joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406fca
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xac
push ebx
push esi
push edi
mov esi, 0x9c
xor edi, edi
push esi
lea eax, [ebp - 0xac]
mov ebx, edx
push edi
mov dword [ebp - 0x10], ecx
push eax
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], edi
call fcn.00410c20
add esp, 0xc
test ebx, ebx
je 0x407000
and byte [ebx], 0
mov eax, dword [ebp + 8]
test eax, eax
je 0x40700a
and byte [eax], 0
lea eax, [ebp - 0xac]
mov dword [ebp - 0xac], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push eax
call esi
test eax, eax
jne 0x40703e
lea eax, [ebp - 0xac]
mov dword [ebp - 0xac], 0x94
push eax
call esi
test eax, eax
je 0x407227
lea ecx, [ebp - 0x98]
call fcn.00406f40
mov dword [ebp - 8], eax
push 1
pop ebx
cmp dword [ebp - 0x9c], ebx
jne 0x407102
cmp dword [ebp - 0xa8], 4
jne 0x4071cb
cmp dword [ebp - 0xa4], 0
jne 0x4070c5
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push 0x420540
push eax
call esi
test eax, eax
je 0x4070bd
push 0x41be10
push dword [ebp - 8]
call esi
test eax, eax
je 0x4070bd
push 0x41be0c
push dword [ebp - 8]
call esi
test eax, eax
je 0x4070b1
push 0x41be08
push dword [ebp - 8]
call esi
test eax, eax
jne 0x4071cb
mov dword [ebp - 4], 2
jmp 0x4071cb
mov dword [ebp - 4], ebx
jmp 0x4071cb
cmp dword [ebp - 0xa4], 0xa
jne 0x4070f0
cmp word [ebp - 0xa0], 0x8ae
mov dword [ebp - 4], 8
jne 0x4071cb
mov dword [ebp - 4], 0x10
jmp 0x4071cb
jbe 0x4071cb
mov dword [ebp - 4], 0x20
jmp 0x4071cb
push 2
pop ecx
cmp dword [ebp - 0x9c], ecx
jne 0x4071cb
mov eax, dword [ebp - 0xa8]
cmp eax, 3
jne 0x407125
mov dword [ebp - 4], 0x80
jmp 0x40717c
cmp eax, 4
jne 0x407133
mov dword [ebp - 4], 0x100
jmp 0x40717c
cmp eax, 5
jne 0x407170
cmp dword [ebp - 0xa4], ebx
mov dword [ebp - 4], 0x200
je 0x40714f
cmp dword [ebp - 0xa4], ecx
jne 0x40717c
cmp word [ebp - 0x18], bx
mov dword [ebp - 4], 0x400
jne 0x407165
mov dword [ebp - 4], 0x800
jmp 0x40717c
jbe 0x40717c
mov dword [ebp - 4], 0x1000
jmp 0x40717c
cmp eax, 6
jne 0x40717c
mov dword [ebp - 4], 0x2000
cmp byte [ebp - 0x12], bl
jne 0x40719c
test byte [ebp - 3], 0x1c
je 0x4071cb
mov edi, dword [ebp - 0x14]
and di, 0x200
neg di
sbb edi, edi
and edi, 0xfffffff0
add edi, 0x20
jmp 0x4071cb
cmp byte [ebp - 0x12], 3
jne 0x4071cb
test byte [ebp - 3], 0x1c
mov edi, 0x10000000
je 0x4071b0
add edi, 0x40
test byte [ebp - 0x14], 0x80
je 0x4071ba
or edi, ebx
jmp 0x4071cb
test byte [ebp - 0x14], cl
je 0x4071cb
cmp eax, 4
jne 0x4071c8
or edi, ecx
jmp 0x4071cb
or edi, 4
push 0x56
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x4071dd
or edi, 0x80
call fcn.00406f91
test eax, eax
je 0x4071ec
or edi, 0x1000
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x4071f5
mov dword [eax], edi
cmp dword [ebp - 0xc], 0
je 0x407212
push dword [ebp - 0xa0]
push str.Build__d
push dword [ebp - 0xc]
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
cmp dword [ebp + 8], 0
je 0x407224
push dword [ebp - 8]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4074a3
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
xor esi, esi
cmp dword [0x420864], 0x80
mov ebx, ecx
jl 0x40750f
lea eax, [ebp - 4]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40750b
lea eax, [ebp - 0x10]
push eax
push str.SeShutdownPrivilege
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 1
push esi
push esi
push esi
push eax
push esi
mov dword [ebp - 8], 2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x40750f
xor eax, eax
jmp 0x40751a
push esi
push ebx
call dword [sym.imp.USER32.dll_ExitWindowsEx]
push 1
pop eax
pop esi
pop ebx
leave
ret

Function at 0x407cf1
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x360
push esi
lea eax, [ebp - 0x158]
push edi
xor esi, esi
push eax
push esi
mov edi, edx
push ecx
call dword [sym.imp.SHELL32.dll_FindExecutableA]
cmp eax, 0x20
ja 0x407d18
xor eax, eax
jmp 0x407d78
lea eax, [ebp - 0x158]
push edi
push eax
lea eax, [ebp - 0x360]
push 0x41bed8
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
push 0x10
lea eax, [ebp - 0x10]
push esi
push eax
call fcn.00410c20
push 0x44
lea eax, [ebp - 0x54]
pop edi
push edi
push esi
push eax
call fcn.00410c20
add esp, 0x28
lea eax, [ebp - 0x10]
mov dword [ebp - 0x54], edi
push eax
lea eax, [ebp - 0x54]
push eax
push esi
push esi
push 0x4000000
push esi
push esi
lea eax, [ebp - 0x360]
push esi
push eax
lea eax, [ebp - 0x158]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
pop edi
pop esi
leave
ret
Function at 0x4082ef
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x850
push ebx
push esi
mov esi, ecx
mov dword [ebp - 8], 1
mov dword [ebp - 0xc], 0x5333
lea ecx, [esi + 0xb8]
call fcn.00407633
mov dword [ebp - 0x10], eax
xor ebx, ebx
push 0x1a8
lea eax, [ebp - 0x238]
push ebx
push eax
mov dword [ebp - 4], ebx
call fcn.00410c20
mov eax, dword [esi + 0xe24]
add esp, 0xc
shr eax, 0x10
cmp eax, 0xa
mov dword [ebp - 0x238], 0x1a8
je 0x40834f
cmp eax, 0xb
jne 0x408356
mov dword [ebp - 0xc], 0x1106
movzx eax, word [esi + 0xaa]
push eax
movzx eax, word [esi + 0xa4]
push eax
movzx eax, word [esi + 0xa6]
push eax
movzx eax, word [esi + 0xa0]
push eax
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
movzx eax, word [ebp - 0xc]
push eax
lea eax, [ebp - 0x440]
push str.PCI:VEN__04XDEV__04XSUBSYS__04X_04XREV__02X
push eax
call esi
add esp, 0x1c
lea eax, [ebp - 0x544]
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push dword [ebp + 8]
push str._dx_d_x__dHz
push eax
call esi
add esp, 0x14
lea eax, [ebp - 0x238]
push ebx
push eax
push ebx
push dword [ebp - 0x10]
call fcn.004073c0
test eax, eax
je 0x4084bf
push dword [ebp - 4]
lea eax, [ebp - 0x190]
push eax
lea eax, [ebp - 0x33c]
push str._s__d
push eax
call esi
lea eax, [ebp - 0x33c]
push 0x5c
push eax
call fcn.00411150
add esp, 0x18
cmp eax, ebx
je 0x40840c
mov cl, byte [eax]
cmp cl, bl
je 0x40840c
cmp cl, 0x5c
jne 0x408400
mov byte [eax], 0x3a
push 0x5c
push eax
call fcn.00411150
pop ecx
pop ecx
jmp 0x4083ee
lea eax, [ebp - 0x544]
push eax
lea eax, [ebp - 0x33c]
push eax
lea eax, [ebp - 0x440]
push eax
lea eax, [ebp - 0x850]
push str.HKLMSoftwareMicrosoftWindowsCurrentVersionControl_PanelSettingsVideo_s_s_s
push eax
call esi
add esp, 0x14
lea eax, [ebp - 0x90]
push dword [ebp + 0x10]
push str._d_bpp
push eax
call esi
add esp, 0xc
lea eax, [ebp + 0xc]
mov edx, 0xf003f
lea ecx, [ebp - 0x850]
push dword [ebp + 0x18]
mov dword [ebp + 0x14], ebx
push eax
call fcn.00406b4f
test eax, eax
jne 0x4084a6
cmp dword [ebp + 0x18], ebx
je 0x40848b
lea eax, [ebp + 0x14]
push 4
push eax
push 4
lea eax, [ebp - 0x90]
push ebx
push eax
mov dword [ebp + 0x14], 1
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x4084a6
mov ecx, dword [ebp + 0xc]
push ebx
lea edx, [ebp - 0x90]
call fcn.00406d54
mov dword [ebp + 0x14], eax
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 0x14]
push ebx
and dword [ebp - 8], eax
inc dword [ebp - 4]
lea eax, [ebp - 0x238]
push eax
push dword [ebp - 4]
jmp 0x4083b5
mov eax, dword [ebp - 8]
pop esi
pop ebx
leave
ret 0x14
Function at 0x40bda5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
lea eax, [ebp - 8]
push edi
push eax
mov esi, edx
push dword [ebp + 0x10]
mov edx, dword [ebp + 8]
mov dword [ebp - 4], ecx
mov ecx, esi
call fcn.0040bd45
mov edi, eax
test edi, edi
je 0x40bdf9
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp + 0x10], eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp + 8], eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowDC]
mov ebx, eax
test ebx, ebx
jne 0x40bdfd
xor eax, eax
jmp 0x40be3b
mov esi, dword [ebp + 0x14]
push 0x34
push 0
push esi
call fcn.00410c20
add esp, 0xc
mov edx, dword [ebp - 8]
or dword [esi + 0x30], 0xffffffff
mov ecx, ebx
push esi
mov dword [esi], edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040be42
mov esi, eax
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_FreeResource]
push ebx
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_ReleaseDC]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x40be61
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
test eax, eax
mov ebx, edx
mov dword [ebp - 4], ecx
je 0x40be7b
and word [eax + 2], 0
mov edx, dword [ebp + 8]
lea eax, [ebp + 8]
push eax
mov ecx, ebx
push dword [ebp + 0x14]
call fcn.0040bd45
mov esi, eax
test esi, esi
je 0x40bebf
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp + 0x14], eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowDC]
mov ebx, eax
test ebx, ebx
jne 0x40bec6
xor eax, eax
jmp 0x40bff1
push 0x34
lea eax, [ebp - 0x38]
push 0
push eax
call fcn.00410c20
add esp, 0xc
lea eax, [ebp - 0x38]
mov edx, dword [ebp + 8]
or dword [ebp - 8], 0xffffffff
push eax
mov ecx, ebx
push dword [ebp + 0x10]
mov dword [ebp - 0x38], esi
push dword [ebp + 0x14]
call fcn.0040be42
mov dword [ebp + 0x14], eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor edi, edi
cmp dword [ebp + 0x14], edi
jne 0x40bf17
cmp dword [ebp - 0x30], edi
je 0x40bf10
push dword [ebp - 0x30]
call fcn.00410fb5
pop ecx
xor esi, esi
jmp 0x40bfe5
mov ecx, dword [ebp - 0x30]
mov esi, dword [sym.imp.GDI32.dll_SelectPalette]
cmp ecx, edi
je 0x40bf58
cmp dword [ebp + 0x18], edi
je 0x40bf3c
cmp dword [ebp + 0x1c], edi
jle 0x40bf3c
push dword [ebp + 0x1c]
mov edx, dword [ebp - 0x2c]
push dword [ebp + 0x18]
call fcn.0040bff8
push dword [ebp - 0x30]
call dword [sym.imp.GDI32.dll_CreatePalette]
mov dword [ebp + 0x10], eax
push 1
push eax
push ebx
call esi
mov dword [ebp + 0x18], eax
push ebx
call dword [sym.imp.GDI32.dll_RealizePalette]
push edi
push dword [ebp - 0x2c]
push dword [ebp - 0x28]
push 4
push dword [ebp - 0x2c]
push ebx
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
cmp dword [ebp - 0x30], edi
mov edi, dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [ebp + 0x1c], eax
je 0x40bfb8
push 1
push dword [ebp + 0x18]
push ebx
call esi
push dword [ebp + 0x10]
call edi
cmp dword [ebp + 0x1c], 0
je 0x40bfad
cmp dword [ebp + 0xc], 0
je 0x40bfad
mov eax, dword [ebp - 0x30]
movzx ecx, word [eax + 2]
lea ecx, [ecx*4 + 8]
push ecx
push eax
push dword [ebp + 0xc]
call fcn.00410c80
add esp, 0xc
push dword [ebp - 0x30]
call fcn.00410fb5
pop ecx
jmp 0x40bfc8
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x40bfc8
and word [eax], 0
and word [eax + 2], 0
mov eax, dword [ebp + 0x20]
test eax, eax
je 0x40bfd4
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
push dword [ebp - 0x2c]
call fcn.00410fb5
pop ecx
push dword [ebp + 0x14]
call edi
mov esi, dword [ebp + 0x1c]
push ebx
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_ReleaseDC]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0x1c
Function at 0x40c0b0
Capabilities:
Read file on windows
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
push ebx
push esi
push edi
xor esi, esi
mov edi, edx
mov ebx, ecx
mov dword [ebp - 8], esi
call fcn.0040c1a3
cmp ax, 0xffff
mov word [edi], ax
je 0x40c180
lea eax, [ebp - 0x14c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x40c180
push esi
push 0x80
push 3
push esi
push 1
push 0x80000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40c180
mov edi, dword [ebp + 8]
mov eax, dword [ebp - 0x12c]
push esi
push esi
push esi
push 2
push esi
push ebx
mov dword [edi], eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp eax, esi
mov dword [ebp - 4], eax
je 0x40c155
push esi
push esi
push esi
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp eax, esi
mov dword [ebp + 8], eax
jne 0x40c149
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40c150
mov dword [ebp - 8], 1
cmp dword [ebp + 8], esi
jne 0x40c184
push dword [edi]
call fcn.0041101e
cmp eax, esi
pop ecx
mov dword [ebp + 8], eax
je 0x40c180
lea ecx, [ebp - 0xc]
push esi
push ecx
push dword [edi]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, esi
jne 0x40c184
xor eax, eax
jmp 0x40c19c
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 4]
mov dword [eax], ebx
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x40c460
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor edx, edx
mov ecx, 0x420bec
mov dword [ecx], edx
mov esi, 8
mov eax, dword [ecx]
test al, 1
jne 0x40c479
shr eax, 1
jmp 0x40c480
shr eax, 1
xor eax, 0xedb88320
dec esi
mov dword [ecx], eax
jne 0x40c46f
add ecx, 4
inc edx
cmp ecx, 0x420fec
jb 0x40c468
pop esi
ret

Function at 0x40c670
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov eax, ecx
xor ecx, ecx
mov esi, edx
test edi, edi
jbe 0x40c6a2
push ebx
xor edx, edx
mov ebx, eax
mov dl, byte [ecx + esi]
and ebx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x420bec]
xor eax, edx
inc ecx
cmp ecx, edi
jb 0x40c681
pop ebx
pop edi
pop esi
ret 4
Function at 0x410494
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x104
lea eax, [ebp - 0x210]
and byte [edi], 0
push esi
mov dword [ebp - 8], edx
mov ebx, ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp + 8]
mov dword [ebp + 8], esi
push eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 4]
push eax
push 0
push str.Filename
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41053d
cmp dword [ebp - 4], 1
jne 0x41053d
cmp byte [ebp - 0x10b], 0x3a
lea eax, [ebp - 0x10c]
push eax
jne 0x410503
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x410519
lea eax, [ebp - 0x210]
push eax
push str._s_s
push edi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov esi, dword [ebx + 0xdf8]
test esi, esi
je 0x410541
lea eax, [esi + 0x104]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x41053d
mov esi, dword [esi + 0xc10]
jmp 0x41051f
xor eax, eax
jmp 0x410544
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x4105e4
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x430
push ebx
push edi
mov ebx, ecx
xor edi, edi
lea eax, [ebp - 0xc]
push edi
lea ecx, [ebx + 0x1084]
push eax
mov edx, 0x20019
mov dword [ebp - 0x14], edi
call fcn.00406b4f
test eax, eax
je 0x410617
or eax, 0xffffffff
jmp 0x41072c
mov dword [ebp - 4], edi
lea eax, [ebp - 0x20]
mov dword [ebp - 8], 0x104
push eax
push edi
push edi
lea eax, [ebp - 8]
push edi
push eax
lea eax, [ebp - 0x124]
push eax
push dword [ebp - 4]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp eax, edi
jne 0x41070a
lea eax, [ebp - 0x10]
push eax
push 0x20019
lea eax, [ebp - 0x124]
push edi
push eax
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x410702
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x104
push eax
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x18]
push eax
push edi
push str.UtilityName
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4106a6
lea eax, [ebp - 0x124]
push eax
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0x430]
push eax
mov ecx, ebx
call fcn.00410494
test eax, eax
je 0x4106f9
lea eax, [ebp - 0x124]
push eax
lea eax, [ebx + 0x1084]
push eax
lea eax, [ebp - 0x32c]
push str._s_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x32c]
lea edx, [ebp - 0x430]
mov ecx, ebx
push eax
call fcn.00410730
test eax, eax
je 0x4106f9
inc dword [ebp - 0x14]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp - 4]
jmp 0x41061a
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x14]
cmp eax, edi
je 0x410726
mov dword [ebx + 0x88], 0x14
jmp 0x41072c
mov dword [ebx + 0x88], edi
pop edi
pop ebx
leave
ret
Function at 0x415b19
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x41fd90
cmp edx, dword [eax]
je 0x415b3b
add eax, 8
inc ecx
cmp eax, 0x41fe20
jl 0x415b2c
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x41fd90]
jne 0x415c69
mov eax, dword [0x42155c]
cmp eax, 1
je 0x415c43
test eax, eax
jne 0x415b6c
cmp dword [0x41d314], 1
je 0x415c43
cmp edx, 0xfc
je 0x415c69
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x415ba3
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00411310
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00413860
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x415be6
lea eax, [ebp - 0x1a4]
push eax
call fcn.00413860
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4194e8
push edi
call fcn.00411210
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00411310
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00411320
lea eax, [ebp - 0xa0]
push 0x4194c8
push eax
call fcn.00411320
push dword [esi + 0x41fd94]
lea eax, [ebp - 0xa0]
push eax
call fcn.00411320
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004170fd
add esp, 0x2c
pop edi
jmp 0x415c69
lea eax, [ebp + 8]
lea esi, [esi + 0x41fd94]
push 0
push eax
push dword [esi]
call fcn.00413860
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x408680
Capabilities:
Resolve function by parsing pe exports

Disassembly:
and eax, 0xf9eabf72
dec ebp
sbb eax, ebx
xchg ebx, eax

Function at 0x408ac0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov esi, dword [edx + 0x28]
xor eax, eax
lodsb al, byte [esi]
cmp al, 0x61
jl 0x408acc
sub al, 0x20
ror edi, 0xd
add edi, eax
dec ecx
jne 0x408ac3
push edx
push edi
mov edx, dword [edx + 0x10]
mov eax, dword [edx + 0x3c]
add eax, edx
mov eax, dword [eax + 0x78]
test eax, eax
Function at 0x40d8a0
Capabilities:
Hash data using sha224

Disassembly:
sub esp, 0x2c
mov eax, dword [ecx + 0xc]
test eax, eax
je 0x40d8c9
mov edx, dword [ecx + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp + 0x1c], ecx
mov dword [esp], edx
call sub.msvcrt.dll_memset
mov ecx, dword [esp + 0x1c]
mov eax, dword [ecx + 0x2c]
mov dword [ecx + 0x20], 0
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x1c], 0
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0x367cd507
mov dword [eax + 8], 0x3070dd17
mov dword [eax + 0xc], 0xf70e5939
mov dword [eax + 0x10], 0xffc00b31
mov dword [eax + 0x14], 0x68581511
mov dword [eax + 0x18], 0x64f98fa7
mov dword [eax + 0x1c], 0xbefa4fa4
add esp, 0x2c
ret

Function at 0x40d930
Capabilities:
Hash data using sha256

Disassembly:
sub esp, 0x2c
mov eax, dword [ecx + 0xc]
test eax, eax
je 0x40d959
mov edx, dword [ecx + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp + 0x1c], ecx
mov dword [esp], edx
call sub.msvcrt.dll_memset
mov ecx, dword [esp + 0x1c]
mov eax, dword [ecx + 0x2c]
mov dword [ecx + 0x20], 0
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x1c], 0
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
add esp, 0x2c
ret

Function at 0x40df80
Capabilities:
Hash data using sha224

Disassembly:
sub esp, 0x2c
mov eax, dword [ecx + 0xc]
test eax, eax
je 0x40dfa9
mov edx, dword [ecx + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp + 0x1c], ecx
mov dword [esp], edx
call sub.msvcrt.dll_memset
mov ecx, dword [esp + 0x1c]
mov eax, dword [ecx + 0x2c]
mov dword [ecx + 0x20], 0
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x1c], 0
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0xcbbb9d5d
mov dword [eax + 8], 0x367cd507
mov dword [eax + 0xc], 0x629a292a
mov dword [eax + 0x10], 0x3070dd17
mov dword [eax + 0x14], 0x9159015a
mov dword [eax + 0x18], 0xf70e5939
mov dword [eax + 0x1c], 0x152fecd8
mov dword [eax + 0x20], 0xffc00b31
mov dword [eax + 0x24], 0x67332667
mov dword [eax + 0x28], 0x68581511
mov dword [eax + 0x2c], 0x8eb44a87
mov dword [eax + 0x30], 0x64f98fa7
mov dword [eax + 0x34], 0xdb0c2e0d
mov dword [eax + 0x38], 0xbefa4fa4
mov dword [eax + 0x3c], 0x47b5481d
add esp, 0x2c
ret
Function at 0x40e050
Capabilities:
Hash data using sha256

Disassembly:
sub esp, 0x2c
mov eax, dword [ecx + 0xc]
test eax, eax
je 0x40e079
mov edx, dword [ecx + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp + 0x1c], ecx
mov dword [esp], edx
call sub.msvcrt.dll_memset
mov ecx, dword [esp + 0x1c]
mov eax, dword [ecx + 0x2c]
mov dword [ecx + 0x20], 0
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x1c], 0
mov dword [eax], 0xf3bcc908
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x3c], 0x5be0cd19
add esp, 0x2c
ret

Function at 0x40e500
Capabilities:
Hash data using sha1

Disassembly:
push ebx
mov ebx, ecx
sub esp, 0x18
mov eax, dword [ecx + 0xc]
test eax, eax
jne 0x40e570
mov eax, dword [ebx + 0x30]
mov dword [ebx + 0x20], 0
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x1c], 0
test eax, eax
je 0x40e543
mov edx, dword [ebx + 0x2c]
shl eax, 2
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp], edx
call sub.msvcrt.dll_memset
mov eax, dword [ebx + 0x3c]
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
add esp, 0x18
pop ebx
ret
mov edx, dword [ecx + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], edx
call sub.msvcrt.dll_memset
jmp 0x40e50d

Function at 0x40e5a0
Capabilities:
Hash data with md5

Disassembly:
push ebx
mov ebx, ecx
sub esp, 0x18
mov eax, dword [ecx + 0xc]
test eax, eax
jne 0x40e610
mov eax, dword [ebx + 0x30]
mov dword [ebx + 0x20], 0
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x1c], 0
test eax, eax
je 0x40e5e3
mov edx, dword [ebx + 0x2c]
shl eax, 2
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp], edx
call sub.msvcrt.dll_memset
mov eax, dword [ebx + 0x3c]
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
add esp, 0x18
pop ebx
ret
mov edx, dword [ecx + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], edx
call sub.msvcrt.dll_memset
jmp 0x40e5ad