joyce8/EMBER2024-capa huggingface dataset:
Function at 0x423790
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4c4318
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push esi
push edi
mov eax, dword [0x4f4de0]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionProfileList
lea ecx, [esp + 0x18]
call fcn.00404050
mov dword [esp + 0x40], 0
mov eax, dword [0x4fc0d8]
mov edx, dword [eax + 0xc]
mov ecx, 0x4fc0d8
call edx
lea esi, [eax + 0x10]
mov dword [esp + 0x1c], esi
mov eax, dword [esp + 0x4c]
push eax
push 0
push ecx
mov byte [esp + 0x4c], 1
mov ecx, esp
mov dword [esp + 0x2c], esp
push 0x4d992c
call fcn.00404050
push 0x4d689c
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x2c]
push edx
mov byte [esp + 0x58], 2
call fcn.004067a0
mov edx, dword [esp + 0x60]
add esp, 8
mov ecx, esp
mov dword [esp + 0x34], esp
push edx
push eax
push ecx
mov byte [esp + 0x5c], 3
call fcn.00410450
add esp, 0xc
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x3c]
mov byte [esp + 0x54], 4
call fcn.0040b9b0
push eax
mov byte [esp + 0x48], 5
call fcn.0040be00
add esp, 8
test eax, eax
mov byte [esp + 0x40], 4
mov eax, dword [esp + 0x30]
sete byte [esp + 0x13]
add eax, 0xfffffff0
or edi, 0xffffffff
lea ecx, [eax + 0xc]
mov edx, edi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x423883
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov edx, edi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4238a2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x40], 1
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov edx, edi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4238c6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [esi - 0x10]
mov byte [esp + 0x40], 0
mov edx, edi
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
cmp byte [esp + 0x13], 0
je 0x423922
test edx, edx
jg 0x4238ed
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x40], edi
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edi
dec edi
test edi, edi
jg 0x42390e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x38
ret
test edx, edx
jg 0x423930
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x40], edi
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edi
dec edi
test edi, edi
jg 0x423951
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x38
ret
Function at 0x4256c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4c4fb6
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x4f4de0]
xor eax, esp
mov dword [esp + 0x220], eax
push ebx
push esi
push edi
mov eax, dword [0x4f4de0]
xor eax, esp
push eax
lea eax, [esp + 0x238]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov ebx, ecx
cmp dword [ebx + 0x84], 0
mov dword [esp + 0x10], eax
je 0x4258be
mov ecx, dword [ebx + 0x5c]
mov edx, dword [ebx + 0x44]
lea edi, [ebx + 0x44]
lea eax, [ebp + 8]
mov dword [esp + 0x18], ecx
push eax
lea ecx, [esp + 0x20]
push ecx
mov dword [esp + 0x1c], edx
call fcn.004272b0
mov esi, eax
mov eax, dword [esi]
test eax, eax
je 0x425743
cmp eax, dword [esp + 0x14]
je 0x425748
call fcn.00497857
mov edx, dword [esp + 0x18]
cmp dword [esi + 4], edx
je 0x425770
lea eax, [ebp + 8]
push eax
mov ecx, edi
call fcn.00427100
mov ecx, dword [esp + 0x10]
push eax
call fcn.004105d0
mov eax, 1
jmp 0x4258c0
mov eax, dword [ebx + 0x7c]
mov ecx, dword [eax]
mov esi, dword [ebx + 0x64]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], esi
mov edi, dword [ebx + 0x7c]
mov eax, dword [ebx + 0x64]
test esi, esi
je 0x42578e
cmp esi, eax
je 0x425793
call fcn.00497857
cmp dword [esp + 0x18], edi
je 0x42583a
mov edx, dword [0x4fc0d8]
mov eax, dword [edx + 0xc]
mov ecx, 0x4fc0d8
call eax
add eax, 0x10
mov dword [esp + 0x1c], eax
mov dword [esp + 0x240], 0
test esi, esi
jne 0x425836
call fcn.00497857
mov edi, dword [esp + 0x18]
cmp edi, dword [esi + 0x18]
jne 0x4257d6
call fcn.00497857
mov edx, dword [ebp + 8]
mov eax, dword [edi + 0x10]
lea ecx, [esp + 0x1c]
push ecx
push edx
call fcn.00426050
test eax, eax
je 0x4257f9
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x1c]
push eax
call fcn.004105d0
mov dword [esp + 0x240], 0xffffffff
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x425824
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea esi, [esp + 0x14]
call fcn.004223d0
mov esi, dword [esp + 0x14]
jmp 0x425780
mov esi, dword [esi]
jmp 0x4257c8
mov esi, dword [esp + 0x10]
mov ecx, dword [esi + 0x10]
sub ecx, dword [esi + 0xc]
test ecx, 0xfffffffc
jne 0x425766
mov edx, dword [ebp + 8]
push 0
push edx
lea eax, [esp + 0x2c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x4258be
lea ecx, [esp + 0x24]
push ecx
lea ecx, [esp + 0x14]
call fcn.00404050
lea edx, [esp + 0x10]
push edx
mov ecx, esi
mov dword [esp + 0x244], 1
call fcn.004105d0
mov dword [esp + 0x240], 0xffffffff
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4258b7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
jmp 0x4258c0
xor eax, eax
mov ecx, dword [esp + 0x238]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x220]
xor ecx, esp
call fcn.00497941
mov esp, ebp
pop ebp
ret 8
Function at 0x426cc0
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x4c0c60
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4f4de0]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
mov eax, dword [0x4f4de0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov eax, dword [0x4fc0d8]
mov edx, dword [eax + 0xc]
mov ecx, 0x4fc0d8
mov dword [esp + 0x10], edi
call edx
add eax, 0x10
mov dword [edi], eax
mov eax, 0x3b
mov dword [esp + 0x30], 0
mov word [esp + 0xc], ax
xor ecx, ecx
lea eax, [esp + 0xc]
mov word [esp + 0xe], cx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x426d27
sub eax, edx
sar eax, 1
mov esi, eax
mov dword [esp + 0x14], 0
lea eax, [esi + 1]
mov edx, 2
mul edx
mov byte [esp + 0x30], 1
test edx, edx
ja 0x426d58
cmp eax, 0xffffffff
jbe 0x426d62
push 0x80070057
call fcn.00404ce0
cmp eax, 0xa
jbe 0x426d73
lea ecx, [esp + 0x14]
push ecx
call fcn.00429850
jmp 0x426d7b
lea edx, [esp + 0x18]
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x14]
push 2
lea eax, [esp + 0x10]
push eax
lea ecx, [esi + esi + 2]
push ecx
push edx
call fcn.004973eb
push eax
call fcn.004049f0
mov eax, dword [edi]
mov edx, dword [eax - 8]
sub eax, 0x10
mov ecx, 1
sub ecx, dword [eax + 0xc]
sub edx, esi
add esp, 0x14
or ecx, edx
jge 0x426db8
push esi
mov ecx, edi
call fcn.00404b40
mov ecx, dword [edi]
cmp esi, 1
jne 0x426dcb
mov eax, dword [esp + 0x14]
movzx eax, word [eax]
mov word [ecx], ax
jmp 0x426dec
xor eax, eax
test esi, esi
jle 0x426de6
mov edx, dword [esp + 0x14]
mov dx, word [edx + eax*2]
mov word [ecx], dx
inc eax
add ecx, 2
cmp eax, esi
jl 0x426dd1
test esi, esi
jl 0x426d58
mov eax, dword [edi]
cmp esi, dword [eax - 8]
jg 0x426d58
mov dword [eax - 0xc], esi
mov eax, dword [edi]
xor ecx, ecx
lea edx, [esp + 0x18]
mov word [eax + esi*2], cx
cmp dword [esp + 0x14], edx
je 0x426e15
lea eax, [esp + 0x14]
call fcn.00428ec0
mov eax, edi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00497941
add esp, 0x2c
ret

Function at 0x429b10
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [0x4f4de0]
xor eax, esp
mov dword [esp + 0x208], eax
push esi
push edi
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x12]
push ecx
mov word [esp + 0x14], ax
call fcn.00497680
add esp, 0xc
push 0x104
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0x4d9a7c
lea eax, [esp + 0xc]
push eax
call esi
push str.psapi.dll
lea ecx, [esp + 0xc]
push ecx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea edx, [esp + 8]
push edx
call edi
test eax, eax
jne 0x429baa
push 0x4d9a90
lea eax, [esp + 0xc]
push eax
call esi
push 0x4d9a90
lea ecx, [esp + 0xc]
push ecx
call esi
push str.psapi.dll
lea edx, [esp + 0xc]
push edx
call esi
lea eax, [esp + 8]
push eax
call edi
mov ecx, dword [esp + 0x210]
pop edi
pop esi
xor ecx, esp
call fcn.00497941
add esp, 0x20c
ret
Function at 0x439c30
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4bff38
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x4f4de0]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push eax
lea ecx, [esp + 0xc]
push ecx
call fcn.0043add0
push eax
lea edx, [esp + 0x38]
push edx
mov dword [esp + 0x70], 0
call fcn.0043ae30
add esp, 0x10
push 0x4e6d0c
lea eax, [esp + 0x30]
push eax
call fcn.004978f5
int3

Function at 0x43f190
Capabilities:
Get disk information

Disassembly:
sub esp, 0x634
mov eax, dword [0x4f4de0]
xor eax, esp
mov dword [esp + 0x630], eax
push esi
push 0x104
lea eax, [esp + 0x14]
push eax
mov esi, 0x1234abcd
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
xor ecx, ecx
cmp eax, ecx
je 0x43f25f
cmp eax, 0x104
ja 0x43f25f
xor edx, edx
mov word [esp + eax*2 + 0x10], dx
mov ax, word [esp + 0x10]
cmp ax, 0x41
jb 0x43f1e7
cmp ax, 0x5a
jbe 0x43f1f4
mov eax, dword [esp + 0x10]
add eax, 0xffffff9f
cmp ax, 0x19
ja 0x43f1fb
xor edx, edx
mov word [esp + 0x16], dx
push 0x104
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ecx
lea eax, [esp + 0x220]
push eax
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
push eax
push 0x104
lea ecx, [esp + 0x440]
push ecx
lea edx, [esp + 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x43f259
mov eax, dword [esp + 4]
pop esi
mov ecx, dword [esp + 0x630]
xor ecx, esp
call fcn.00497941
add esp, 0x634
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x634]
mov eax, esi
pop esi
xor ecx, esp
call fcn.00497941
add esp, 0x634
ret
Function at 0x44b1b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4c2f10
mov eax, dword fs:[0]
push eax
sub esp, 0x64
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4f4de0]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x88]
mov ecx, dword [ebp + 0x18]
mov eax, dword [ecx + 4]
xor ebx, ebx
mov dword [esp + 0x88], ecx
cmp byte [eax + 0x3d], bl
jne 0x44b21a
mov edx, dword [esp + 0x8c]
mov edx, dword [edx]
jmp 0x44b200
cmp dword [eax + 0xc], edx
jge 0x44b20a
mov eax, dword [eax + 8]
jmp 0x44b20e
mov ecx, eax
mov eax, dword [eax]
cmp byte [eax + 0x3d], bl
je 0x44b200
mov dword [esp + 0x88], ecx
mov esi, dword [ebp]
mov eax, dword [ebp + 0x18]
mov edi, ecx
mov dword [esp + 0x18], eax
cmp esi, ebx
je 0x44b22e
cmp esi, esi
je 0x44b23a
call fcn.00497857
mov ecx, dword [esp + 0x88]
cmp ecx, dword [esp + 0x18]
je 0x44b252
mov edx, dword [esp + 0x8c]
mov eax, dword [edx]
cmp eax, dword [ecx + 0xc]
jge 0x44b344
mov ecx, vtable.qtray::TraySrvArg.0
mov eax, 0xf
mov dword [esp + 0x1c], ecx
mov byte [esp + 0x20], bl
mov dword [esp + 0x24], ebx
mov dword [esp + 0x40], eax
mov dword [esp + 0x3c], ebx
mov byte [esp + 0x2c], bl
mov byte [esp + 0x44], bl
mov byte [esp + 0x45], bl
mov byte [esp + 0x46], bl
mov edx, dword [esp + 0x8c]
mov dword [esp + 0x80], ebx
mov edx, dword [edx]
push 0xffffffffffffffff
mov dword [esp + 0x74], eax
push ebx
lea eax, [esp + 0x30]
mov dword [esp + 0x54], ecx
push eax
lea ecx, [esp + 0x64]
mov dword [esp + 0x54], edx
mov byte [esp + 0x5c], bl
mov dword [esp + 0x60], ebx
mov dword [esp + 0x78], ebx
mov byte [esp + 0x68], bl
call fcn.004056c0
mov cx, word [esp + 0x44]
mov dl, byte [esp + 0x46]
mov word [esp + 0x74], cx
mov byte [esp + 0x76], dl
push edi
push esi
lea eax, [esp + 0x50]
push eax
lea ecx, [esp + 0x20]
push ecx
mov eax, ebp
mov byte [esp + 0x90], 1
call fcn.0044b3b0
cmp dword [esp + 0x70], 0x10
mov esi, dword [eax]
mov edi, dword [eax + 4]
mov ebp, vtable.qtray::TraySrvArg.0
mov dword [esp + 0x4c], ebp
jb 0x44b30c
mov edx, dword [esp + 0x5c]
push edx
call fcn.00493cb0
add esp, 4
cmp dword [esp + 0x40], 0x10
mov dword [esp + 0x70], 0xf
mov dword [esp + 0x6c], ebx
mov byte [esp + 0x5c], bl
mov dword [esp + 0x1c], ebp
jb 0x44b334
mov eax, dword [esp + 0x2c]
push eax
call fcn.00493cb0
add esp, 4
mov dword [esp + 0x40], 0xf
mov dword [esp + 0x3c], ebx
mov byte [esp + 0x2c], bl
cmp esi, ebx
jne 0x44b372
call fcn.00497857
xor esi, esi
cmp edi, dword [esi + 0x18]
jne 0x44b359
call fcn.00497857
lea eax, [edi + 0x10]
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x70
ret 8
mov esi, dword [esi]
jmp 0x44b34f
Function at 0x44bbd0
Capabilities:
Create thread

Disassembly:
push ecx
mov eax, dword [0x4fd894]
push esi
mov esi, dword [0x4fd888]
push 0x104
push eax
lea ecx, [esi + 0x14]
push 0x105
push ecx
call fcn.004992c2
add esp, 0x10
cmp dword [esi], 0xffffffff
mov dword [esi + 0x224], 0x43d490
mov dword [esi + 0x220], 0x43cea0
je 0x44bc1c
mov dword [esi + 0x10], 0
mov eax, 1
pop esi
pop ecx
ret
lea edx, [esp + 4]
push edx
push 0
push esi
push 0x44bcc0
push 0
push 0
mov dword [esp + 0x1c], 0
call fcn.0049befe
add esp, 0x18
mov dword [esi], eax
mov eax, 1
pop esi
pop ecx
ret

Function at 0x44bc50
Capabilities:
Terminate thread

Disassembly:
mov eax, dword [esi + 0x224]
test eax, eax
je 0x44bc67
mov ecx, dword [esi + 0x228]
push ecx
push esi
call eax
add esp, 8
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x44bcaa
push 0x1388
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x44bca1
mov edx, dword [esi]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0xffffffff
mov eax, 1
ret
mov ecx, dword [esi]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0xffffffff
mov eax, 1
ret
Function at 0x44d690
Capabilities:
Check os version

Disassembly:
push 0xffffffffffffffff
push 0x4bfdd8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x4f4de0]
xor eax, esp
mov dword [esp + 0x24], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4f4de0]
xor eax, esp
push eax
lea eax, [esp + 0x3c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x4c]
xor ebx, ebx
mov esi, ecx
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
mov dword [esp + 0x44], ebx
mov eax, dword [esi]
mov edx, dword [eax + 0x60]
lea ecx, [esp + 0x1c]
push ecx
mov ecx, esi
call edx
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x1c]
push edx
mov edi, eax
mov eax, dword [esi]
mov edx, dword [eax + 0x68]
lea ecx, [esp + 0x24]
push ecx
mov ecx, esi
call edx
add edi, eax
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x44d80f
mov bl, 1
movsx ecx, word [esp + 0x14]
dec ecx
cmp ecx, 5
ja case.default.0x44d725
jmp dword [ecx*4 + 0x44d854]
cmp eax, 0xb
jne case.default.0x44d725
mov eax, dword [esi]
mov edx, dword [eax + 0xa4]
lea ecx, [ebp + 4]
push ecx
mov ecx, esi
call edx
mov byte [ebp + 0x4c], bl
jmp 0x44d7dc
mov edx, dword [esi]
mov ecx, esi
cmp eax, 0xb
jne 0x44d7d3
mov edx, dword [edx + 0xa4]
lea eax, [ebp + 0x20]
push eax
call edx
mov byte [ebp + 0x4d], bl
jmp 0x44d7dc
mov edx, dword [esi]
mov ecx, esi
cmp eax, 8
jne 0x44d7d3
mov edx, dword [edx + 0x98]
lea eax, [ebp + 0x3c]
push eax
call edx
mov byte [ebp + 0x4e], bl
jmp 0x44d7dc
mov edx, dword [esi]
mov ecx, esi
cmp eax, 8
jne 0x44d7d3
mov edx, dword [edx + 0x98]
lea eax, [ebp + 0x40]
push eax
call edx
mov byte [ebp + 0x4f], bl
jmp 0x44d7dc
mov edx, dword [esi]
mov ecx, esi
cmp eax, 8
jne 0x44d7d3
mov edx, dword [edx + 0x98]
lea eax, [ebp + 0x44]
push eax
call edx
mov byte [ebp + 0x50], bl
jmp 0x44d7dc
mov edx, dword [esi]
mov ecx, esi
cmp eax, 8
jne 0x44d7d3
mov edx, dword [edx + 0x98]
lea eax, [ebp + 0x48]
push eax
call edx
mov byte [ebp + 0x51], bl
jmp 0x44d7dc
mov edx, dword [esi]
mov ecx, esi
push eax
mov eax, dword [edx + 0xac]
call eax
mov edx, dword [esi]
add edi, eax
mov eax, dword [edx + 0x6c]
mov ecx, esi
call eax
mov edx, dword [esi]
mov edx, dword [edx + 0x68]
add edi, eax
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x1c]
push ecx
lea eax, [esp + 0x24]
push eax
mov ecx, esi
call edx
add edi, eax
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x44d716
mov eax, dword [esi]
mov edx, dword [eax + 0x64]
mov ecx, esi
call edx
mov esi, eax
add esi, edi
cmp dword [esp + 0x34], 0x10
jb 0x44d830
mov eax, dword [esp + 0x20]
push eax
call fcn.00493cb0
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.00497941
add esp, 0x34
ret 4
Function at 0x455a80
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x68
mov eax, dword [0x4f4de0]
xor eax, esp
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x6c]
xor ecx, ecx
push esi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], ecx
push eax
mov eax, dword [esp + 0x78]
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.004598d0
add esp, 4
lea esi, [esp + 8]
mov ecx, edi
call fcn.00459970
mov ecx, dword [esp + 0x64]
pop esi
xor ecx, esp
call fcn.00497941
add esp, 0x68
ret
Function at 0x455c10
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov esi, eax
lea eax, [esp + 0x18]
push eax
push 0x20119
xor edi, edi
push edi
push 0x4dc3f0
push reloc.OLEAUT32.dll_SysReAllocString
mov ebx, ecx
mov dword [esp + 0x30], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x455da1
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
lea ecx, [esp + 0x10]
push ecx
mov dword [esi + 0x10], eax
push ebx
mov dword [esi + 0x14], eax
lea edx, [esp + 0x1c]
push edx
mov dword [esi + 0x18], eax
push eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov eax, dword [esp + 0x28]
push str.Operator
mov edi, 0x400
push eax
mov dword [esp + 0x28], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x455ca3
cmp dword [esp + 0x14], 1
jne 0x455d88
mov eax, dword [esp + 0x10]
sub edi, eax
mov dword [esi], ebx
lea ebx, [eax + ebx]
je 0x455d88
mov eax, dword [esp + 0x18]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [esp + 0x10]
push ecx
push ebx
lea edx, [esp + 0x1c]
push edx
push 0
push str.IssueDate
push eax
mov dword [esp + 0x28], edi
call ebp
test eax, eax
jne 0x455ce8
cmp dword [esp + 0x14], 1
jne 0x455d88
mov eax, dword [esp + 0x10]
mov dword [esi + 4], ebx
sub edi, eax
add ebx, eax
test edi, edi
je 0x455d88
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x10]
push ecx
push ebx
lea edx, [esp + 0x1c]
push edx
push 0
push str.ExpirationDate
push eax
mov dword [esp + 0x28], edi
call ebp
test eax, eax
jne 0x455d1f
cmp dword [esp + 0x14], 1
jne 0x455d88
mov eax, dword [esp + 0x10]
mov dword [esi + 8], ebx
sub edi, eax
add ebx, eax
test edi, edi
je 0x455d88
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x10]
push ecx
push ebx
lea edx, [esp + 0x1c]
push edx
push 0
push str.SignData
push eax
mov dword [esp + 0x28], edi
call ebp
test eax, eax
jne 0x455d88
cmp dword [esp + 0x14], 3
jne 0x455d88
mov eax, dword [esp + 0x10]
sub edi, eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], ebx
je 0x455d88
lea eax, [esi + 0xc]
call fcn.00455af0
test eax, eax
je 0x455d88
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov ecx, 0x400
sub ecx, edi
push eax
mov dword [edx], ecx
mov esi, 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x4561d0
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x6c
mov eax, dword [0x4f4de0]
xor eax, esp
mov dword [esp + 0x68], eax
push esi
lea eax, [esp + 8]
mov esi, edx
push eax
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x18], 0x67452301
mov dword [esp + 0x1c], 0xefcdab89
mov dword [esp + 0x20], 0x98badcfe
mov dword [esp + 0x24], 0x10325476
call fcn.00458410
add esp, 8
test eax, eax
jne 0x45623b
pop esi
mov ecx, dword [esp + 0x68]
xor ecx, esp
call fcn.00497941
add esp, 0x6c
ret
mov eax, dword [esp + 0x74]
test eax, eax
jbe 0x456250
push esi
lea ecx, [esp + 0x14]
call fcn.004598d0
add esp, 4
lea esi, [esp + 0x10]
mov ecx, ebx
call fcn.00459970
test edi, edi
je 0x45626e
mov ecx, dword [esp + 0xc]
xor eax, eax
cmp ecx, dword [esp + 8]
sete al
mov dword [edi], eax
mov ecx, dword [esp + 0x6c]
pop esi
xor ecx, esp
mov eax, 1
call fcn.00497941
add esp, 0x6c
ret

Function at 0x4562b0
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x64
mov eax, dword [0x4f4de0]
xor eax, esp
mov dword [esp + 0x5c], eax
xor eax, eax
push esi
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
push edi
lea eax, [esp + 8]
mov edi, ecx
push eax
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.00458610
add esp, 4
test eax, eax
jne 0x45630e
pop edi
pop esi
mov ecx, dword [esp + 0x5c]
xor ecx, esp
call fcn.00497941
add esp, 0x64
ret
lea esi, [esp + 8]
mov ecx, ebx
call fcn.00459970
mov ecx, dword [esp + 0x64]
pop edi
pop esi
xor ecx, esp
mov eax, 1
call fcn.00497941
add esp, 0x64
ret

Function at 0x456330
Capabilities:
Hash data using sha256

Disassembly:
sub esp, 0x74
mov eax, dword [0x4f4de0]
xor eax, esp
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x78]
xor ecx, ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ecx
push edi
lea ecx, [esp + 8]
push ecx
push eax
mov dword [esp + 0x10], 0x6a09e667
mov dword [esp + 0x14], 0xbb67ae85
mov dword [esp + 0x18], 0x3c6ef372
mov dword [esp + 0x1c], 0xa54ff53a
mov dword [esp + 0x20], 0x510e527f
mov dword [esp + 0x24], 0x9b05688c
mov dword [esp + 0x28], 0x1f83d9ab
mov dword [esp + 0x2c], 0x5be0cd19
call fcn.00458700
add esp, 8
test eax, eax
jne 0x4563af
pop edi
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00497941
add esp, 0x74
ret
mov eax, esi
lea edi, [esp + 8]
call fcn.004594c0
mov ecx, dword [esp + 0x74]
pop edi
xor ecx, esp
mov eax, 1
call fcn.00497941
add esp, 0x74
ret

Function at 0x456d60
Capabilities:
Read file on windows

Disassembly:
push ecx
push 0
lea eax, [esp + 4]
push eax
push esi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x456d92
push str.ReadFile__
push 0xfc
push str..QHImageHlp.c
xor edx, edx
call fcn.0045a7b0
add esp, 0xc
xor eax, eax
pop ecx
ret
cmp esi, dword [esp]
je 0x456db7
push 0x4dc584
push 0xfe
push str..QHImageHlp.c
mov edx, 1
call fcn.0045a8e0
add esp, 0xc
xor eax, eax
pop ecx
ret
mov eax, 1
pop ecx
ret