joyce8/EMBER2024-capa huggingface dataset:
Function at 0x438d80
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x30]
push eax
push ebx
cmp ecx, 0
je 0x438e6a
and ebp, 0xfffffff8
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
je 0x438dfd
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.00438540
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x438dc3
mov ebp, dword [esp + 0x34]
and ebp, 7
je 0x438f33
call fcn.00438e0f
and ebp, 0xfffffff8
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
je 0x438eca
mov eax, dword [esi]
mov ebx, dword [esi + 4]
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.00438960
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x438e7b
mov ebp, dword [esp + 0x34]
and ebp, 7
je 0x438f33
mov eax, dword [esi]
mov ebx, dword [esi + 4]
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.00438960
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x438f2e
jmp 0x438f33
mov ecx, dword [esp + 0x3c]
add esp, 0x18
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x439c60
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x439c7e
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
ret

Function at 0x439cc0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x439cde
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
ret
Function at 0x439d20
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x439d42
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
ret

Function at 0x439da0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x439dc2
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
ret

Function at 0x439e20
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
movups xmm1, xmmword [edx + 0x10]
shl ecx, 4
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
nop dword [eax]
add ecx, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x439e4a
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
ret

Function at 0x439eb0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
movups xmm1, xmmword [edx + 0x10]
shl ecx, 4
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
nop dword [eax]
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x439eda
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
ret

Function at 0x439f40
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesenc xmm2, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesenc xmm3, xmm1
lea edx, [edx + ecx + 0x20]
neg ecx
aesenc xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [edx + ecx]
add ecx, 0x10
jmp 0x439f9f
Function at 0x439fae
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x439f90
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
aesenclast xmm6, xmm0
aesenclast xmm7, xmm0
ret

Function at 0x43a020
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesdec xmm2, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesdec xmm3, xmm1
lea edx, [edx + ecx + 0x20]
neg ecx
aesdec xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [edx + ecx]
add ecx, 0x10
jmp 0x43a07f

Function at 0x43a08e
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
aesdec xmm6, xmm0
aesdec xmm7, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x43a070
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
aesdeclast xmm6, xmm0
aesdeclast xmm7, xmm0
ret
Function at 0x43c700
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
push ebx
test eax, eax
je 0x43cc20
test edx, edx
je 0x43cc20
call fcn.0043c717
mov eax, 0xffffffff
pop ebx
pop ebp
ret

Function at 0x43cc60
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
call fcn.0043c700
mov edx, dword [esp + 0xc]
shl ecx, 4
test eax, eax
jne 0x43ccd1
lea eax, [edx + ecx + 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
movups xmmword [eax], xmm0
movups xmmword [edx], xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
aesimc xmm0, xmm0
aesimc xmm1, xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmmword [eax + 0x10], xmm0
movups xmmword [edx - 0x10], xmm1
cmp eax, edx
ja 0x43cc96
movups xmm0, xmmword [edx]
aesimc xmm0, xmm0
movups xmmword [edx], xmm0
pxor xmm0, xmm0
pxor xmm1, xmm1
xor eax, eax
ret

Function at 0x43d5e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push esi
push edi
sub esp, 0x10
mov ebp, dword [esp + 0x24]
mov esi, dword [esp + 0x28]
mov edi, dword [esp + 0x2c]
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov ecx, dword [esi + 8]
mov edx, dword [esi + 0xc]
bswap eax
bswap ebx
bswap ecx
bswap edx
mov dword [edi], eax
mov dword [edi + 4], ebx
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
cmp ebp, 0x80
je 0x43d664
mov eax, dword [esi + 0x10]
mov ebx, dword [esi + 0x14]
cmp ebp, 0xc0
je 0x43d63c
mov ecx, dword [esi + 0x18]
mov edx, dword [esi + 0x1c]
jmp 0x43d644
mov ecx, eax
mov edx, ebx
not ecx
not edx
bswap eax
bswap ebx
bswap ecx
bswap edx
mov dword [edi + 0x20], eax
mov dword [edi + 0x24], ebx
mov dword [edi + 0x28], ecx
mov dword [edi + 0x2c], edx
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
nop
call fcn.0043d669

Function at 0x44c510
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x65b3d0
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x6feae4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0060964c
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.00606eff
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x44f810
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x44f841
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x44f830
pop edi
mov eax, edx
pop esi
pop ebp
ret 8
Function at 0x4513a0
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
xor cl, cl
push edi
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x4515bd
cmp eax, 0x7c
je 0x4515bd
cmp eax, 0x29
jne 0x4513dc
cmp dword [esi + 0x10], 0
jne 0x4515bd
test dword [esi + 0x50], 0x10000000
je 0x4515d4
cmp eax, 0x2e
jne 0x4513f0
push 5
lea ecx, [esi + 0x24]
call fcn.00451630
jmp 0x4515a1
cmp eax, 0x5c
jne 0x451455
mov ecx, esi
call fcn.00451340
mov eax, dword [esi + 0x50]
and eax, 0x80
je 0x451422
cmp byte [esi + 0x48], 0x62
jne 0x451422
push 4
lea ecx, [esi + 0x24]
call fcn.00451630
mov ecx, esi
call fcn.00451340
jmp 0x4515af
test eax, eax
je 0x451449
cmp byte [esi + 0x48], 0x42
jne 0x451449
push 4
lea ecx, [esi + 0x24]
call fcn.00451630
mov eax, dword [esi + 0x28]
mov ecx, esi
xor dword [eax + 8], 1
call fcn.00451340
jmp 0x4515af
mov ecx, esi
call fcn.00451f90
jmp 0x4515a8
cmp eax, 0x5b
jne 0x451508
mov ecx, esi
call fcn.00451340
lea ecx, [esi + 0x24]
call fcn.004533b0
mov eax, dword [esi + 0x4c]
cmp eax, 0x5e
jne 0x451486
mov eax, dword [esi + 0x28]
mov ecx, esi
xor dword [eax + 8], 1
call fcn.00451340
mov eax, dword [esi + 0x4c]
test dword [esi + 0x50], 0x20000000
je 0x4514f2
cmp eax, 0x5d
jne 0x4514f2
test dword [esi + 0x2c], 0x100
mov bl, al
je 0x4514b0
mov eax, dword [esi + 0x30]
push 0x5d
mov ecx, dword [eax + 4]
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
call eax
mov bl, al
mov edi, dword [esi + 0x28]
mov ecx, dword [edi + 0x18]
test ecx, ecx
jne 0x4514d6
push 0x20
call fcn.0060964c
xorps xmm0, xmm0
mov dword [ebp - 4], eax
add esp, 4
mov ecx, eax
movups xmmword [eax], xmm0
movups xmmword [eax + 0x10], xmm0
mov dword [edi + 0x18], eax
movzx edx, bl
mov eax, edx
and edx, 7
shr eax, 3
add ecx, eax
movzx eax, byte [ecx]
bts eax, edx
mov byte [ecx], al
mov ecx, esi
call fcn.00451340
mov ecx, esi
call fcn.00452ee0
cmp dword [esi + 0x4c], 0x5d
jne 0x4515cd
jmp 0x4515a1
cmp eax, 0x28
jne 0x451534
mov ecx, esi
call fcn.00451340
mov ecx, esi
call fcn.00452130
cmp dword [esi + 0x4c], 0x29
mov bl, al
jne 0x4515d4
mov ecx, esi
call fcn.00451340
test bl, bl
je 0x4515af
jmp 0x4515a8
cmp eax, 0x5e
jne 0x45154c
push 2
lea ecx, [esi + 0x24]
call fcn.00451630
mov ecx, esi
call fcn.00451340
jmp 0x4515af
cmp eax, 0x24
jne 0x451564
push 3
lea ecx, [esi + 0x24]
call fcn.00451630
mov ecx, esi
call fcn.00451340
jmp 0x4515af
cmp eax, 0x2a
je 0x4515c6
cmp eax, 0x2b
je 0x4515c6
cmp eax, 0x3f
je 0x4515c6
cmp eax, 0x7b
je 0x4515c6
cmp eax, 0x7d
jne 0x451586
test dword [esi + 0x50], 0x10000000
je 0x4515db
cmp eax, 0x5d
jne 0x451594
test dword [esi + 0x50], 0x10000000
je 0x4515cd
movzx eax, byte [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.004523a0
mov ecx, esi
call fcn.00451340
mov ecx, esi
call fcn.00452240
mov eax, dword [esi + 0x4c]
mov cl, 1
cmp eax, 0xffffffff
jne 0x4513b7
pop edi
pop esi
mov al, cl
pop ebx
mov esp, ebp
pop ebp
ret
push 0xa
call fcn.00450750
push 4
call fcn.00450750
push 5
call fcn.00450750
push 6
call fcn.00450750
int3
Function at 0x454fd0
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x6feae4]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push 0x105
xor edi, edi
lea eax, [ebp - 0x214]
push edi
push eax
call fcn.0062b160
add esp, 0xc
lea eax, [ebp - 0x214]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x455167
push ebx
push 3
call fcn.004c61c0
add esp, 4
call fcn.004c6120
mov ebx, eax
mov dword [ebp - 0x21c], ebx
test ebx, ebx
je 0x455161
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
push esi
cmovae eax, dword [ebp + 8]
push eax
push 0x2712
push ebx
call fcn.004c9840
push 1
push 0x29
push ebx
call fcn.004c9840
push edi
push 0x40
push ebx
call fcn.004c9840
push edi
push 0x51
push ebx
call fcn.004c9840
push 1
push 0x34
push ebx
call fcn.004c9840
push 1
push 0x2b
push ebx
call fcn.004c9840
add esp, 0x48
push 0x454fc0
push 0x4e2b
push ebx
call fcn.004c9840
push 0x105
lea eax, [ebp - 0x10c]
push edi
push eax
call fcn.0062b160
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea eax, [ebp - 0x214]
add esp, 0x18
push eax
lea eax, [ebp - 0x10c]
push eax
call esi
cmp dword [ebp + 0x34], 0x10
lea eax, [ebp + 0x20]
cmovae eax, dword [ebp + 0x20]
push eax
lea eax, [ebp - 0x10c]
push eax
call esi
push 0x6e2340
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.006394ac
add esp, 0xc
test eax, eax
jne 0x455157
mov eax, dword [ebp - 0x218]
test eax, eax
je 0x455157
push eax
push 0x2711
push ebx
call fcn.004c9840
push ebx
call fcn.004c6160
push dword [ebp - 0x218]
mov esi, eax
call fcn.00638f9a
add esp, 0x14
test esi, esi
jne 0x455157
lea esi, [edi + 5]
lea ebx, [edi + 1]
nop word [eax + eax]
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
push 0x3e8
cmovne edi, ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esi, ebx
jne 0x455130
mov ebx, dword [ebp - 0x21c]
push ebx
call fcn.004c6100
add esp, 4
pop esi
call fcn.004c6180
pop ebx
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x455197
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x45518d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4551ea
push edx
push ecx
call fcn.0060967c
add esp, 8
mov edx, dword [ebp + 0x34]
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 0xf
mov byte [ebp + 8], 0
cmp edx, 0x10
jb 0x4551d9
mov ecx, dword [ebp + 0x20]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4551cf
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4551ea
push edx
push ecx
call fcn.0060967c
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, edi
xor ecx, ebp
pop edi
call fcn.0060963b
mov esp, ebp
pop ebp
ret
call fcn.0062eee9
int3
Function at 0x4553a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x65bec2
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x6feae4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x21c], esi
mov dword [ebp - 4], 0
lea eax, [ebp - 0x218]
push 0x208
mov dword [ebp - 0x228], esi
push 0
mov dword [ebp - 0x224], 0
push eax
mov dword [ebp - 0x21c], 1
call fcn.0062b160
add esp, 0xc
mov dword [ebp - 0x220], 0x208
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x21c]
push eax
push 0x6e2344
push str.SOFTWARE_smallant
push reloc.WS2_32.dll_bind
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea edx, [ebp - 0x218]
mov ecx, esi
call fcn.0044e410
mov dword [ebp - 4], 0
cmp dword [esi + 0x10], 0
mov dword [ebp - 0x224], 1
jne 0x455471
push 1
push 0x6e2370
mov ecx, esi
call fcn.00447110
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0060963b
mov esp, ebp
pop ebp
ret
Function at 0x455bc0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x65bfc0
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x6feae4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x1c], 0x10
lea edx, [esi + 8]
jb 0x455bf8
mov edx, dword [edx]
lea ecx, [ebp - 0x40]
call fcn.0044e5b0
lea edx, [esi + 0x20]
mov dword [ebp - 4], 0
cmp dword [edx + 0x14], 0x10
jb 0x455c12
mov edx, dword [edx]
lea ecx, [ebp - 0x28]
call fcn.0044e5b0
mov byte [ebp - 4], 1
lea edi, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
lea ebx, [ebp - 0x40]
lea edx, [esi + 0x38]
cmovae edi, dword [ebp - 0x28]
cmp dword [ebp - 0x2c], 8
cmovae ebx, dword [ebp - 0x40]
cmp dword [edx + 0x14], 8
jb 0x455c3f
mov edx, dword [edx]
mov eax, dword [esi + 4]
push 0
push edi
push ebx
mov ecx, dword [eax + 0xa4]
push edx
mov eax, dword [ecx]
call dword [eax + 0x10]
push str.task_end_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea ecx, [ebp - 0x28]
call fcn.0044d6c0
lea ecx, [ebp - 0x40]
call fcn.0044d6c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0060963b
mov esp, ebp
pop ebp
ret
Function at 0x45caf0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x6feae4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x214], ecx
push esi
mov esi, dword [ebp + 8]
push edi
test ebx, ebx
je 0x45cca0
cmp dword [esi + 0x21c], 0
je 0x45cb4d
push ecx
push eax
mov edx, ebx
mov ecx, esi
call fcn.0045ccc0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0060963b
mov esp, ebp
pop ebp
ret 0x10
push 0x104
lea eax, [esi + 0xc]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.006395a1
add esp, 0xc
mov esi, ebx
mov ax, word [ebx]
add ebx, 2
test ax, ax
jne 0x45cb67
lea edi, [ebp - 0x20c]
sub ebx, esi
add edi, 0xfffffffe
nop dword [eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x45cb80
mov ecx, ebx
lea eax, [ebp - 0x20c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 0
push 0
push 3
push 0
push 7
mov ecx, ebx
and ecx, 3
push connect
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x45cca0
test esi, esi
je 0x45cca0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x21c], eax
test eax, eax
je 0x45cc65
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, dword [ebp - 0x214]
mov ebx, dword [ebp - 0x218]
push edi
push 0
push eax
mov dword [ebx], eax
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
cmp dword [edi], 0
jne 0x45cc12
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x45cc92
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push 0
lea ecx, [ebp - 0x210]
mov dword [ebp - 0x214], eax
push ecx
push dword [ebp - 0x21c]
mov dword [ebp - 0x210], 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x45cc71
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x214]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0060963b
mov esp, ebp
pop ebp
ret 0x10
mov ebx, dword [ebp - 0x218]
mov edi, dword [ebp - 0x214]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [edi]
test ecx, ecx
je 0x45cc8a
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [edi], 0
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [ebx], 0
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0060963b
mov esp, ebp
pop ebp
ret 0x10