joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002f030
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x10
mov eax, dword [0x10057bf0]
xor eax, esp
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
mov eax, dword [ecx]
cmp eax, dword [0x1005b150]
jne 0x1002f075
mov eax, dword [ecx + 4]
cmp eax, dword [0x1005b154]
jne 0x1002f075
mov dword [edx + 0x10], 1
fldz
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.1004486e
add esp, 0x10
ret 8
mov dword [edx + 0x10], 0
mov al, byte [ecx]
mov dl, byte [ecx + 1]
mov ah, byte [ecx + 3]
mov dh, byte [ecx + 4]
mov byte [esp + 3], al
mov al, byte [ecx + 6]
push ebx
mov bl, byte [ecx + 2]
mov bh, byte [ecx + 5]
mov cl, byte [ecx + 7]
mov byte [esp + 6], al
mov byte [esp + 9], al
mov al, byte [esp + 7]
mov byte [esp + 0xe], dl
mov byte [esp + 0xd], bl
mov byte [esp + 0xc], ah
mov byte [esp + 0xb], dh
mov byte [esp + 0xa], bh
mov byte [esp + 8], cl
test al, al
jns 0x1002f0c4
and al, 0x7f
jmp 0x1002f0f4
not cl
not bh
mov byte [esp + 8], cl
not dh
mov cl, byte [esp + 6]
not ah
not cl
mov byte [esp + 0xa], bh
not bl
mov byte [esp + 9], cl
not dl
mov byte [esp + 0xb], dh
mov byte [esp + 0xc], ah
not al
mov byte [esp + 0xd], bl
mov byte [esp + 0xe], dl
mov ecx, dword [esp + 0x10]
pop ebx
mov byte [esp + 0xb], al
xor ecx, esp
fld qword [esp + 4]
call fcn.1004486e
add esp, 0x10
ret 8

Function at 0x10032b00
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x10]
xorps xmm0, xmm0
mov ecx, dword [esp + 0x14]
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [esp + 0x10], 0
mov dx, word [esp + 0x10]
movq qword [eax + 3], xmm0
push ebx
mov bx, word [esp + 0xc]
push ebp
lea ebp, [eax + 3]
push esi
mov si, word [esp + 0xc]
push edi
mov di, word [esp + 0x14]
cmp ecx, 8
jl 0x10032b6a
shr ecx, 3
xor dx, word [eax]
lea eax, [eax + 8]
xor si, word [eax - 6]
xor di, word [eax - 4]
xor bx, word [eax - 2]
dec ecx
jne 0x10032b55
mov word [ebp], dx
xor eax, eax
mov word [ebp + 2], si
mov word [ebp + 4], di
pop edi
pop esi
mov word [ebp + 6], bx
pop ebp
pop ebx
add esp, 0xc
ret 8
Function at 0x10013275
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x100132b4
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100132b4
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100132b4
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x100132b4
cmp dword [ecx + 0x74], 0xe
jbe 0x100132b4
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x10015fca
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x10016067
push ebx
push esi
call fcn.10015f93
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10015f27
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10016014
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10016066
push edi
push eax
call fcn.10016f85
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10016034
call fcn.10014af1
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10016065
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10015f27
add esp, 0x20
test eax, eax
jne 0x10016053
push edi
call fcn.10014af1
jmp 0x1001605b
push ebx
call fcn.10014af1
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x100162d4
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1001e348
push 0x1001e340
push str.FlsAlloc
push 0x1f
call fcn.100161f0
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10016308
push dword [ebp + 8]
mov ecx, esi
call dword [0x1001c150]
call esi
jmp 0x1001630e
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10016352
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1001e358
push 0x1001e350
push str.FlsGetValue
push 0x21
call fcn.100161f0
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10016389
push dword [ebp + 8]
mov ecx, esi
call dword [0x1001c150]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x10016391
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1001e360
push 0x1001e358
push str.FlsSetValue
push 0x22
call fcn.100161f0
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100163cb
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1001c150]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x1001b900
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1001b92d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1001b92d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x402130
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x402149
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x402184
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x402180
lea ebx, [ebx]
cmp esi, eax
jae 0x402184
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x402170
cmp esi, eax
jb 0x40218a
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x402670
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43fa50
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4482e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.00402430
add esp, 4
test eax, eax
je 0x4026c9
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
je 0x4026de
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4026b0
cmp dword [ebp + 0x10], ebx
je 0x4026f8
mov ecx, dword [ebp + 8]
push ecx
call fcn.00402b10
add esp, 4
test eax, eax
sete al
cmp al, bl
jne 0x4026b0
mov dword [ebp - 4], ebx
mov dword [ebp + 0x10], ebx
cmp esi, ebx
je 0x402704
mov dword [esi], ebx
mov eax, dword [ebp + 8]
mov dword [ebp + 0xc], ebx
lea ebx, [ebp + 0xc]
lea edi, [ebp + 0x10]
call fcn.004025c0
test esi, esi
je 0x40271e
mov edx, dword [ebp + 0xc]
mov dword [esi], edx
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x402b10
Capabilities:
Parse pe header
Read file on windows

Disassembly:
sub esp, 0x144
mov eax, dword [0x4482e0]
xor eax, esp
mov dword [esp + 0x140], eax
mov eax, dword [esp + 0x148]
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push ebx
push 3
push ebx
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x402b64
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x140]
xor ecx, esp
call fcn.0041a78d
add esp, 0x144
ret
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea eax, [esp + 0x10]
push eax
push 0x40
lea ecx, [esp + 0x114]
push ecx
push esi
call edi
test eax, eax
je 0x402bec
cmp dword [esp + 0xc], 0x40
jne 0x402bec
mov edx, 0x5a4d
cmp word [esp + 0x108], dx
jne 0x402bec
mov eax, dword [esp + 0x144]
push 0
push 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, dword [esp + 0x144]
jne 0x402bec
push 0
lea ecx, [esp + 0x10]
push ecx
push pe_nt_image_headers32
lea edx, [esp + 0x1c]
push edx
push esi
call edi
test eax, eax
je 0x402bec
cmp dword [esp + 0xc], 0xf8
jne 0x402bec
cmp dword [esp + 0x10], 0x4550
jne 0x402bec
cmp word [esp + 0x16], bx
je 0x402bec
mov ebx, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x14c]
pop edi
pop esi
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.0041a78d
add esp, 0x144
ret

Function at 0x403160
Capabilities:
Check http status code

Disassembly:
sub esp, 0x14
push edi
xor edi, edi
mov dword [esp + 0xc], 3
mov dword [esp + 8], edi
mov dword [esp + 0x10], 4
cmp esi, edi
je 0x403259
push ebx
mov ebx, dword [sym.imp.WININET.dll_HttpSendRequestW]
push ebp
mov ebp, dword [sym.imp.WININET.dll_InternetQueryOptionW]
mov eax, dword [esp + 0x14]
mov ecx, eax
dec eax
mov dword [esp + 0x14], eax
test ecx, ecx
jle 0x403257
push 0
push 0
push 0
push 0
push esi
call ebx
mov edi, eax
test edi, edi
jne 0x403218
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x2f0d
je 0x4031c8
cmp eax, 0x2f19
jne 0x403204
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x10]
push eax
push 0x1f
push esi
mov dword [esp + 0x2c], 4
call ebp
or dword [esp + 0xc], 0x3180
push 4
lea ecx, [esp + 0x10]
push ecx
push 0x1f
push esi
call dword [sym.imp.WININET.dll_InternetSetOptionW]
push 0
push 0
push 0
push 0
push esi
call ebx
mov edi, eax
test edi, edi
jne 0x403190
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x403190
push 0
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x18]
push eax
push 0x20000013
push esi
mov dword [esp + 0x24], 0
mov dword [esp + 0x2c], 4
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
mov edi, eax
test edi, edi
je 0x403208
cmp dword [esp + 0x10], 0xc8
je 0x403257
xor edi, edi
jmp 0x403190
pop ebp
pop ebx
mov eax, edi
pop edi
add esp, 0x14
ret
Function at 0x403740
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push 0xffffffffffffffff
push 0x43f9cb
mov eax, dword fs:[0]
push eax
sub esp, 0x2c8
mov eax, dword [0x4482e0]
xor eax, esp
mov dword [esp + 0x2c0], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4482e0]
xor eax, esp
push eax
lea eax, [esp + 0x2dc]
mov dword fs:[0], eax
mov eax, dword [esp + 0x2ec]
lea ecx, [esp + 0x3c]
push ecx
push 0x202
mov dword [esp + 0x20], eax
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov eax, dword [esp + 0x3c]
cmp al, 2
jne 0x4038b6
shr eax, 8
cmp al, 2
jne 0x4038b6
push str.dl.360safe.com
call dword [sym.imp.WS2_32.dll_gethostbyname]
xor ebx, ebx
mov dword [esp + 0x1c], eax
cmp eax, ebx
jne 0x4037d2
call dword [sym.imp.WS2_32.dll_WSACleanup]
push str.pHost__NULL__n
jmp 0x4038bb
mov esi, dword [eax + 0xc]
xor ebp, ebp
cmp dword [esi], ebx
je 0x4038ae
xor edi, edi
jmp 0x4037f2
xor ebx, ebx
push 0x103
lea edx, [esp + 0x1d1]
push ebx
push edx
mov byte [esp + 0x1d8], bl
call fcn.0041a7a0
mov eax, dword [esi + edi]
mov ecx, dword [eax]
add esp, 0xc
push ecx
call dword [sym.imp.WS2_32.dll_inet_ntoa]
lea edx, [esp + 0x1cc]
mov cl, byte [eax]
mov byte [edx], cl
inc eax
inc edx
cmp cl, bl
jne 0x403822
lea eax, [esp + 0x1cc]
mov dword [esp + 0x38], 0xf
mov dword [esp + 0x34], ebx
mov byte [esp + 0x24], bl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x403846
sub eax, edx
push eax
lea edx, [esp + 0x1d0]
push edx
lea ecx, [esp + 0x28]
call fcn.00404540
lea eax, [esp + 0x20]
mov dword [esp + 0x2e4], ebx
mov ebx, dword [esp + 0x18]
push eax
call fcn.004040e0
mov dword [esp + 0x2e4], 0xffffffff
cmp dword [esp + 0x38], 0x10
jb 0x403895
mov ecx, dword [esp + 0x24]
push ecx
call fcn.0041a66e
add esp, 4
mov edx, dword [esp + 0x1c]
mov esi, dword [edx + 0xc]
inc ebp
cmp dword [esi + ebp*4], 0
lea edi, [ebp*4]
jne 0x4037f0
call dword [sym.imp.WS2_32.dll_WSACleanup]
jmp 0x4038c3
push str.init_socket_failed
call fcn.0041c66d
add esp, 4
mov ecx, dword [esp + 0x2dc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2c0]
xor ecx, esp
call fcn.0041a78d
add esp, 0x2d4
ret
Function at 0x403d20
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x43fac6
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
mov eax, dword [0x4482e0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov ebx, 1
test byte [0x44b4f4], bl
jne 0x403dae
or dword [0x44b4f4], ebx
xor eax, eax
mov dword [esp + 0x20], 0
mov ecx, 0x44b4d8
mov dword [0x44b4d8], eax
mov dword [0x44b4dc], eax
mov dword [0x44b4e0], eax
mov dword [0x44b4e4], eax
mov dword [0x44b4e8], eax
mov dword [0x44b4ec], eax
call fcn.00405b50
test eax, eax
jge 0x403d99
push eax
call fcn.00402240
push 0x43fc50
call fcn.0041b259
add esp, 4
mov dword [esp + 0x20], 0xffffffff
mov eax, 2
test byte [0x44b4f4], al
jne 0x403dd8
or dword [0x44b4f4], eax
push 0x43fc30
mov dword [0x44b4d4], 0
call fcn.0041b259
add esp, 4
push 0x44b4d8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x44b4f0], 0
jne 0x403e44
cmp dword [0x44b4d4], 0
jne 0x403e44
push str.A2CE3D3C_15E7_4985_B2C5_58F681DD07A5
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [0x44b4d4], eax
test eax, eax
jne 0x403e44
push str.A2CE3D3C_15E7_4985_B2C5_58F681DD07A5
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x44b4d4], eax
test eax, eax
jne 0x403e44
push 0x44b4d8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret
push 0x44b4d8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x44b4d4]
push 0xffffffffffffffff
push eax
mov dword [esp + 0x14], 0x44b4d4
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov byte [esp + 0x10], bl
mov dword [esp + 0x20], ebx
cmp dword [0x44b4f0], 0
jne 0x403ea4
call fcn.004038f0
mov dword [0x44b4f0], eax
test eax, eax
jne 0x403ea4
mov ecx, dword [0x44b4d4]
push ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor eax, eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [0x44b4d4]
push edx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [ebp + 8]
mov ecx, dword [0x44b4f0]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x406160
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x68
mov eax, dword [0x4482e0]
xor eax, esp
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x6c]
xor ecx, ecx
push esi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], ecx
push eax
mov eax, dword [esp + 0x78]
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.0040c220
add esp, 4
lea esi, [esp + 8]
mov ecx, edi
call fcn.0040c2c0
mov ecx, dword [esp + 0x64]
pop esi
xor ecx, esp
call fcn.0041a78d
add esp, 0x68
ret
Function at 0x4061d0
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x68
mov eax, dword [0x4482e0]
xor eax, esp
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x6c]
xor ecx, ecx
push esi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], ecx
push eax
mov eax, dword [esp + 0x78]
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.0040c220
add esp, 4
lea esi, [esp + 8]
mov ecx, edi
call fcn.0040c2c0
mov ecx, dword [esp + 0x64]
pop esi
xor ecx, esp
call fcn.0041a78d
add esp, 0x68
ret
Function at 0x406340
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov esi, eax
lea eax, [esp + 0x18]
push eax
push 0x20119
xor edi, edi
push edi
push str.SOFTWARE360MachineSignature
push SysStringLen
mov ebx, ecx
mov dword [esp + 0x30], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4064d1
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
lea ecx, [esp + 0x10]
push ecx
mov dword [esi + 0x10], eax
push ebx
mov dword [esi + 0x14], eax
lea edx, [esp + 0x1c]
push edx
mov dword [esi + 0x18], eax
push eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov eax, dword [esp + 0x28]
push str.Operator
mov edi, 0x400
push eax
mov dword [esp + 0x28], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4063d3
cmp dword [esp + 0x14], 1
jne 0x4064b8
mov eax, dword [esp + 0x10]
sub edi, eax
mov dword [esi], ebx
lea ebx, [eax + ebx]
je 0x4064b8
mov eax, dword [esp + 0x18]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [esp + 0x10]
push ecx
push ebx
lea edx, [esp + 0x1c]
push edx
push 0
push str.IssueDate
push eax
mov dword [esp + 0x28], edi
call ebp
test eax, eax
jne 0x406418
cmp dword [esp + 0x14], 1
jne 0x4064b8
mov eax, dword [esp + 0x10]
mov dword [esi + 4], ebx
sub edi, eax
add ebx, eax
test edi, edi
je 0x4064b8
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x10]
push ecx
push ebx
lea edx, [esp + 0x1c]
push edx
push 0
push str.ExpirationDate
push eax
mov dword [esp + 0x28], edi
call ebp
test eax, eax
jne 0x40644f
cmp dword [esp + 0x14], 1
jne 0x4064b8
mov eax, dword [esp + 0x10]
mov dword [esi + 8], ebx
sub edi, eax
add ebx, eax
test edi, edi
je 0x4064b8
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x10]
push ecx
push ebx
lea edx, [esp + 0x1c]
push edx
push 0
push str.SignData
push eax
mov dword [esp + 0x28], edi
call ebp
test eax, eax
jne 0x4064b8
cmp dword [esp + 0x14], 3
jne 0x4064b8
mov eax, dword [esp + 0x10]
sub edi, eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], ebx
je 0x4064b8
lea eax, [esi + 0xc]
call fcn.00406240
test eax, eax
je 0x4064b8
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov ecx, 0x400
sub ecx, edi
push eax
mov dword [edx], ecx
mov esi, 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x406a60
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x6c
mov eax, dword [0x4482e0]
xor eax, esp
mov dword [esp + 0x68], eax
push esi
lea eax, [esp + 8]
mov esi, edx
push eax
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x18], 0x67452301
mov dword [esp + 0x1c], 0xefcdab89
mov dword [esp + 0x20], 0x98badcfe
mov dword [esp + 0x24], 0x10325476
call fcn.0040a0f0
add esp, 8
test eax, eax
jne 0x406acb
pop esi
mov ecx, dword [esp + 0x68]
xor ecx, esp
call fcn.0041a78d
add esp, 0x6c
ret
mov eax, dword [esp + 0x74]
test eax, eax
jbe 0x406ae0
push esi
lea ecx, [esp + 0x14]
call fcn.0040c220
add esp, 4
lea esi, [esp + 0x10]
mov ecx, ebx
call fcn.0040c2c0
test edi, edi
je 0x406afe
mov ecx, dword [esp + 0xc]
xor eax, eax
cmp ecx, dword [esp + 8]
sete al
mov dword [edi], eax
mov ecx, dword [esp + 0x6c]
pop esi
xor ecx, esp
mov eax, 1
call fcn.0041a78d
add esp, 0x6c
ret

Function at 0x406b60
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x64
mov eax, dword [0x4482e0]
xor eax, esp
mov dword [esp + 0x5c], eax
xor eax, eax
push esi
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
push edi
lea eax, [esp + 8]
mov edi, ecx
push eax
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.0040a2e0
add esp, 4
test eax, eax
jne 0x406bbe
pop edi
pop esi
mov ecx, dword [esp + 0x5c]
xor ecx, esp
call fcn.0041a78d
add esp, 0x64
ret
lea esi, [esp + 8]
mov ecx, ebx
call fcn.0040c2c0
mov ecx, dword [esp + 0x64]
pop edi
pop esi
xor ecx, esp
mov eax, 1
call fcn.0041a78d
add esp, 0x64
ret

Function at 0x406be0
Capabilities:
Hash data using sha256

Disassembly:
sub esp, 0x74
mov eax, dword [0x4482e0]
xor eax, esp
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x78]
xor ecx, ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ecx
push edi
lea ecx, [esp + 8]
push ecx
push eax
mov dword [esp + 0x10], 0x6a09e667
mov dword [esp + 0x14], 0xbb67ae85
mov dword [esp + 0x18], 0x3c6ef372
mov dword [esp + 0x1c], 0xa54ff53a
mov dword [esp + 0x20], 0x510e527f
mov dword [esp + 0x24], 0x9b05688c
mov dword [esp + 0x28], 0x1f83d9ab
mov dword [esp + 0x2c], 0x5be0cd19
call fcn.0040a3c0
add esp, 8
test eax, eax
jne 0x406c5f
pop edi
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.0041a78d
add esp, 0x74
ret
mov eax, esi
lea edi, [esp + 8]
call fcn.0040b8d0
mov ecx, dword [esp + 0x74]
pop edi
xor ecx, esp
mov eax, 1
call fcn.0041a78d
add esp, 0x74
ret

Function at 0x408290
Capabilities:
Read file on windows

Disassembly:
push ecx
push 0
lea eax, [esp + 4]
push eax
push esi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4082bb
push 0x444b58
mov eax, 0x444b58
call fcn.0040cee0
add esp, 4
xor eax, eax
pop ecx
ret
mov eax, 1
cmp esi, dword [esp]
je 0x4082d4
push 0x444b58
call fcn.0040d190
add esp, 4
xor eax, eax
pop ecx
ret
Function at 0x4090a0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x28
mov eax, dword [0x4482e0]
xor eax, esp
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x38]
push ebx
push ebp
xor ebx, ebx
push esi
mov esi, ecx
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], ebx
cmp eax, ebx
jne 0x4090d3
mov dword [esp + 0x10], 0xffffffff
jmp 0x4090d9
mov eax, dword [eax]
mov dword [esp + 0x10], eax
mov ebp, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
push ebx
push ebx
push ebp
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x409107
push 0x444b58
mov eax, 0x444b58
call fcn.0040cee0
add esp, 4
jmp 0x4091e7
push 0
lea edx, [esp + 0x1c]
push edx
push 8
lea eax, [esp + 0x30]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x409137
push 0x444b58
mov eax, 0x444b58
call fcn.0040cee0
add esp, 4
jmp 0x4091e7
mov eax, 8
cmp dword [esp + 0x18], eax
je 0x409159
mov eax, 1
push 0x444b58
call fcn.0040d190
add esp, 4
jmp 0x4091e7
cmp dword [esp + 0x40], ebx
je 0x409195
mov ebx, eax
cmp dword [esp + 0x10], eax
jae 0x40917b
mov eax, 5
push 0x444b58
call fcn.0040d190
add esp, 4
jmp 0x4091e7
mov ecx, dword [esp + 0x24]
mov dx, word [esp + 0x28]
mov dword [esi], ecx
mov cx, word [esp + 0x2a]
mov word [esi + 4], dx
mov word [esi + 6], cx
jmp 0x4091df
mov esi, dword [esp + 0x24]
cmp esi, dword [esp + 0x10]
jbe 0x4091a3
mov ebx, esi
jmp 0x409167
mov edx, dword [esp + 0x38]
xor ebx, ebx
push ebx
push ebx
push ebp
push edx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x4091cc
push 0x444b58
mov eax, 0x444b58
call fcn.0040cee0
add esp, 4
jmp 0x4091e7
mov ecx, dword [esp + 0x20]
mov edx, edi
call fcn.00408290
test eax, eax
je 0x4091e7
mov ebx, dword [esp + 0x24]
mov dword [esp + 0x14], 1
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x4091f1
mov dword [eax], ebx
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x14]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0041a78d
add esp, 0x28
ret