joyce8/EMBER2024-capa huggingface dataset:
Function at 0x460d00
Capabilities:
Enumerate pe sections

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, edx
test esi, esi
je 0x460e57
test edi, edi
je 0x460e57
mov ecx, dword [esi + 0x1c]
cmp ecx, 0x40
jb 0x460d26
pop edi
mov eax, 0xfffffffe
pop esi
ret
lea eax, [ecx*8]
add dword [esi], eax
adc dword [esi + 4], 0
mov byte [ecx + esi + 0x20], 0x80
inc dword [esi + 0x1c]
mov eax, dword [esi + 0x1c]
cmp eax, 0x38
jbe 0x460d73
cmp eax, 0x40
jae 0x460d60
nop dword [eax + eax]
mov byte [eax + esi + 0x20], 0
inc dword [esi + 0x1c]
mov eax, dword [esi + 0x1c]
cmp eax, 0x40
jb 0x460d50
lea edx, [esi + 0x20]
mov ecx, esi
call fcn.004607a0
mov dword [esi + 0x1c], 0
jmp 0x460d75
jae 0x460d86
mov eax, dword [esi + 0x1c]
mov byte [eax + esi + 0x20], 0
inc dword [esi + 0x1c]
cmp dword [esi + 0x1c], 0x38
jb 0x460d75
movzx eax, byte [esi + 7]
lea edx, [esi + 0x20]
mov byte [esi + 0x58], al
mov ecx, esi
movzx eax, byte [esi + 6]
mov byte [esi + 0x59], al
movzx eax, byte [esi + 5]
mov byte [esi + 0x5a], al
movzx eax, byte [esi + 4]
mov byte [esi + 0x5b], al
movzx eax, byte [esi + 3]
mov byte [esi + 0x5c], al
movzx eax, byte [esi + 2]
mov byte [esi + 0x5d], al
movzx eax, byte [esi + 1]
mov byte [esi + 0x5e], al
movzx eax, byte [esi]
mov byte [esi + 0x5f], al
call fcn.004607a0
movzx eax, byte [esi + 0xb]
mov byte [edi], al
movzx eax, byte [esi + 0xa]
mov byte [edi + 1], al
movzx eax, byte [esi + 9]
mov byte [edi + 2], al
movzx eax, byte [esi + 8]
mov byte [edi + 3], al
movzx eax, byte [esi + 0xf]
mov byte [edi + 4], al
movzx eax, byte [esi + 0xe]
mov byte [edi + 5], al
movzx eax, byte [esi + 0xd]
mov byte [edi + 6], al
movzx eax, byte [esi + 0xc]
mov byte [edi + 7], al
movzx eax, byte [esi + 0x13]
mov byte [edi + 8], al
movzx eax, byte [esi + 0x12]
mov byte [edi + 9], al
movzx eax, byte [esi + 0x11]
mov byte [edi + 0xa], al
movzx eax, byte [esi + 0x10]
mov byte [edi + 0xb], al
movzx eax, byte [esi + 0x17]
mov byte [edi + 0xc], al
movzx eax, byte [esi + 0x16]
mov byte [edi + 0xd], al
movzx eax, byte [esi + 0x15]
mov byte [edi + 0xe], al
movzx eax, byte [esi + 0x14]
mov byte [edi + 0xf], al
movzx eax, byte [esi + 0x1b]
mov byte [edi + 0x10], al
movzx eax, byte [esi + 0x1a]
mov byte [edi + 0x11], al
movzx eax, byte [esi + 0x19]
mov byte [edi + 0x12], al
movzx eax, byte [esi + 0x18]
mov byte [edi + 0x13], al
xor eax, eax
pop edi
pop esi
ret
pop edi
or eax, 0xffffffff
pop esi
ret

Function at 0x460f40
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x6c
mov eax, dword [0x68f014]
xor eax, esp
mov dword [esp + 0x68], eax
push esi
mov esi, dword [ebp + 8]
xorps xmm0, xmm0
push edx
mov edx, ecx
mov dword [esp + 0x14], 0x67452301
lea ecx, [esp + 0xc]
mov dword [esp + 0x18], 0xefcdab89
mov dword [esp + 0x1c], 0x98badcfe
mov dword [esp + 0x20], 0x10325476
mov dword [esp + 0x24], 0xc3d2e1f0
mov dword [esp + 0x28], 0
movlpd qword [esp + 0xc], xmm0
call fcn.00460e60
add esp, 4
test eax, eax
jne 0x460faf
mov edx, esi
lea ecx, [esp + 8]
call fcn.00460d00
mov ecx, dword [esp + 0x6c]
pop esi
xor ecx, esp
call fcn.005cf250
mov esp, ebp
pop ebp
ret
Function at 0x4624d0
Capabilities:
Encode data using xor
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x374
mov eax, dword [0x68f014]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x36c], ecx
mov dword [ebp - 0x370], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ecx, ecx
je 0x46276e
test eax, eax
je 0x46276e
mov dword [eax], 0
cmp byte [ebx + 0xff], 0xbc
jne 0x462758
mov ecx, 0x3a
lea edi, [ebp - 0x108]
mov esi, ebx
mov eax, ebx
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x308]
mov edx, 0x14
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov esi, ecx
sub eax, esi
lea esi, [eax + 0xeb]
mov al, byte [esi + ecx]
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
sub edx, 1
jne 0x462544
test byte [ebx], 0x80
jne 0x462758
lea eax, [ebp - 0x208]
mov edx, 0x14
push 0xeb
push eax
lea ecx, [ebp - 0x308]
call fcn.00466450
add esp, 8
test eax, eax
jne 0x462773
nop dword [eax]
nop word [eax + eax]
movups xmm0, xmmword [ebp + eax - 0x108]
movups xmm1, xmmword [ebp + eax - 0x208]
pxor xmm1, xmm0
movups xmmword [ebp + eax - 0x108], xmm1
movups xmm0, xmmword [ebp + eax - 0xf8]
movups xmm1, xmmword [ebp + eax - 0x1f8]
pxor xmm1, xmm0
movups xmmword [ebp + eax - 0xf8], xmm1
movups xmm0, xmmword [ebp + eax - 0xe8]
movups xmm1, xmmword [ebp + eax - 0x1e8]
pxor xmm1, xmm0
movups xmmword [ebp + eax - 0xe8], xmm1
movups xmm0, xmmword [ebp + eax - 0xd8]
movups xmm1, xmmword [ebp + eax - 0x1d8]
pxor xmm1, xmm0
movups xmmword [ebp + eax - 0xd8], xmm1
add eax, 0x40
cmp eax, 0xc0
jb 0x462590
cmp eax, 0xeb
jae 0x462627
mov cl, byte [ebp + eax - 0x208]
xor byte [ebp + eax - 0x108], cl
inc eax
cmp eax, 0xeb
jb 0x462611
and byte [ebp - 0x108], 0x7f
xor esi, esi
cmp byte [ebp + esi - 0x108], 0
jne 0x462758
inc esi
cmp esi, 0xd6
jb 0x462630
cmp byte [ebp + esi - 0x108], 1
jne 0x462758
xorps xmm0, xmm0
mov dword [ebp - 0x360], 0x67452301
push 8
lea edx, [ebp - 0x208]
mov dword [ebp - 0x35c], 0xefcdab89
lea ecx, [ebp - 0x368]
mov dword [ebp - 0x358], 0x98badcfe
mov dword [ebp - 0x354], 0x10325476
mov dword [ebp - 0x350], 0xc3d2e1f0
mov dword [ebp - 0x34c], 0
movlpd qword [ebp - 0x368], xmm0
movq qword [ebp - 0x208], xmm0
call fcn.00460e60
add esp, 4
test eax, eax
jne 0x462773
mov edx, dword [ebp - 0x36c]
lea ecx, [ebp - 0x368]
push 0x14
call fcn.00460e60
add esp, 4
test eax, eax
jne 0x462773
lea edx, [ebp - 0x107]
push 0x14
add edx, esi
lea ecx, [ebp - 0x368]
call fcn.00460e60
add esp, 4
test eax, eax
jne 0x462773
lea edx, [ebp - 0x208]
lea ecx, [ebp - 0x368]
call fcn.00460d00
test eax, eax
jne 0x462773
mov esi, 0x14
xor edx, edx
nop dword [eax + eax]
mov al, byte [ebp + edx - 0x208]
lea ecx, [ebp - 0x308]
add ecx, edx
dec esi
inc edx
cmp al, byte [ecx]
jne 0x462745
test esi, esi
jne 0x462720
mov eax, dword [ebp - 0x370]
mov dword [eax], 1
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005cf250
mov esp, ebp
pop ebp
ret
mov eax, 7
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005cf250
mov esp, ebp
pop ebp
ret
mov eax, 0x10
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005cf250
mov esp, ebp
pop ebp
ret
Function at 0x4641f0
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xfc
mov eax, dword [0x68f014]
xor eax, esp
mov dword [esp + 0xf8], eax
add dword [0x6b14f8], 1
lea ecx, [esp + 4]
push ebx
adc dword [0x6b14fc], 0
xorps xmm0, xmm0
push esi
push edi
push 0x20
mov edx, 0x6b14bc
mov dword [esp + 0x3c], 0
movlpd qword [esp + 0x14], xmm0
mov dword [esp + 0x1c], 0x6a09e667
mov dword [esp + 0x20], 0xbb67ae85
mov dword [esp + 0x24], 0x3c6ef372
mov dword [esp + 0x28], 0xa54ff53a
mov dword [esp + 0x2c], 0x510e527f
mov dword [esp + 0x30], 0x9b05688c
mov dword [esp + 0x34], 0x1f83d9ab
mov dword [esp + 0x38], 0x5be0cd19
call fcn.0045e940
mov esi, eax
add esp, 4
test esi, esi
je 0x4642ac
lea edx, [esp + 0x80]
lea ecx, [esp + 0x10]
call fcn.0045ea30
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xf8]
xor ecx, esp
call fcn.005cf250
mov esp, ebp
pop ebp
ret
xor edi, edi
mov esi, 0x6b04d8
test edi, edi
je 0x4642d3
mov eax, dword [0x6b14f8]
lea ecx, [edi - 1]
mov edx, dword [0x6b14fc]
call fcn.005f6d00
and eax, 1
xor edx, edx
or eax, edx
jne 0x46431f
lea edx, [esp + 0x80]
mov ecx, esi
call fcn.0045ea30
mov ebx, eax
lea edx, [esp + 0x80]
lea ecx, [esp + 0x10]
test ebx, ebx
jne 0x464386
push 0x20
call fcn.0045e940
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x46437b
mov ecx, esi
call fcn.0045e8e0
mov ebx, eax
test ebx, ebx
jne 0x46437b
add esi, 0x70
inc edi
cmp esi, 0x6b12d8
jl 0x4642b3
mov edx, 0x6b14bc
lea ecx, [esp + 0x10]
call fcn.0045ea30
test eax, eax
jne 0x46438d
push 0x6b12d8
push eax
lea edx, [eax + 0x20]
mov ecx, 0x6b14bc
call fcn.0045f610
add esp, 8
test eax, eax
jne 0x46438d
call fcn.004641c0
mov dword [0x6b14f0], 0
xor eax, eax
mov dword [0x6b14f4], 0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xf8]
xor ecx, esp
call fcn.005cf250
mov esp, ebp
pop ebp
ret
lea ecx, [esp + 0x10]
lea edx, [esp + 0x80]
call fcn.0045ea30
mov eax, ebx
mov ecx, dword [esp + 0x104]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.005cf250
mov esp, ebp
pop ebp
ret
Function at 0x4643b0
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [0x68f014]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor esi, esi
mov eax, 0x6b04e0
nop dword [eax]
lea ecx, [eax - 8]
test ecx, ecx
je 0x4644d6
mov dword [eax + 0x20], 0
inc esi
mov dword [eax - 8], 0
mov dword [eax - 4], 0
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
add eax, 0x70
cmp eax, 0x6b12e0
jl 0x4643d0
xorps xmm0, xmm0
mov dword [0x6b14f4], 0
push 0x6b12d8
push 0
mov edx, 0x20
mov dword [0x6b14f0], 0
mov ecx, 0x6b14bc
mov dword [0x6b14ec], 0
movlpd qword [0x6b14f8], xmm0
movups xmmword [0x6b14bc], xmm0
movups xmmword [0x6b14cc], xmm0
call fcn.0045f610
mov edi, eax
add esp, 8
test edi, edi
je 0x4644ba
mov esi, 0x6b04d8
nop dword [eax]
lea edx, [ebp - 0x84]
mov ecx, esi
call fcn.0045ea30
add esi, 0x70
cmp esi, 0x6b12d8
jl 0x464490
mov eax, edi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005cf250
mov esp, ebp
pop ebp
ret
xorps xmm0, xmm0
xor eax, eax
pop edi
movups xmmword [0x6b14dc], xmm0
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005cf250
mov esp, ebp
pop ebp
ret
test esi, esi
jle 0x4644f5
mov edi, 0x6b04d8
nop
lea edx, [ebp - 0x84]
mov ecx, edi
call fcn.0045ea30
add edi, 0x70
sub esi, 1
jne 0x4644e0
mov ecx, dword [ebp - 4]
mov eax, 0x10
pop edi
xor ecx, ebp
pop esi
call fcn.005cf250
mov esp, ebp
pop ebp
ret
Function at 0x465d40
Capabilities:
Encode data using xor
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x380
mov eax, dword [0x68f014]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
push edi
test esi, esi
je 0x465f88
test ebx, ebx
je 0x465f88
lea eax, [ebp - 0x1c]
push 0x14
push eax
call fcn.0045f370
add esp, 8
test eax, eax
je 0x465d93
mov eax, 9
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.005cf250
mov esp, ebp
pop ebp
ret
xorps xmm0, xmm0
mov dword [ebp - 0x374], 0x67452301
push 8
lea edx, [ebp - 0x11c]
mov dword [ebp - 0x370], 0xefcdab89
lea ecx, [ebp - 0x37c]
mov dword [ebp - 0x36c], 0x98badcfe
mov dword [ebp - 0x368], 0x10325476
mov dword [ebp - 0x364], 0xc3d2e1f0
mov dword [ebp - 0x360], 0
movlpd qword [ebp - 0x37c], xmm0
movq qword [ebp - 0x11c], xmm0
call fcn.00460e60
add esp, 4
test eax, eax
jne 0x465f8d
push 0x14
mov edx, esi
lea ecx, [ebp - 0x37c]
call fcn.00460e60
add esp, 4
test eax, eax
jne 0x465f8d
push 0x14
lea edx, [ebp - 0x1c]
lea ecx, [ebp - 0x37c]
call fcn.00460e60
add esp, 4
test eax, eax
jne 0x465f8d
lea edx, [ebp - 0x31c]
lea ecx, [ebp - 0x37c]
call fcn.00460d00
test eax, eax
jne 0x465f8d
push 0xd6
push eax
lea eax, [ebp - 0x11c]
push eax
call fcn.005d1880
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 0x31c]
movups xmm0, xmmword [ebp - 0x1c]
add esp, 0xc
mov dword [ebp - 0x35], eax
lea eax, [ebp - 0x21c]
mov byte [ebp - 0x46], 1
mov edx, 0x14
movups xmmword [ebp - 0x45], xmm0
push 0xeb
push eax
call fcn.00466450
add esp, 8
test eax, eax
jne 0x465f8d
nop dword [eax]
movups xmm0, xmmword [ebp + eax - 0x11c]
movups xmm1, xmmword [ebp + eax - 0x21c]
pxor xmm1, xmm0
movups xmmword [ebp + eax - 0x11c], xmm1
movups xmm0, xmmword [ebp + eax - 0x10c]
movups xmm1, xmmword [ebp + eax - 0x20c]
pxor xmm1, xmm0
movups xmmword [ebp + eax - 0x10c], xmm1
movups xmm0, xmmword [ebp + eax - 0xfc]
movups xmm1, xmmword [ebp + eax - 0x1fc]
pxor xmm1, xmm0
movups xmmword [ebp + eax - 0xfc], xmm1
movups xmm0, xmmword [ebp + eax - 0xec]
movups xmm1, xmmword [ebp + eax - 0x1ec]
pxor xmm1, xmm0
movups xmmword [ebp + eax - 0xec], xmm1
add eax, 0x40
cmp eax, 0xc0
jb 0x465ea0
cmp eax, 0xeb
jae 0x465f37
mov cl, byte [ebp + eax - 0x21c]
xor byte [ebp + eax - 0x11c], cl
inc eax
cmp eax, 0xeb
jb 0x465f21
mov ecx, 0x3a
lea esi, [ebp - 0x11c]
mov edi, ebx
mov edx, 0x14
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [ebx + 0xeb]
lea esi, [ebp - 0x31c]
mov ecx, edi
sub esi, edi
nop
mov al, byte [esi + ecx]
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
sub edx, 1
jne 0x465f60
mov byte [edi + 0x14], 0xbc
and byte [ebx], 0x7f
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.005cf250
mov esp, ebp
pop ebp
ret
mov eax, 0x10
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005cf250
mov esp, ebp
pop ebp
ret
Function at 0x465fa0
Capabilities:
Encode data using xor
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3a0
mov eax, dword [0x68f014]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
push edi
test esi, esi
je 0x466208
test ebx, ebx
je 0x466208
lea eax, [ebp - 0x28]
push 0x20
push eax
call fcn.0045f370
add esp, 8
test eax, eax
je 0x465ff3
mov eax, 9
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.005cf250
mov esp, ebp
pop ebp
ret
xorps xmm0, xmm0
mov dword [ebp - 0x374], 0
push 8
lea edx, [ebp - 0x12c]
movlpd qword [ebp - 0x39c], xmm0
lea ecx, [ebp - 0x39c]
mov dword [ebp - 0x394], 0x6a09e667
mov dword [ebp - 0x390], 0xbb67ae85
mov dword [ebp - 0x38c], 0x3c6ef372
mov dword [ebp - 0x388], 0xa54ff53a
mov dword [ebp - 0x384], 0x510e527f
mov dword [ebp - 0x380], 0x9b05688c
mov dword [ebp - 0x37c], 0x1f83d9ab
mov dword [ebp - 0x378], 0x5be0cd19
movq qword [ebp - 0x12c], xmm0
call fcn.0045e940
add esp, 4
test eax, eax
jne 0x46620d
push 0x20
mov edx, esi
lea ecx, [ebp - 0x39c]
call fcn.0045e940
add esp, 4
test eax, eax
jne 0x46620d
push 0x20
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x39c]
call fcn.0045e940
add esp, 4
test eax, eax
jne 0x46620d
lea edx, [ebp - 0x32c]
lea ecx, [ebp - 0x39c]
call fcn.0045ea30
test eax, eax
jne 0x46620d
push 0xbe
push eax
lea eax, [ebp - 0x12c]
push eax
call fcn.005d1880
movups xmm0, xmmword [ebp - 0x28]
add esp, 0xc
mov byte [ebp - 0x6e], 1
lea eax, [ebp - 0x22c]
movups xmmword [ebp - 0x6d], xmm0
lea ecx, [ebp - 0x32c]
movups xmm0, xmmword [ebp - 0x18]
push 0xdf
push eax
movups xmmword [ebp - 0x5d], xmm0
call fcn.00466570
add esp, 8
test eax, eax
jne 0x46620d
nop word [eax + eax]
movups xmm0, xmmword [ebp + eax - 0x12c]
movups xmm1, xmmword [ebp + eax - 0x22c]
pxor xmm1, xmm0
movups xmmword [ebp + eax - 0x12c], xmm1
movups xmm0, xmmword [ebp + eax - 0x11c]
movups xmm1, xmmword [ebp + eax - 0x21c]
pxor xmm1, xmm0
movups xmmword [ebp + eax - 0x11c], xmm1
movups xmm0, xmmword [ebp + eax - 0x10c]
movups xmm1, xmmword [ebp + eax - 0x20c]
pxor xmm1, xmm0
movups xmmword [ebp + eax - 0x10c], xmm1
movups xmm0, xmmword [ebp + eax - 0xfc]
movups xmm1, xmmword [ebp + eax - 0x1fc]
pxor xmm1, xmm0
movups xmmword [ebp + eax - 0xfc], xmm1
add eax, 0x40
cmp eax, 0xc0
jb 0x466120
cmp eax, 0xdf
jae 0x4661b7
mov cl, byte [ebp + eax - 0x22c]
xor byte [ebp + eax - 0x12c], cl
inc eax
cmp eax, 0xdf
jb 0x4661a1
mov ecx, 0x37
lea esi, [ebp - 0x12c]
mov edi, ebx
mov edx, 0x20
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [ebx + 0xdf]
lea esi, [ebp - 0x32c]
mov ecx, edi
sub esi, edi
nop
mov al, byte [esi + ecx]
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
sub edx, 1
jne 0x4661e0
mov byte [edi + 0x20], 0xbc
and byte [ebx], 0x7f
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.005cf250
mov esp, ebp
pop ebp
ret
mov eax, 0x10
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005cf250
mov esp, ebp
pop ebp
ret
Function at 0x466450
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [0x68f014]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x80], edx
mov dword [ebp - 0x7c], ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
test ecx, ecx
je 0x466552
test esi, esi
je 0x466552
mov edi, dword [ebp + 0xc]
xor ebx, ebx
test edi, edi
je 0x46653f
nop dword [eax]
mov eax, ebx
mov byte [ebp - 0x15], bl
shr eax, 0x18
xorps xmm0, xmm0
mov byte [ebp - 0x18], al
mov eax, ebx
shr eax, 0x10
mov byte [ebp - 0x17], al
mov eax, ebx
push edx
shr eax, 8
mov edx, ecx
lea ecx, [ebp - 0x78]
mov byte [ebp - 0x16], al
inc ebx
mov dword [ebp - 0x70], 0x67452301
mov dword [ebp - 0x6c], 0xefcdab89
mov dword [ebp - 0x68], 0x98badcfe
mov dword [ebp - 0x64], 0x10325476
mov dword [ebp - 0x60], 0xc3d2e1f0
mov dword [ebp - 0x5c], 0
movlpd qword [ebp - 0x78], xmm0
call fcn.00460e60
add esp, 4
test eax, eax
jne 0x466557
push 4
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x78]
call fcn.00460e60
add esp, 4
test eax, eax
jne 0x466557
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x78]
call fcn.00460d00
test eax, eax
jne 0x466557
lea edx, [ebp - 0x18]
xor ecx, ecx
sub edx, esi
nop word [eax + eax]
test edi, edi
je 0x46653f
mov al, byte [edx + esi]
inc ecx
mov byte [esi], al
dec edi
inc esi
cmp ecx, 0x14
jb 0x466520
mov ecx, dword [ebp - 0x7c]
mov edx, dword [ebp - 0x80]
test edi, edi
jne 0x466490
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005cf250
mov esp, ebp
pop ebp
ret
mov eax, 0x10
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005cf250
mov esp, ebp
pop ebp
ret
Function at 0x466570
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
mov eax, dword [0x68f014]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x9c], ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
test ecx, ecx
je 0x46669a
test esi, esi
je 0x46669a
mov edi, dword [ebp + 0xc]
xor ebx, ebx
test edi, edi
je 0x466687
nop dword [eax]
mov eax, ebx
mov byte [ebp - 0x21], bl
shr eax, 0x18
xorps xmm0, xmm0
mov byte [ebp - 0x24], al
mov edx, ecx
mov eax, ebx
mov dword [ebp - 0x70], 0
shr eax, 0x10
lea ecx, [ebp - 0x98]
mov byte [ebp - 0x23], al
mov eax, ebx
shr eax, 8
inc ebx
push 0x20
mov byte [ebp - 0x22], al
movlpd qword [ebp - 0x98], xmm0
mov dword [ebp - 0x90], 0x6a09e667
mov dword [ebp - 0x8c], 0xbb67ae85
mov dword [ebp - 0x88], 0x3c6ef372
mov dword [ebp - 0x84], 0xa54ff53a
mov dword [ebp - 0x80], 0x510e527f
mov dword [ebp - 0x7c], 0x9b05688c
mov dword [ebp - 0x78], 0x1f83d9ab
mov dword [ebp - 0x74], 0x5be0cd19
call fcn.0045e940
add esp, 4
test eax, eax
jne 0x46669f
push 4
lea edx, [ebp - 0x24]
lea ecx, [ebp - 0x98]
call fcn.0045e940
add esp, 4
test eax, eax
jne 0x46669f
lea edx, [ebp - 0x24]
lea ecx, [ebp - 0x98]
call fcn.0045ea30
test eax, eax
jne 0x46669f
lea edx, [ebp - 0x24]
xor ecx, ecx
sub edx, esi
test edi, edi
je 0x466687
mov al, byte [edx + esi]
inc ecx
mov byte [esi], al
dec edi
inc esi
cmp ecx, 0x20
jb 0x466668
mov ecx, dword [ebp - 0x9c]
test edi, edi
jne 0x4665b0
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005cf250
mov esp, ebp
pop ebp
ret
mov eax, 0x10
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005cf250
mov esp, ebp
pop ebp
ret

Function at 0x46ff34
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
push edi
cmp dword [ecx + 0x58], esi
je 0x46ff87
push esi
push dword [ebp + 8]
call fcn.0047011d
mov edi, eax
test edi, edi
je 0x46ff82
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x46ff82
mov eax, dword [ebp - 8]
jmp 0x46ff99
mov eax, dword [ebp + 0x10]
jmp 0x46ff99
push dword [ecx + 0x6c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
pop edi
pop esi
leave
ret 0xc
Function at 0x4719cc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor edi, edi
mov eax, ecx
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], edi
je 0x471a11
call fcn.00475775
push 0xf0
push dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x471a0e
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x471a58
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov eax, dword [ebp - 4]
push ebx
xor ebx, ebx
inc ebx
test edi, edi
je 0x471a34
mov ecx, dword [eax]
push dword [ebp + 0x10]
push edi
mov esi, dword [ecx + 0x20]
mov ecx, esi
push dword [ebp + 8]
call dword [0x60fae8]
mov ecx, dword [ebp - 4]
call esi
mov ebx, eax
mov eax, dword [ebp + 8]
mov edi, dword [eax + 0x70]
test edi, edi
je 0x471a55
mov edx, dword [edi]
push dword [ebp + 0x10]
mov esi, dword [edx + 0xa0]
mov ecx, esi
call dword [0x60fae8]
mov ecx, edi
call esi
mov eax, ebx
pop ebx
pop edi
pop esi
leave
ret 0xc

Function at 0x474f10
Capabilities:
Delete registry key

Disassembly:
push 8
mov eax, 0x5fc120
call fcn.005cfa7d
push dword [ebp + 0xc]
lea ecx, [ebp - 0x10]
call fcn.0040d060
and dword [ebp - 4], 0
mov esi, dword [ebp + 8]
cmp esi, 0x80000000
jne 0x474f72
call fcn.004757c3
cmp eax, 1
jne 0x474f72
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push str.SoftwareClasses_
push eax
call fcn.0047414f
add esp, 0xc
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.0040b6a0
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 0
lea ecx, [ecx - 0x10]
call fcn.004062b0
inc esi
push dword [ebp - 0x10]
mov ecx, dword [ebp + 0x10]
push esi
test ecx, ecx
je 0x474f84
call fcn.004746f5
jmp 0x474f8a
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ecx, dword [ebp - 0x10]
mov esi, eax
lea ecx, [ecx - 0x10]
call fcn.004062b0
mov eax, esi
call fcn.005cfa4b
ret 0xc

Function at 0x47503b
Capabilities:
Query or enumerate registry value

Disassembly:
push 8
mov eax, 0x5fc120
call fcn.005cfa7d
push dword [ebp + 0xc]
lea ecx, [ebp - 0x10]
call fcn.0040d060
and dword [ebp - 4], 0
mov esi, dword [ebp + 8]
cmp esi, 0x80000000
jne 0x475099
call fcn.004757c3
cmp eax, 1
jne 0x475099
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push str.SoftwareClasses_
push eax
call fcn.0047414f
add esp, 0xc
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.0040b6a0
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.004062b0
inc esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 0x10]
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
mov ecx, dword [ebp - 0x10]
mov esi, eax
add ecx, 0xfffffff0
call fcn.004062b0
mov eax, esi
call fcn.005cfa4b
ret 0x10