joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44ca95
Capabilities:
Contain obfuscated stackstrings

Disassembly:
invalid
sti
mov byte [ebp - 0x526], 0xf2
mov byte [ebp - 0x525], 0x97
lea eax, [ebp - 0x534]
push eax
call fcn.0044bfd2
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0044bf87
add esp, 0xc
mov dword [ebp - 0x680], eax
call fcn.0044bfc2
scasb al, byte es:[edi]
loopne 0x44ca86
cmc
and byte [ebp - 0x664], 0
and byte [ebp - 0x663], 0
mov byte [ebp - 0x662], 7
and byte [ebp - 0x661], 0
mov byte [ebp - 0x660], 0xb0
mov byte [ebp - 0x65f], 0x9d
mov byte [ebp - 0x65e], 0x99
mov byte [ebp - 0x65d], 0x88
mov byte [ebp - 0x65c], 0xb9
mov byte [ebp - 0x65b], 0x94
mov byte [ebp - 0x65a], 0x94
mov byte [ebp - 0x659], 0x97
mov byte [ebp - 0x658], 0x9b
mov byte [ebp - 0x657], 0xf8
lea eax, [ebp - 0x664]
push eax
call fcn.0044bfd2
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0044bf87
add esp, 0xc
mov dword [ebp - 0x67c], eax
and byte [ebp - 0x524], 0
and byte [ebp - 0x523], 0
mov byte [ebp - 0x522], 0x15
and byte [ebp - 0x521], 0
mov byte [ebp - 0x520], 0xa2
mov byte [ebp - 0x51f], 0x8f
mov byte [ebp - 0x51e], 0x8b
mov byte [ebp - 0x51d], 0x9a
mov byte [ebp - 0x51c], 0xac
mov byte [ebp - 0x51b], 0x98
mov byte [ebp - 0x51a], 0x8f
mov byte [ebp - 0x519], 0x8f
mov byte [ebp - 0x518], 0xea
lea eax, [ebp - 0x524]
push eax
call fcn.0044bfd2
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0044bf87
add esp, 0xc
mov dword [ebp - 0x39c], eax
call fcn.0044bfc2
jns 0x44cc24
mov dl, 0x3e
and byte [ebp - 0x514], 0
and byte [ebp - 0x513], 0
mov byte [ebp - 0x512], 0xe3
and byte [ebp - 0x511], 0
mov byte [ebp - 0x510], 0x5b
mov byte [ebp - 0x50f], 0x79
mov byte [ebp - 0x50e], 0x68
mov byte [ebp - 0x50d], 0x5a
mov byte [ebp - 0x50c], 0x75
mov byte [ebp - 0x50b], 0x70
mov byte [ebp - 0x50a], 0x79
mov byte [ebp - 0x509], 0x4f
mov byte [ebp - 0x508], 0x75
mov byte [ebp - 0x507], 0x66
mov byte [ebp - 0x506], 0x79
mov byte [ebp - 0x505], 0x1c
lea eax, [ebp - 0x514]
push eax
call fcn.0044bfd2
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0044bf87
add esp, 0xc
mov dword [ebp - 0x33c], eax
call fcn.0044bfc2
xchg esi, eax
push edi
inc edx
adc dword [eax + 4], ebp
add dword [eax], eax
add byte [ebp - 0x3337b], cl
call dword [eax - 1]
jne 0x44cc8b
invalid
call dword [ebp - 0x538]
mov dword [ebp - 0x398], eax
mov byte [ebp - 0x544], 1
cmp dword [ebp - 0x398], 0
je 0x44ccb6
push 0xc6fffffc
test dword [edx + edi*8 - 0x7cfe0001], edi
mov ebp, 0xfffffc68
add byte [edi + edx - 0x7d], dh
mov ebp, 0xfffffc68
add byte [edi], cl
test ah, dl
add dword [eax], eax
add byte [ebx + 0xf010c7d], al
test dl, cl
add dword [eax], eax
add byte [ebx + 0xf080c7d], al
test dword [eax - 0x7fffffff], ecx
movsd dword es:[edi], dword [esi]
dec eax
stc
invalid
cmp dword [ebp - 0x398], 0
je 0x44ce80
cmp dword [ebp + 0xc], 1
je 0x44ce80
cmp dword [ebp + 0xc], 8
jne 0x44ce48
and byte [ebp - 0x6b8], 0
invalid
movsd dword es:[edi], dword [esi]
dec ecx
stc
Function at 0x44d498
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x72a], 0xc2
and byte [ebp - 0x729], 0
mov byte [ebp - 0x728], 0x6b
mov byte [ebp - 0x727], 0x54
mov byte [ebp - 0x726], 0x4f
mov byte [ebp - 0x725], 0x49
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
mov byte [ebp - 0x71e], 0x49
mov byte [ebp - 0x71d], 0x58
mov byte [ebp - 0x71c], 0x5e
mov byte [ebp - 0x71b], 0x49
mov byte [ebp - 0x71a], 0x3d
call fcn.0044bfc2
loop 0x44d42f
ror edi, cl
lea eax, [ebp - 0x72c]
push eax
call fcn.0044bfd2
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0044bf87
add esp, 0xc
mov dword [ebp - 0x6e4], eax
call fcn.0044bfc2
sal dl, 1
pop edi
xchg ebp, eax
lea eax, [ebp - 0x718]
push eax
push 0x40
push 5
push dword [ebp - 0x3a8]
call dword [ebp - 0x6e4]
push 5
lea eax, [ebp - 0x394]
push eax
push dword [ebp - 0x3a8]
call fcn.0044bf33
add esp, 0xc
lea eax, [ebp - 0x718]
push eax
push dword [ebp - 0x718]
push 5
push dword [ebp - 0x3a8]
call dword [ebp - 0x6e4]
call fcn.0044bfc2
dec edi
and edx, dword fs:[ecx - 0x7d]
movsd dword es:[edi], dword [esi]
add cl, bh
invalid
Function at 0x454c40
Capabilities:
Hash data using sha256

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x46ce7c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 0x24]
push edi
mov ecx, ebx
and ecx, 0x3f
mov edi, 0x40
sub edi, ecx
mov dword [ebp - 0x50], eax
cmp edi, 8
ja 0x454c75
add edi, 0x40
lea edx, [edi - 8]
push edx
lea eax, [ebp - 0x4c]
push 0
push eax
call fcn.00450c60
mov ecx, dword [esi + 0x20]
add ecx, ecx
add ecx, ecx
add ecx, ecx
mov edx, ebx
shr edx, 0x1d
or ecx, edx
add esp, 0xc
mov dword [ebp - 0x58], ecx
push 2
lea ecx, [ebp - 0x58]
push ecx
lea edx, [ebp + edi - 0x54]
lea eax, [ebx*8]
push edx
mov byte [ebp - 0x4c], 0x80
mov dword [ebp - 0x54], eax
call fcn.00455ae0
push edi
lea eax, [ebp - 0x4c]
push eax
push esi
call fcn.00454b30
mov ecx, dword [ebp - 0x50]
push 8
push esi
push ecx
call fcn.00455ae0
xor eax, eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi], 0x6a09e667
mov dword [esi + 4], 0xbb67ae85
mov dword [esi + 8], 0x3c6ef372
mov dword [esi + 0xc], 0xa54ff53a
mov dword [esi + 0x10], 0x510e527f
mov dword [esi + 0x14], 0x9b05688c
mov dword [esi + 0x18], 0x1f83d9ab
mov dword [esi + 0x1c], 0x5be0cd19
mov eax, 0x40
add esi, 0x28
mov byte [esi], 0
inc esi
sub eax, 1
jne 0x454d16
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044341a
mov esp, ebp
pop ebp
ret 8

Function at 0x455870
Capabilities:
Hash data using sha1

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
cmp dword [0x46cec4], 0
push ebx
jne 0x4558ed
push eax
push ebx
push ecx
push edx
xor eax, eax
cpuid
xor eax, eax
xor ebx, 0x756e6547
sete al
xor ebx, ebx
xor ecx, 0x6c65746e
sete bl
and eax, ebx
xor ecx, ecx
xor edx, 0x49656e69
sete cl
and eax, ecx
mov dword [ebp - 4], eax
mov eax, 1
cpuid
xor ecx, ecx
xor edx, edx
mov ebx, 0xff0
and ebx, eax
mov dword [ebp - 8], ebx
pop edx
pop ecx
pop ebx
pop eax
cmp dword [ebp - 4], 0
mov eax, 1
je 0x4558e1
cmp dword [ebp - 8], 0x660
jae 0x4558e1
xor eax, eax
mov eax, dword [eax*4 + 0x46c604]
mov dword [0x46cec4], eax
mov eax, dword [ebp + 8]
mov dword [eax + 0x54], 0
mov dword [eax + 0x58], 0
mov dword [eax + 0x40], 0x67452301
mov dword [eax + 0x44], 0xefcdab89
mov dword [eax + 0x48], 0x98badcfe
mov dword [eax + 0x4c], 0x10325476
mov dword [eax + 0x50], 0xc3d2e1f0
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x457910
Capabilities:
Hash data with md5

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
pop ebp
ret 4
Function at 0x457b00
Capabilities:
Hash data using sha224

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0xcbbb9d5d
mov dword [eax + 8], 0x367cd507
mov dword [eax + 0xc], 0x629a292a
mov dword [eax + 0x10], 0x3070dd17
mov dword [eax + 0x14], 0x9159015a
mov dword [eax + 0x18], 0xf70e5939
mov dword [eax + 0x1c], 0x152fecd8
mov dword [eax + 0x20], 0xffc00b31
mov dword [eax + 0x24], 0x67332667
mov dword [eax + 0x28], 0x68581511
mov dword [eax + 0x2c], 0x8eb44a87
mov dword [eax + 0x30], 0x64f98fa7
mov dword [eax + 0x34], 0xdb0c2e0d
mov dword [eax + 0x38], 0xbefa4fa4
mov dword [eax + 0x3c], 0x47b5481d
mov dword [eax + 0x40], ecx
mov dword [eax + 0x44], ecx
mov dword [eax + 0x48], ecx
mov dword [eax + 0x4c], ecx
pop ebp
ret 4

Function at 0x457b90
Capabilities:
Hash data using sha256

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax], 0xf3bcc908
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x3c], 0x5be0cd19
mov dword [eax + 0x40], ecx
mov dword [eax + 0x44], ecx
mov dword [eax + 0x48], ecx
mov dword [eax + 0x4c], ecx
pop ebp
ret 4
Function at 0x43b643
Capabilities:
Encode data using xor

Disassembly:
push 0x43b3c1
mov ebx, dword [esp]
add esp, 4
sub esp, 4
mov dword [esp], 0xb6381c88
mov esi, dword [esp]
add esp, 4
call fcn.0043b688
add edx, edx
inc edx
xor dword [eax], ebx
and esi, edx
inc edx
add esi, 0x6201485b
inc eax
and esi, edx
and edx, edx
dec edx
cmp eax, ecx
jne fcn.0043b643
sub edx, esi
or edx, esi
ret
Function at 0x1004378
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xc
mov eax, 0x1004ee7
call fcn.010047b9
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov eax, dword [ebp + 0x18]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [eax], ebx
lea eax, [ebp - 0x14]
push eax
push ebx
lea eax, [ebp - 0x18]
push eax
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 4], ebx
push dword [ebp + 8]
call esi
mov edi, eax
cmp edi, ebx
jne 0x100444d
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + 0x10]
shr eax, 1
lea eax, [eax + ecx + 1]
mov dword [ebp + 0x10], eax
cmp eax, dword [ebp + 0x14]
jbe 0x10043e5
push 0x6f
pop edi
cmp dword [0x1006138], ebx
je 0x100444d
push dword [ebp + 0xc]
push 0x10020c8
push ebx
call fcn.01003510
add esp, 0xc
jmp 0x100444d
lea edi, [eax + eax]
push edi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
lea ecx, [ebp - 0x10]
call fcn.01002447
cmp dword [ebp - 0x10], ebx
jne 0x1004404
push 0xe
pop edi
jmp 0x100444d
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x10]
lea eax, [ebp - 0x18]
push eax
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 0x18], 1
push dword [ebp + 8]
mov dword [ebp - 0x14], edi
call esi
mov edi, eax
cmp edi, ebx
jne 0x100443f
mov eax, dword [ebp + 0x1c]
cmp eax, ebx
je 0x1004434
mov ecx, dword [ebp + 0x10]
mov dword [eax], ecx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 0x18]
mov dword [ebp - 0x10], ebx
mov dword [ecx], eax
cmp dword [ebp - 0x10], ebx
je 0x100444d
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, edi
call fcn.010047f1
ret 0x18

Function at 0x1004d35
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [esi]
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1004d92
lea eax, [ebp + 0x14]
push eax
push esi
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 0x10]
mov dword [ebp + 0x14], 4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1004d90
cmp dword [ebp + 0xc], 4
je 0x1004d97
push 0xd
mov dword [esi], edi
pop eax
jmp 0x1004d97
mov dword [esi], edi
cmp eax, 2
je 0x1004da9
mov esi, eax
lea ecx, [ebp - 4]
call fcn.010022aa
pop edi
mov eax, esi
pop esi
leave
ret 0x10
xor esi, esi
jmp 0x1004d99
Function at 0x100f2cd
Capabilities:
Get number of processors

Disassembly:
inc esi
call fcn.0100f26e
cmp dword [ebp + 0x6810], 0x1be
jle 0x100f1d1
nop
mov ch, 0x64
cld
sub esi, dword [esp + 0x28]
not ch
jbe 0x100f1d1
setne cl
nop
sub eax, dword [esp + 0x30]
lea ecx, [esp + 1]
sbb edx, dword [ecx + 0x2b]
idiv esi
mov edx, 0x492599a3
lea edx, [ebx]
sub eax, 0x1e342
mov dl, 0x93
sub eax, 0x986b20
nop
xchg cl, dl
sbb eax, eax
push 0xfffffffffffffff4
imul edx, eax, 0xcfa924b3
mov al, 0x7b
nop
sbb byte [ebp + 0x6920], dh
pop edi
lea edi, [edi + 0x144]
sub eax, esp
xchg ecx, eax
push dword [ebp + 0x69c6]
inc cl
add edi, ebp
pop edx
sbb eax, edx
ret
push 0x3d59cc2d
cmp cl, 0x52
call fcn.0100f292
push esi
inc eax
mov edx, dword fs:[0x30]
test edx, edx
js 0x100f32d
dec eax
xchg cl, ah
nop
push ebx
mov cl, 0x15
mov edx, dword [edx + 0xc]
mov ebx, dword [edx + 0x1c]
sbb ecx, ebx
push 1
mov ebx, dword [ebx + 8]
adc cl, bh
push 0xedc20e21
call fcn.0100f292
sub eax, 0x30
inc ebx
mov edx, esp
mov edi, 0x88275012
push 4
xchg ah, bl
inc cl
push edx
push 0x15
sub ah, 0xc6
push 0xffffffffffffffff
sub edi, eax
not bl
call fcn.0100f28b
add esp, 4
pop ebx
pop edi
mov esi, 0x331eb0f1
dec esi
call edi
jmp 0x100f178
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x431072
nop
nop
mov ebx, 0x40915c
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x612046cf
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x431060
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4310d2
nop
nop
nop
mov ebx, 0x42f3f8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x36e65bb0
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4310c0
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x407eb8
Capabilities:
Encode data using base64

Disassembly:
mov eax, 0x4782e9
call fcn.00457fe8
sub esp, 0x10
push esi
xor esi, esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x18], esi
mov ecx, dword [ebp + 8]
call fcn.00403ca4
mov dword [ebp - 4], esi
mov dword [ebp - 0x18], 1
cmp dword [ebp + 0x10], esi
je 0x408008
push edi
mov edi, dword [ebp + 0xc]
push ebx
mov al, byte [edi]
dec dword [ebp + 0x10]
mov byte [ebp + esi - 0x10], al
mov bl, byte [ebp - 0xf]
inc esi
inc edi
cmp esi, 3
jne 0x407f62
mov al, byte [ebp - 0x10]
shr al, 2
mov byte [ebp - 0x14], al
mov al, byte [ebp - 0x10]
and al, 3
shl al, 4
mov cl, bl
shr cl, 4
add al, cl
mov cl, byte [ebp - 0xe]
mov byte [ebp - 0x13], al
mov al, bl
and al, 0xf
shl al, 2
shr cl, 6
add al, cl
mov byte [ebp - 0x12], al
mov al, byte [ebp - 0xe]
and al, 0x3f
mov byte [ebp - 0x11], al
xor esi, esi
movzx eax, byte [ebp + esi - 0x14]
push eax
mov ecx, 0x4a8b34
call fcn.0040369e
mov al, byte [eax]
mov ecx, dword [ebp + 8]
mov byte [ebp - 0x1c], al
push dword [ebp - 0x1c]
push 1
call fcn.00403d9d
inc esi
cmp esi, 4
jl 0x407f38
xor esi, esi
cmp dword [ebp + 0x10], 0
jne 0x407eee
xor edi, edi
cmp esi, edi
je 0x408006
cmp esi, 3
jge 0x407f8e
push 3
pop ecx
sub ecx, esi
push ecx
lea eax, [ebp + esi - 0x10]
push edi
push eax
call fcn.004598b0
mov bl, byte [ebp - 0xf]
add esp, 0xc
mov al, byte [ebp - 0x10]
mov cl, al
shr cl, 2
mov byte [ebp - 0x14], cl
and al, 3
mov cl, bl
shl al, 4
shr cl, 4
add al, cl
mov byte [ebp - 0x13], al
mov al, byte [ebp - 0xe]
and bl, 0xf
mov cl, al
shl bl, 2
shr cl, 6
add bl, cl
mov byte [ebp - 0x12], bl
and al, 0x3f
lea ebx, [esi + 1]
mov byte [ebp - 0x11], al
test ebx, ebx
jle 0x407fee
movzx eax, byte [ebp + edi - 0x14]
push eax
mov ecx, 0x4a8b34
call fcn.0040369e
mov al, byte [eax]
mov ecx, dword [ebp + 8]
mov byte [ebp + 0x10], al
push dword [ebp + 0x10]
push 1
call fcn.00403d9d
inc edi
cmp edi, ebx
jl 0x407fc7
push 3
pop edi
cmp esi, edi
jge 0x408006
sub edi, esi
mov ecx, dword [ebp + 8]
push 0x3d
push 1
call fcn.00403d9d
dec edi
jne 0x407ff7
pop ebx
pop edi
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x409951
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push edi
mov edi, 0x1f4
push edi
mov dword [ebp - 0xc], 0x10
call fcn.0045a61f
push edi
xor edi, edi
mov esi, eax
push edi
push esi
call fcn.004598b0
add esp, 0x10
push 0xf0000000
push 1
push str.Microsoft_Base_Cryptographic_Provider_v1.0
push edi
lea eax, [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x4099b6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push str.CryptAcquireContext_failed:__d_n
call fcn.0045a50b
pop ecx
pop ecx
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
xor eax, eax
jmp 0x409aa4
lea eax, [ebp - 8]
push eax
push edi
push edi
push 0x8003
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x4099ef
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push str.CryptCreateHash_failed:__d_n
call fcn.0045a50b
pop ecx
pop ecx
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
jmp 0x4099aa
push edi
push dword [ebp + 8]
call fcn.00458060
pop ecx
push eax
push dword [ebp + 8]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x409a37
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push str.CryptHashData_failed:__d_n
call fcn.0045a50b
pop ecx
pop ecx
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
jmp 0x4099aa
push edi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x1c]
push eax
push 2
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
jne 0x409a5f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push str.CryptGetHashParam_failed:__d_n
jmp 0x409a18
xor eax, eax
cmp dword [ebp - 0xc], edi
jbe 0x409a8f
lea ecx, [ebp + eax - 0x1c]
movzx edx, byte [ecx]
shr edx, 4
mov dl, byte [edx + str.0123456789abcdef]
mov byte [esi + eax*2], dl
movzx ecx, byte [ecx]
and ecx, 0xf
mov cl, byte [ecx + str.0123456789abcdef]
mov byte [esi + eax*2 + 1], cl
inc eax
cmp eax, dword [ebp - 0xc]
jb 0x409a66
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, esi
pop edi
pop esi
leave
ret 8
Function at 0x412f2e
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x479924
call fcn.00457fe8
sub esp, 0x50
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], ebx
wait
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x5c], 0x3c
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x58], 0x100140
mov esi, dword [ebp + 8]
mov ecx, dword [esi]
mov dword [ebp - 0x44], ecx
mov eax, dword [esi + 8]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x3c], ebx
mov eax, dword [esi + 4]
mov dword [ebp - 0x4c], eax
fld qword [0x483f90]
fcomp qword [esi + 0x18]
fnstsw ax
test ah, 0x41
jp 0x412fc9
fld qword [0x483f88]
fcomp qword [esi + 0x18]
fnstsw ax
test ah, 1
jne 0x412fc9
mov ecx, dword [ecx - 0xc]
push 3
add ecx, 0xfffffffd
push ecx
lea eax, [ebp - 0x20]
push eax
mov ecx, esi
call fcn.0040bad4
mov byte [ebp - 4], 1
mov dword [ebp - 0x18], 1
push 0x483f7c
push eax
call fcn.0040b67b
pop ecx
pop ecx
test al, al
mov byte [ebp - 0x11], 1
jne 0x412fcc
mov byte [ebp - 0x11], bl
mov dword [ebp - 4], ebx
test byte [ebp - 0x18], 1
je 0x412fe1
and dword [ebp - 0x18], 0xfffffffe
lea ecx, [ebp - 0x20]
call fcn.00401436
cmp byte [ebp - 0x11], bl
mov dword [ebp - 0x50], str.runas
jne 0x412ff4
mov dword [ebp - 0x50], 0x483f64
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x41302d
push dword [esi + 0x20]
push 1
lea eax, [ebp - 0x24]
push eax
push 1
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x24]
test eax, eax
jne 0x413033
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xffffffffffffff9d
pop eax
wait
jmp 0x41304b
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x1c]
jmp 0x413030
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x41382d
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x3c]
add eax, ecx
movzx ecx, word [eax + 0x14]
push ebx
movzx ebx, word [eax + 6]
lea edx, [ecx + eax + 0x18]
push esi
xor ecx, ecx
push edi
test ebx, ebx
jle 0x413870
lea eax, [edx + 8]
mov edi, dword [eax]
test edi, edi
jne 0x413859
mov edi, dword [eax + 8]
mov esi, dword [eax + 4]
cmp dword [ebp + 0xc], esi
jb 0x413868
add esi, edi
cmp dword [ebp + 0xc], esi
jb 0x413877
inc ecx
add eax, 0x28
cmp ecx, ebx
jl 0x413850
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
imul ecx, ecx, 0x28
add ecx, edx
mov eax, dword [ecx + 0x14]
sub eax, dword [ecx + 0xc]
add eax, dword [ebp + 8]
add eax, dword [ebp + 0xc]
jmp 0x413872

Function at 0x41388a
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x3c]
mov edx, 0x5a4d
add eax, ecx
cmp word [ecx], dx
je 0x4138a3
xor eax, eax
pop ebp
ret
cmp dword [eax], 0x4550
jne 0x41389f
mov edx, 0xe0
cmp word [eax + 0x14], dx
jb 0x41389f
push dword [eax + 0x88]
push ecx
call fcn.0041382d
pop ecx
pop ecx
pop ebp
ret
Function at 0x413d00
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x628
push esi
mov esi, dword [ebp + 8]
push 0x25
push esi
call fcn.0045ae6d
pop ecx
pop ecx
test eax, eax
jne 0x413d23
or eax, 0xffffffff
jmp 0x413e00
add eax, 2
push 0x25
push eax
call fcn.0045ae6d
pop ecx
pop ecx
test eax, eax
je 0x413d1b
xor eax, eax
push ebx
mov word [ebp - 0x210], ax
push edi
lea edi, [ebp - 0x210]
cmp word [esi], ax
je 0x413dd6
movzx eax, word [esi]
cmp ax, 0x25
je 0x413d60
mov word [edi], ax
inc edi
inc edi
inc esi
inc esi
jmp 0x413dcc
lea ebx, [esi + 2]
push 0x25
push ebx
call fcn.0045ae6d
pop ecx
pop ecx
mov dword [ebp - 4], eax
test eax, eax
je 0x413e03
sub eax, esi
sar eax, 1
push eax
push ebx
lea eax, [ebp - 0x628]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push 0x104
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x628]
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jbe 0x413dc6
lea eax, [ebp - 0x41c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [edi + eax*2]
mov esi, dword [ebp - 4]
add esi, 2
cmp word [esi], 0
jne 0x413d4e
xor eax, eax
mov word [edi], ax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x413dfc
lea eax, [ebp - 0x210]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
xor eax, eax
pop edi
pop ebx
pop esi
leave
ret
or eax, 0xffffffff
jmp 0x413dfe