joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4193e1
Capabilities:
Enumerate files on windows
Enumerate files recursively
Set current directory
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x260
mov edx, dword [ebp + 8]
push ebx
push esi
or ebx, 0xffffffff
push edi
mov edi, edx
mov ecx, ebx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp byte [ecx + edx - 1], 0x5c
je 0x419433
mov edi, 0x41f088
mov ecx, ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov dword [ebp - 4], eax
mov edi, edx
mov ecx, ebx
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [ebp - 4]
dec edi
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
je 0x419589
mov edi, dword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea eax, [ebp - 0x15c]
push eax
push str..EXE
call edi
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x4194dc
xor eax, eax
push eax
push 0x80
push 3
push eax
push eax
lea eax, [ebp - 0x130]
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, ebx
je 0x4194bf
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
lea eax, [ebp - 0x130]
push eax
push esi
call fcn.0041958e
pop ecx
lea eax, [ebp - 0x1c]
pop ecx
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x15c]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x41945f
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebp - 0x15c]
push eax
push 0x41f07c
call edi
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x419589
test byte [ebp - 0x15c], 0x10
je 0x419568
mov edi, dword [ebp + 8]
mov ecx, ebx
xor eax, eax
lea edx, [ebp - 0x260]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x260]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x130]
mov ecx, ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
mov ecx, ebx
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
cmp byte [ebp - 0x130], 0x2e
rep movsb byte es:[edi], byte [esi]
je 0x419568
lea eax, [ebp - 0x260]
push eax
call fcn.004193e1
pop ecx
lea eax, [ebp - 0x15c]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4194f5
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x419b07
Capabilities:
Parse pe header
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
xor ebx, ebx
push edi
lea eax, [ebp - 4]
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
push eax
lea eax, [ebp - 0x48]
push 0x40
push eax
push dword [ebp + 8]
call esi
test eax, eax
je 0x419c72
cmp dword [ebp - 4], 0x40
jne 0x419c72
cmp word [ebp - 0x48], 0x5a4d
jne 0x419c72
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
push ebx
push dword [ebp - 0xc]
push dword [ebp + 8]
call edi
cmp eax, 0xffffffff
je 0x419c72
lea eax, [ebp - 4]
push ebx
push eax
push 0xf8
push 0x421740
push dword [ebp + 8]
call esi
test eax, eax
je 0x419c72
cmp dword [ebp - 4], 0xf8
jne 0x419c72
cmp dword [0x421740], 0x4550
jne 0x419c72
mov eax, dword [0x421548]
mov ecx, dword [0x421746]
add eax, ecx
lea eax, [eax + eax*4]
shl eax, 3
cmp ax, bx
je 0x419c72
movzx eax, ax
push eax
push 0x40
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
cmp eax, ebx
mov dword [0x421540], eax
je 0x419c72
push 1
push ebx
push ebx
push dword [ebp + 8]
call edi
cmp eax, ebx
mov dword [0x421568], eax
je 0x419c72
lea eax, [ebp - 4]
push ebx
push eax
push dword [ebp - 8]
push dword [0x421540]
push dword [ebp + 8]
call esi
test eax, eax
je 0x419c72
mov eax, dword [ebp - 8]
cmp dword [ebp - 4], eax
jne 0x419c72
push 1
push ebx
push ebx
push dword [ebp + 8]
call edi
mov ecx, dword [0x421548]
lea ecx, [ecx + ecx*4]
lea eax, [eax + ecx*8]
cmp eax, dword [0x421794]
ja 0x419c72
mov ecx, dword [0x421540]
mov eax, dword [ecx + 0x10]
add eax, dword [ecx + 0xc]
cmp dword [0x421768], eax
jae 0x419c72
test byte [0x421757], 0x20
jne 0x419c72
movzx eax, word [0x421746]
push 2
push ebx
lea eax, [eax + eax*4]
push ebx
push dword [ebp + 8]
lea esi, [ecx + eax*8]
mov eax, dword [ecx + eax*8 - 0x18]
mov dword [ebp - 8], eax
call edi
mov edx, dword [esi - 0x14]
mov ecx, dword [ebp - 8]
add edx, ecx
cmp eax, edx
jne 0x419c72
cmp dword [esi - 0x20], ecx
ja 0x419c72
push 1
pop eax
jmp 0x419c74
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10020e3
Capabilities:
Hide graphical window

Disassembly:
push 0xc
mov eax, 0x101f6e4
call fcn.01001520
mov esi, ecx
and dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
push 0x10021e0
lea ecx, [ebp - 0x18]
call fcn.01001580
push dword [esi + 0x28]
mov ebx, dword [sym.imp.USER32.dll_IsWindowVisible]
and dword [ebp - 4], 0
call ebx
cmp eax, dword [ebp + 8]
je 0x100df5f
mov eax, dword [ebp + 8]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
neg eax
sbb eax, eax
and eax, 5
push eax
push dword [esi + 0x28]
call edi
cmp dword [ebp + 8], 0
je 0x10021c4
push dword [esi + 0x28]
call dword [sym.imp.USER32.dll_IsZoomed]
test eax, eax
jne 0x100df66
mov eax, dword [esi + 0x2c]
test eax, eax
je 0x1002170
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x129
push eax
call edi
test eax, eax
jne 0x100df72
xor edi, edi
cmp dword [ebp + 0xc], edi
jne 0x100df88
mov eax, dword [esi + 0x18]
push dword [eax + 0x10]
call ebx
cmp eax, edi
je 0x1002191
mov ecx, esi
call fcn.01008c11
mov dword [ebp - 0x10], eax
mov eax, dword [section..data]
cmp eax, section..data
je 0x10021c4
test dword [eax + 0x1c], 0x2000
je 0x10021c4
push 0x1391
push edi
push edi
push dword [ebp - 0x10]
push 7
push 0x1003090
push 0xa
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01002de8
mov esi, dword [ebp - 0x10]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.010015c0
mov eax, esi
call fcn.01001560
ret 8
xor esi, esi
jmp 0x10021c7
push 9
push dword [esi + 0x28]
call edi
jmp 0x100214f
push 0
push 0x20002
push 0x127
push dword [esi + 0x2c]
call edi
jmp 0x1002170
push dword [esi + 0x28]
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x100217b
push dword [esi + 0x28]
call dword [sym.imp.USER32.dll_OpenIcon]
jmp 0x100217b
Function at 0x10074a1
Capabilities:
Identify system language via api

Disassembly:
push 0x1c
mov eax, 0x101da9c
call fcn.01001520
mov edi, ecx
lea eax, [ebp - 0x10]
push eax
xor esi, esi
push 0x1007520
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x10], esi
call fcn.01001580
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
mov ebx, dword [ebp + 8]
movzx eax, ax
and eax, 0x3ff
cmp ax, 0xd
je 0x100dd90
push 0x13
push esi
push esi
push esi
push esi
push dword [edi + 0x40]
push 2
push 2
push ebx
call dword [sym.imp.USER32.dll_DrawIconEx]
cmp eax, esi
je 0x100dd9d
cmp dword [ebp + 0x10], esi
jne 0x100dde8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.010015c0
xor eax, eax
call fcn.01001560
ret 0x10
push esi
push esi
push ebx
call fcn.010050f5
jmp 0x10074e3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jle 0x100ddb1
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x10], eax
mov eax, dword [section..data]
cmp eax, section..data
je 0x1007508
test byte [eax + 0x1c], 4
je 0x1007508
push dword [ebp - 0x10]
push 0x1003090
push 0x4b
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101113b
jmp 0x1007508
push esi
push esi
push 1
push 6
call fcn.01008311
mov dword [ebp + 0x10], eax
cmp eax, esi
je 0x1007508
lea ecx, [ebp - 0x10]
push ecx
push eax
push ebx
call fcn.0100251b
mov dword [ebp + 8], eax
cmp eax, esi
je 0x100dea6
push esi
push esi
push 5
call fcn.0101d36f
push eax
push ebx
call fcn.0100251b
mov edi, eax
cmp edi, esi
je 0x100de9c
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x28]
push eax
push dword [ebp + 0xc]
call fcn.01003277
cmp dword [ebp - 0x10], esi
jl 0x100de94
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push ebx
call dword [sym.imp.GDI32.dll_Rectangle]
cmp eax, esi
jne 0x100de94
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jle 0x100de6a
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x10], eax
mov eax, dword [section..data]
cmp eax, section..data
je 0x100de94
test byte [eax + 0x1c], 4
je 0x100de94
push dword [ebp - 0x10]
push 0x1003090
push 0x4c
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101113b
push esi
push edi
push ebx
call fcn.0100251b
push esi
push dword [ebp + 8]
push ebx
call fcn.0100251b
push esi
push dword [ebp + 0x10]
call fcn.010024b5
jmp 0x1007508
Function at 0x1007741
Capabilities:
Inspect load icon resource

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 4], 0
push esi
lea eax, [ebp - 4]
push eax
push 0x1007790
lea ecx, [ebp - 0xc]
call fcn.01001580
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_LoadIconW]
mov esi, eax
test esi, esi
je 0x10103b5
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x1010400
lea ecx, [ebp - 0xc]
call fcn.010015c0
mov eax, esi
pop esi
leave
ret 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x10103c9
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
mov eax, dword [section..data]
cmp eax, section..data
je 0x1007775
test byte [eax + 0x1c], 4
je 0x1007775
push dword [ebp - 4]
push 0x10015f4
push 0x31
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101113b
jmp 0x1007775
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
jmp 0x1007780

Function at 0x100c151
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x1022004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
call fcn.0100c225
mov eax, 0x1000000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x98]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x88], 2
jne 0x100c1f3
cmp dword [ebp - 0x94], 5
jb 0x100c1c6
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x100c210
call fcn.0100c0af
test eax, eax
jl 0x100fe06
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.01001684
leave
ret
cmp dword [ebp - 0x88], 1
je 0x100fdee
jmp 0x100c1c6
cmp dword [ebp - 0x90], 0
jbe 0x100c1c6
jmp 0x100c1c2
cmp dword [ebp - 0x94], 4
ja 0x100c1c2
je 0x100c202
jmp 0x100c1c6
mov byte [0x1022ae0], 1
jmp 0x100c1e4
Function at 0x1011dcd
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x634
mov eax, 0x101ddcc
call int.01001630
lea eax, [ebp - 0x62c]
push eax
xor ebx, ebx
push 0x1011ef8
lea ecx, [ebp - 0x640]
mov dword [ebp - 0x62c], ebx
call fcn.01001580
push ebx
push ebx
push ebx
lea eax, [ebp - 0x638]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x634]
push eax
push 0x1008df8
push dword [0x1022210]
mov esi, 0x208
mov dword [ebp - 4], ebx
mov dword [ebp - 0x638], esi
mov dword [ebp - 0x634], 1
call sub.SHLWAPI.dll_SHRegGetUSValueW
xor ecx, ecx
mov word [ebp - 0x12], cx
cmp eax, ebx
jne 0x1011ede
push dword [0x1022218]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpICW]
test eax, eax
je 0x1011edc
xor eax, eax
push 0x40e
mov word [ebp - 0x628], ax
lea eax, [ebp - 0x626]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push dword [0x1022210]
lea eax, [ebp - 0x628]
push esi
push eax
call fcn.01011d1d
cmp eax, ebx
mov dword [ebp - 0x62c], eax
jl 0x1011ede
lea eax, [ebp - 0x218]
push eax
push esi
lea eax, [ebp - 0x628]
push eax
call fcn.01011d57
cmp eax, ebx
mov dword [ebp - 0x62c], eax
jl 0x1011ede
lea eax, [ebp - 0x630]
push eax
push dword [0x1022214]
lea eax, [ebp - 0x628]
push eax
mov dword [ebp - 0x630], ebx
call fcn.01010b67
cmp eax, ebx
jne 0x1011ede
mov bl, 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x640]
call fcn.010015c0
mov al, bl
call fcn.01001670
ret
Function at 0x10165c9
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1016622
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x1016614
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x1016610
cmp esi, eax
jae 0x1016614
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x1016602
cmp esi, eax
jb 0x1016618
xor eax, eax
jmp 0x1016621
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop ebp
ret 0xc
Function at 0x406937
Capabilities:
Terminate process

Disassembly:
push 0x58
push 0x40b138
call fcn.00406c3c
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.kernel32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, 0x40dbfc
push 0
push esi
push edi
call dword [sym.imp.kernel32.dll_InterlockedCompareExchange]
test eax, eax
je 0x4066d6
cmp eax, esi
jne 0x4066c9
xor esi, esi
inc esi
mov ebx, esi
jmp 0x4066d9
push 0x3e8
call dword [sym.imp.kernel32.dll_Sleep]
jmp 0x4066b0
xor esi, esi
inc esi
mov eax, dword [0x40dbf8]
cmp eax, esi
jne 0x4066ec
push 0x1f
call sub.MSVCR80.dll__amsg_exit
pop ecx
jmp 0x40671b
mov eax, dword [0x40dbf8]
test eax, eax
jne 0x406715
mov dword [0x40dbf8], esi
push 0x4072cc
push 0x4072c4
call sub.MSVCR80.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x40671b
jmp 0x406843
mov dword [0x40c2cc], esi
mov eax, dword [0x40dbf8]
cmp eax, esi
jne 0x40673f
push 0x4072c0
push 0x4072b8
call sub.MSVCR80.dll__initterm
pop ecx
pop ecx
mov dword [0x40dbf8], 2
test ebx, ebx
jne 0x40674b
push ebx
push edi
call dword [sym.imp.kernel32.dll_InterlockedExchange]
cmp dword [0x40dc08], 0
je 0x40676f
push 0x40dc08
call fcn.00406bc2
pop ecx
test eax, eax
je 0x40676f
push 0
push 2
push 0
call dword [0x40dc08]
mov eax, dword [sym.imp.MSVCR80.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x4067cb
test al, al
je 0x406789
cmp dword [ebp - 0x1c], 0
jne 0x4067cb
mov al, byte [esi]
test al, al
je 0x406799
cmp al, 0x20
ja 0x406799
inc esi
mov dword [ebp - 0x20], esi
jmp 0x406789
test byte [ebp - 0x3c], 1
je 0x4067a5
movzx eax, word [ebp - 0x38]
jmp 0x4067a8
push 0xa
pop eax
push eax
push esi
push 0
push 0x400000
call main
mov dword [0x40c2c8], eax
cmp dword [0x40c2bc], 0
jne 0x40681f
push eax
call dword [sym.imp.MSVCR80.dll_exit]
cmp al, 0x22
jne 0x4067da
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.MSVCR80.dll__ismbblead]
pop ecx
test eax, eax
je 0x4067ed
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x406776
cmp dword [0x40c2cc], 0
jne 0x40682e
call dword [sym.imp.MSVCR80.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x40c2c8]
jmp 0x40684f
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.00406c81
ret
call fcn.0040632d
jmp 0x406676

Function at 0x100016be
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1001fbcc]
jne 0x100016cf
test ecx, 0xffff0000
jne 0x100016cf
ret
jmp fcn.100016d4
Function at 0x401440
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x68
mov eax, dword [0x4a9150]
xor eax, esp
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x6c]
xor ecx, ecx
push esi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], ecx
push eax
mov eax, dword [esp + 0x78]
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.00407960
add esp, 4
lea esi, [esp + 8]
mov ecx, edi
call fcn.00407a00
mov ecx, dword [esp + 0x64]
pop esi
xor ecx, esp
call fcn.0043f097
add esp, 0x68
ret

Function at 0x4014b0
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x68
mov eax, dword [0x4a9150]
xor eax, esp
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x6c]
xor ecx, ecx
push esi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], ecx
push eax
mov eax, dword [esp + 0x78]
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.00407960
add esp, 4
lea esi, [esp + 8]
mov ecx, edi
call fcn.00407a00
mov ecx, dword [esp + 0x64]
pop esi
xor ecx, esp
call fcn.0043f097
add esp, 0x68
ret
Function at 0x401640
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov esi, eax
lea eax, [esp + 0x18]
push eax
push 0x20119
xor edi, edi
push edi
push 0x49ea68
push reloc.OLEAUT32.dll_SysReAllocString
mov ebx, ecx
mov dword [esp + 0x30], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4017d1
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
lea ecx, [esp + 0x10]
push ecx
mov dword [esi + 0x10], eax
push ebx
mov dword [esi + 0x14], eax
lea edx, [esp + 0x1c]
push edx
mov dword [esi + 0x18], eax
push eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov eax, dword [esp + 0x28]
push str.Operator
mov edi, 0x400
push eax
mov dword [esp + 0x28], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4016d3
cmp dword [esp + 0x14], 1
jne 0x4017b8
mov eax, dword [esp + 0x10]
sub edi, eax
mov dword [esi], ebx
lea ebx, [eax + ebx]
je 0x4017b8
mov eax, dword [esp + 0x18]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [esp + 0x10]
push ecx
push ebx
lea edx, [esp + 0x1c]
push edx
push 0
push str.IssueDate
push eax
mov dword [esp + 0x28], edi
call ebp
test eax, eax
jne 0x401718
cmp dword [esp + 0x14], 1
jne 0x4017b8
mov eax, dword [esp + 0x10]
mov dword [esi + 4], ebx
sub edi, eax
add ebx, eax
test edi, edi
je 0x4017b8
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x10]
push ecx
push ebx
lea edx, [esp + 0x1c]
push edx
push 0
push str.ExpirationDate
push eax
mov dword [esp + 0x28], edi
call ebp
test eax, eax
jne 0x40174f
cmp dword [esp + 0x14], 1
jne 0x4017b8
mov eax, dword [esp + 0x10]
mov dword [esi + 8], ebx
sub edi, eax
add ebx, eax
test edi, edi
je 0x4017b8
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x10]
push ecx
push ebx
lea edx, [esp + 0x1c]
push edx
push 0
push str.SignData
push eax
mov dword [esp + 0x28], edi
call ebp
test eax, eax
jne 0x4017b8
cmp dword [esp + 0x14], 3
jne 0x4017b8
mov eax, dword [esp + 0x10]
sub edi, eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], ebx
je 0x4017b8
lea eax, [esi + 0xc]
call fcn.00401520
test eax, eax
je 0x4017b8
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov ecx, 0x400
sub ecx, edi
push eax
mov dword [edx], ecx
mov esi, 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x401da0
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x6c
mov eax, dword [0x4a9150]
xor eax, esp
mov dword [esp + 0x68], eax
push esi
lea eax, [esp + 8]
mov esi, edx
push eax
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x18], 0x67452301
mov dword [esp + 0x1c], 0xefcdab89
mov dword [esp + 0x20], 0x98badcfe
mov dword [esp + 0x24], 0x10325476
call fcn.00405820
add esp, 8
test eax, eax
jne 0x401e0b
pop esi
mov ecx, dword [esp + 0x68]
xor ecx, esp
call fcn.0043f097
add esp, 0x6c
ret
mov eax, dword [esp + 0x74]
test eax, eax
jbe 0x401e20
push esi
lea ecx, [esp + 0x14]
call fcn.00407960
add esp, 4
lea esi, [esp + 0x10]
mov ecx, ebx
call fcn.00407a00
test edi, edi
je 0x401e3e
mov ecx, dword [esp + 0xc]
xor eax, eax
cmp ecx, dword [esp + 8]
sete al
mov dword [edi], eax
mov ecx, dword [esp + 0x6c]
pop esi
xor ecx, esp
mov eax, 1
call fcn.0043f097
add esp, 0x6c
ret

Function at 0x401ed0
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x64
mov eax, dword [0x4a9150]
xor eax, esp
mov dword [esp + 0x5c], eax
xor eax, eax
push esi
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
push edi
lea eax, [esp + 8]
mov edi, ecx
push eax
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.00405a20
add esp, 4
test eax, eax
jne 0x401f2e
pop edi
pop esi
mov ecx, dword [esp + 0x5c]
xor ecx, esp
call fcn.0043f097
add esp, 0x64
ret
lea esi, [esp + 8]
mov ecx, ebx
call fcn.00407a00
mov ecx, dword [esp + 0x64]
pop edi
pop esi
xor ecx, esp
mov eax, 1
call fcn.0043f097
add esp, 0x64
ret

Function at 0x401f50
Capabilities:
Hash data using sha256

Disassembly:
sub esp, 0x74
mov eax, dword [0x4a9150]
xor eax, esp
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x78]
xor ecx, ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ecx
push edi
lea ecx, [esp + 8]
push ecx
push eax
mov dword [esp + 0x10], 0x6a09e667
mov dword [esp + 0x14], 0xbb67ae85
mov dword [esp + 0x18], 0x3c6ef372
mov dword [esp + 0x1c], 0xa54ff53a
mov dword [esp + 0x20], 0x510e527f
mov dword [esp + 0x24], 0x9b05688c
mov dword [esp + 0x28], 0x1f83d9ab
mov dword [esp + 0x2c], 0x5be0cd19
call fcn.00405b10
add esp, 8
test eax, eax
jne 0x401fcf
pop edi
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.0043f097
add esp, 0x74
ret
mov eax, esi
lea edi, [esp + 8]
call fcn.00407010
mov ecx, dword [esp + 0x74]
pop edi
xor ecx, esp
mov eax, 1
call fcn.0043f097
add esp, 0x74
ret

Function at 0x403660
Capabilities:
Read file on windows

Disassembly:
push ecx
push 0
lea eax, [esp + 4]
push eax
push esi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x403692
push str.ReadFile__
push 0xfc
push str..QHImageHlp.c
xor edx, edx
call fcn.00408ae0
add esp, 0xc
xor eax, eax
pop ecx
ret
cmp esi, dword [esp]
je 0x4036b7
push 0x49ec00
push 0xfe
push str..QHImageHlp.c
mov edx, 1
call fcn.00408ee0
add esp, 0xc
xor eax, eax
pop ecx
ret
mov eax, 1
pop ecx
ret