebp
ret

Function at 0x4015a0
Capabilities:
Create new key via cryptacquirecontext
Generate random numbers via winapi

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
push 0
push 1
push 0
push 0
lea eax, [esp + 0x14]
push eax
call esi
test eax, eax
jne 0x4015e0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090016
je 0x4015cd
xor al, al
pop esi
pop ecx
ret
push 8
push 1
push 0
push 0
lea ecx, [esp + 0x14]
push ecx
call esi
test eax, eax
je 0x4015c8
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 4]
push ebx
push edx
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov edx, dword [esp + 8]
push 0
test eax, eax
push edx
setne bl
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov al, bl
pop ebx
pop esi
pop ecx
ret

Function at 0x401980
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
or eax, 0xffffffff
test ecx, ecx
je 0x4019ac
push esi
jmp 0x401990
movsx esi, byte [edx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x534bf0]
dec ecx
inc edx
test ecx, ecx
jne 0x401990
pop esi
not eax
ret
Function at 0x4019b0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x54
mov eax, dword [0x533014]
xor eax, esp
mov dword [esp + 0x50], eax
mov eax, dword [esp + 0x5c]
push esi
push edi
mov edi, edx
mov edx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 8], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
lea edx, [esp + 8]
lea eax, [esp + 0x18]
call fcn.00404220
mov esi, dword [esp + 0x60]
lea edx, [esp + 0x18]
mov eax, edx
xor ecx, ecx
sub esi, edx
sub edi, eax
lea ebx, [ebx]
lea eax, [esp + ecx + 0x18]
mov dl, byte [esi + eax]
xor dl, byte [eax]
inc ecx
cmp ecx, 0x30
mov byte [edi + eax], dl
jl 0x401a00
mov ecx, dword [esp + 0x58]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.004eabb3
add esp, 0x54
ret

Function at 0x401a30
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x80
push ebx
push ebp
push esi
mov ebx, eax
push edi
mov ecx, 0x20
mov esi, ebx
lea edi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
xor ecx, ecx
mov edx, 0x520140
sub edx, ebx
lea esi, [ecx + 0x1f]
mov edi, dword [edx + eax]
add edi, dword [eax]
add eax, 4
add ecx, edi
movzx edi, cl
mov dword [eax - 4], edi
shr ecx, 8
sub esi, 1
jne 0x401a55
sub ecx, 0xffffff80
add dword [ebx + 0x7c], ecx
mov edx, dword [ebx + 0x7c]
shr edx, 7
and edx, 1
lea edi, [esp + 0x10]
lea ebp, [esp + 0x14]
neg edx
xor ecx, ecx
sub edi, ebx
lea eax, [ebx + 8]
sub ebp, ebx
nop
mov esi, dword [eax - 8]
mov ebx, dword [esp + ecx*4 + 0x10]
xor ebx, esi
and ebx, edx
xor ebx, esi
mov esi, dword [eax - 4]
mov dword [eax - 8], ebx
mov ebx, dword [esp + ecx*4 + 0x14]
xor ebx, esi
and ebx, edx
xor ebx, esi
mov esi, dword [eax]
mov dword [eax - 4], ebx
mov ebx, dword [edi + eax]
xor ebx, esi
and ebx, edx
xor ebx, esi
mov esi, dword [eax + 4]
mov dword [eax], ebx
mov ebx, dword [eax + ebp]
xor ebx, esi
and ebx, edx
xor ebx, esi
mov dword [eax + 4], ebx
add ecx, 4
add eax, 0x10
cmp ecx, 0x20
jb 0x401a90
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x80
ret

Function at 0x4027a0
Capabilities:
Encrypt data using curve25519

Disassembly:
sub esp, 0x1a4
mov eax, dword [0x533014]
xor eax, esp
mov dword [esp + 0x1a0], eax
mov eax, dword [esp + 0x1a8]
push 0x20
push eax
lea ecx, [esp + 0x188]
push ecx
call fcn.004ef680
mov dl, byte [esp + 0x1ab]
and byte [esp + 0x18c], 0xf8
and dl, 0x3f
or dl, 0x40
add esp, 0xc
mov byte [esp + 0x19f], dl
xor eax, eax
lea esp, [esp]
movzx ecx, byte [eax + edi]
mov dword [esp + eax*4], ecx
inc eax
cmp eax, 0x20
jb 0x4027f0
lea edx, [esp + 0x180]
push edx
lea eax, [esp + 4]
push eax
call fcn.00401e60
lea ecx, [esp + 0x88]
push ecx
mov eax, ecx
call fcn.004023b0
lea edx, [esp + 0x8c]
push edx
lea eax, [esp + 0x110]
push eax
lea edx, [esp + 0x14]
call fcn.00401af0
add esp, 0x14
lea eax, [esp + 0x100]
call fcn.00401a30
xor eax, eax
jmp 0x402850
mov cl, byte [esp + eax*4 + 0x100]
mov byte [esi + eax], cl
inc eax
cmp eax, 0x20
jb 0x402850
mov ecx, dword [esp + 0x1a0]
xor ecx, esp
xor eax, eax
call fcn.004eabb3
add esp, 0x1a4
ret
Function at 0x402880
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
sub esp, 0x44
push ebx
push esi
push edi
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [esp + 0xc], ecx
mov ecx, dword [eax + 8]
mov dword [esp + 0x10], edx
mov edx, dword [eax + 0xc]
mov dword [esp + 0x14], ecx
mov ecx, dword [eax + 0x10]
mov dword [esp + 0x18], edx
mov edx, dword [eax + 0x14]
mov dword [esp + 0x1c], ecx
mov ecx, dword [eax + 0x18]
mov dword [esp + 0x20], edx
mov edx, dword [eax + 0x1c]
mov dword [esp + 0x24], ecx
mov ecx, dword [eax + 0x20]
mov dword [esp + 0x28], edx
mov edx, dword [eax + 0x24]
mov dword [esp + 0x2c], ecx
mov ecx, dword [eax + 0x28]
mov dword [esp + 0x30], edx
mov edx, dword [eax + 0x2c]
mov dword [esp + 0x34], ecx
mov ecx, dword [eax + 0x30]
mov dword [esp + 0x38], edx
mov edx, dword [eax + 0x34]
mov dword [esp + 0x3c], ecx
mov ecx, dword [eax + 0x38]
mov dword [esp + 0x40], edx
mov edx, dword [eax + 0x3c]
mov dword [esp + 0x44], ecx
mov ecx, dword [eax + 0x40]
mov dword [esp + 0x48], edx
xor edx, edx
mov esi, 0x5200f8
mov dword [esp + 0x4c], ecx
mov ecx, eax
sub esi, eax
lea edi, [edx + 0x11]
lea ebx, [ebx]
mov ebx, dword [esi + ecx]
add ebx, dword [ecx]
add ecx, 4
add edx, ebx
movzx ebx, dl
mov dword [ecx - 4], ebx
shr edx, 8
sub edi, 1
jne 0x402910
mov edx, dword [eax + 0x40]
shr edx, 7
lea esi, [esp + 0xc]
neg edx
sub esi, eax
mov edi, 0x11
jmp 0x402940
mov ecx, dword [eax]
mov ebx, dword [esi + eax]
xor ebx, ecx
and ebx, edx
xor ebx, ecx
mov dword [eax], ebx
add eax, 4
sub edi, 1
jne 0x402940
pop edi
pop esi
pop ebx
add esp, 0x44
ret
Function at 0x4032f0
Capabilities:
Encode data using xor
Encrypt data using aes

Disassembly:
push esi
mov esi, ecx
test esi, esi
je 0x40348e
test eax, eax
je 0x40348e
mov dword [eax + 0xf0], 0xa
mov ecx, dword [esi]
push edi
mov edx, ecx
ror edx, 8
and edx, 0xff00ff00
rol ecx, 8
and ecx, 0xff00ff
or edx, ecx
mov dword [eax], edx
mov edx, dword [esi + 4]
mov edi, edx
ror edi, 8
and edi, 0xff00ff00
rol edx, 8
and edx, 0xff00ff
or edi, edx
mov dword [eax + 4], edi
mov edx, dword [esi + 8]
mov edi, edx
ror edi, 8
and edi, 0xff00ff00
rol edx, 8
and edx, 0xff00ff
or edi, edx
mov dword [eax + 8], edi
mov edx, dword [esi + 0xc]
lea ecx, [eax + 4]
mov esi, edx
ror esi, 8
and esi, 0xff00ff00
rol edx, 8
and edx, 0xff00ff
or esi, edx
mov dword [eax + 0xc], esi
mov edx, esi
shr edx, 0x10
and edx, 0xff
mov edx, dword [edx*4 + 0x51e7d0]
xor edx, 0x1000000
mov edi, esi
shr edi, 8
and edi, 0xff
mov edi, dword [edi*4 + 0x51ebd0]
and edi, 0xff0000
and edx, 0xff000000
xor edx, edi
mov edi, esi
shr edi, 0x18
movzx edi, byte [edi*4 + 0x51e3d0]
xor edx, edi
mov edi, esi
and edi, 0xff
mov edi, dword [edi*4 + 0x51dfd0]
and edi, 0xff00
xor edx, edi
xor edx, dword [eax]
mov edi, dword [ecx]
xor edi, edx
mov dword [eax + 0x10], edx
mov edx, dword [eax + 8]
xor edx, edi
mov dword [eax + 0x18], edx
xor edx, esi
mov dword [eax + 0x14], edi
mov dword [eax + 0x1c], edx
mov esi, 0x5200d4
jmp 0x403400
mov edx, dword [ecx + 0x18]
add ecx, 0x10
mov eax, edx
shr eax, 8
mov edi, edx
and eax, 0xff
mov eax, dword [eax*4 + 0x51ebd0]
shr edi, 0x10
and edi, 0xff
mov edi, dword [edi*4 + 0x51e7d0]
and eax, 0xff0000
and edi, 0xff000000
xor eax, edi
mov edi, edx
and edx, 0xff
mov edx, dword [edx*4 + 0x51dfd0]
shr edi, 0x18
movzx edi, byte [edi*4 + 0x51e3d0]
xor eax, edi
and edx, 0xff00
xor eax, edx
xor eax, dword [ecx - 4]
add esi, 4
xor eax, dword [esi - 4]
mov dword [ecx + 0xc], eax
mov edx, dword [ecx]
xor edx, eax
mov dword [ecx + 0x10], edx
mov eax, dword [ecx + 4]
xor eax, edx
mov dword [ecx + 0x14], eax
mov edx, dword [ecx + 8]
xor edx, eax
mov dword [ecx + 0x18], edx
cmp esi, 0x5200f8
jne 0x403400
pop edi
xor eax, eax
pop esi
ret
or eax, 0xffffffff
pop esi
ret
Function at 0x4034a0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
mov eax, ebx
call fcn.004032f0
test eax, eax
jl 0x4036d8
mov edx, dword [ebx + 0xf0]
add edx, edx
push esi
add edx, edx
xor esi, esi
push edi
test edx, edx
jle 0x40350d
lea ecx, [ebx + edx*4 + 8]
lea eax, [ebx + 8]
push ebp
lea esp, [esp]
mov ebp, dword [ecx - 8]
mov edi, dword [eax - 8]
mov dword [eax - 8], ebp
mov ebp, dword [ecx - 4]
mov dword [ecx - 8], edi
mov edi, dword [eax - 4]
mov dword [eax - 4], ebp
mov ebp, dword [ecx]
mov dword [ecx - 4], edi
mov edi, dword [eax]
mov dword [eax], ebp
mov ebp, dword [ecx + 4]
mov dword [ecx], edi
mov edi, dword [eax + 4]
mov dword [eax + 4], ebp
mov dword [ecx + 4], edi
add esi, 4
sub edx, 4
add eax, 0x10
sub ecx, 0x10
cmp esi, edx
jl 0x4034d0
pop ebp
mov edx, 1
cmp dword [ebx + 0xf0], edx
jle 0x4036d4
lea eax, [ebx + 2]
mov ecx, dword [eax + 0xe]
movzx edi, byte [eax + 0xf]
mov edi, dword [edi*4 + 0x51e3d0]
add eax, 0x10
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x51e3d0]
and esi, 0xff
mov esi, dword [esi*4 + 0x51efd0]
and edi, 0xff
xor esi, dword [edi*4 + 0x51f7d0]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x51e3d0]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x51fbd0]
movzx ecx, byte [eax]
mov ecx, dword [ecx*4 + 0x51e3d0]
movzx edi, byte [eax + 3]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x51f3d0]
mov ecx, dword [eax + 2]
mov dword [eax - 2], esi
mov edi, dword [edi*4 + 0x51e3d0]
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x51e3d0]
and esi, 0xff
mov esi, dword [esi*4 + 0x51efd0]
and edi, 0xff
xor esi, dword [edi*4 + 0x51f7d0]
movzx edi, byte [eax + 4]
mov edi, dword [edi*4 + 0x51e3d0]
and edi, 0xff
xor esi, dword [edi*4 + 0x51f3d0]
movzx edi, byte [eax + 7]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x51e3d0]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x51fbd0]
mov ecx, dword [eax + 6]
mov dword [eax + 2], esi
mov edi, dword [edi*4 + 0x51e3d0]
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x51e3d0]
and esi, 0xff
mov esi, dword [esi*4 + 0x51efd0]
and edi, 0xff
xor esi, dword [edi*4 + 0x51f7d0]
movzx edi, byte [eax + 8]
mov edi, dword [edi*4 + 0x51e3d0]
and edi, 0xff
xor esi, dword [edi*4 + 0x51f3d0]
movzx edi, byte [eax + 0xb]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x51e3d0]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x51fbd0]
mov ecx, dword [eax + 0xa]
mov dword [eax + 6], esi
mov edi, dword [edi*4 + 0x51e3d0]
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x51e3d0]
and esi, 0xff
mov esi, dword [esi*4 + 0x51efd0]
and edi, 0xff
xor esi, dword [edi*4 + 0x51f7d0]
movzx edi, byte [eax + 0xc]
mov edi, dword [edi*4 + 0x51e3d0]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x51e3d0]
and edi, 0xff
xor esi, dword [edi*4 + 0x51f3d0]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x51fbd0]
inc edx
mov dword [eax + 0xa], esi
cmp edx, dword [ebx + 0xf0]
jl 0x403521
pop edi
xor eax, eax
pop esi
ret
Function at 0x404b50
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x78
mov eax, dword [0x533014]
xor eax, esp
mov dword [esp + 0x74], eax
mov eax, dword [esp + 0x80]
push ebx
push ebp
mov ebp, dword [esp + 0x84]
push esi
push edi
xor edi, edi
push eax
mov eax, dword [esp + 0x98]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x30], edi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x1c], 0x67452301
mov dword [esp + 0x20], 0xefcdab89
mov dword [esp + 0x24], 0x98badcfe
mov dword [esp + 0x28], 0x10325476
call fcn.00405810
add esp, 4
lea esi, [esp + 0x18]
lea ecx, [esp + 0x74]
call fcn.004058c0
mov dword [esp + 0x14], edi
lea ecx, [edi + 0x10]
lea eax, [ebp + 0x13]
lea esi, [esp + 0x83]
lea esp, [esp]
movzx dx, byte [eax]
movzx bx, byte [esi]
add dx, bx
add di, dx
mov word [esp + 0x14], di
mov dl, byte [esp + 0x14]
mov byte [eax], dl
add ecx, 0xffff
shr di, 8
dec esi
dec eax
test cx, cx
ja 0x404bd0
mov eax, dword [ebp]
mov ecx, dword [esp + 0x94]
cmp eax, ecx
jae 0x404c24
mov dword [ebp], 0
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x74]
xor ecx, esp
call fcn.004eabb3
add esp, 0x78
ret
sub eax, ecx
mov ecx, dword [esp + 0x84]
pop edi
pop esi
mov dword [ebp], eax
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.004eabb3
add esp, 0x78
ret

Function at 0x404c50
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x70
mov eax, dword [0x533014]
xor eax, esp
mov dword [esp + 0x6c], eax
mov eax, dword [esp + 0x74]
push ebx
push ebp
mov ebx, ecx
cmp dword [ebx], 0
push esi
push edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ebx
mov ebp, 1
je 0x404c92
mov eax, 0x408
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x6c]
xor ecx, esp
call fcn.004eabb3
add esp, 0x70
ret
mov eax, dword [ebx + 0x14]
cmp eax, 1
jae 0x404d48
mov ecx, 0xfffffffd
sub ecx, ebx
mov dword [esp + 0x1c], ecx
lea esp, [esp]
mov ecx, ebx
sub ecx, eax
add ecx, 0x28
mov edi, eax
test eax, eax
je 0x404cce
mov esi, dword [esp + 0x14]
sub esi, ecx
mov dl, byte [ecx]
mov byte [esi + ecx], dl
inc ecx
sub edi, 1
jne 0x404cc3
add dword [esp + 0x14], eax
sub ebp, eax
xor eax, eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x30], eax
lea eax, [ebx + 4]
push eax
mov eax, 0x10
lea ecx, [esp + 0x24]
mov dword [esp + 0x24], 0x67452301
mov dword [esp + 0x28], 0xefcdab89
mov dword [esp + 0x2c], 0x98badcfe
mov dword [esp + 0x30], 0x10325476
call fcn.00405810
add esp, 4
lea esi, [esp + 0x20]
lea ecx, [ebx + 0x18]
call fcn.004058c0
mov eax, 0x10
lea ecx, [ebx + 0x13]
mov dl, byte [ecx]
mov bl, dl
inc bl
mov byte [ecx], bl
test dl, dl
jne 0x404d3c
mov edx, dword [esp + 0x1c]
dec ecx
add edx, ecx
jne 0x404d27
mov ebx, dword [esp + 0x18]
cmp ebp, eax
ja 0x404cb0
mov ecx, ebx
sub ecx, eax
add ecx, 0x28
mov edi, ebp
test ebp, ebp
je 0x404d6b
mov esi, dword [esp + 0x14]
sub esi, ecx
jmp 0x404d60
mov dl, byte [ecx]
mov byte [esi + ecx], dl
inc ecx
sub edi, 1
jne 0x404d60
mov ecx, dword [esp + 0x7c]
pop edi
sub eax, ebp
pop esi
mov dword [ebx + 0x14], eax
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.004eabb3
add esp, 0x70
ret
Function at 0x406390
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x68
mov eax, dword [0x533014]
xor eax, esp
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x6c]
xor ecx, ecx
push esi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], ecx
push eax
mov eax, dword [esp + 0x78]
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.00409e20
add esp, 4
lea esi, [esp + 8]
mov ecx, edi
call fcn.00409ec0
mov ecx, dword [esp + 0x64]
pop esi
xor ecx, esp
call fcn.004eabb3
add esp, 0x68
ret
Function at 0x406500
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov esi, eax
lea eax, [esp + 0x18]
push eax
push 0x20119
xor edi, edi
push edi
push str.SOFTWARE360MachineSignature
push reloc.OLEAUT32.dll_SysReAllocString
mov ebx, ecx
mov dword [esp + 0x30], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x406691
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
lea ecx, [esp + 0x10]
push ecx
mov dword [esi + 0x10], eax
push ebx
mov dword [esi + 0x14], eax
lea edx, [esp + 0x1c]
push edx
mov dword [esi + 0x18], eax
push eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov eax, dword [esp + 0x28]
push str.Operator
mov edi, 0x400
push eax
mov dword [esp + 0x28], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x406593
cmp dword [esp + 0x14], 1
jne 0x406678
mov eax, dword [esp + 0x10]
sub edi, eax
mov dword [esi], ebx
lea ebx, [eax + ebx]
je 0x406678
mov eax, dword [esp + 0x18]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [esp + 0x10]
push ecx
push ebx
lea edx, [esp + 0x1c]
push edx
push 0
push str.IssueDate
push eax
mov dword [esp + 0x28], edi
call ebp
test eax, eax
jne 0x4065d8
cmp dword [esp + 0x14], 1
jne 0x406678
mov eax, dword [esp + 0x10]
mov dword [esi + 4], ebx
sub edi, eax
add ebx, eax
test edi, edi
je 0x406678
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x10]
push ecx
push ebx
lea edx, [esp + 0x1c]
push edx
push 0
push str.ExpirationDate
push eax
mov dword [esp + 0x28], edi
call ebp
test eax, eax
jne 0x40660f
cmp dword [esp + 0x14], 1
jne 0x406678
mov eax, dword [esp + 0x10]
mov dword [esi + 8], ebx
sub edi, eax
add ebx, eax
test edi, edi
je 0x406678
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x10]
push ecx
push ebx
lea edx, [esp + 0x1c]
push edx
push 0
push str.SignData
push eax
mov dword [esp + 0x28], edi
call ebp
test eax, eax
jne 0x406678
cmp dword [esp + 0x14], 3
jne 0x406678
mov eax, dword [esp + 0x10]
sub edi, eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], ebx
je 0x406678
lea eax, [esi + 0xc]
call fcn.00406400
test eax, eax
je 0x406678
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov ecx, 0x400
sub ecx, edi
push eax
mov dword [edx], ecx
mov esi, 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret