joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4129d0
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x43263b
mov eax, dword fs:[0]
push eax
sub esp, 0xa20
mov eax, dword [0x43f090]
xor eax, esp
mov dword [esp + 0xa1c], eax
push ebx
push edi
mov eax, dword [0x43f090]
xor eax, esp
push eax
lea eax, [esp + 0xa2c]
mov dword fs:[0], eax
xor edi, edi
mov dword [esp + 0x10], edi
mov eax, dword [0x4418c4]
mov edx, dword [eax + 0xc]
mov ecx, 0x4418c4
call edx
lea ebx, [eax + 0x10]
mov dword [esp + 0xc], ebx
push 0x206
lea ecx, [esp + 0x26]
xor eax, eax
push edi
mov dword [esp + 0xa3c], edi
push ecx
mov word [esp + 0x2c], ax
call fcn.00420660
mov edi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
add esp, 0xc
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x18]
push ecx
push str.UninstallString
push str.Software360ChromeUpdateClientState27D39816_7A3D_406c_9ABC_97FB55674016
push SysReAllocString
mov dword [esp + 0x28], 1
mov dword [esp + 0x34], 0x103
call edi
test eax, eax
jne 0x412ad1
xor edx, edx
cmp dx, word [esp + 0x20]
je 0x412ad1
push str.......
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push str.360chrome.exe
lea ecx, [esp + 0x24]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea edx, [esp + 0x20]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x412ad1
lea edx, [esp + 0x20]
lea edi, [esp + 0xc]
call fcn.00402a40
mov edi, dword [esp + 0xc]
add edi, 0xfffffff0
jmp 0x412b94
xor ecx, ecx
push 0x7fe
push ecx
lea edx, [esp + 0x232]
push edx
mov word [esp + 0x234], cx
call fcn.00420660
add esp, 0xc
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x22c]
push ecx
lea edx, [esp + 0x1c]
push edx
push 0x43649c
push str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths360chrome.exe
push SysReAllocString
mov dword [esp + 0x2c], 1
mov dword [esp + 0x30], 0x7fe
call edi
cmp dword [esp + 0x14], 1
jne 0x412b91
cmp word [esp + 0x228], 0
je 0x412b91
lea eax, [esp + 0x228]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x412b91
lea edx, [esp + 0x228]
lea edi, [esp + 0xc]
call fcn.00402a40
mov edi, dword [esp + 0xc]
add edi, 0xfffffff0
mov eax, edi
call fcn.004049c0
add eax, 0x10
mov dword [esi], eax
mov dword [esp + 0xa34], 0xffffffff
lea ecx, [edi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x412bc0
mov ecx, dword [edi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push edi
call edx
jmp 0x412bc0
lea edi, [ebx - 0x10]
mov eax, edi
call fcn.004049c0
add eax, 0x10
or ecx, 0xffffffff
mov dword [esi], eax
lea eax, [edi + 0xc]
mov dword [esp + 0xa34], ecx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x412bc0
mov ecx, dword [edi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push edi
call eax
mov eax, esi
mov ecx, dword [esp + 0xa2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [esp + 0xa1c]
xor ecx, esp
call fcn.0041e5bb
add esp, 0xa2c
ret
Function at 0x414cf0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test ecx, ecx
jne 0x414cf7
xor eax, eax
ret
push esi
not eax
cmp edx, 8
jb 0x414dd4
mov esi, edx
shr esi, 3
push edi
lea esp, [esp]
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x438498]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0x438498]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0x438498]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x438498]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x438498]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x438498]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x438498]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x438498]
inc ecx
sub edx, 8
sub esi, 1
jne 0x414d10
pop edi
test edx, edx
je 0x414dfb
jmp 0x414de0
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x438498]
inc ecx
sub edx, 1
jne 0x414de0
not eax
pop esi
ret

Function at 0x4154f0
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, ebx
imul esi, dword [esp + 8]
cmp byte [edi], 0
je 0x415522
mov ecx, dword [edi + 4]
push 0
lea eax, [esp + 0xc]
push eax
push esi
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x415518
mov byte [edi + 8], 1
mov eax, dword [esp + 8]
xor edx, edx
div ebx
pop esi
ret
mov ecx, dword [edi + 0x18]
mov eax, dword [edi + 0x14]
push ebp
lea ebp, [ecx + esi]
cmp ebp, eax
pop ebp
jbe 0x415535
sub eax, ecx
mov esi, eax
mov eax, dword [edi + 0x10]
push esi
add eax, ecx
push eax
push edx
call fcn.00421e00
add dword [edi + 0x18], esi
mov eax, esi
add esp, 0xc
xor edx, edx
div ebx
pop esi
ret

Function at 0x415550
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
cmp byte [esi], 0
push edi
mov edi, 1
je 0x415583
mov edx, dword [esi + 4]
push 0
lea eax, [esp + 0xc]
push eax
push edi
lea ecx, [esp + 0x13]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41557d
mov byte [esi + 8], 1
mov edi, dword [esp + 8]
jmp 0x4155af
mov eax, dword [esi + 0x14]
push ebx
mov ebx, dword [esi + 0x18]
lea ecx, [ebx + 1]
cmp ecx, eax
jbe 0x415595
sub eax, ebx
mov edi, eax
mov edx, dword [esi + 0x10]
push edi
add edx, ebx
push edx
lea eax, [esp + 0x13]
push eax
call fcn.00421e00
add esp, 0xc
add ebx, edi
mov dword [esi + 0x18], ebx
pop ebx
cmp edi, 1
pop edi
jne 0x4155c6
movzx ecx, byte [esp + 3]
mov edx, dword [esp + 0xc]
mov dword [edx], ecx
xor eax, eax
add esp, 8
ret
cmp byte [esi], 0
je 0x4155c0
cmp byte [esi + 8], 0
je 0x4155c0
or eax, 0xffffffff
add esp, 8
ret
Function at 0x4156b0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x18
cmp byte [esi], 0
je 0x4156f5
cmp byte [esi + 1], 0
je 0x4156fd
mov eax, dword [esi + 4]
push 2
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp byte [esi], 0
push ebp
je 0x415711
cmp byte [esi + 1], 0
je 0x415703
mov edx, dword [esi + 4]
push 1
push 0
push 0
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebp, eax
sub ebp, dword [esi + 0xc]
mov dword [esp + 4], ebp
jmp 0x41571a
mov ecx, dword [esi + 0x14]
mov dword [esi + 0x18], ecx
jmp 0x4156ce
xor eax, eax
add esp, 0x18
ret
mov dword [esp + 4], 0
mov ebp, dword [esp + 4]
jmp 0x41571a
mov eax, dword [esi + 0x18]
mov dword [esp + 4], eax
mov ebp, eax
push edi
mov edi, 0xffff
mov dword [esp + 0xc], edi
cmp ebp, edi
jae 0x41572e
mov dword [esp + 0xc], ebp
mov edi, ebp
push ebx
push 0x404
call fcn.0041f58b
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x415749
pop ebx
pop edi
pop ebp
add esp, 0x18
ret
mov eax, 4
mov dword [esp + 0x18], 0
cmp edi, eax
jbe 0x41585c
jmp 0x41576c
mov edi, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov ebp, dword [esp + 0xc]
add eax, 0x400
mov dword [esp + 0x14], edi
cmp eax, edi
ja 0x41577d
mov dword [esp + 0x14], eax
mov eax, ebp
sub eax, dword [esp + 0x14]
sub ebp, eax
mov dword [esp + 0x20], eax
cmp ebp, 0x404
jbe 0x415796
mov ebp, 0x404
cmp byte [esi], 0
je 0x4157bb
cmp byte [esi + 1], 0
je 0x41585c
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 4]
push 0
push 0
add ecx, eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x4157be
mov dword [esi + 0x18], eax
cmp byte [esi], 0
mov edi, ebp
je 0x4157e6
mov ecx, dword [esi + 4]
push 0
lea eax, [esp + 0x20]
push eax
push ebp
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4157e0
mov byte [esi + 8], 1
mov eax, dword [esp + 0x1c]
jmp 0x41580c
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x14]
lea edx, [eax + ebp]
cmp edx, ecx
jbe 0x4157f7
sub ecx, eax
mov edi, ecx
mov ecx, dword [esi + 0x10]
push edi
add ecx, eax
push ecx
push ebx
call fcn.00421e00
add esp, 0xc
add dword [esi + 0x18], edi
mov eax, edi
xor edx, edx
div ebp
cmp eax, 1
jne 0x41585c
lea eax, [ebp - 3]
test eax, eax
jle 0x41584e
lea esp, [esp]
dec eax
cmp byte [eax + ebx], 0x50
jne 0x41583c
cmp byte [eax + ebx + 1], 0x4b
jne 0x41583c
cmp byte [eax + ebx + 2], 5
jne 0x41583c
cmp byte [eax + ebx + 3], 6
je 0x415842
test eax, eax
jg 0x415820
jmp 0x41584e
mov edx, dword [esp + 0x20]
add eax, edx
mov dword [esp + 0x18], eax
jne 0x41585c
mov eax, dword [esp + 0x10]
cmp dword [esp + 0x14], eax
jb 0x415760
push ebx
call fcn.0041ef04
mov eax, dword [esp + 0x1c]
add esp, 4
pop ebx
pop edi
pop ebp
add esp, 0x18
ret
Function at 0x416560
Capabilities:
Get common file path

Disassembly:
sub esp, 8
cmp dword [ebx], 0
push esi
push edi
jne 0x4165e4
cmp dword [ebx + 4], 0xffffffff
jne 0x4165e4
lea esi, [ebx + 0x138]
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea edi, [esp + 0xc]
mov ecx, 0x82
mov edx, esi
call fcn.00412ee0
test eax, eax
jl 0x4165b3
mov eax, dword [esp + 0xc]
mov ecx, 0x82
sub ecx, eax
lea edx, [esi + eax*2]
push 0x43653c
mov eax, SysReAllocString
call fcn.00416e10
mov eax, dword [esp + 0x14]
lea edi, [esp + 0x14]
call fcn.00415450
test eax, eax
jne 0x4165d0
mov eax, dword [esp + 0x14]
pop edi
pop esi
add esp, 8
ret 4
call fcn.00415870
mov dword [ebx], eax
mov eax, dword [0x442650]
pop edi
pop esi
add esp, 8
ret 4
pop edi
mov eax, 0x1000000
pop esi
add esp, 8
ret 4

Function at 0x4169f0
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x4144
call fcn.0042ac70
mov eax, dword [0x43f090]
xor eax, esp
mov dword [esp + 0x413c], eax
mov eax, dword [esp + 0x414c]
push ebx
push ebp
mov ebp, dword [esp + 0x4150]
push esi
or esi, 0xffffffff
push edi
mov ebx, ecx
mov dword [esp + 0x14], eax
cmp dword [ebp + 4], esi
je 0x416a30
mov edi, dword [ebp]
call fcn.00416460
mov dword [ebp + 4], esi
mov esi, dword [ebp]
cmp ebx, dword [esi + 4]
jl 0x416a45
mov eax, 0x10000
jmp 0x416b7d
cmp ebx, dword [esi + 0x10]
jge 0x416a4f
call fcn.00415e80
mov ecx, dword [ebp]
cmp dword [ecx + 0x10], ebx
jge 0x416aa6
mov esi, dword [ebp]
test esi, esi
je 0x416a9e
cmp dword [esi + 0x18], 0
je 0x416a9e
mov eax, dword [esi + 0x10]
inc eax
cmp eax, dword [esi + 4]
je 0x416a9e
mov edx, dword [esi + 0x50]
add edx, dword [esi + 0x4c]
mov ecx, dword [esi + 0x48]
push 0
mov dword [esi + 0x10], eax
lea edx, [edx + ecx + 0x2e]
add dword [esi + 0x14], edx
push 0
lea eax, [esi + 0x78]
push eax
lea ecx, [esi + 0x28]
push ecx
mov eax, esi
call fcn.00415a30
add esp, 0x10
neg eax
sbb eax, eax
inc eax
mov dword [esi + 0x18], eax
mov edx, dword [ebp]
cmp dword [edx + 0x10], ebx
jl 0x416a57
lea eax, [esp + 0x18]
push eax
push ebx
mov ecx, ebp
call fcn.00416600
test byte [esp + 0x120], 0x10
je 0x416ac4
xor eax, eax
jmp 0x416b7d
mov edi, dword [esp + 0x14]
cmp edi, 0xffffffff
jne 0x416ad7
mov eax, 0x200
jmp 0x416b7d
mov eax, dword [ebp]
call fcn.004161b0
mov eax, dword [ebp]
lea ecx, [esp + 0x148]
push ecx
mov ecx, 0x4000
xor bl, bl
call fcn.004162c0
add esp, 4
test eax, eax
jl 0x416b38
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
je 0x416b3a
push 0
lea edx, [esp + 0x18]
push edx
push eax
lea eax, [esp + 0x154]
push eax
push edi
call esi
test eax, eax
je 0x416b38
mov eax, dword [ebp]
lea ecx, [esp + 0x148]
push ecx
mov ecx, 0x4000
call fcn.004162c0
add esp, 4
test eax, eax
jge 0x416b03
mov bl, 1
push edi
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
jne 0x416b69
test bl, bl
jne 0x416b69
lea edx, [esp + 0x134]
push edx
lea eax, [esp + 0x128]
push eax
lea ecx, [esp + 0x134]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
mov edi, dword [ebp]
call fcn.00416460
movzx eax, bl
neg eax
sbb eax, eax
and eax, 0x400
mov ecx, dword [esp + 0x414c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0041e5bb
add esp, 0x4144
ret 8
Function at 0x417420
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp dword [esi + 0x18], 0
je 0x4174dc
mov eax, dword [esi + 0x1c]
mov ecx, dword [esi + 0x20]
push ebx
push ebp
push edi
mov edi, dword [esp + 0x18]
add eax, edi
cmp eax, ecx
jb 0x4174bb
add ecx, ecx
mov ebp, ecx
cmp ecx, eax
ja 0x417448
mov ebp, eax
push 0
push ebp
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ebx, eax
test ebx, ebx
je 0x41747d
push ebp
push 0
push 0
push 0xf001f
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
test edi, edi
jne 0x417489
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebp
mov eax, 0x300
pop ebx
pop ecx
ret 8
mov ecx, dword [esi + 0x20]
mov edx, dword [esi + 0x18]
push ecx
push edx
push edi
call fcn.00421e00
mov eax, dword [esi + 0x18]
add esp, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x18], edi
mov edi, dword [esp + 0x18]
mov dword [esi + 0x20], ebp
mov dword [esi + 4], ebx
mov eax, dword [esi + 0x1c]
mov edx, dword [esp + 0x14]
add eax, dword [esi + 0x18]
push edi
push edx
push eax
call fcn.00421e00
add esp, 0xc
add dword [esi + 0x1c], edi
mov eax, edi
pop edi
pop ebp
pop ebx
pop ecx
ret 8
mov eax, dword [esi]
test eax, eax
je 0x417509
mov edx, dword [esp + 0xc]
push 0
lea ecx, [esp + 4]
push ecx
mov ecx, dword [esp + 0x10]
push edx
push ecx
push eax
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp]
pop ecx
ret 8
mov dword [esi + 0xc], 0x1000000
xor eax, eax
pop ecx
ret 8

Function at 0x417ac0
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x68
mov eax, dword [0x43f090]
xor eax, esp
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x6c]
xor ecx, ecx
push esi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], ecx
push eax
mov eax, dword [esp + 0x78]
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.0041b640
add esp, 4
lea esi, [esp + 8]
mov ecx, edi
call fcn.0041b6e0
mov ecx, dword [esp + 0x64]
pop esi
xor ecx, esp
call fcn.0041e5bb
add esp, 0x68
ret
Function at 0x417c30
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov esi, eax
lea eax, [esp + 0x18]
push eax
push 0x20119
xor edi, edi
push edi
push 0x43a0d0
push reloc.OLEAUT32.dll_SysReAllocString
mov ebx, ecx
mov dword [esp + 0x30], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x417dc1
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
lea ecx, [esp + 0x10]
push ecx
mov dword [esi + 0x10], eax
push ebx
mov dword [esi + 0x14], eax
lea edx, [esp + 0x1c]
push edx
mov dword [esi + 0x18], eax
push eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov eax, dword [esp + 0x28]
push str.Operator
mov edi, 0x400
push eax
mov dword [esp + 0x28], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x417cc3
cmp dword [esp + 0x14], 1
jne 0x417da8
mov eax, dword [esp + 0x10]
sub edi, eax
mov dword [esi], ebx
lea ebx, [eax + ebx]
je 0x417da8
mov eax, dword [esp + 0x18]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [esp + 0x10]
push ecx
push ebx
lea edx, [esp + 0x1c]
push edx
push 0
push str.IssueDate
push eax
mov dword [esp + 0x28], edi
call ebp
test eax, eax
jne 0x417d08
cmp dword [esp + 0x14], 1
jne 0x417da8
mov eax, dword [esp + 0x10]
mov dword [esi + 4], ebx
sub edi, eax
add ebx, eax
test edi, edi
je 0x417da8
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x10]
push ecx
push ebx
lea edx, [esp + 0x1c]
push edx
push 0
push str.ExpirationDate
push eax
mov dword [esp + 0x28], edi
call ebp
test eax, eax
jne 0x417d3f
cmp dword [esp + 0x14], 1
jne 0x417da8
mov eax, dword [esp + 0x10]
mov dword [esi + 8], ebx
sub edi, eax
add ebx, eax
test edi, edi
je 0x417da8
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x10]
push ecx
push ebx
lea edx, [esp + 0x1c]
push edx
push 0
push str.SignData
push eax
mov dword [esp + 0x28], edi
call ebp
test eax, eax
jne 0x417da8
cmp dword [esp + 0x14], 3
jne 0x417da8
mov eax, dword [esp + 0x10]
sub edi, eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], ebx
je 0x417da8
lea eax, [esi + 0xc]
call fcn.00417b30
test eax, eax
je 0x417da8
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov ecx, 0x400
sub ecx, edi
push eax
mov dword [edx], ecx
mov esi, 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x4181b0
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x6c
mov eax, dword [0x43f090]
xor eax, esp
mov dword [esp + 0x68], eax
push esi
lea eax, [esp + 8]
mov esi, edx
push eax
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x18], 0x67452301
mov dword [esp + 0x1c], 0xefcdab89
mov dword [esp + 0x20], 0x98badcfe
mov dword [esp + 0x24], 0x10325476
call fcn.0041a170
add esp, 8
test eax, eax
jne 0x41821b
pop esi
mov ecx, dword [esp + 0x68]
xor ecx, esp
call fcn.0041e5bb
add esp, 0x6c
ret
mov eax, dword [esp + 0x74]
test eax, eax
jbe 0x418230
push esi
lea ecx, [esp + 0x14]
call fcn.0041b640
add esp, 4
lea esi, [esp + 0x10]
mov ecx, ebx
call fcn.0041b6e0
test edi, edi
je 0x41824e
mov ecx, dword [esp + 0xc]
xor eax, eax
cmp ecx, dword [esp + 8]
sete al
mov dword [edi], eax
mov ecx, dword [esp + 0x6c]
pop esi
xor ecx, esp
mov eax, 1
call fcn.0041e5bb
add esp, 0x6c
ret

Function at 0x418290
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x64
mov eax, dword [0x43f090]
xor eax, esp
mov dword [esp + 0x5c], eax
xor eax, eax
push esi
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
push edi
lea eax, [esp + 8]
mov edi, ecx
push eax
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.0041a360
add esp, 4
test eax, eax
jne 0x4182ee
pop edi
pop esi
mov ecx, dword [esp + 0x5c]
xor ecx, esp
call fcn.0041e5bb
add esp, 0x64
ret
lea esi, [esp + 8]
mov ecx, ebx
call fcn.0041b6e0
mov ecx, dword [esp + 0x64]
pop edi
pop esi
xor ecx, esp
mov eax, 1
call fcn.0041e5bb
add esp, 0x64
ret

Function at 0x418310
Capabilities:
Hash data using sha256

Disassembly:
sub esp, 0x74
mov eax, dword [0x43f090]
xor eax, esp
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x78]
xor ecx, ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ecx
push edi
lea ecx, [esp + 8]
push ecx
push eax
mov dword [esp + 0x10], 0x6a09e667
mov dword [esp + 0x14], 0xbb67ae85
mov dword [esp + 0x18], 0x3c6ef372
mov dword [esp + 0x1c], 0xa54ff53a
mov dword [esp + 0x20], 0x510e527f
mov dword [esp + 0x24], 0x9b05688c
mov dword [esp + 0x28], 0x1f83d9ab
mov dword [esp + 0x2c], 0x5be0cd19
call fcn.0041a440
add esp, 8
test eax, eax
jne 0x41838f
pop edi
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.0041e5bb
add esp, 0x74
ret
mov eax, esi
lea edi, [esp + 8]
call fcn.0041b220
mov ecx, dword [esp + 0x74]
pop edi
xor ecx, esp
mov eax, 1
call fcn.0041e5bb
add esp, 0x74
ret

Function at 0x418ce0
Capabilities:
Read file on windows

Disassembly:
push ecx
push 0
lea eax, [esp + 4]
push eax
push esi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x418d0b
push 0x43649c
mov eax, 0x43649c
call fcn.0041c140
add esp, 4
xor eax, eax
pop ecx
ret
mov eax, 1
cmp esi, dword [esp]
je 0x418d24
push 0x43649c
call fcn.0041c1b0
add esp, 4
xor eax, eax
pop ecx
ret
Function at 0x4195c0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x28
mov eax, dword [0x43f090]
xor eax, esp
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x38]
push ebx
push ebp
xor ebx, ebx
push esi
mov esi, ecx
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], ebx
cmp eax, ebx
jne 0x4195f3
mov dword [esp + 0x10], 0xffffffff
jmp 0x4195f9
mov eax, dword [eax]
mov dword [esp + 0x10], eax
mov ebp, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
push ebx
push ebx
push ebp
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x419627
push 0x43649c
mov eax, 0x43649c
call fcn.0041c140
add esp, 4
jmp 0x419707
push 0
lea edx, [esp + 0x1c]
push edx
push 8
lea eax, [esp + 0x30]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x419657
push 0x43649c
mov eax, 0x43649c
call fcn.0041c140
add esp, 4
jmp 0x419707
mov eax, 8
cmp dword [esp + 0x18], eax
je 0x419679
mov eax, 1
push 0x43649c
call fcn.0041c1b0
add esp, 4
jmp 0x419707
cmp dword [esp + 0x40], ebx
je 0x4196b5
mov ebx, eax
cmp dword [esp + 0x10], eax
jae 0x41969b
mov eax, 5
push 0x43649c
call fcn.0041c1b0
add esp, 4
jmp 0x419707
mov ecx, dword [esp + 0x24]
mov dx, word [esp + 0x28]
mov dword [esi], ecx
mov cx, word [esp + 0x2a]
mov word [esi + 4], dx
mov word [esi + 6], cx
jmp 0x4196ff
mov esi, dword [esp + 0x24]
cmp esi, dword [esp + 0x10]
jbe 0x4196c3
mov ebx, esi
jmp 0x419687
mov edx, dword [esp + 0x38]
xor ebx, ebx
push ebx
push ebx
push ebp
push edx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x4196ec
push 0x43649c
mov eax, 0x43649c
call fcn.0041c140
add esp, 4
jmp 0x419707
mov ecx, dword [esp + 0x20]
mov edx, edi
call fcn.00418ce0
test eax, eax
je 0x419707
mov ebx, dword [esp + 0x24]
mov dword [esp + 0x14], 1
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x419711
mov dword [eax], ebx
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x14]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0041e5bb
add esp, 0x28
ret
Function at 0x419ff0
Capabilities:
Get file size

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov esi, eax
mov eax, dword [esi]
mov edi, dword [esi + 0x18]
lea ecx, [esp + 0x10]
push ecx
xor ebp, ebp
push eax
xor ebx, ebx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x41a036
push 0x43649c
mov eax, 0x43649c
call fcn.0041c140
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov ebx, dword [esp + 0x10]
mov ecx, dword [esi + 0xb4]
xor edx, edx
sub ebx, edi
mov edi, dword [esp + 0x14]
sbb edi, edx
sub ebx, 0x298
sbb edi, ebp
xor eax, eax
cmp edi, eax
jl 0x41a0c8
jg 0x41a05e
cmp ebx, ecx
jb 0x41a0c8
mov ebp, dword [esi]
push 0
push 0
push edi
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x41a08d
push 0x43649c
mov eax, 0x43649c
call fcn.0041c140
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov ecx, dword [esp + 0x1c]
mov esi, 0x298
mov edx, ebp
call fcn.00418ce0
test eax, eax
je 0x41a083
mov eax, dword [esp + 0x20]
test eax, eax
je 0x41a0ae
mov dword [eax], ebx
mov dword [eax + 4], edi
mov eax, dword [esp + 0x24]
test eax, eax
je 0x41a0d5
mov ecx, 1
mov word [eax], cx
mov eax, ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x24]
cmp eax, ebp
je 0x41a0d5
xor edx, edx
mov word [eax], dx
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret