joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f202
Capabilities:
Print debug messages

Disassembly:
push 0xec
mov eax, 0x4d97f6
call fcn.004d631c
mov ebx, ecx
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x18]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0x10]
push edi
mov dword [ebp - 0x44], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
dec eax
test eax, eax
jle 0x40f24e
lea ecx, [edi + eax*2]
movzx edx, word [ecx]
cmp edx, 0x2f
je 0x40f24b
cmp edx, 0x5c
je 0x40f24b
dec eax
sub ecx, 2
test eax, eax
jg 0x40f234
jmp 0x40f24e
lea edi, [ecx + 2]
push 1
push 3
lea ecx, [ebp - 0xf8]
call fcn.004038fa
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
lea ecx, [esi + 0x18]
call fcn.00407daf
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 1
push eax
call fcn.0040f164
mov esi, eax
mov dword [esp], 0x4ecda4
lea eax, [ebp - 0x28]
push eax
push 0x4ed350
push dword [ebp - 0x44]
mov ecx, ebx
mov byte [ebp - 4], 2
push 0x4ecb30
push edi
push 0x4ec19c
push dword [ebp - 0x48]
call fcn.0040f1da
movzx eax, ax
push eax
push 0x4ed354
push esi
lea eax, [ebp - 0xe8]
push 0x4ed35c
push eax
call fcn.00402f9e
pop ecx
pop ecx
push eax
call fcn.00407c4c
pop ecx
pop ecx
push eax
call fcn.00402f9e
pop ecx
pop ecx
push eax
call fcn.0040ef32
pop ecx
pop ecx
push eax
call fcn.00402f9e
pop ecx
pop ecx
push eax
call fcn.00402f9e
pop ecx
pop ecx
push eax
call fcn.00402f9e
pop ecx
pop ecx
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___int_]
push eax
call fcn.00402f9e
pop ecx
pop ecx
push eax
call fcn.00407c4c
pop ecx
pop ecx
push eax
call fcn.00402f9e
pop ecx
pop ecx
lea ecx, [ebp - 0x40]
call fcn.00401f5a
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00401f5a
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0xe0]
call fcn.00407daf
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea ecx, [ebp - 0x28]
call fcn.00401f5a
lea esi, [ebx + 0x24]
cmp dword [esi], 0
je 0x40f3b5
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0xe0]
call fcn.00407daf
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00402f2c
pop ecx
pop ecx
lea ecx, [ebp - 0x40]
call fcn.00401f5a
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push 0
push dword [ebp - 0x18]
cmovae eax, dword [ebp - 0x28]
mov ecx, esi
push eax
call fcn.004049a2
push dword [esi]
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
test eax, eax
jne 0x40f3ad
call fcn.00403ee6
lea ecx, [ebp - 0x28]
call fcn.00401f34
lea ecx, [ebp - 0x90]
call fcn.00403ad6
lea ecx, [ebp - 0x90]
call dword [sym.imp.MSVCP140.dll_public_virtual:_void___thiscall_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::destructor_void_]
call fcn.004d62c6
ret 0x14
Function at 0x415c1f
Capabilities:
Parse credit card information

Disassembly:
push esi
mov esi, ecx
xor cl, cl
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x415d77
push edi
push 0x29
pop edi
push ebx
mov edx, 0x10000000
cmp eax, 0x7c
je 0x415d75
cmp eax, edi
jne 0x415c60
cmp dword [esi + 0x10], 0
mov eax, edi
jne 0x415d75
cmp eax, edi
jne 0x415c60
test dword [esi + 0x50], edx
je 0x415d83
cmp eax, 0x2e
jne 0x415c7b
push 5
lea ecx, [esi + 0x24]
call fcn.00418d8d
mov ecx, esi
call fcn.00418dcb
jmp 0x415d60
cmp eax, 0x5c
jne 0x415ccd
mov ecx, esi
call fcn.00418dcb
test byte [esi + 0x50], 0x80
je 0x415cc1
mov al, byte [esi + 0x48]
cmp al, 0x62
jne 0x415caa
push 4
lea ecx, [esi + 0x24]
call fcn.00418d8d
mov ecx, esi
call fcn.00418dcb
jmp 0x415d67
cmp al, 0x42
jne 0x415cc1
push 4
lea ecx, [esi + 0x24]
call fcn.00418d8d
mov eax, dword [esi + 0x28]
xor dword [eax + 8], 1
jmp 0x415c9e
mov ecx, esi
call fcn.00415efe
jmp 0x415d60
cmp eax, 0x5b
jne 0x415ced
mov ecx, esi
call fcn.00418dcb
mov ecx, esi
call fcn.00416632
cmp dword [esi + 0x4c], 0x5d
je 0x415c6f
push 4
jmp 0x415d85
cmp eax, 0x28
jne 0x415d09
mov ecx, esi
call fcn.00418dcb
mov ecx, esi
call fcn.004197d2
mov bl, al
cmp dword [esi + 0x4c], edi
jne 0x415d83
jmp 0x415d55
cmp eax, 0x5e
jne 0x415d12
push 2
jmp 0x415c96
cmp eax, 0x24
jne 0x415d1e
push 3
jmp 0x415c96
cmp eax, 0x2a
je 0x415d7f
cmp eax, 0x2b
je 0x415d7f
cmp eax, 0x3f
je 0x415d7f
cmp eax, 0x7b
je 0x415d7f
cmp eax, 0x7d
jne 0x415d3c
test dword [esi + 0x50], edx
je 0x415d7b
cmp eax, 0x5d
jne 0x415d46
test dword [esi + 0x50], edx
je 0x415ce6
movzx eax, byte [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.00414f04
mov bl, 1
mov ecx, esi
call fcn.00418dcb
test bl, bl
je 0x415d67
mov ecx, esi
call fcn.00418e28
mov eax, dword [esi + 0x4c]
mov cl, 1
cmp eax, 0xffffffff
jne 0x415c35
pop ebx
pop edi
mov al, cl
pop esi
ret
push 6
jmp 0x415d85
push 0xa
jmp 0x415d85
push 5
mov ecx, esi
call fcn.00417f78
int3
Function at 0x415d8d
Capabilities:
Parse credit card information

Disassembly:
push esi
mov esi, ecx
xor cl, cl
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x415ee8
push edi
push 0x29
pop edi
push ebx
mov edx, 0x10000000
cmp eax, 0x7c
je 0x415ee6
cmp eax, edi
jne 0x415dce
cmp dword [esi + 0x10], 0
mov eax, edi
jne 0x415ee6
cmp eax, edi
jne 0x415dce
test dword [esi + 0x50], edx
je 0x415ef4
cmp eax, 0x2e
jne 0x415de9
push 5
lea ecx, [esi + 0x24]
call fcn.00418d8d
mov ecx, esi
call fcn.00418df9
jmp 0x415ed1
cmp eax, 0x5c
jne 0x415e3e
mov ecx, esi
call fcn.00418df9
test byte [esi + 0x50], 0x80
je 0x415e32
movzx eax, word [esi + 0x48]
cmp eax, 0x62
jne 0x415e1a
push 4
lea ecx, [esi + 0x24]
call fcn.00418d8d
mov ecx, esi
call fcn.00418df9
jmp 0x415ed8
cmp eax, 0x42
jne 0x415e32
push 4
lea ecx, [esi + 0x24]
call fcn.00418d8d
mov eax, dword [esi + 0x28]
xor dword [eax + 8], 1
jmp 0x415e0e
mov ecx, esi
call fcn.00415fa4
jmp 0x415ed1
cmp eax, 0x5b
jne 0x415e5e
mov ecx, esi
call fcn.00418df9
mov ecx, esi
call fcn.0041667b
cmp dword [esi + 0x4c], 0x5d
je 0x415ddd
push 4
jmp 0x415ef6
cmp eax, 0x28
jne 0x415e7a
mov ecx, esi
call fcn.00418df9
mov ecx, esi
call fcn.00419851
mov bl, al
cmp dword [esi + 0x4c], edi
jne 0x415ef4
jmp 0x415ec6
cmp eax, 0x5e
jne 0x415e83
push 2
jmp 0x415e06
cmp eax, 0x24
jne 0x415e8f
push 3
jmp 0x415e06
cmp eax, 0x2a
je 0x415ef0
cmp eax, 0x2b
je 0x415ef0
cmp eax, 0x3f
je 0x415ef0
cmp eax, 0x7b
je 0x415ef0
cmp eax, 0x7d
jne 0x415ead
test dword [esi + 0x50], edx
je 0x415eec
cmp eax, 0x5d
jne 0x415eb7
test dword [esi + 0x50], edx
je 0x415e57
movzx eax, word [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.00414f62
mov bl, 1
mov ecx, esi
call fcn.00418df9
test bl, bl
je 0x415ed8
mov ecx, esi
call fcn.00418ef3
mov eax, dword [esi + 0x4c]
mov cl, 1
cmp eax, 0xffffffff
jne 0x415da3
pop ebx
pop edi
mov al, cl
pop esi
ret
push 6
jmp 0x415ef6
push 0xa
jmp 0x415ef6
push 5
mov ecx, esi
call fcn.00417f78
int3
Function at 0x42502f
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x566f9c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x4250b3
cmp byte [esi + 0x3d], 0
je 0x4250b3
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x425084
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x425088
sub eax, 1
je 0x42508c
dec eax
sub eax, 1
je 0x4250b3
xor al, al
jmp 0x4250b5
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x4250aa
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x425084
cmp byte [esi + 0x3d], 0
sete al
jmp 0x4250b5
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004d62a0
leave
ret

Function at 0x42bc5b
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x566f9c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
or edi, 0xffffffff
mov esi, ecx
cmp ebx, edi
jne 0x42bc81
xor eax, eax
jmp 0x42bd3c
mov eax, dword [esi + 0x20]
cmp dword [eax], 0
je 0x42bca3
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, dword [eax]
cmp dword [eax], edx
jae 0x42bca3
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
mov byte [eax], bl
mov eax, ebx
jmp 0x42bd3c
cmp dword [esi + 0x4c], 0
je 0x42bd3a
call fcn.004251b9
mov ecx, dword [esi + 0x38]
mov al, bl
test ecx, ecx
jne 0x42bccd
push dword [esi + 0x4c]
push eax
call fcn.00422a5e
test al, al
pop ecx
pop ecx
cmovne edi, ebx
jmp 0x42bd3a
mov byte [ebp - 0x28], al
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
test eax, eax
js 0x42bd3a
cmp eax, 1
jle 0x42bd08
cmp eax, 3
jne 0x42bd3a
push dword [esi + 0x4c]
push dword [ebp - 0x28]
jmp 0x42bcbf
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x24]
sub eax, ecx
mov dword [ebp - 0x30], eax
je 0x42bd2c
push dword [esi + 0x4c]
push eax
mov eax, ecx
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp dword [ebp - 0x30], eax
jne 0x42bd3a
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x34], eax
mov eax, ebx
jne 0x42bd3c
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004d62a0
leave
ret 4
Function at 0x432d11
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x432d34
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
jmp 0x432dec
mov eax, dword [edi + 0x1c]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov eax, dword [eax]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], eax
test eax, eax
je 0x432d55
mov eax, dword [edi + 0x2c]
mov eax, dword [eax]
jmp 0x432d57
xor eax, eax
cdq
mov dword [ebp + 0x10], eax
mov ecx, edx
mov dword [ebp - 4], ecx
test ebx, ebx
jl 0x432de0
jg 0x432d6a
test esi, esi
je 0x432de0
test ecx, ecx
jl 0x432dac
jg 0x432d74
test eax, eax
je 0x432dac
cmp ebx, ecx
jg 0x432d86
jl 0x432d7e
cmp esi, eax
jae 0x432d86
mov eax, esi
mov dword [ebp + 0x10], esi
mov dword [ebp - 4], ebx
push eax
push dword [ebp - 8]
push dword [ebp + 8]
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [ebp + 0x10]
add esp, 0xc
mov eax, dword [edi + 0x2c]
add dword [ebp + 8], ecx
sub esi, ecx
sbb ebx, dword [ebp - 4]
sub dword [eax], ecx
mov eax, dword [edi + 0x1c]
add dword [eax], ecx
jmp 0x432db2
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
test ebx, ebx
jl 0x432de0
jg 0x432dbc
test esi, esi
je 0x432de0
cmp dword [edi + 0x4c], 0
je 0x432de0
mov ecx, edi
call fcn.004251b9
push dword [edi + 0x4c]
push esi
push 1
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
sub esi, eax
sbb ebx, 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
sub eax, esi
pop esi
sbb edx, ebx
pop ebx
pop edi
leave
ret 0xc
Function at 0x432df1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x432e14
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
jmp 0x432ec2
mov eax, dword [ebx + 0x20]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov eax, dword [eax]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], eax
test eax, eax
je 0x432e35
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x432e37
xor eax, eax
cdq
mov dword [ebp + 0x10], eax
mov ecx, edx
mov dword [ebp - 4], ecx
test edi, edi
jl 0x432eb6
jg 0x432e4a
test esi, esi
je 0x432eb6
test ecx, ecx
jl 0x432e8e
jg 0x432e54
test eax, eax
je 0x432e8e
cmp edi, ecx
jg 0x432e66
jl 0x432e5e
cmp esi, eax
jae 0x432e66
mov eax, esi
mov dword [ebp + 0x10], esi
mov dword [ebp - 4], edi
push eax
push dword [ebp + 8]
push dword [ebp - 8]
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [ebp + 0x10]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x30]
add edx, ecx
sub esi, ecx
sbb edi, dword [ebp - 4]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
jmp 0x432e91
mov edx, dword [ebp + 8]
test edi, edi
jl 0x432eb6
jg 0x432e9b
test esi, esi
je 0x432eb6
cmp dword [ebx + 0x4c], 0
je 0x432eb6
push dword [ebx + 0x4c]
push esi
push 1
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x4351da
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push edi
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x4c], ebx
jne 0x4351f2
xor al, al
jmp 0x435362
lea eax, [edi + 0x3c]
mov dword [ebp - 0x14], ebx
cmp dword [eax + 0x14], 8
mov dword [ebp - 0x10], ebx
jb 0x435203
mov eax, dword [eax]
push esi
push ebx
push ebx
push 0x80
push 2
push 2
push 0x40000000
push eax
lea ecx, [ebp - 0x14]
call fcn.004041db
mov esi, dword [ebp - 0x14]
test eax, eax
jne 0x435354
cmp dword [edi], 4
jne 0x435251
push ebx
lea eax, [ebp - 0xc]
push eax
push 4
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x435245
call fcn.00403ee6
push ebx
lea eax, [ebp - 0xc]
push eax
push 5
lea eax, [edi + 8]
jmp 0x43527c
cmp dword [edi], 5
jne 0x435347
push ebx
lea eax, [ebp - 0xc]
push eax
push 4
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x435272
call fcn.00403ee6
push ebx
lea eax, [ebp - 0xc]
push eax
push 8
lea eax, [edi + 0xd]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x43528d
call fcn.00403ee6
mov ecx, dword [edi + 4]
mov dword [ebp - 4], ebx
lea eax, [ecx + 1]
test eax, eax
je 0x4352c4
mov esi, ebx
mov eax, dword [edi + 0x18]
lea ecx, [ebp - 0x14]
push ebx
push 6
add eax, esi
push eax
call fcn.004049a2
mov ecx, dword [edi + 4]
add esi, 6
mov edx, dword [ebp - 4]
inc edx
mov dword [ebp - 4], edx
lea eax, [ecx + 1]
cmp edx, eax
jb 0x43529c
mov esi, dword [ebp - 0x14]
cmp dword [edi], 5
jne 0x4352f4
xor eax, eax
cmp ax, word [edi + 0x13]
jae 0x4352f4
mov esi, ebx
mov eax, dword [edi + 0x24]
lea ecx, [ebp - 0x14]
push ebx
push 4
lea eax, [eax + esi*4]
push eax
call fcn.004049a2
movzx eax, word [edi + 0x13]
inc esi
cmp esi, eax
jl 0x4352d3
mov ecx, dword [edi + 4]
mov esi, dword [ebp - 0x14]
mov edx, ebx
mov dword [ebp - 4], edx
test ecx, ecx
je 0x435336
mov ecx, ebx
mov dword [ebp - 8], ebx
mov eax, dword [edi + 0x30]
mov esi, dword [eax + ecx]
mov eax, dword [eax + ecx + 4]
mov dword [ebp - 0xc], esi
sub eax, esi
je 0x435324
push ebx
push eax
push esi
lea ecx, [ebp - 0x14]
call fcn.004049a2
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
inc edx
add ecx, 0xc
mov dword [ebp - 4], edx
mov dword [ebp - 8], ecx
cmp edx, dword [edi + 4]
jb 0x435302
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x435343
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, ebx
mov bl, 1
jmp 0x435354
test esi, esi
je 0x43535f
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, ebx
test esi, esi
je 0x43535f
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
pop esi
pop edi
pop ebx
leave
ret
Function at 0x449769
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x14]
lea ecx, [eax - 4]
mov dword [ebx], ecx
cmp eax, 4
jne 0x44978b
mov eax, dword [ebp + 0x10]
and dword [eax], 0
mov al, 1
jmp 0x44984b
push esi
push ecx
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov eax, dword [ebp + 0x10]
mov dword [eax], esi
test esi, esi
je 0x449848
push edi
push dword [ebx]
xor edi, edi
push edi
push esi
call sub.VCRUNTIME140.dll_memset
mov eax, dword [ebp + 8]
add esp, 0xc
mov ecx, dword [ebx]
mov edx, dword [eax]
add eax, 4
mov dword [ebp + 0xc], eax
mov eax, ecx
shr eax, 2
test eax, eax
je 0x44981d
mov ebx, dword [ebp + 0xc]
mov edi, eax
mov al, byte [ebx]
imul edx, edx, 0x343fd
add edx, 0x269ec3
xor al, dl
mov byte [esi], al
mov eax, edx
sar eax, 8
xor al, byte [ebx + 1]
mov byte [esi + 1], al
mov eax, edx
sar eax, 0x10
xor al, byte [ebx + 2]
mov byte [esi + 2], al
mov eax, edx
mov cl, byte [ebx + 3]
add ebx, 4
sar eax, 0x18
xor al, cl
mov byte [esi + 3], al
add esi, 4
sub edi, 1
jne 0x4497d5
mov dword [ebp + 0xc], ebx
mov ebx, dword [ebp + 0x14]
mov ecx, dword [ebx]
imul eax, edx, 0x343fd
add eax, 0x269ec3
mov dword [ebp + 0x14], eax
and ecx, 3
je 0x449843
mov edx, dword [ebp + 0xc]
dec edx
mov al, byte [ebp + edi + 0x14]
inc edx
xor al, byte [edx]
inc edi
mov byte [esi - 1], al
cmp edi, ecx
jb 0x449834
mov al, 1
pop edi
jmp 0x44984a
xor al, al
pop esi
pop ebx
leave
ret
Function at 0x44c9c7
Capabilities:
Create directory

Disassembly:
push 0xac
mov eax, 0x4e362d
call fcn.004d631c
lea edi, [ecx + 0x80]
push 0x4ebfb4
lea eax, [ebp - 0xb8]
push edi
push eax
call fcn.00403164
and dword [ebp - 4], 0
push 0x4eed4c
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.004029e1
add esp, 0x18
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 2
call fcn.00401f5a
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebx, str.operaprefs.ini
lea eax, [ebp - 0x28]
push ebx
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.00403164
add esp, 0xc
push eax
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], 3
call fcn.004080c5
mov esi, eax
push ebx
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 4
push edi
push eax
call fcn.00403164
add esp, 0xc
push eax
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], 5
call fcn.004080c5
push 1
push esi
push eax
mov byte [ebp - 4], 6
call fcn.0040a465
add esp, 0xc
lea ecx, [ebp - 0x64]
call fcn.00402dce
lea ecx, [ebp - 0x7c]
call fcn.00401f5a
lea ecx, [ebp - 0x40]
call fcn.00401f5a
lea ecx, [ebp - 0x88]
call fcn.00402dce
lea ecx, [ebp - 0xa0]
call fcn.00401f5a
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 2
call fcn.00401f5a
mov ebx, str._search.ini
lea eax, [ebp - 0x28]
push ebx
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.00403164
add esp, 0xc
push eax
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], 7
call fcn.004080c5
mov esi, eax
push ebx
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 8
push edi
push eax
call fcn.00403164
add esp, 0xc
push eax
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], 9
call fcn.004080c5
push 1
push esi
push eax
mov byte [ebp - 4], 0xa
call fcn.0040a465
add esp, 0xc
lea ecx, [ebp - 0x88]
call fcn.00402dce
lea ecx, [ebp - 0xa0]
call fcn.00401f5a
lea ecx, [ebp - 0x58]
call fcn.00401f5a
lea ecx, [ebp - 0x64]
call fcn.00402dce
lea ecx, [ebp - 0x7c]
call fcn.00401f5a
lea ecx, [ebp - 0x40]
call fcn.00401f5a
lea ecx, [ebp - 0x28]
call fcn.00401f5a
call fcn.004d62c6
ret
Function at 0x45305c
Capabilities:
Hash data using sha1
Initialize hashing via wincrypt

Disassembly:
push 0x6c
mov eax, 0x4d8634
call fcn.004d631c
mov esi, ecx
push 0x4ebbbc
lea ecx, [ebp - 0x44]
call fcn.004019e2
xor edi, edi
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
call fcn.00404c3c
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x28]
push ecx
lea ecx, [esi + 4]
mov dword [esi], eax
call fcn.00401b47
lea ecx, [ebp - 0x28]
call fcn.00401f34
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x44]
call fcn.00401f34
lea ebx, [esi + 0x1c]
cmp dword [ebx], edi
lea edi, [esi + 0x20]
je 0x453118
cmp dword [edi], 0
je 0x453118
push str.Cryptographic_provider_already_acquired_
lea ecx, [ebp - 0x44]
call fcn.004019e2
xor eax, eax
mov dword [ebp - 4], 1
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x2c], eax
lea ecx, [ebp - 0x28]
lea eax, [ebp - 0x44]
push eax
call fcn.00404c3c
mov eax, dword [ebp - 0x2c]
lea ecx, [esi + 4]
mov dword [esi], eax
lea eax, [ebp - 0x28]
push eax
call fcn.00401b47
lea ecx, [ebp - 0x28]
call fcn.00401f34
lea ecx, [ebp - 0x44]
call fcn.00401f34
xor al, al
jmp 0x4531d0
mov eax, dword [esi + 0x24]
push 0xf0000020
push 1
push 0
push 0
push ebx
mov dword [esi + 0x28], eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x453158
push str.Failed_to_acquire_cryptographic_context.
lea ecx, [ebp - 0x44]
call fcn.004019e2
mov dword [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_GetLastError]
and dword [ebp - 0x18], 0
and dword [ebp - 0x14], 0
jmp 0x4530e1
push edi
xor edi, edi
push edi
push edi
push 0x8004
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x4531ce
push str.Failed_to_acquire_cryptographic_context.
lea ecx, [ebp - 0x78]
call fcn.004019e2
mov dword [ebp - 4], 3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x60], eax
lea ecx, [ebp - 0x5c]
lea eax, [ebp - 0x78]
mov dword [ebp - 0x4c], edi
push eax
mov dword [ebp - 0x48], edi
call fcn.00404c3c
mov eax, dword [ebp - 0x60]
lea ecx, [esi + 4]
mov dword [esi], eax
lea eax, [ebp - 0x5c]
push eax
call fcn.00401b47
lea ecx, [ebp - 0x5c]
call fcn.00401f34
lea ecx, [ebp - 0x78]
call fcn.00401f34
push edi
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov dword [ebx], edi
jmp 0x453111
mov al, 1
call fcn.004d62c6
ret
Function at 0x4531d6
Capabilities:
Get system firmware table

Disassembly:
push 0x90
mov eax, 0x4e4a79
call fcn.004d631c
mov dword [ebp - 0x98], ecx
mov esi, dword [ebp + 8]
xor eax, eax
push eax
push eax
mov dword [ebp - 0x9c], esi
push eax
mov dword [ebp - 0x90], eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetSystemFirmwareTable]
push 0x52534d42
call ebx
push eax
mov dword [ebp - 0x94], eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
pop ecx
mov edi, eax
mov dword [esi + 0x14], 7
xor ecx, ecx
xor eax, eax
mov dword [esi + 0x10], ecx
mov word [esi], ax
mov dword [ebp - 4], ecx
mov dword [ebp - 0x90], 1
test edi, edi
je 0x453315
push dword [ebp - 0x94]
push edi
push ecx
push 0x52534d42
call ebx
mov ecx, dword [ebp - 0x98]
lea eax, [ebp - 0x28]
push edi
push eax
call fcn.004533dd
cmp dword [ebp - 0x18], 0
mov dword [ebp - 4], 1
je 0x453305
mov ebx, str.E6A23A08432E47E1
push ebx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
pop ecx
push eax
push ebx
lea ecx, [ebp - 0x28]
call fcn.00402e22
lea ecx, [ebp - 0x74]
call fcn.00406d8f
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.0041991b
pop ecx
pop ecx
mov dword [ebp - 0x90], 3
push 0
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp - 0x8c]
push eax
lea ecx, [ebp - 0x74]
call fcn.00453d10
push eax
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 4
push eax
call fcn.0041997c
pop ecx
pop ecx
lea eax, [ebp - 0x40]
mov ecx, esi
push eax
call fcn.00402b70
lea ecx, [ebp - 0x40]
call fcn.00401f5a
lea ecx, [ebp - 0x8c]
call fcn.00401f34
lea ecx, [ebp - 0x58]
call fcn.00401f34
lea ecx, [ebp - 0x70]
call fcn.00401f34
lea ecx, [ebp - 0x28]
call fcn.00401f5a
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
mov eax, esi
call fcn.004d62c6
ret 4