joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4069d0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x48d928
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push esi
push edi
mov eax, dword [0x4b1d00]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionProfileList
lea ecx, [esp + 0x18]
call fcn.00404be0
mov dword [esp + 0x40], 0
mov eax, dword [0x4b84ac]
mov edx, dword [eax + 0xc]
mov ecx, 0x4b84ac
call edx
lea esi, [eax + 0x10]
mov dword [esp + 0x1c], esi
mov eax, dword [esp + 0x4c]
push eax
push 0
push ecx
mov byte [esp + 0x4c], 1
mov ecx, esp
mov dword [esp + 0x2c], esp
push 0x49a7e4
call fcn.00404be0
push 0x499254
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x2c]
push edx
mov byte [esp + 0x58], 2
call fcn.00404cd0
mov edx, dword [esp + 0x60]
add esp, 8
mov ecx, esp
mov dword [esp + 0x34], esp
push edx
push eax
push ecx
mov byte [esp + 0x5c], 3
call fcn.0040a5e0
add esp, 0xc
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x3c]
mov byte [esp + 0x54], 4
call fcn.00405c80
push eax
mov byte [esp + 0x48], 5
call fcn.004060d0
add esp, 8
test eax, eax
mov byte [esp + 0x40], 4
mov eax, dword [esp + 0x30]
sete byte [esp + 0x13]
add eax, 0xfffffff0
or edi, 0xffffffff
lea ecx, [eax + 0xc]
mov edx, edi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406ac3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov edx, edi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406ae2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x40], 1
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov edx, edi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406b06
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [esi - 0x10]
mov byte [esp + 0x40], 0
mov edx, edi
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
cmp byte [esp + 0x13], 0
je 0x406b62
test edx, edx
jg 0x406b2d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x40], edi
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edi
dec edi
test edi, edi
jg 0x406b4e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x38
ret
test edx, edx
jg 0x406b70
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x40], edi
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edi
dec edi
test edi, edi
jg 0x406b91
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x38
ret
Function at 0x4089a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x48d7c6
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x4b1d00]
xor eax, esp
mov dword [esp + 0x220], eax
push ebx
push esi
push edi
mov eax, dword [0x4b1d00]
xor eax, esp
push eax
lea eax, [esp + 0x238]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov ebx, ecx
cmp dword [ebx + 0x84], 0
mov dword [esp + 0x10], eax
je 0x408b9e
mov ecx, dword [ebx + 0x5c]
mov edx, dword [ebx + 0x44]
lea edi, [ebx + 0x44]
lea eax, [ebp + 8]
mov dword [esp + 0x18], ecx
push eax
lea ecx, [esp + 0x20]
push ecx
mov dword [esp + 0x1c], edx
call fcn.0040aba0
mov esi, eax
mov eax, dword [esi]
test eax, eax
je 0x408a23
cmp eax, dword [esp + 0x14]
je 0x408a28
call fcn.00464ef7
mov edx, dword [esp + 0x18]
cmp dword [esi + 4], edx
je 0x408a50
lea eax, [ebp + 8]
push eax
mov ecx, edi
call fcn.0040aa50
mov ecx, dword [esp + 0x10]
push eax
call fcn.0040a790
mov eax, 1
jmp 0x408ba0
mov eax, dword [ebx + 0x7c]
mov ecx, dword [eax]
mov esi, dword [ebx + 0x64]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], esi
mov edi, dword [ebx + 0x7c]
mov eax, dword [ebx + 0x64]
test esi, esi
je 0x408a6e
cmp esi, eax
je 0x408a73
call fcn.00464ef7
cmp dword [esp + 0x18], edi
je 0x408b1a
mov edx, dword [0x4b84ac]
mov eax, dword [edx + 0xc]
mov ecx, 0x4b84ac
call eax
add eax, 0x10
mov dword [esp + 0x1c], eax
mov dword [esp + 0x240], 0
test esi, esi
jne 0x408b16
call fcn.00464ef7
mov edi, dword [esp + 0x18]
cmp edi, dword [esi + 0x18]
jne 0x408ab6
call fcn.00464ef7
mov edx, dword [ebp + 8]
mov eax, dword [edi + 0x10]
lea ecx, [esp + 0x1c]
push ecx
push edx
call fcn.004093e0
test eax, eax
je 0x408ad9
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x1c]
push eax
call fcn.0040a790
mov dword [esp + 0x240], 0xffffffff
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408b04
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea esi, [esp + 0x14]
call fcn.0040d100
mov esi, dword [esp + 0x14]
jmp 0x408a60
mov esi, dword [esi]
jmp 0x408aa8
mov esi, dword [esp + 0x10]
mov ecx, dword [esi + 0x10]
sub ecx, dword [esi + 0xc]
test ecx, 0xfffffffc
jne 0x408a46
mov edx, dword [ebp + 8]
push 0
push edx
lea eax, [esp + 0x2c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x408b9e
lea ecx, [esp + 0x24]
push ecx
lea ecx, [esp + 0x14]
call fcn.00404be0
lea edx, [esp + 0x10]
push edx
mov ecx, esi
mov dword [esp + 0x244], 1
call fcn.0040a790
mov dword [esp + 0x240], 0xffffffff
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408b97
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
jmp 0x408ba0
xor eax, eax
mov ecx, dword [esp + 0x238]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x220]
xor ecx, esp
call fcn.00464fe1
mov esp, ebp
pop ebp
ret 8
Function at 0x40a150
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x48cdf0
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4b1d00]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
mov eax, dword [0x4b1d00]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov eax, dword [0x4b84ac]
mov edx, dword [eax + 0xc]
mov ecx, 0x4b84ac
mov dword [esp + 0x10], edi
call edx
add eax, 0x10
mov dword [edi], eax
mov eax, 0x3b
mov dword [esp + 0x30], 0
mov word [esp + 0xc], ax
xor ecx, ecx
lea eax, [esp + 0xc]
mov word [esp + 0xe], cx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40a1b7
sub eax, edx
sar eax, 1
mov esi, eax
mov dword [esp + 0x14], 0
lea eax, [esi + 1]
mov edx, 2
mul edx
mov byte [esp + 0x30], 1
test edx, edx
ja 0x40a1e8
cmp eax, 0xffffffff
jbe 0x40a1f2
push 0x80070057
call fcn.004016b0
cmp eax, 0xa
jbe 0x40a203
lea ecx, [esp + 0x14]
push ecx
call fcn.0040daf0
jmp 0x40a20b
lea edx, [esp + 0x18]
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x14]
push 2
lea eax, [esp + 0x10]
push eax
lea ecx, [esi + esi + 2]
push ecx
push edx
call fcn.00464a8b
push eax
call fcn.00402ea0
mov eax, dword [edi]
mov edx, dword [eax - 8]
sub eax, 0x10
mov ecx, 1
sub ecx, dword [eax + 0xc]
sub edx, esi
add esp, 0x14
or ecx, edx
jge 0x40a248
push esi
mov ecx, edi
call fcn.00402340
mov ecx, dword [edi]
cmp esi, 1
jne 0x40a25b
mov eax, dword [esp + 0x14]
movzx eax, word [eax]
mov word [ecx], ax
jmp 0x40a27c
xor eax, eax
test esi, esi
jle 0x40a276
mov edx, dword [esp + 0x14]
mov dx, word [edx + eax*2]
mov word [ecx], dx
inc eax
add ecx, 2
cmp eax, esi
jl 0x40a261
test esi, esi
jl 0x40a1e8
mov eax, dword [edi]
cmp esi, dword [eax - 8]
jg 0x40a1e8
mov dword [eax - 0xc], esi
mov eax, dword [edi]
xor ecx, ecx
lea edx, [esp + 0x18]
mov word [eax + esi*2], cx
cmp dword [esp + 0x14], edx
je 0x40a2a5
lea eax, [esp + 0x14]
call fcn.0040d170
mov eax, edi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00464fe1
add esp, 0x2c
ret

Function at 0x40e1e0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x214
mov eax, dword [0x4b1d00]
xor eax, esp
mov dword [esp + 0x210], eax
push esi
mov esi, dword [esp + 0x21c]
push 0x208
lea eax, [esp + 0x10]
push 0
push eax
mov dword [esp + 0x10], 0
call fcn.00464d20
add esp, 0xc
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0xc]
push eax
push str.Path
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsQHSafeMain.exe
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x20], 0x208
mov dword [esp + 0x1c], 1
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x40e284
mov eax, dword [esp + 8]
shr eax, 1
dec eax
cmp eax, 0x104
jae 0x40e284
cmp word [esp + eax*2 + 0xc], 0x5c
je 0x40e27e
cmp eax, 0x103
jae 0x40e284
mov ecx, 0x5c
xor edx, edx
mov word [esp + eax*2 + 0xc], cx
mov word [esp + eax*2 + 0xe], dx
lea eax, [esp + 0xc]
jmp 0x40e289
mov eax, 0x4991c8
push eax
mov ecx, esi
call fcn.00404be0
mov ecx, dword [esp + 0x214]
mov eax, esi
pop esi
xor ecx, esp
call fcn.00464fe1
add esp, 0x214
ret
Function at 0x410a40
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x48aa18
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x4b1d00]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push eax
lea ecx, [esp + 0xc]
push ecx
call fcn.00411c10
push eax
lea edx, [esp + 0x38]
push edx
mov dword [esp + 0x70], 0
call fcn.00411c70
add esp, 0x10
push 0x4a6e20
lea eax, [esp + 0x30]
push eax
call fcn.00464f95
int3

Function at 0x416190
Capabilities:
Get disk information

Disassembly:
sub esp, 0x634
mov eax, dword [0x4b1d00]
xor eax, esp
mov dword [esp + 0x630], eax
push esi
push 0x104
lea eax, [esp + 0x14]
push eax
mov esi, 0x1234abcd
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
xor ecx, ecx
cmp eax, ecx
je 0x41626d
cmp eax, 0x104
ja 0x41626d
xor edx, edx
mov word [esp + eax*2 + 0x10], dx
mov ax, word [esp + 0x10]
cmp ax, 0x41
jb 0x4161e7
cmp ax, 0x5a
jbe 0x4161f4
mov eax, dword [esp + 0x10]
add eax, 0xffffff9f
cmp ax, 0x19
ja 0x4161fb
xor edx, edx
mov word [esp + 0x16], dx
push 0x104
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ecx
lea eax, [esp + 0x220]
push eax
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
push eax
push 0x104
lea ecx, [esp + 0x440]
push ecx
lea edx, [esp + 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x416259
mov eax, dword [esp + 4]
pop esi
mov ecx, dword [esp + 0x630]
xor ecx, esp
call fcn.00464fe1
add esp, 0x634
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.dwLastErr_d_n
call fcn.00469998
add esp, 8
mov ecx, dword [esp + 0x634]
mov eax, esi
pop esi
xor ecx, esp
call fcn.00464fe1
add esp, 0x634
ret
Function at 0x421b10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x48a200
mov eax, dword fs:[0]
push eax
sub esp, 0x64
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4b1d00]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x88]
mov ecx, dword [ebp + 0x18]
mov eax, dword [ecx + 4]
xor ebx, ebx
mov dword [esp + 0x88], ecx
cmp byte [eax + 0x3d], bl
jne 0x421b7a
mov edx, dword [esp + 0x8c]
mov edx, dword [edx]
jmp 0x421b60
cmp dword [eax + 0xc], edx
jge 0x421b6a
mov eax, dword [eax + 8]
jmp 0x421b6e
mov ecx, eax
mov eax, dword [eax]
cmp byte [eax + 0x3d], bl
je 0x421b60
mov dword [esp + 0x88], ecx
mov esi, dword [ebp]
mov eax, dword [ebp + 0x18]
mov edi, ecx
mov dword [esp + 0x18], eax
cmp esi, ebx
je 0x421b8e
cmp esi, esi
je 0x421b9a
call fcn.00464ef7
mov ecx, dword [esp + 0x88]
cmp ecx, dword [esp + 0x18]
je 0x421bb2
mov edx, dword [esp + 0x8c]
mov eax, dword [edx]
cmp eax, dword [ecx + 0xc]
jge 0x421ca4
mov ecx, vtable.qtray::TraySrvArg.0
mov eax, 0xf
mov dword [esp + 0x1c], ecx
mov byte [esp + 0x20], bl
mov dword [esp + 0x24], ebx
mov dword [esp + 0x40], eax
mov dword [esp + 0x3c], ebx
mov byte [esp + 0x2c], bl
mov byte [esp + 0x44], bl
mov byte [esp + 0x45], bl
mov byte [esp + 0x46], bl
mov edx, dword [esp + 0x8c]
mov dword [esp + 0x80], ebx
mov edx, dword [edx]
push 0xffffffffffffffff
mov dword [esp + 0x74], eax
push ebx
lea eax, [esp + 0x30]
mov dword [esp + 0x54], ecx
push eax
lea ecx, [esp + 0x64]
mov dword [esp + 0x54], edx
mov byte [esp + 0x5c], bl
mov dword [esp + 0x60], ebx
mov dword [esp + 0x78], ebx
mov byte [esp + 0x68], bl
call fcn.00401980
mov cx, word [esp + 0x44]
mov dl, byte [esp + 0x46]
mov word [esp + 0x74], cx
mov byte [esp + 0x76], dl
push edi
push esi
lea eax, [esp + 0x50]
push eax
lea ecx, [esp + 0x20]
push ecx
mov eax, ebp
mov byte [esp + 0x90], 1
call fcn.00421d10
cmp dword [esp + 0x70], 0x10
mov esi, dword [eax]
mov edi, dword [eax + 4]
mov ebp, vtable.qtray::TraySrvArg.0
mov dword [esp + 0x4c], ebp
jb 0x421c6c
mov edx, dword [esp + 0x5c]
push edx
call fcn.004617a0
add esp, 4
cmp dword [esp + 0x40], 0x10
mov dword [esp + 0x70], 0xf
mov dword [esp + 0x6c], ebx
mov byte [esp + 0x5c], bl
mov dword [esp + 0x1c], ebp
jb 0x421c94
mov eax, dword [esp + 0x2c]
push eax
call fcn.004617a0
add esp, 4
mov dword [esp + 0x40], 0xf
mov dword [esp + 0x3c], ebx
mov byte [esp + 0x2c], bl
cmp esi, ebx
jne 0x421cd2
call fcn.00464ef7
xor esi, esi
cmp edi, dword [esi + 0x18]
jne 0x421cb9
call fcn.00464ef7
lea eax, [edi + 0x10]
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x70
ret 8
mov esi, dword [esi]
jmp 0x421caf
Function at 0x422640
Capabilities:
Create thread

Disassembly:
push ecx
mov eax, dword [0x4b9bf4]
push esi
mov esi, dword [0x4b9be8]
push 0x104
push eax
lea ecx, [esi + 0x14]
push 0x105
push ecx
call fcn.004667f9
add esp, 0x10
cmp dword [esi], 0xffffffff
mov dword [esi + 0x224], 0x4144d0
mov dword [esi + 0x220], 0x413ee0
je 0x42268c
mov dword [esi + 0x10], 0
mov eax, 1
pop esi
pop ecx
ret
lea edx, [esp + 4]
push edx
push 0
push esi
push 0x422730
push 0
push 0
mov dword [esp + 0x1c], 0
call fcn.0046902c
add esp, 0x18
mov dword [esi], eax
mov eax, 1
pop esi
pop ecx
ret

Function at 0x4226c0
Capabilities:
Terminate thread

Disassembly:
mov eax, dword [esi + 0x224]
test eax, eax
je 0x4226d7
mov ecx, dword [esi + 0x228]
push ecx
push esi
call eax
add esp, 8
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x42271a
push 0x1388
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x422711
mov edx, dword [esi]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0xffffffff
mov eax, 1
ret
mov ecx, dword [esi]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0xffffffff
mov eax, 1
ret
Function at 0x4242b0
Capabilities:
Check os version

Disassembly:
push 0xffffffffffffffff
push 0x4898e8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x4b1d00]
xor eax, esp
mov dword [esp + 0x24], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4b1d00]
xor eax, esp
push eax
lea eax, [esp + 0x3c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x4c]
xor ebx, ebx
mov esi, ecx
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
mov dword [esp + 0x44], ebx
mov eax, dword [esi]
mov edx, dword [eax + 0x60]
lea ecx, [esp + 0x1c]
push ecx
mov ecx, esi
call edx
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x1c]
push edx
mov edi, eax
mov eax, dword [esi]
mov edx, dword [eax + 0x68]
lea ecx, [esp + 0x24]
push ecx
mov ecx, esi
call edx
add edi, eax
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x42442f
mov bl, 1
movsx ecx, word [esp + 0x14]
dec ecx
cmp ecx, 5
ja case.default.0x424345
jmp dword [ecx*4 + 0x424474]
cmp eax, 0xb
jne case.default.0x424345
mov eax, dword [esi]
mov edx, dword [eax + 0xa4]
lea ecx, [ebp + 4]
push ecx
mov ecx, esi
call edx
mov byte [ebp + 0x4c], bl
jmp 0x4243fc
mov edx, dword [esi]
mov ecx, esi
cmp eax, 0xb
jne 0x4243f3
mov edx, dword [edx + 0xa4]
lea eax, [ebp + 0x20]
push eax
call edx
mov byte [ebp + 0x4d], bl
jmp 0x4243fc
mov edx, dword [esi]
mov ecx, esi
cmp eax, 8
jne 0x4243f3
mov edx, dword [edx + 0x98]
lea eax, [ebp + 0x3c]
push eax
call edx
mov byte [ebp + 0x4e], bl
jmp 0x4243fc
mov edx, dword [esi]
mov ecx, esi
cmp eax, 8
jne 0x4243f3
mov edx, dword [edx + 0x98]
lea eax, [ebp + 0x40]
push eax
call edx
mov byte [ebp + 0x4f], bl
jmp 0x4243fc
mov edx, dword [esi]
mov ecx, esi
cmp eax, 8
jne 0x4243f3
mov edx, dword [edx + 0x98]
lea eax, [ebp + 0x44]
push eax
call edx
mov byte [ebp + 0x50], bl
jmp 0x4243fc
mov edx, dword [esi]
mov ecx, esi
cmp eax, 8
jne 0x4243f3
mov edx, dword [edx + 0x98]
lea eax, [ebp + 0x48]
push eax
call edx
mov byte [ebp + 0x51], bl
jmp 0x4243fc
mov edx, dword [esi]
mov ecx, esi
push eax
mov eax, dword [edx + 0xac]
call eax
mov edx, dword [esi]
add edi, eax
mov eax, dword [edx + 0x6c]
mov ecx, esi
call eax
mov edx, dword [esi]
mov edx, dword [edx + 0x68]
add edi, eax
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x1c]
push ecx
lea eax, [esp + 0x24]
push eax
mov ecx, esi
call edx
add edi, eax
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x424336
mov eax, dword [esi]
mov edx, dword [eax + 0x64]
mov ecx, esi
call edx
mov esi, eax
add esi, edi
cmp dword [esp + 0x34], 0x10
jb 0x424450
mov eax, dword [esp + 0x20]
push eax
call fcn.004617a0
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.00464fe1
add esp, 0x34
ret 4
Function at 0x42a470
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x68
mov eax, dword [0x4b1d00]
xor eax, esp
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x6c]
xor ecx, ecx
push esi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], ecx
push eax
mov eax, dword [esp + 0x78]
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.0042e270
add esp, 4
lea esi, [esp + 8]
mov ecx, edi
call fcn.0042e310
mov ecx, dword [esp + 0x64]
pop esi
xor ecx, esp
call fcn.00464fe1
add esp, 0x68
ret
Function at 0x42a600
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov esi, eax
lea eax, [esp + 0x18]
push eax
push 0x20119
xor edi, edi
push edi
push 0x49cfec
push reloc.OLEAUT32.dll_SysReAllocString
mov ebx, ecx
mov dword [esp + 0x30], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42a791
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
lea ecx, [esp + 0x10]
push ecx
mov dword [esi + 0x10], eax
push ebx
mov dword [esi + 0x14], eax
lea edx, [esp + 0x1c]
push edx
mov dword [esi + 0x18], eax
push eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov eax, dword [esp + 0x28]
push str.Operator
mov edi, 0x400
push eax
mov dword [esp + 0x28], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x42a693
cmp dword [esp + 0x14], 1
jne 0x42a778
mov eax, dword [esp + 0x10]
sub edi, eax
mov dword [esi], ebx
lea ebx, [eax + ebx]
je 0x42a778
mov eax, dword [esp + 0x18]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [esp + 0x10]
push ecx
push ebx
lea edx, [esp + 0x1c]
push edx
push 0
push str.IssueDate
push eax
mov dword [esp + 0x28], edi
call ebp
test eax, eax
jne 0x42a6d8
cmp dword [esp + 0x14], 1
jne 0x42a778
mov eax, dword [esp + 0x10]
mov dword [esi + 4], ebx
sub edi, eax
add ebx, eax
test edi, edi
je 0x42a778
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x10]
push ecx
push ebx
lea edx, [esp + 0x1c]
push edx
push 0
push str.ExpirationDate
push eax
mov dword [esp + 0x28], edi
call ebp
test eax, eax
jne 0x42a70f
cmp dword [esp + 0x14], 1
jne 0x42a778
mov eax, dword [esp + 0x10]
mov dword [esi + 8], ebx
sub edi, eax
add ebx, eax
test edi, edi
je 0x42a778
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x10]
push ecx
push ebx
lea edx, [esp + 0x1c]
push edx
push 0
push str.SignData
push eax
mov dword [esp + 0x28], edi
call ebp
test eax, eax
jne 0x42a778
cmp dword [esp + 0x14], 3
jne 0x42a778
mov eax, dword [esp + 0x10]
sub edi, eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], ebx
je 0x42a778
lea eax, [esi + 0xc]
call fcn.0042a4e0
test eax, eax
je 0x42a778
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov ecx, 0x400
sub ecx, edi
push eax
mov dword [edx], ecx
mov esi, 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x42aba0
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x6c
mov eax, dword [0x4b1d00]
xor eax, esp
mov dword [esp + 0x68], eax
push esi
lea eax, [esp + 8]
mov esi, edx
push eax
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x18], 0x67452301
mov dword [esp + 0x1c], 0xefcdab89
mov dword [esp + 0x20], 0x98badcfe
mov dword [esp + 0x24], 0x10325476
call fcn.0042cda0
add esp, 8
test eax, eax
jne 0x42ac0b
pop esi
mov ecx, dword [esp + 0x68]
xor ecx, esp
call fcn.00464fe1
add esp, 0x6c
ret
mov eax, dword [esp + 0x74]
test eax, eax
jbe 0x42ac20
push esi
lea ecx, [esp + 0x14]
call fcn.0042e270
add esp, 4
lea esi, [esp + 0x10]
mov ecx, ebx
call fcn.0042e310
test edi, edi
je 0x42ac3e
mov ecx, dword [esp + 0xc]
xor eax, eax
cmp ecx, dword [esp + 8]
sete al
mov dword [edi], eax
mov ecx, dword [esp + 0x6c]
pop esi
xor ecx, esp
mov eax, 1
call fcn.00464fe1
add esp, 0x6c
ret

Function at 0x42aca0
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x64
mov eax, dword [0x4b1d00]
xor eax, esp
mov dword [esp + 0x5c], eax
xor eax, eax
push esi
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
push edi
lea eax, [esp + 8]
mov edi, ecx
push eax
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.0042cfa0
add esp, 4
test eax, eax
jne 0x42acfe
pop edi
pop esi
mov ecx, dword [esp + 0x5c]
xor ecx, esp
call fcn.00464fe1
add esp, 0x64
ret
lea esi, [esp + 8]
mov ecx, ebx
call fcn.0042e310
mov ecx, dword [esp + 0x64]
pop edi
pop esi
xor ecx, esp
mov eax, 1
call fcn.00464fe1
add esp, 0x64
ret

Function at 0x42ad20
Capabilities:
Hash data using sha256

Disassembly:
sub esp, 0x74
mov eax, dword [0x4b1d00]
xor eax, esp
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x78]
xor ecx, ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ecx
push edi
lea ecx, [esp + 8]
push ecx
push eax
mov dword [esp + 0x10], 0x6a09e667
mov dword [esp + 0x14], 0xbb67ae85
mov dword [esp + 0x18], 0x3c6ef372
mov dword [esp + 0x1c], 0xa54ff53a
mov dword [esp + 0x20], 0x510e527f
mov dword [esp + 0x24], 0x9b05688c
mov dword [esp + 0x28], 0x1f83d9ab
mov dword [esp + 0x2c], 0x5be0cd19
call fcn.0042d090
add esp, 8
test eax, eax
jne 0x42ad9f
pop edi
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00464fe1
add esp, 0x74
ret
mov eax, esi
lea edi, [esp + 8]
call fcn.0042de50
mov ecx, dword [esp + 0x74]
pop edi
xor ecx, esp
mov eax, 1
call fcn.00464fe1
add esp, 0x74
ret

Function at 0x42b6f0
Capabilities:
Read file on windows

Disassembly:
push ecx
push 0
lea eax, [esp + 4]
push eax
push esi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x42b722
push str.ReadFile__
push 0xfc
push str..QHImageHlp.c
xor edx, edx
call fcn.0042f150
add esp, 0xc
xor eax, eax
pop ecx
ret
cmp esi, dword [esp]
je 0x42b747
push 0x49d180
push 0xfe
push str..QHImageHlp.c
mov edx, 1
call fcn.0042f280
add esp, 0xc
xor eax, eax
pop ecx
ret
mov eax, 1
pop ecx
ret