joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10048960
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x38
mov eax, dword [0x10139d00]
xor eax, esp
mov dword [esp + 0x34], eax
push ebx
xor ebx, ebx
push ebp
mov ebp, dword [esp + 0x48]
push esi
mov al, 0x1d
push edi
mov edi, edx
mov dword [esp + 0x10], ebp
mov esi, ebp
mov byte [esp + 0x18], 0xed
mov byte [esp + 0x19], 0x4e
mov byte [esp + 0x1a], 6
mov byte [esp + 0x1b], bl
mov byte [esp + 0x1c], 0xb0
mov byte [esp + 0x1d], 0x84
mov byte [esp + 0x1e], 0x53
mov byte [esp + 0x1f], bl
mov byte [esp + 0x20], bl
mov byte [esp + 0x21], 0xb4
mov byte [esp + 0x22], 0xbf
mov byte [esp + 0x23], bl
mov byte [esp + 0x24], 0x89
mov byte [esp + 0x25], 0x98
mov byte [esp + 0x26], 0x24
mov byte [esp + 0x27], bl
mov byte [esp + 0x28], al
mov byte [esp + 0x29], 0x5f
mov byte [esp + 0x2a], 0xb
mov byte [esp + 0x2b], bl
mov byte [esp + 0x2c], 0x1c
mov byte [esp + 0x2d], 0xb1
mov byte [esp + 0x2e], 0x45
mov byte [esp + 0x2f], bl
mov byte [esp + 0x30], 0x2b
mov byte [esp + 0x31], 0x34
mov byte [esp + 0x32], 0xd
mov byte [esp + 0x33], bl
mov byte [esp + 0x34], 0xac
mov byte [esp + 0x35], 0xa1
mov byte [esp + 0x36], 0xfa
mov byte [esp + 0x37], 4
mov byte [esp + 0x38], al
mov byte [esp + 0x39], 0x12
mov byte [esp + 0x3a], 0x8d
mov byte [esp + 0x3b], bl
mov byte [esp + 0x3c], 0xf2
mov byte [esp + 0x3d], 0xa9
mov byte [esp + 0x3e], 0x1e
mov byte [esp + 0x3f], 3
mov byte [esp + 0x40], 0xce
mov byte [esp + 0x41], 0x95
mov byte [esp + 0x42], 0xd1
mov byte [esp + 0x43], 5
cmp ecx, ebx
je 0x10048b06
mov eax, dword [esp + 0x4c]
xor edx, edx
cmp eax, 4
mov dword [esp + 0x14], ecx
jl 0x10048abd
mov ebp, eax
shr ebp, 2
mov ebx, ebp
neg ebx
lea eax, [eax + ebx*4]
mov dword [esp + 0x4c], eax
lea ebx, [ebx]
mov ebx, dword [esp + edx*4 + 0x18]
mov eax, edx
imul eax, edx
add ebx, eax
xor ecx, ebx
jne 0x10048a93
mov ecx, dword [esp + 0x14]
lea eax, [edx + 2]
xor edx, edx
mov ebx, 0xb
div ebx
mov eax, dword [edi]
xor eax, ecx
mov dword [esi], eax
mov eax, ebp
add edi, 4
add esi, 4
dec ebp
cmp eax, 1
jne 0x10048a80
mov ebp, dword [esp + 0x10]
mov eax, dword [esp + 0x4c]
xor ebx, ebx
cmp eax, ebx
je 0x10048b2a
sub edi, esi
movzx eax, byte [esp + edx*4 + 0x18]
xor ecx, eax
cmp cl, bl
jne 0x10048ad2
mov ecx, dword [esp + 0x14]
lea eax, [edx + 1]
xor edx, edx
mov ebp, 0xb
div ebp
mov al, byte [edi + esi]
xor al, cl
mov byte [esi], al
inc esi
sub dword [esp + 0x4c], 1
jne 0x10048ac3
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.100d0738
add esp, 0x38
ret 8
mov ecx, dword [esp + 0x4c]
push ecx
push edi
push ebp
call fcn.100d4950
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.100d0738
add esp, 0x38
ret 8
mov ecx, dword [esp + 0x44]
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
xor ecx, esp
call fcn.100d0738
add esp, 0x38
ret 8
Function at 0x10049560
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Manually build aes constants

Disassembly:
sub esp, 0x800
push ebx
push ebp
xor ecx, ecx
push esi
lea eax, [ecx + 1]
push edi
nop
mov edx, eax
and dl, 0x80
movsx edx, dl
neg edx
sbb edx, edx
and edx, 0x1b
lea esi, [eax + eax]
xor edx, esi
xor edx, eax
mov dword [esp + ecx*4 + 0x410], eax
mov dword [esp + eax*4 + 0x10], ecx
and edx, 0xff
inc ecx
cmp ecx, 0x100
mov eax, edx
jl 0x10049570
mov eax, 1
mov ecx, 0x101db9d0
lea esp, [esp]
mov edx, eax
and dl, 0x80
movsx edx, dl
neg edx
sbb edx, edx
mov dword [ecx], eax
and edx, 0x1b
add eax, eax
xor edx, eax
and edx, 0xff
add ecx, 4
cmp ecx, 0x101db9f8
mov eax, edx
jl 0x100495b0
mov byte [0x101db0d0], 0x63
mov byte [0x101dd25b], 0
mov ebx, 1
jmp 0x100495f0
mov ecx, dword [esp + ebx*4 + 0x10]
add ecx, ecx
add ecx, ecx
lea edx, [esp + 0x80c]
sub edx, ecx
mov eax, dword [edx]
mov ecx, eax
sar ecx, 7
lea edx, [eax + eax]
or ecx, edx
and ecx, 0xff
xor eax, ecx
mov edx, ecx
sar edx, 7
add ecx, ecx
or edx, ecx
and edx, 0xff
xor eax, edx
mov ecx, edx
add edx, edx
sar ecx, 7
or ecx, edx
and ecx, 0xff
xor eax, ecx
mov edx, ecx
sar edx, 7
add ecx, ecx
or edx, ecx
xor edx, 0x63
and edx, 0xff
xor eax, edx
mov byte [ebx + 0x101db0d0], al
mov byte [eax + 0x101dd1f8], bl
inc ebx
cmp ebx, 0x100
jl 0x100495f0
xor ecx, ecx
movzx esi, byte [ecx + 0x101db0d0]
mov edx, esi
and dl, 0x80
movsx edx, dl
neg edx
sbb edx, edx
and edx, 0x1b
lea eax, [esi + esi]
xor edx, eax
and edx, 0xff
mov eax, edx
xor eax, esi
shl eax, 8
xor eax, esi
shl eax, 8
xor eax, esi
shl eax, 8
xor eax, edx
mov dword [ecx*4 + 0x101dcdf8], eax
rol eax, 8
mov dword [ecx*4 + 0x101dc9f8], eax
rol eax, 8
mov dword [ecx*4 + 0x101dc5f8], eax
rol eax, 8
mov dword [ecx*4 + 0x101dc1f8], eax
movzx eax, byte [ecx + 0x101dd1f8]
test eax, eax
je 0x10049718
mov esi, dword [esp + eax*4 + 0x10]
mov edx, dword [esp + 0x48]
lea eax, [esi + edx]
cdq
mov edi, 0xff
idiv edi
mov eax, dword [esp + 0x34]
add eax, esi
mov ebp, dword [esp + edx*4 + 0x410]
cdq
idiv edi
mov ebx, dword [esp + edx*4 + 0x410]
mov edx, dword [esp + 0x44]
lea eax, [esi + edx]
cdq
idiv edi
mov eax, dword [esp + 0x3c]
add eax, esi
mov esi, 0xff
mov edi, dword [esp + edx*4 + 0x410]
cdq
idiv esi
mov edx, dword [esp + edx*4 + 0x410]
jmp 0x10049720
xor ebp, ebp
xor ebx, ebx
xor edi, edi
xor edx, edx
shl edx, 8
xor edx, edi
shl edx, 8
xor edx, ebx
shl edx, 8
xor edx, ebp
mov dword [ecx*4 + 0x101dbdf8], edx
rol edx, 8
mov dword [ecx*4 + 0x101db9f8], edx
rol edx, 8
mov dword [ecx*4 + 0x101db5d0], edx
rol edx, 8
mov dword [ecx*4 + 0x101db1d0], edx
inc ecx
cmp ecx, 0x100
jl 0x10049662
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x800
ret
Function at 0x10049cb0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x118
push ebx
push ebp
push esi
push edi
push 0x118
mov edi, eax
lea eax, [esp + 0x14]
push 0
push eax
call fcn.100d4cc0
mov ecx, dword [esp + 0x138]
lea esi, [edi + 8]
push ecx
lea eax, [esp + 0x20]
mov dword [edi + 4], esi
call fcn.10049770
add esp, 0x10
test eax, eax
jne 0x10049dc2
mov ecx, dword [esp + 0x10]
mov dword [edi], ecx
shl ecx, 4
add ecx, dword [esp + 0x14]
add esi, 4
mov edx, dword [ecx]
mov dword [esi - 4], edx
mov edx, dword [ecx + 4]
add ecx, 4
mov dword [esi], edx
mov edx, dword [ecx + 4]
add ecx, 4
add esi, 4
mov dword [esi], edx
mov edx, dword [ecx + 4]
add ecx, 4
add esi, 4
mov dword [esi], edx
mov edx, dword [edi]
dec edx
add esi, 4
sub ecx, 0x1c
test edx, edx
jle 0x10049da2
nop
mov edi, 4
jmp 0x10049d40
movzx ebx, byte [ecx + 3]
movzx ebx, byte [ebx + 0x101db0d0]
movzx ebp, byte [ecx + 2]
movzx ebp, byte [ebp + 0x101db0d0]
mov ebx, dword [ebx*4 + 0x101db1d0]
xor ebx, dword [ebp*4 + 0x101db5d0]
movzx ebp, byte [ecx + 1]
movzx ebp, byte [ebp + 0x101db0d0]
xor ebx, dword [ebp*4 + 0x101db9f8]
mov ebp, dword [ecx]
and ebp, 0xff
movzx ebp, byte [ebp + 0x101db0d0]
xor ebx, dword [ebp*4 + 0x101dbdf8]
add esi, 4
mov dword [esi - 4], ebx
add ecx, 4
sub edi, 1
jne 0x10049d40
dec edx
sub ecx, 0x20
test edx, edx
jg 0x10049d30
mov edx, dword [ecx]
mov dword [esi], edx
mov edx, dword [ecx + 4]
add ecx, 4
add esi, 4
mov dword [esi], edx
mov edx, dword [ecx + 4]
add esi, 4
add ecx, 4
mov dword [esi], edx
mov ecx, dword [ecx + 4]
mov dword [esi + 4], ecx
mov ecx, 0x118
lea edx, [esp + 0x10]
jmp 0x10049dd0
dec ecx
mov byte [edx], 0
inc edx
test ecx, ecx
jne 0x10049dd0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x118
ret
Function at 0x1004a9e0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x1c
mov eax, dword [0x10139d00]
xor eax, esp
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x20]
push ebx
mov ebx, dword [esp + 0x28]
push esi
mov esi, edx
mov dword [esp + 0xc], ecx
test al, 0xf
je 0x1004aa18
pop esi
mov eax, 0xffffffde
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.100d0738
add esp, 0x1c
ret
test eax, eax
jbe 0x1004aab9
push ebp
dec eax
mov ebp, edi
shr eax, 4
sub ebp, ebx
inc eax
mov dword [esp + 0xc], eax
mov edi, edi
mov eax, dword [esi + 4]
mov edx, dword [esi]
mov ecx, dword [esi + 8]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x14], edx
mov edx, dword [esi + 0xc]
mov dword [esp + 0x1c], ecx
push ebx
push eax
mov ecx, esi
mov dword [esp + 0x28], edx
call fcn.1004a3f0
add esp, 8
lea ecx, [edi + 2]
mov eax, ebx
mov edx, 4
movzx ebx, byte [eax + ebp]
xor byte [eax], bl
movzx ebx, byte [ecx - 1]
xor byte [eax + 1], bl
movzx ebx, byte [ecx]
xor byte [eax + 2], bl
movzx ebx, byte [ecx + 1]
xor byte [eax + 3], bl
add eax, 4
add ecx, 4
sub edx, 1
jne 0x1004aa65
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [edi], ecx
mov ecx, dword [esp + 0x1c]
mov dword [edi + 4], edx
mov edx, dword [esp + 0x20]
add esi, 0x10
sub ebp, 0x10
sub dword [esp + 0xc], 1
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
mov ebx, eax
jne 0x1004aa30
pop ebp
mov ecx, dword [esp + 0x20]
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.100d0738
add esp, 0x1c
ret
Function at 0x1004b080
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x32c
mov eax, dword [0x10139d00]
xor eax, esp
mov dword [esp + 0x328], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov ebx, edx
push edi
mov dword [esp + 0x10], eax
mov esi, ecx
cmp ebx, 0x180
jbe 0x1004b0ca
mov eax, 0xffffffc8
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x328]
xor ecx, esp
call fcn.100d0738
mov esp, ebp
pop ebp
ret
push 0x1a0
lea ecx, [esp + 0x194]
push 0
push ecx
call fcn.100d4cc0
push 0x118
lea edx, [esp + 0x28]
push 0
push edx
call fcn.100d4cc0
mov eax, ebx
shr eax, 0x18
push ebx
mov byte [esp + 0x1bc], al
mov ecx, ebx
mov edx, ebx
lea eax, [esp + 0x1c4]
shr ecx, 0x10
shr edx, 8
push esi
push eax
mov byte [esp + 0x1c5], cl
mov byte [esp + 0x1c6], dl
mov byte [esp + 0x1c7], bl
mov byte [esp + 0x1cb], 0x30
call fcn.100d4950
lea esi, [ebx + 0x19]
add esp, 0x24
mov byte [esp + ebx + 0x1a8], 0x80
mov dword [esp + 0x14], esi
xor eax, eax
mov byte [esp + eax + 0x170], al
inc eax
cmp eax, 0x20
jl 0x1004b145
lea ecx, [esp + 0x170]
push ecx
lea eax, [esp + 0x1c]
call fcn.10049770
add esp, 4
xor ebx, ebx
xor eax, eax
mov dword [esp + 0x130], eax
mov dword [esp + 0x134], eax
mov dword [esp + 0x138], eax
mov dword [esp + 0x13c], eax
test esi, esi
jbe 0x1004b1e4
lea edi, [esp + 0x190]
lea edx, [esp + 0x130]
sub edi, edx
lea ebx, [ebx]
xor ecx, ecx
lea eax, [esp + ecx + 0x130]
mov dl, byte [edi + eax]
xor byte [eax], dl
inc ecx
cmp ecx, 0x10
jl 0x1004b1a2
add edi, 0x10
mov eax, 0x10
cmp esi, 0x10
jae 0x1004b1c3
mov eax, esi
sub esi, eax
lea eax, [esp + 0x130]
push eax
lea ecx, [esp + 0x1c]
push ecx
mov ecx, eax
call fcn.10049df0
add esp, 8
test esi, esi
ja 0x1004b1a0
mov esi, dword [esp + 0x14]
mov edx, dword [esp + 0x130]
mov eax, dword [esp + 0x134]
mov ecx, dword [esp + 0x138]
inc byte [esp + 0x193]
mov dword [esp + ebx + 0x140], edx
mov edx, dword [esp + 0x13c]
mov dword [esp + ebx + 0x144], eax
mov dword [esp + ebx + 0x148], ecx
mov dword [esp + ebx + 0x14c], edx
add ebx, 0x10
cmp ebx, 0x30
jl 0x1004b168
lea eax, [esp + 0x140]
push eax
lea eax, [esp + 0x1c]
call fcn.10049770
mov esi, dword [esp + 0x14]
add esp, 4
mov edi, 3
lea esp, [esp]
lea ecx, [esp + 0x160]
push ecx
lea edx, [esp + 0x1c]
push edx
call fcn.10049df0
mov eax, dword [esp + 0x168]
mov ecx, dword [esp + 0x16c]
mov edx, dword [esp + 0x170]
mov dword [esi], eax
mov eax, dword [esp + 0x174]
mov dword [esi + 4], ecx
mov dword [esi + 8], edx
mov dword [esi + 0xc], eax
add esp, 8
add esi, 0x10
sub edi, 1
jne 0x1004b250
mov eax, 0x118
lea ecx, [esp + 0x18]
lea ecx, [ecx]
dec eax
mov byte [ecx], 0
inc ecx
test eax, eax
jne 0x1004b2a0
mov ecx, dword [esp + 0x334]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100d0738
mov esp, ebp
pop ebp
ret
Function at 0x1004b2c0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x38
mov eax, dword [0x10139d00]
xor eax, esp
mov dword [esp + 0x34], eax
push ebx
push ebp
push 0x30
lea ebp, [esp + 0x10]
mov eax, ebp
push 0
push eax
call fcn.100d4cc0
add esp, 0xc
mov dword [esp + 8], 3
mov ebx, 1
mov eax, 0x10
add byte [esi + eax - 1], bl
jne 0x1004b314
add byte [esi + eax - 2], bl
jne 0x1004b314
add byte [esi + eax - 3], bl
jne 0x1004b314
add byte [esi + eax - 4], bl
jne 0x1004b314
sub eax, 4
test eax, eax
jg 0x1004b2f5
lea eax, [esi + 0x20]
push ebp
push eax
mov ecx, esi
call fcn.10049df0
add esp, 8
add ebp, 0x10
sub dword [esp + 8], ebx
jne 0x1004b2f0
mov ebp, edi
lea edx, [esp + 0xc]
xor ecx, ecx
sub ebp, edx
lea eax, [esp + ecx + 0xc]
movzx edx, byte [eax + ebp]
xor byte [eax], dl
movzx edx, byte [edi + ecx + 1]
xor byte [eax + 1], dl
movzx edx, byte [edi + ecx + 2]
xor byte [eax + 2], dl
movzx edx, byte [edi + ecx + 3]
xor byte [eax + 3], dl
movzx edx, byte [edi + ecx + 4]
xor byte [eax + 4], dl
movzx edx, byte [edi + ecx + 5]
xor byte [eax + 5], dl
add ecx, 6
cmp ecx, 0x30
jl 0x1004b336
lea eax, [esp + 0xc]
push eax
lea eax, [esi + 0x20]
call fcn.10049770
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
mov dword [esi], ecx
mov ecx, dword [esp + 0x3c]
add esp, 4
mov dword [esi + 4], edx
mov dword [esi + 8], eax
mov dword [esi + 0xc], ecx
mov ecx, dword [esp + 0x3c]
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.100d0738
add esp, 0x38
ret
Function at 0x1004fa30
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x18]
lea eax, [ebp + 1]
push eax
push 0
push esi
call fcn.100d4cc0
xor edx, edx
add esp, 0xc
mov dword [esp + 0xc], edx
test ebp, ebp
jbe 0x1004fac3
movzx eax, byte [esp + 0x1c]
push edi
xor edi, edi
test eax, eax
jbe 0x1004fab9
mov ecx, dword [esp + 0x24]
mov ebx, dword [ecx + 4]
mov al, byte [edx + esi]
shl ebx, 5
mov dword [esp + 0x14], ebx
mov byte [esp + 0x1c], al
cmp ebx, edx
ja 0x1004fa7b
xor eax, eax
jmp 0x1004fa98
mov ecx, dword [esp + 0x24]
mov ebx, dword [ecx + 8]
mov eax, edx
shr eax, 5
mov eax, dword [ebx + eax*4]
mov ebx, dword [esp + 0x14]
mov ecx, edx
and ecx, 0x1f
shr eax, cl
and eax, 1
mov ecx, edi
shl al, cl
inc edi
add edx, ebp
or byte [esp + 0x1c], al
movzx eax, byte [esp + 0x20]
cmp edi, eax
jb 0x1004fa73
mov dl, byte [esp + 0x1c]
mov ecx, dword [esp + 0x10]
mov byte [ecx + esi], dl
mov edx, ecx
inc edx
mov dword [esp + 0x10], edx
cmp edx, ebp
jb 0x1004fa58
pop edi
mov ecx, 1
xor al, al
cmp ebp, ecx
jb 0x1004fb10
mov edi, edi
mov bl, byte [ecx + esi]
mov dl, bl
and dl, al
xor bl, al
mov byte [esp + 0x18], dl
mov al, bl
and al, 1
mov dl, 1
sub dl, al
mov al, byte [ecx + esi - 1]
imul dl
mov byte [esp + 0xb], al
mov byte [ecx + esi], bl
and al, bl
movzx ebx, byte [esp + 0xb]
xor byte [ecx + esi], bl
or al, byte [esp + 0x18]
shl dl, 7
or dl, byte [ecx + esi - 1]
inc ecx
mov byte [ecx + esi - 2], dl
cmp ecx, ebp
jbe 0x1004fad0
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x10051630
Capabilities:
Hash data using sha256

Disassembly:
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], 0xf3bcc908
mov dword [eax + 0x14], 0x6a09e667
mov dword [eax + 0x18], 0x84caa73b
mov dword [eax + 0x1c], 0xbb67ae85
mov dword [eax + 0x20], 0xfe94f82b
mov dword [eax + 0x24], 0x3c6ef372
mov dword [eax + 0x28], 0x5f1d36f1
mov dword [eax + 0x2c], 0xa54ff53a
mov dword [eax + 0x30], 0xade682d1
mov dword [eax + 0x34], 0x510e527f
mov dword [eax + 0x38], 0x2b3e6c1f
mov dword [eax + 0x3c], 0x9b05688c
mov dword [eax + 0x40], 0xfb41bd6b
mov dword [eax + 0x44], 0x1f83d9ab
mov dword [eax + 0x48], 0x137e2179
mov dword [eax + 0x4c], 0x5be0cd19
mov dword [eax + 0xd0], ecx
ret
Function at 0x10063120
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x68
mov eax, dword [0x10139d00]
xor eax, esp
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x6c]
xor ecx, ecx
push esi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], ecx
push eax
mov eax, dword [esp + 0x78]
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.10066fb0
add esp, 4
lea esi, [esp + 8]
mov ecx, edi
call fcn.10067050
mov ecx, dword [esp + 0x64]
pop esi
xor ecx, esp
call fcn.100d0738
add esp, 0x68
ret
Function at 0x100632b0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov esi, eax
lea eax, [esp + 0x18]
push eax
push 0x20119
xor edi, edi
push edi
push 0x1012ff44
push reloc.OLEAUT32.dll_SysReAllocString
mov ebx, ecx
mov dword [esp + 0x30], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10063441
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
lea ecx, [esp + 0x10]
push ecx
mov dword [esi + 0x10], eax
push ebx
mov dword [esi + 0x14], eax
lea edx, [esp + 0x1c]
push edx
mov dword [esi + 0x18], eax
push eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov eax, dword [esp + 0x28]
push str.Operator
mov edi, 0x400
push eax
mov dword [esp + 0x28], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10063343
cmp dword [esp + 0x14], 1
jne 0x10063428
mov eax, dword [esp + 0x10]
sub edi, eax
mov dword [esi], ebx
lea ebx, [eax + ebx]
je 0x10063428
mov eax, dword [esp + 0x18]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [esp + 0x10]
push ecx
push ebx
lea edx, [esp + 0x1c]
push edx
push 0
push str.IssueDate
push eax
mov dword [esp + 0x28], edi
call ebp
test eax, eax
jne 0x10063388
cmp dword [esp + 0x14], 1
jne 0x10063428
mov eax, dword [esp + 0x10]
mov dword [esi + 4], ebx
sub edi, eax
add ebx, eax
test edi, edi
je 0x10063428
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x10]
push ecx
push ebx
lea edx, [esp + 0x1c]
push edx
push 0
push str.ExpirationDate
push eax
mov dword [esp + 0x28], edi
call ebp
test eax, eax
jne 0x100633bf
cmp dword [esp + 0x14], 1
jne 0x10063428
mov eax, dword [esp + 0x10]
mov dword [esi + 8], ebx
sub edi, eax
add ebx, eax
test edi, edi
je 0x10063428
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x10]
push ecx
push ebx
lea edx, [esp + 0x1c]
push edx
push 0
push str.SignData
push eax
mov dword [esp + 0x28], edi
call ebp
test eax, eax
jne 0x10063428
cmp dword [esp + 0x14], 3
jne 0x10063428
mov eax, dword [esp + 0x10]
sub edi, eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], ebx
je 0x10063428
lea eax, [esi + 0xc]
call fcn.10063190
test eax, eax
je 0x10063428
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov ecx, 0x400
sub ecx, edi
push eax
mov dword [edx], ecx
mov esi, 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x10063870
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x6c
mov eax, dword [0x10139d00]
xor eax, esp
mov dword [esp + 0x68], eax
push esi
lea eax, [esp + 8]
mov esi, edx
push eax
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x18], 0x67452301
mov dword [esp + 0x1c], 0xefcdab89
mov dword [esp + 0x20], 0x98badcfe
mov dword [esp + 0x24], 0x10325476
call fcn.10065ae0
add esp, 8
test eax, eax
jne 0x100638db
pop esi
mov ecx, dword [esp + 0x68]
xor ecx, esp
call fcn.100d0738
add esp, 0x6c
ret
mov eax, dword [esp + 0x74]
test eax, eax
jbe 0x100638f0
push esi
lea ecx, [esp + 0x14]
call fcn.10066fb0
add esp, 4
lea esi, [esp + 0x10]
mov ecx, ebx
call fcn.10067050
test edi, edi
je 0x1006390e
mov ecx, dword [esp + 0xc]
xor eax, eax
cmp ecx, dword [esp + 8]
sete al
mov dword [edi], eax
mov ecx, dword [esp + 0x6c]
pop esi
xor ecx, esp
mov eax, 1
call fcn.100d0738
add esp, 0x6c
ret

Function at 0x10063950
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x64
mov eax, dword [0x10139d00]
xor eax, esp
mov dword [esp + 0x5c], eax
xor eax, eax
push esi
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
push edi
lea eax, [esp + 8]
mov edi, ecx
push eax
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.10065ce0
add esp, 4
test eax, eax
jne 0x100639ae
pop edi
pop esi
mov ecx, dword [esp + 0x5c]
xor ecx, esp
call fcn.100d0738
add esp, 0x64
ret
lea esi, [esp + 8]
mov ecx, ebx
call fcn.10067050
mov ecx, dword [esp + 0x64]
pop edi
pop esi
xor ecx, esp
mov eax, 1
call fcn.100d0738
add esp, 0x64
ret

Function at 0x100639d0
Capabilities:
Hash data using sha256

Disassembly:
sub esp, 0x74
mov eax, dword [0x10139d00]
xor eax, esp
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x78]
xor ecx, ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ecx
push edi
lea ecx, [esp + 8]
push ecx
push eax
mov dword [esp + 0x10], 0x6a09e667
mov dword [esp + 0x14], 0xbb67ae85
mov dword [esp + 0x18], 0x3c6ef372
mov dword [esp + 0x1c], 0xa54ff53a
mov dword [esp + 0x20], 0x510e527f
mov dword [esp + 0x24], 0x9b05688c
mov dword [esp + 0x28], 0x1f83d9ab
mov dword [esp + 0x2c], 0x5be0cd19
call fcn.10065dd0
add esp, 8
test eax, eax
jne 0x10063a4f
pop edi
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.100d0738
add esp, 0x74
ret
mov eax, esi
lea edi, [esp + 8]
call fcn.10066b90
mov ecx, dword [esp + 0x74]
pop edi
xor ecx, esp
mov eax, 1
call fcn.100d0738
add esp, 0x74
ret

Function at 0x10064430
Capabilities:
Read file on windows

Disassembly:
push ecx
push 0
lea eax, [esp + 4]
push eax
push esi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10064462
push str.ReadFile__
push 0xfc
push str..QHImageHlp.c
xor edx, edx
call fcn.10067e90
add esp, 0xc
xor eax, eax
pop ecx
ret
cmp esi, dword [esp]
je 0x10064487
push 0x101300d8
push 0xfe
push str..QHImageHlp.c
mov edx, 1
call fcn.10067fc0
add esp, 0xc
xor eax, eax
pop ecx
ret
mov eax, 1
pop ecx
ret
Function at 0x10065950
Capabilities:
Get file size

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov esi, eax
mov eax, dword [esi]
mov edi, dword [esi + 0x18]
lea ecx, [esp + 0x10]
push ecx
xor ebp, ebp
push eax
xor ebx, ebx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
xor edx, edx
test eax, eax
jne 0x1006599d
push str.GetFileSizeEx__
push 0x11e
push str..QHImageHlp.c
call fcn.10067e90
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov ebx, dword [esp + 0x10]
mov ecx, dword [esi + 0xb4]
sub ebx, edi
mov edi, dword [esp + 0x14]
sbb edi, edx
sub ebx, 0x298
sbb edi, ebp
xor eax, eax
cmp edi, eax
jl 0x10065a34
jg 0x100659c3
cmp ebx, ecx
jb 0x10065a34
mov ebp, dword [esi]
push 0
push 0
push edi
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x100659f9
push str.SetFilePointerEx__
push 0xf9
push str..QHImageHlp.c
xor edx, edx
call fcn.10067e90
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov ecx, dword [esp + 0x1c]
mov esi, 0x298
mov edx, ebp
call fcn.10064430
test eax, eax
je 0x100659ef
mov eax, dword [esp + 0x20]
test eax, eax
je 0x10065a1a
mov dword [eax], ebx
mov dword [eax + 4], edi
mov eax, dword [esp + 0x24]
test eax, eax
je 0x10065a41
mov ecx, 1
mov word [eax], cx
mov eax, ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x24]
cmp eax, ebp
je 0x10065a41
xor edx, edx
mov word [eax], dx
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret