joyce8/EMBER2024-capa huggingface dataset:
Function at 0x453720
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
push 0x588c30
mov esi, ecx
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 4], eax
test eax, eax
jne 0x453744
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push ebx
push 0x588c20
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
push 0x588c4c
push esi
mov dword [ebp - 8], ebx
call fcn.00535749
add esp, 8
test eax, eax
je 0x45378c
test ebx, ebx
je 0x45377c
push 8
push 0
push esi
call ebx
pop ebx
mov edi, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop ebx
mov edi, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
test ebx, ebx
je 0x4537b5
push str.AddDllDirectory
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4537b5
push 0x800
push 0
push esi
call ebx
pop ebx
mov edi, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edx, eax
mov dword [ebp - 4], edx
test edx, edx
je 0x453860
mov ecx, esi
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4537d1
sub ecx, ebx
lea eax, [edx + 1]
add eax, ecx
push eax
call dword [0x5b7b68]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x453856
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x453856
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x453802
sub ecx, edx
mov eax, 0x5c
mov word [ecx + ebx], ax
mov ecx, ebx
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x453820
sub ecx, edx
sub ecx, esi
add ecx, ebx
nop dword [eax]
mov al, byte [esi]
lea esi, [esi + 1]
mov byte [ecx + esi - 1], al
test al, al
jne 0x453830
mov eax, dword [ebp - 8]
test eax, eax
je 0x45384d
push 8
push 0
push ebx
call eax
jmp 0x453854
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
push ebx
call dword [0x5b7b6c]
add esp, 4
pop ebx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x454030
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x5b706c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x10], ebx
mov dword [esi], ebx
lea esi, [ebp - 8]
push esi
push eax
push edx
push ecx
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x4541b8
push edi
mov edi, dword [ebp - 8]
test edi, edi
je 0x4541a4
mov eax, dword [edi + 4]
cmp eax, 2
jne 0x454085
mov eax, 0x10
jmp 0x454093
cmp eax, 0x17
jne 0x454143
mov eax, 0x1c
cmp dword [edi + 0x18], 0
mov dword [ebp - 0xc], eax
je 0x454143
mov ecx, dword [edi + 0x10]
test ecx, ecx
je 0x454143
cmp ecx, eax
jb 0x454143
push 0x20
call dword [0x5b7b68]
mov esi, eax
add esp, 4
test esi, esi
je 0x454199
mov eax, dword [edi]
mov dword [esi], eax
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x18], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x1c], 0
call dword [0x5b7b68]
add esp, 4
mov dword [esi + 0x18], eax
test eax, eax
je 0x454188
push dword [ebp - 0xc]
push dword [edi + 0x18]
push eax
call fcn.00524840
mov eax, dword [edi + 0x14]
add esp, 0xc
test eax, eax
je 0x454131
push eax
call dword [0x5b7b74]
add esp, 4
mov dword [esi + 0x14], eax
test eax, eax
je 0x45416e
mov eax, dword [ebp - 0x10]
test ebx, ebx
cmove ebx, esi
test eax, eax
je 0x454140
mov dword [eax + 0x1c], esi
mov dword [ebp - 0x10], esi
mov edi, dword [edi + 0x1c]
test edi, edi
jne 0x454076
mov edi, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
test eax, eax
je 0x45415f
push eax
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
test edi, edi
je 0x4541a0
mov ecx, ebx
call fcn.00453ff0
xor ebx, ebx
jmp 0x4541b0
push dword [esi + 0x18]
mov edi, 8
call dword [0x5b7b6c]
push esi
call dword [0x5b7b6c]
add esp, 8
jmp 0x454151
push esi
mov edi, 8
call dword [0x5b7b6c]
add esp, 4
jmp 0x454151
mov edi, 8
jmp 0x454151
test ebx, ebx
jne 0x4541b0
mov edi, 0x2af9
push edi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, dword [ebp - 0x18]
mov dword [eax], ebx
mov eax, edi
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0051e9d8
mov esp, ebp
pop ebp
ret
Function at 0x45b1a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 8], ecx
mov esi, ebx
cmp dword [ebx + 0x14], 0x10
mov edi, dword [ebx + 0x10]
mov dword [ebp - 4], edi
jb 0x45b1bf
mov esi, dword [ebx]
xor ecx, ecx
mov edx, 0x811c9dc5
test edi, edi
je 0x45b1e1
nop word [eax + eax]
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x45b1d0
mov edi, dword [ebp - 8]
mov eax, dword [edi + 0x1c]
mov ecx, dword [edi + 0x10]
and eax, edx
mov edi, dword [edi + 8]
mov dword [ebp - 0xc], edi
mov esi, dword [ecx + eax*8]
add eax, eax
mov edx, dword [ecx + eax*4]
inc eax
mov dword [ebp - 0x10], edx
lea eax, [ecx + eax*4]
mov dword [ebp - 0x14], eax
cmp edx, edi
jne 0x45b20c
mov eax, edi
jmp 0x45b210
mov eax, dword [eax]
mov eax, dword [eax]
cmp esi, eax
je 0x45b27d
cmp dword [ebx + 0x14], 0x10
mov edx, ebx
jb 0x45b21e
mov edx, dword [ebx]
mov edi, dword [esi + 0x1c]
lea ecx, [esi + 8]
mov dword [ebp - 0x18], edi
cmp edi, 0x10
mov edi, dword [ebp - 0xc]
jb 0x45b232
mov ecx, dword [esi + 8]
push dword [ebp - 4]
mov eax, dword [esi + 0x18]
push edx
mov edx, eax
mov dword [ebp - 0x1c], eax
call fcn.0040a610
add esp, 8
test al, al
jne 0x45b254
mov esi, dword [esi]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
jmp 0x45b204
cmp dword [ebp - 0x18], 0x10
lea eax, [esi + 8]
jb 0x45b25f
mov eax, dword [eax]
cmp dword [ebx + 0x14], 0x10
jb 0x45b267
mov ebx, dword [ebx]
push dword [ebp - 0x1c]
mov edx, dword [ebp - 4]
mov ecx, ebx
push eax
call fcn.0040a610
add esp, 8
test al, al
cmovne edi, esi
mov ecx, dword [ebp - 8]
cmp dword [ecx + 8], edi
jne 0x45b290
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [edi + 0x20]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x45b350
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x559467
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x5b706c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov ebx, dword [ebp + 8]
mov esi, ebx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
cmp dword [ebx + 0x14], 0x10
mov edi, dword [ebx + 0x10]
jb 0x45b391
mov esi, dword [ebx]
xor ecx, ecx
mov edx, 0x811c9dc5
test edi, edi
je 0x45b3b1
nop dword [eax]
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x45b3a0
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx + 0x1c]
and eax, edx
mov edx, dword [ecx + 0x10]
mov dword [ebp - 0x24], edx
mov esi, dword [edx + eax*8]
add eax, eax
lea edi, [eax*4 + 4]
mov eax, dword [edx + eax*4]
mov dword [ebp - 0x1c], edi
mov edi, dword [ecx + 8]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], edi
nop word [eax + eax]
cmp eax, edi
jne 0x45b3e8
mov eax, edi
jmp 0x45b3f0
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + edx]
mov eax, dword [eax]
cmp esi, eax
je 0x45b461
cmp dword [ebx + 0x14], 0x10
mov edx, ebx
jb 0x45b3fe
mov edx, dword [ebx]
mov edi, dword [esi + 0x1c]
lea ecx, [esi + 8]
mov dword [ebp - 0x2c], edi
cmp edi, 0x10
mov edi, dword [ebp - 0x20]
jb 0x45b412
mov ecx, dword [esi + 8]
push dword [ebx + 0x10]
mov eax, dword [esi + 0x18]
push edx
mov edx, eax
mov dword [ebp - 0x18], eax
call fcn.0040a610
add esp, 8
test al, al
jne 0x45b434
mov esi, dword [esi]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
jmp 0x45b3e0
cmp dword [ebp - 0x2c], 0x10
lea eax, [esi + 8]
jb 0x45b43f
mov eax, dword [eax]
cmp dword [ebx + 0x14], 0x10
mov ecx, ebx
jb 0x45b449
mov ecx, dword [ebx]
push dword [ebp - 0x18]
mov edx, dword [ebx + 0x10]
push eax
call fcn.0040a610
mov ecx, dword [ebp - 0x10]
add esp, 8
test al, al
je 0x45b464
jmp 0x45b467
mov ecx, dword [ebp - 0x10]
mov esi, dword [ecx + 8]
cmp dword [ecx + 8], esi
je 0x45b4be
push 0
push 0x5bb704
push 0x5bb770
push 0
push dword [esi + 0x20]
call fcn.00526967
mov esi, eax
add esp, 0x14
test esi, esi
je 0x45b4be
mov edx, dword [ebp - 0x14]
lea ecx, [esi + 4]
cmp ecx, edx
je 0x45b4a8
cmp dword [edx + 0x14], 0x10
mov eax, edx
jb 0x45b49f
mov eax, dword [edx]
push dword [edx + 0x10]
push eax
call fcn.00403f90
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0x1c
call fcn.0051ebe4
mov esi, eax
add esp, 4
mov dword [ebp - 0x18], esi
push dword [ebp - 0x14]
mov dword [ebp - 4], 1
lea ecx, [esi + 4]
mov dword [esi], vtable.logical::ExprValueStr.0
call fcn.00409180
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
push esi
push ebx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x45b510
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, ebx
cmp dword [ebx + 0x14], 0x10
mov edi, dword [ebx + 0x10]
jb 0x45b52c
mov esi, dword [ebx]
xor ecx, ecx
mov edx, 0x811c9dc5
test edi, edi
je 0x45b548
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x45b537
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x1c]
and eax, edx
mov edx, dword [ecx + 0x10]
mov dword [ebp - 0x14], edx
mov esi, dword [edx + eax*8]
add eax, eax
lea edi, [eax*4 + 4]
mov eax, dword [edx + eax*4]
mov dword [ebp - 0x10], edi
mov edi, dword [ecx + 8]
mov dword [ebp - 0x18], eax
nop
cmp eax, edi
jne 0x45b578
mov eax, edi
jmp 0x45b580
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + edx]
mov eax, dword [eax]
cmp esi, eax
je 0x45b5f6
cmp dword [ebx + 0x14], 0x10
lea eax, [esi + 8]
mov ecx, ebx
jb 0x45b591
mov ecx, dword [ebx]
mov edx, dword [eax + 0x14]
mov dword [ebp - 8], eax
mov dword [ebp - 0x1c], edx
cmp edx, 0x10
jb 0x45b5a4
mov edx, dword [eax]
mov dword [ebp - 8], edx
push dword [ebx + 0x10]
mov eax, dword [eax + 0x10]
mov edx, eax
push ecx
mov ecx, dword [ebp - 8]
mov dword [ebp - 0xc], eax
call fcn.0040a610
add esp, 8
test al, al
jne 0x45b5c9
mov esi, dword [esi]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
jmp 0x45b570
cmp dword [ebp - 0x1c], 0x10
lea eax, [esi + 8]
jb 0x45b5d4
mov eax, dword [eax]
cmp dword [ebx + 0x14], 0x10
mov ecx, ebx
jb 0x45b5de
mov ecx, dword [ebx]
push dword [ebp - 0xc]
mov edx, dword [ebx + 0x10]
push eax
call fcn.0040a610
mov ecx, dword [ebp - 4]
add esp, 8
test al, al
je 0x45b5f9
jmp 0x45b5fc
mov ecx, dword [ebp - 4]
mov esi, dword [ecx + 8]
cmp dword [ecx + 8], esi
je 0x45b633
push 0
push 0x5bb74c
push 0x5bb770
push 0
push dword [esi + 0x20]
call fcn.00526967
add esp, 0x14
test eax, eax
je 0x45b633
mov ecx, dword [ebp + 0xc]
mov dword [eax + 8], ecx
mov ecx, dword [ebp + 0x10]
mov dword [eax + 0xc], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x10
call fcn.0051ebe4
mov ecx, dword [ebp - 4]
add esp, 4
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov dword [eax + 8], edx
mov edx, dword [ebp + 0x10]
mov dword [eax], vtable.logical::ExprValueNum.0
mov dword [eax + 0xc], edx
mov edx, dword [ecx]
push eax
push ebx
call dword [edx + 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x45b950
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, ebx
cmp dword [ebx + 0x14], 0x10
mov edi, dword [ebx + 0x10]
mov dword [ebp - 0xc], eax
jb 0x45b972
mov esi, dword [ebx]
xor ecx, ecx
mov edx, 0x811c9dc5
test edi, edi
je 0x45b991
nop dword [eax]
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x45b980
mov edi, dword [ebp - 4]
mov eax, dword [edi + 0x18]
mov ecx, dword [edi + 0xc]
and eax, edx
mov edi, dword [edi + 4]
mov dword [ebp - 0x10], edi
mov esi, dword [ecx + eax*8]
add eax, eax
mov edx, dword [ecx + eax*4]
inc eax
mov dword [ebp - 0x14], edx
lea eax, [ecx + eax*4]
mov dword [ebp - 0x18], eax
cmp edx, edi
jne 0x45b9bc
mov eax, edi
jmp 0x45b9c0
mov eax, dword [eax]
mov eax, dword [eax]
cmp esi, eax
je 0x45ba42
cmp dword [ebx + 0x14], 0x10
mov edx, ebx
jb 0x45b9ce
mov edx, dword [ebx]
mov edi, dword [esi + 0x1c]
lea ecx, [esi + 8]
mov dword [ebp - 0x1c], edi
cmp edi, 0x10
mov edi, dword [ebp - 0x10]
jb 0x45b9e2
mov ecx, dword [esi + 8]
push dword [ebx + 0x10]
mov eax, dword [esi + 0x18]
push edx
mov edx, eax
mov dword [ebp - 8], eax
call fcn.0040a610
add esp, 8
test al, al
jne 0x45ba04
mov esi, dword [esi]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
jmp 0x45b9b4
cmp dword [ebp - 0x1c], 0x10
lea eax, [esi + 8]
jb 0x45ba0f
mov eax, dword [eax]
cmp dword [ebx + 0x14], 0x10
mov ecx, ebx
jb 0x45ba19
mov ecx, dword [ebx]
push dword [ebp - 8]
mov edx, dword [ebx + 0x10]
push eax
call fcn.0040a610
add esp, 8
test al, al
jne 0x45ba35
test al, al
mov ecx, edi
cmovne edi, esi
jmp 0x45ba44
mov ecx, dword [ebp - 4]
test al, al
cmovne edi, esi
mov ecx, dword [ecx + 4]
jmp 0x45ba44
mov ecx, edi
mov eax, edi
cmp edi, ecx
jne 0x45ba9e
mov esi, dword [ecx]
lea eax, [ebp - 8]
push ecx
push eax
push ecx
mov edi, dword [esi + 4]
push edi
push esi
mov dword [ebp - 8], ebx
call fcn.0045bd30
mov ebx, dword [ebp - 4]
mov ecx, eax
mov eax, 0x71c71c6
mov edx, dword [ebx + 8]
sub eax, edx
cmp eax, 1
jb 0x45bab2
lea eax, [edx + 1]
mov dword [ebx + 8], eax
mov dword [esi + 4], ecx
mov esi, dword [ebp - 0xc]
mov dword [edi], ecx
mov ecx, ebx
mov edx, dword [ebx + 4]
mov edx, dword [edx]
push edx
add edx, 8
push edx
push esi
call fcn.0045bae0
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword [ecx], eax
mov eax, ecx
mov byte [ecx + 4], 0
mov esp, ebp
pop ebp
ret 8
push str.list_T__too_long
call fcn.00509daf
int3
Function at 0x45bdc0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
cmp dword [edi + 0x1c], 0x10
lea esi, [edi + 8]
mov ebx, dword [edi + 0x18]
jb 0x45bde4
mov esi, dword [edi + 8]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x45be01
nop
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x45bdf0
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0xc]
and eax, edx
lea edx, [eax*8]
mov eax, dword [ecx + edx]
add ecx, edx
cmp dword [ecx + 4], edi
jne 0x45be3a
cmp eax, edi
jne 0x45be32
mov eax, dword [ebx + 4]
mov dword [ecx], eax
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 4]
mov dword [edx + ecx + 4], eax
jmp 0x45be42
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x45be42
cmp eax, edi
jne 0x45be42
mov eax, dword [edi]
mov dword [ecx], eax
mov eax, dword [edi + 4]
lea ecx, [edi + 8]
mov esi, dword [edi]
mov dword [eax], esi
mov edx, dword [edi]
mov eax, dword [edi + 4]
mov dword [edx + 4], eax
dec dword [ebx + 8]
call fcn.0045b8c0
push 0x24
push edi
call fcn.0051ec14
mov eax, dword [ebp - 8]
add esp, 8
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x45d3a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x45d3d1
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x45d3c0
pop edi
mov eax, edx
pop esi
pop ebp
ret 8
Function at 0x45fba0
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
xor cl, cl
push edi
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x45fdbd
cmp eax, 0x7c
je 0x45fdbd
cmp eax, 0x29
jne 0x45fbdc
cmp dword [esi + 0x10], 0
jne 0x45fdbd
test dword [esi + 0x50], 0x10000000
je 0x45fdd4
cmp eax, 0x2e
jne 0x45fbf0
push 5
lea ecx, [esi + 0x24]
call fcn.0045fe30
jmp 0x45fda1
cmp eax, 0x5c
jne 0x45fc55
mov ecx, esi
call fcn.0045fb40
mov eax, dword [esi + 0x50]
and eax, 0x80
je 0x45fc22
cmp byte [esi + 0x48], 0x62
jne 0x45fc22
push 4
lea ecx, [esi + 0x24]
call fcn.0045fe30
mov ecx, esi
call fcn.0045fb40
jmp 0x45fdaf
test eax, eax
je 0x45fc49
cmp byte [esi + 0x48], 0x42
jne 0x45fc49
push 4
lea ecx, [esi + 0x24]
call fcn.0045fe30
mov eax, dword [esi + 0x28]
mov ecx, esi
xor dword [eax + 8], 1
call fcn.0045fb40
jmp 0x45fdaf
mov ecx, esi
call fcn.004604a0
jmp 0x45fda8
cmp eax, 0x5b
jne 0x45fd08
mov ecx, esi
call fcn.0045fb40
lea ecx, [esi + 0x24]
call fcn.00460f50
mov eax, dword [esi + 0x4c]
cmp eax, 0x5e
jne 0x45fc86
mov eax, dword [esi + 0x28]
mov ecx, esi
xor dword [eax + 8], 1
call fcn.0045fb40
mov eax, dword [esi + 0x4c]
test dword [esi + 0x50], 0x20000000
je 0x45fcf2
cmp eax, 0x5d
jne 0x45fcf2
test dword [esi + 0x2c], 0x100
mov bl, al
je 0x45fcb0
mov eax, dword [esi + 0x30]
push 0x5d
mov ecx, dword [eax + 4]
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
call eax
mov bl, al
mov edi, dword [esi + 0x28]
mov ecx, dword [edi + 0x18]
test ecx, ecx
jne 0x45fcd6
push 0x20
call fcn.0051ebe4
xorps xmm0, xmm0
mov dword [ebp - 4], eax
add esp, 4
mov ecx, eax
movups xmmword [eax], xmm0
movups xmmword [eax + 0x10], xmm0
mov dword [edi + 0x18], eax
movzx edx, bl
mov eax, edx
and edx, 7
shr eax, 3
add ecx, eax
movzx eax, byte [ecx]
bts eax, edx
mov byte [ecx], al
mov ecx, esi
call fcn.0045fb40
mov ecx, esi
call fcn.00460a80
cmp dword [esi + 0x4c], 0x5d
jne 0x45fdcd
jmp 0x45fda1
cmp eax, 0x28
jne 0x45fd34
mov ecx, esi
call fcn.0045fb40
mov ecx, esi
call fcn.00460640
cmp dword [esi + 0x4c], 0x29
mov bl, al
jne 0x45fdd4
mov ecx, esi
call fcn.0045fb40
test bl, bl
je 0x45fdaf
jmp 0x45fda8
cmp eax, 0x5e
jne 0x45fd4c
push 2
lea ecx, [esi + 0x24]
call fcn.0045fe30
mov ecx, esi
call fcn.0045fb40
jmp 0x45fdaf
cmp eax, 0x24
jne 0x45fd64
push 3
lea ecx, [esi + 0x24]
call fcn.0045fe30
mov ecx, esi
call fcn.0045fb40
jmp 0x45fdaf
cmp eax, 0x2a
je 0x45fdc6
cmp eax, 0x2b
je 0x45fdc6
cmp eax, 0x3f
je 0x45fdc6
cmp eax, 0x7b
je 0x45fdc6
cmp eax, 0x7d
jne 0x45fd86
test dword [esi + 0x50], 0x10000000
je 0x45fddb
cmp eax, 0x5d
jne 0x45fd94
test dword [esi + 0x50], 0x10000000
je 0x45fdcd
movzx eax, byte [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.004608b0
mov ecx, esi
call fcn.0045fb40
mov ecx, esi
call fcn.00460750
mov eax, dword [esi + 0x4c]
mov cl, 1
cmp eax, 0xffffffff
jne 0x45fbb7
pop edi
pop esi
mov al, cl
pop ebx
mov esp, ebp
pop ebp
ret
push 0xa
call fcn.0045eb50
push 4
call fcn.0045eb50
push 5
call fcn.0045eb50
push 6
call fcn.0045eb50
int3
Function at 0x46bfc0
Capabilities:
Hash data using sha1
Hash data using sha256

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x54], 0
mov dword [esi + 4], 0
je 0x46bff5
push 0
push str.set_timer_to__d_ms
push 0x52
push str.c:projectswiperinstallerlibsmbedtls_2.7.0library_ssl_tls.c
push 3
push esi
call fcn.00475430
mov eax, dword [esi + 0x54]
push 0
push 0
push dword [esi + 0x50]
call eax
add esp, 0x24
xorps xmm0, xmm0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0xec], 0
movups xmmword [esi + 0xf0], xmm0
movq qword [esi + 0x100], xmm0
mov eax, dword [esi + 0x5c]
mov ecx, dword [esi + 0xac]
add eax, 0xd
mov dword [esi + 0x70], eax
xor eax, eax
cmp byte [esi + 0xd0], 0
mov word [esi + 0x84], ax
mov dword [esi + 0x90], eax
mov dword [esi + 0x94], eax
mov dword [esi + 0x98], eax
mov dword [esi + 0x9c], eax
mov dword [esi + 0xa0], eax
mov dword [esi + 0xa4], eax
mov dword [esi + 0xa8], eax
lea eax, [ecx + 0xd]
mov dword [esi + 0xe8], 0
mov dword [esi + 0x74], 0
mov dword [esi + 0x78], 0
mov dword [esi + 0x7c], 0
mov dword [esi + 0x88], 0
mov dword [esi + 0xc0], eax
mov dword [esi + 0xc4], 0
mov dword [esi + 0xc8], 0
mov dword [esi + 0xcc], 0
je 0x46c0c1
mov byte [esi + 0xd0], 0
push 0x414d
push 0
push ecx
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
call fcn.00525340
mov ecx, dword [esi + 0x48]
add esp, 0xc
test ecx, ecx
je 0x46c0fd
call fcn.0046cb80
push dword [esi + 0x48]
call fcn.00529d29
add esp, 4
mov dword [esi + 0x48], 0
mov ecx, dword [esi + 0x34]
test ecx, ecx
je 0x46c11b
call fcn.0046cdf0
push dword [esi + 0x34]
call fcn.00529d29
add esp, 4
mov dword [esi + 0x34], 0
mov dword [esi + 0xdc], 0
mov ecx, esi
pop esi
jmp fcn.0046bca0
Function at 0x46d100
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc8
mov eax, dword [0x5b706c]
xor eax, esp
mov dword [esp + 0xc4], eax
mov eax, dword [ebp + 8]
push esi
push edi
push 0x40
mov dword [esp + 0xc], eax
mov edi, ecx
lea eax, [esp + 0x2c]
mov dword [esp + 0x10], edx
push 0
push eax
call fcn.00525340
add esp, 0xc
lea eax, [esp + 0x68]
push 0x5c
push 0
push eax
call fcn.00525340
mov edx, dword [edi + 0x3c]
lea ecx, [esp + 0x1c]
add esp, 0xc
mov dword [esp + 0x10], 0
add edx, 0x41c
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0x67452301
mov dword [esp + 0x1c], 0xefcdab89
push 0x40
mov dword [esp + 0x24], 0x98badcfe
mov dword [esp + 0x28], 0x10325476
call fcn.004765c0
mov esi, eax
add esp, 4
test esi, esi
je 0x46d1a8
push esi
push str.mbedtls_md5_update_ret
push 0x1fe6
jmp 0x46d281
push dword [ebp + 0xc]
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x14]
call fcn.004765c0
mov esi, eax
add esp, 4
test esi, esi
je 0x46d1d1
push esi
push str.mbedtls_md5_update_ret
push 0x1feb
jmp 0x46d281
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x10]
call fcn.00476670
mov esi, eax
test esi, esi
je 0x46d1f4
push esi
push str.mbedtls_md5_finish_ret
push 0x1ff0
jmp 0x46d281
lea ecx, [esp + 0x68]
call fcn.0047ae20
mov esi, eax
test esi, esi
je 0x46d210
push esi
push str.mbedtls_sha1_starts_ret
push 0x1ff6
jmp 0x46d281
mov edx, dword [edi + 0x3c]
lea ecx, [esp + 0x68]
push 0x40
add edx, 0x41c
call fcn.0047bf90
mov esi, eax
add esp, 4
test esi, esi
je 0x46d23a
push esi
push str.mbedtls_sha1_update_ret
push 0x1ffc
jmp 0x46d281
push dword [ebp + 0xc]
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x6c]
call fcn.0047bf90
mov esi, eax
add esp, 4
test esi, esi
je 0x46d260
push esi
push str.mbedtls_sha1_update_ret
push 0x2002
jmp 0x46d281
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x68]
lea edx, [edx + 0x10]
call fcn.0047c040
mov esi, eax
test esi, esi
je 0x46d295
push esi
push str.mbedtls_sha1_finish_ret
push 0x2008
push str.c:projectswiperinstallerlibsmbedtls_2.7.0library_ssl_tls.c
mov edx, 1
mov ecx, edi
call fcn.004754f0
add esp, 0x10
mov eax, 0x58
lea ecx, [esp + 0x10]
nop
mov byte [ecx], 0
lea ecx, [ecx + 1]
sub eax, 1
jne 0x46d2a0
mov eax, 0x5c
lea edx, [esp + 0x68]
mov byte [edx], 0
lea edx, [edx + 1]
sub eax, 1
jne 0x46d2b4
test esi, esi
je 0x46d2d1
push 0x50
mov dl, 2
mov ecx, edi
call fcn.0046a220
add esp, 4
mov ecx, dword [esp + 0xcc]
mov eax, esi
pop edi
pop esi
xor ecx, esp
call fcn.0051e9d8
mov esp, ebp
pop ebp
ret