joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5a4098
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, eax
mov edi, dword [ebx + 0x24]
mov esi, dword [ebx + 0x34]
sub esi, dword [ebx + 0x6c]
sub esi, dword [ebx + 0x64]
test esi, esi
jne 0x5a40c1
cmp dword [ebx + 0x64], 0
jne 0x5a40c1
cmp dword [ebx + 0x6c], 0
jne 0x5a40c1
mov esi, edi
jmp 0x5a414d
cmp esi, 0xffffffff
jne 0x5a40cc
dec esi
jmp 0x5a414d
mov eax, dword [ebx + 0x64]
lea edx, [edi + edi]
sub edx, 0x106
cmp eax, edx
jb 0x5a414d
mov eax, dword [ebx + 0x30]
lea edx, [eax + edi]
mov ecx, edi
call fcn.005a36dc
sub dword [ebx + 0x68], edi
sub dword [ebx + 0x64], edi
sub dword [ebx + 0x54], edi
mov eax, dword [ebx + 0x44]
mov edx, dword [ebx + 0x3c]
lea edx, [edx + eax*2]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp edi, dword [esp]
ja 0x5a4115
movzx ecx, word [esp]
sub cx, di
mov word [edx], cx
jmp 0x5a411a
mov word [edx], 0
dec eax
test eax, eax
jne 0x5a40fb
mov eax, edi
mov edx, dword [ebx + 0x38]
lea edx, [edx + eax*2]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp edi, dword [esp]
ja 0x5a4141
movzx ecx, word [esp]
sub cx, di
mov word [edx], cx
jmp 0x5a4146
mov word [edx], 0
dec eax
test eax, eax
jne 0x5a4127
add esi, edi
mov eax, dword [ebx]
cmp dword [eax + 4], 0
je 0x5a41ab
mov edx, dword [ebx + 0x64]
add edx, dword [ebx + 0x6c]
mov ecx, dword [ebx + 0x30]
lea edx, [ecx + edx]
mov ecx, esi
call fcn.005a3e10
add dword [ebx + 0x6c], eax
cmp dword [ebx + 0x6c], 3
jb 0x5a4196
mov eax, dword [ebx + 0x64]
mov edx, dword [ebx + 0x30]
movzx eax, byte [edx + eax]
mov dword [ebx + 0x40], eax
mov ecx, dword [ebx + 0x50]
shl eax, cl
mov edx, dword [ebx + 0x64]
mov ecx, dword [ebx + 0x30]
movzx edx, byte [ecx + edx + 1]
xor eax, edx
and eax, dword [ebx + 0x4c]
mov dword [ebx + 0x40], eax
cmp dword [ebx + 0x6c], 0x106
jae 0x5a41ab
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x5a40a1
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x5a8b8c
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x5c78b4
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x5a8bae
shr eax, 1
xor eax, 0xedb88320
jmp 0x5a8bb0
shr eax, 1
dec edx
jne 0x5a8b9c
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x5a8b95
mov byte [0x5c7cb4], 1
pop esi
pop ebx
ret

Function at 0x5a8bcc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x5c7cb4], 0
jne 0x5a8be3
call fcn.005a8b8c
mov eax, edi
dec eax
test eax, eax
jl 0x5a8c0b
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x5c78b4]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x5a8bed
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x5ab07c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x14]
movzx edx, byte [eax + 0x461]
movzx ecx, dl
cmp ecx, 6
ja case.0x5ab116.0
jmp dword [ecx*4 + 0x5ab0af]
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x5ab0e1
sub dl, 8
je 0x5ab0f0
jmp case.0x5ab116.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5aad28
jmp case.0x5ab116.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5aad80
jmp case.0x5ab116.0
movzx ecx, byte [eax + 0x460]
cmp ecx, 0x10
ja case.0x5ab116.0
movzx ecx, byte [ecx + 0x5ab11d]
jmp dword [ecx*4 + 0x5ab12e]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5aae2c
jmp case.0x5ab116.0
cmp dl, 3
jne 0x5ab15b
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5aae80
jmp case.0x5ab116.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5aae3c
jmp case.0x5ab116.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5aaec4
jmp case.0x5ab116.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x5ab186
sub dl, 8
je 0x5ab192
jmp case.0x5ab116.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5aaef0
jmp case.0x5ab116.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5aaf5c
jmp case.0x5ab116.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x5ab1b1
sub dl, 8
je 0x5ab1bd
jmp case.0x5ab116.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5ab018
jmp case.0x5ab116.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5ab040
mov edx, dword [eax + 0x468]
mov ecx, dword [ebx + 0x1c]
dec ecx
imul edx, ecx
mov esi, edx
add esi, dword [eax + 0x450]
mov dword [ebp - 0xc], esi
mov esi, dword [eax + 0x454]
mov dword [ebp - 8], esi
mov esi, edx
add esi, dword [eax + 0x44c]
mov dword [ebp - 0x10], esi
mov esi, ecx
test esi, esi
jb 0x5ab261
inc esi
mov eax, dword [ebx + 0x20]
inc eax
push eax
lea eax, [ebx + 0x4c]
push eax
mov eax, dword [ebp + 8]
push eax
movzx eax, byte [ebx + 0x48]
mov ecx, dword [ebx + eax*4 + 0x40]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.005aa2bc
test eax, eax
je 0x5ab261
mov eax, ebx
call fcn.005ab26c
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
lea edx, [eax + 1]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
call dword [ebp - 0x18]
movzx eax, byte [ebx + 0x48]
xor al, 1
mov byte [ebx + 0x48], al
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0x468]
sub dword [ebp - 0xc], eax
sub dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
add dword [ebp - 8], eax
dec esi
jne 0x5ab1fa
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x5ab26c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x5ab29d
dec al
je 0x5ab2d8
dec al
je 0x5ab31d
dec al
je 0x5ab386
jmp 0x5ab410
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x5ab410
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x5ab2ad
jmp 0x5ab410
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x5ab410
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x5ab2e8
jmp 0x5ab410
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x5ab410
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x5ab34c
xor ebp, ebp
jmp 0x5ab35c
mov ecx, esi
sub ecx, edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x5ab365
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x5ab32d
jmp 0x5ab410
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x5ab410
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x5ab3df
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.005a8c14
add al, byte [esp]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x5ab39a
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5afb38
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
mov byte [ebx + 0x439], 1
push 0
mov eax, dword [0x5bf158]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
sub edx, dword [ebx + 0x48]
sub edx, 0x64
mov eax, ebx
call fcn.0046903c
mov eax, dword [0x5bf560]
mov eax, dword [eax]
call fcn.0046982c
mov edx, eax
imul edx, dword [ebx + 0x43c]
mov eax, ebx
call fcn.00469078
mov dl, 1
mov eax, dword [ebx + 0x3ac]
call fcn.004b67dc
push 3
mov eax, dword [ebx + 0x4c]
push eax
mov eax, dword [ebx + 0x48]
push eax
mov eax, ebx
call fcn.0046388c
push eax
mov eax, ebx
call fcn.0046386c
push eax
push 0xffffffffffffffff
mov eax, dword [0x5c7d00]
call fcn.004550cc
push eax
call sub.user32.dll_SetWindowPos
pop ebx
ret

Function at 0x5afbbc
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov byte [ebx + 0x439], 0
imul edx, dword [ebx + 0x43c], 0x1e
mov eax, ebx
call fcn.0046903c
imul edx, dword [ebx + 0x43c], 0x1e
mov eax, ebx
call fcn.00469078
push 5
mov eax, dword [0x5bf158]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [0x5bf158]
mov eax, dword [eax]
call fcn.0046bc04
mov eax, dword [ebx + 0x360]
cmp byte [eax + 0x75], 2
jne 0x5afc42
xor edx, edx
mov eax, ebx
call fcn.0046903c
xor edx, edx
mov eax, ebx
call fcn.00469078
push 0x41
mov eax, dword [ebx + 0x4c]
push eax
mov eax, dword [ebx + 0x48]
push eax
push 0
push 0
push 0xfffffffffffffffe
mov eax, dword [0x5c7d00]
call fcn.004550cc
push eax
call sub.user32.dll_SetWindowPos
pop esi
pop ebx
ret
push 0x41
mov eax, dword [ebx + 0x4c]
push eax
mov eax, dword [ebx + 0x48]
push eax
imul esi, dword [ebx + 0x43c], 0x1e
push esi
push esi
push 0xfffffffffffffffe
mov eax, dword [0x5c7d00]
call fcn.004550cc
push eax
call sub.user32.dll_SetWindowPos
pop esi
pop ebx
ret

Function at 0x5affb4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00405294
xor eax, eax
push ebp
push 0x5b002b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00403730
lea eax, [ebp - 0x58]
xor ecx, ecx
mov edx, 0x10
call fcn.00403730
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004052a4
push eax
push 0
call sub.kernel32.dll_CreateProcessA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5b0032
lea eax, [ebp - 4]
call fcn.00404e14
ret
Function at 0x5b15e0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov ebx, ecx
test ebx, ebx
js 0x5b15fe
shr ebx, 2
mov esi, dword [edx + ebx*4]
dec ebx
push esi
jns 0x5b15f7
mov edx, esp
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5b174b
push dword fs:[eax]
mov dword fs:[eax], esp
lea esi, [ecx + 1]
lea eax, [ebp - 4]
mov dl, 9
call fcn.0057f570
lea eax, [ebp - 4]
mov dl, 1
call fcn.0057f570
lea eax, [ebp - 4]
mov ecx, esi
xor edx, edx
call fcn.0057f60c
lea eax, [ebp - 4]
mov ecx, ebx
xor edx, edx
call fcn.0057f5a4
call fcn.005b159c
mov dword [ebp - 0xc], eax
lea eax, [ebp - 4]
mov ecx, dword [ebp - 0xc]
xor edx, edx
call fcn.0057f5a4
lea eax, [ebp - 4]
mov ecx, 1
xor edx, edx
call fcn.0057f5a4
lea eax, [ebp - 4]
xor ecx, ecx
xor edx, edx
call fcn.0057f5a4
lea eax, [ebp - 4]
xor ecx, ecx
xor edx, edx
call fcn.0057f5a4
lea eax, [ebp - 4]
mov ecx, dword [0x5c7d24]
xor edx, edx
call fcn.0057f5a4
lea eax, [ebp - 4]
mov ecx, dword [0x5c7d28]
xor edx, edx
call fcn.0057f5a4
lea eax, [ebp - 4]
xor ecx, ecx
xor edx, edx
call fcn.0057f5a4
mov eax, dword [ebp - 4]
call fcn.00406258
mov ebx, eax
lea eax, [esi + ebx]
push eax
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x57f3b4]
call fcn.00406414
add esp, 4
mov edx, esi
dec edx
test edx, edx
jl 0x5b16ed
inc edx
xor esi, esi
mov eax, dword [ebp - 8]
lea ecx, [esi + ebx]
mov edi, dword [ebp - 4]
add edi, ecx
movzx ecx, byte [eax]
mov byte [edi], cl
inc esi
inc eax
dec edx
jne 0x5b16db
mov eax, dword [ebp - 4]
call fcn.00406258
mov ebx, eax
mov eax, ebx
call fcn.00402f78
mov esi, eax
mov edx, dword [ebp - 4]
mov ecx, ebx
mov eax, esi
call fcn.0040808c
push 0
push ebx
push esi
mov eax, dword [0x5bf22c]
mov eax, dword [eax]
push eax
call sub.wsock32.dll_send
mov eax, esi
call fcn.00402fc8
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
call fcn.005b15bc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5b1752
lea eax, [ebp - 4]
mov edx, dword [0x57f3b4]
call fcn.00406514
ret
Function at 0x401220
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov eax, dword [edi]
lea ecx, [esp]
push ecx
mov ecx, dword [esp + 0xc]
push esi
add eax, eax
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x18]
push 0
mov dword [edi], 0
mov edx, dword [ecx]
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40128e
mov eax, dword [esp + 0xc]
cmp eax, 1
je 0x40125f
cmp eax, 2
jne 0x40127a
mov eax, dword [esp]
test esi, esi
je 0x401288
test eax, eax
je 0x401283
test al, 1
jne 0x40127a
mov ecx, eax
shr ecx, 1
cmp word [esi + ecx*2 - 2], 0
je 0x401288
mov eax, 0xd
pop ecx
ret 8
xor edx, edx
mov word [esi], dx
shr eax, 1
mov dword [edi], eax
xor eax, eax
pop ecx
ret 8
Function at 0x4012a0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x417a6b
mov eax, dword fs:[0]
push eax
sub esp, 0x8cc
mov eax, dword [0x42d190]
xor eax, esp
mov dword [esp + 0x8c4], eax
push esi
push edi
mov eax, dword [0x42d190]
xor eax, esp
push eax
lea eax, [esp + 0x8d8]
mov dword fs:[0], eax
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x2be]
mov dword [esp + 0x1c], 0
push ecx
mov word [esp + 0x2c0], ax
call fcn.00409a50
add esp, 0xc
push 0x104
lea edx, [esp + 0x2b8]
push edx
push 0x400000
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x2b4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x4c6]
push edx
mov word [esp + 0x4c8], cx
call fcn.00409a50
add esp, 0xc
lea eax, [esp + 0x2b4]
lea edx, [esp + 0x4bc]
call fcn.004011a0
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push str.360Safe.exe
lea eax, [esp + 0x4c0]
push eax
call esi
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea ecx, [esp + 0x4bc]
push ecx
call edi
test eax, eax
je 0x40139b
push ebx
lea ecx, [esp + 0x2b8]
call fcn.00401be0
jmp 0x4014f1
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0xb6]
push eax
mov word [esp + 0xb8], dx
call fcn.00409a50
add esp, 0xc
lea eax, [esp + 0x2b4]
lea edx, [esp + 0xac]
call fcn.004011a0
push str...360Safe.exe
lea ecx, [esp + 0xb0]
push ecx
call esi
lea edx, [esp + 0xac]
push edx
call edi
test eax, eax
je 0x40140b
lea eax, [esp + 0xac]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push ebx
lea ecx, [esp + 0xb0]
call fcn.00401be0
jmp 0x4014f1
mov edx, dword [0x42a14c]
mov ax, word [0x42a150]
mov ecx, 0x20
mov esi, str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
lea edi, [esp + 0x2c]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [str.Path]
xor edi, edi
xor esi, esi
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], edx
mov word [esp + 0x28], ax
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], edi
lea ecx, [esp + 0x10]
push ecx
push 0x20019
push edi
lea edx, [esp + 0x38]
push edx
mov dword [esp + 0x8f0], edi
push 0x80000002
mov dword [esp + 0x24], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x4014db
mov eax, dword [esp + 0x10]
push 0x206
lea edx, [esp + 0x6ca]
xor ecx, ecx
push edi
push edx
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], edi
mov word [esp + 0x6d0], cx
call fcn.00409a50
add esp, 0xc
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x1c]
push ecx
lea edi, [esp + 0x1c]
lea esi, [esp + 0x6cc]
mov dword [esp + 0x1c], 0x104
call fcn.00401220
test eax, eax
jne 0x4014d5
push ebx
mov ecx, esi
call fcn.00401be0
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4014f1
push eax
jmp 0x4014eb
mov esi, dword [esp + 0x18]
xor edi, edi
push ebx
mov ecx, 0x42a08c
call fcn.00401be0
cmp esi, edi
je 0x4014f1
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov ecx, dword [esp + 0x8d8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x8c4]
xor ecx, esp
call fcn.004093f5
mov esp, ebp
pop ebp
ret
Function at 0x4017e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push edi
push ebx
push ebp
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4017f7
pop edi
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401828
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, esi
and edi, 0xf
jbe 0x401824
cmp esi, eax
jae 0x401828
sub edi, 1
movzx ecx, word [esi]
lea esi, [esi + ecx*2 + 2]
jne 0x401814
cmp esi, eax
jb 0x40182e
pop esi
pop edi
xor eax, eax
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebp
ret

Function at 0x402610
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x68
mov eax, dword [0x42d190]
xor eax, esp
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x6c]
xor ecx, ecx
push esi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], ecx
push eax
mov eax, dword [esp + 0x78]
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.004064a0
add esp, 4
lea esi, [esp + 8]
mov ecx, edi
call fcn.00406540
mov ecx, dword [esp + 0x64]
pop esi
xor ecx, esp
call fcn.004093f5
add esp, 0x68
ret
Function at 0x4027a0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov esi, eax
lea eax, [esp + 0x18]
push eax
push 0x20119
xor edi, edi
push edi
push 0x42a738
push 0x80000002
mov ebx, ecx
mov dword [esp + 0x30], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x402931
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
lea ecx, [esp + 0x10]
push ecx
mov dword [esi + 0x10], eax
push ebx
mov dword [esi + 0x14], eax
lea edx, [esp + 0x1c]
push edx
mov dword [esi + 0x18], eax
push eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov eax, dword [esp + 0x28]
push str.Operator
mov edi, 0x400
push eax
mov dword [esp + 0x28], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x402833
cmp dword [esp + 0x14], 1
jne 0x402918
mov eax, dword [esp + 0x10]
sub edi, eax
mov dword [esi], ebx
lea ebx, [eax + ebx]
je 0x402918
mov eax, dword [esp + 0x18]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [esp + 0x10]
push ecx
push ebx
lea edx, [esp + 0x1c]
push edx
push 0
push str.IssueDate
push eax
mov dword [esp + 0x28], edi
call ebp
test eax, eax
jne 0x402878
cmp dword [esp + 0x14], 1
jne 0x402918
mov eax, dword [esp + 0x10]
mov dword [esi + 4], ebx
sub edi, eax
add ebx, eax
test edi, edi
je 0x402918
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x10]
push ecx
push ebx
lea edx, [esp + 0x1c]
push edx
push 0
push str.ExpirationDate
push eax
mov dword [esp + 0x28], edi
call ebp
test eax, eax
jne 0x4028af
cmp dword [esp + 0x14], 1
jne 0x402918
mov eax, dword [esp + 0x10]
mov dword [esi + 8], ebx
sub edi, eax
add ebx, eax
test edi, edi
je 0x402918
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x10]
push ecx
push ebx
lea edx, [esp + 0x1c]
push edx
push 0
push str.SignData
push eax
mov dword [esp + 0x28], edi
call ebp
test eax, eax
jne 0x402918
cmp dword [esp + 0x14], 3
jne 0x402918
mov eax, dword [esp + 0x10]
sub edi, eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], ebx
je 0x402918
lea eax, [esi + 0xc]
call fcn.00402680
test eax, eax
je 0x402918
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov ecx, 0x400
sub ecx, edi
push eax
mov dword [edx], ecx
mov esi, 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x402d30
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x6c
mov eax, dword [0x42d190]
xor eax, esp
mov dword [esp + 0x68], eax
push esi
lea eax, [esp + 8]
mov esi, edx
push eax
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x18], 0x67452301
mov dword [esp + 0x1c], 0xefcdab89
mov dword [esp + 0x20], 0x98badcfe
mov dword [esp + 0x24], 0x10325476
call fcn.00405000
add esp, 8
test eax, eax
jne 0x402d9b
pop esi
mov ecx, dword [esp + 0x68]
xor ecx, esp
call fcn.004093f5
add esp, 0x6c
ret
mov eax, dword [esp + 0x74]
test eax, eax
jbe 0x402db0
push esi
lea ecx, [esp + 0x14]
call fcn.004064a0
add esp, 4
lea esi, [esp + 0x10]
mov ecx, ebx
call fcn.00406540
test edi, edi
je 0x402dce
mov ecx, dword [esp + 0xc]
xor eax, eax
cmp ecx, dword [esp + 8]
sete al
mov dword [edi], eax
mov ecx, dword [esp + 0x6c]
pop esi
xor ecx, esp
mov eax, 1
call fcn.004093f5
add esp, 0x6c
ret

Function at 0x402e60
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x64
mov eax, dword [0x42d190]
xor eax, esp
mov dword [esp + 0x5c], eax
xor eax, eax
push esi
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
push edi
lea eax, [esp + 8]
mov edi, ecx
push eax
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.00405200
add esp, 4
test eax, eax
jne 0x402ebe
pop edi
pop esi
mov ecx, dword [esp + 0x5c]
xor ecx, esp
call fcn.004093f5
add esp, 0x64
ret
lea esi, [esp + 8]
mov ecx, ebx
call fcn.00406540
mov ecx, dword [esp + 0x64]
pop edi
pop esi
xor ecx, esp
mov eax, 1
call fcn.004093f5
add esp, 0x64
ret

Function at 0x402ee0
Capabilities:
Hash data using sha256

Disassembly:
sub esp, 0x74
mov eax, dword [0x42d190]
xor eax, esp
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x78]
xor ecx, ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ecx
push edi
lea ecx, [esp + 8]
push ecx
push eax
mov dword [esp + 0x10], 0x6a09e667
mov dword [esp + 0x14], 0xbb67ae85
mov dword [esp + 0x18], 0x3c6ef372
mov dword [esp + 0x1c], 0xa54ff53a
mov dword [esp + 0x20], 0x510e527f
mov dword [esp + 0x24], 0x9b05688c
mov dword [esp + 0x28], 0x1f83d9ab
mov dword [esp + 0x2c], 0x5be0cd19
call fcn.004052f0
add esp, 8
test eax, eax
jne 0x402f5f
pop edi
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.004093f5
add esp, 0x74
ret
mov eax, esi
lea edi, [esp + 8]
call fcn.00406080
mov ecx, dword [esp + 0x74]
pop edi
xor ecx, esp
mov eax, 1
call fcn.004093f5
add esp, 0x74
ret

Function at 0x403910
Capabilities:
Read file on windows

Disassembly:
push ecx
push 0
lea eax, [esp + 4]
push eax
push esi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x403942
push str.ReadFile__
push 0xfc
push str..QHImageHlp.c
xor edx, edx
call fcn.004073d0
add esp, 0xc
xor eax, eax
pop ecx
ret
cmp esi, dword [esp]
je 0x403967
push 0x42a8cc
push 0xfe
push str..QHImageHlp.c
mov edx, 1
call fcn.00407500
add esp, 0xc
xor eax, eax
pop ecx
ret
mov eax, 1
pop ecx
ret