joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45de20
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x493afb
mov eax, dword fs:[0]
push eax
sub esp, 0x438
mov eax, dword [0x4bd450]
xor eax, esp
mov dword [esp + 0x430], eax
push ebx
push esi
push edi
mov eax, dword [0x4bd450]
xor eax, esp
push eax
lea eax, [esp + 0x448]
mov dword fs:[0], eax
push 0x208
xor ebx, ebx
lea eax, [esp + 0x30]
push ebx
push eax
call fcn.00476ef0
push 0x208
lea ecx, [esp + 0x244]
push ebx
push ecx
call fcn.00476ef0
add esp, 0x18
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x28]
push ecx
push str.ImagePath
push str.SOFTWARE360Safe_tpi360Cactus
mov esi, 1
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x38], esi
mov dword [esp + 0x40], 0x208
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x45df61
mov dword [esp + 0x20], esi
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x450], ebx
lea edx, [esp + 0x1c]
push edx
push 0x20019
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x30], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x45df52
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x14]
mov dword [esp + 0x18], ebx
push ecx
lea edi, [esp + 0x28]
lea esi, [esp + 0x30]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x28], 0x104
call fcn.0040f290
test eax, eax
je 0x45df68
mov dword [esp + 0x450], 0xffffffff
mov eax, dword [esp + 0x1c]
cmp eax, ebx
je 0x45df47
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
xor eax, eax
jmp 0x45dfe9
mov dword [esp + 0x450], 0xffffffff
mov dword [esp + 0x18], ebx
xor eax, eax
jmp 0x45dfe9
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
push str.360leakfixer.exe
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x23c]
push eax
call esi
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea ecx, [esp + 0x234]
push ecx
call edi
test eax, eax
jne 0x45df29
push str.hipsver.dll
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x23c]
push eax
call esi
lea ecx, [esp + 0x234]
push ecx
call edi
test eax, eax
jne 0x45dfd0
mov dword [esp + 0x450], 0xffffffff
lea esi, [esp + 0x14]
call fcn.0040f310
xor eax, eax
jmp 0x45dfe9
mov dword [esp + 0x450], 0xffffffff
lea esi, [esp + 0x14]
call fcn.0040f310
mov eax, 1
mov ecx, dword [esp + 0x448]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x430]
xor ecx, esp
call fcn.00471eba
mov esp, ebp
pop ebp
ret
Function at 0x45e010
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0x10]
push esi
lea eax, [esp + 0xc]
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x45e090
push edi
push 0x512dc0
push esi
call fcn.00472b75
mov edi, eax
add esp, 8
test edi, edi
je 0x45e08f
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x45e086
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x1c]
push edx
push 0x4a5a68
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x45e086
cmp dword [esp + 0x1c], 0x34
jb 0x45e086
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 8]
mov dword [ebp + 0x66c], ecx
mov edx, dword [eax + 0xc]
mov dword [ebp + 0x668], edx
push edi
call fcn.00471eaf
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
Function at 0x45fd70
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, dword [esp + 0x10]
test ebp, ebp
jne 0x45fd80
lea eax, [ebp + 0xd]
pop ebp
ret 0xc
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
push edi
xor edi, edi
mov esi, ebp
lea ecx, [ecx]
push esi
call ebx
inc eax
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x45fd90
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx]
push edi
push ebp
push 7
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x4602e0
Capabilities:
Query or enumerate registry key

Disassembly:
push 0xffffffffffffffff
push 0x493a3b
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x4bd450]
xor eax, esp
mov dword [esp + 0x220], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4bd450]
xor eax, esp
push eax
lea eax, [esp + 0x23c]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [esp + 0x24c]
xor ebp, ebp
mov dword [esp + 0x28], ecx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x244], ebp
mov ebx, dword [esi + 4]
mov eax, dword [esi]
lea edx, [esp + 0x24]
push edx
or ebx, 0x2001f
push ebx
push ebp
push ecx
push eax
mov dword [esp + 0x38], ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
cmp edi, ebp
jne 0x46038e
mov ecx, dword [esp + 0x18]
xor eax, eax
cmp ecx, ebp
je 0x460372
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x18], ebp
mov ecx, dword [esp + 0x24]
and ebx, 0x300
mov dword [esp + 0x1c], ebp
mov edi, eax
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ebx
cmp eax, ebp
je 0x4603b3
mov dword [esp + 0x244], 0xffffffff
mov eax, dword [esp + 0x18]
cmp eax, ebp
je 0x4603ac
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x18], ebp
mov eax, edi
jmp 0x460460
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea eax, [esp + 0x2c]
push eax
push ebp
push ebp
push ebp
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x48]
push eax
push ebp
push ecx
mov dword [esp + 0x40], pe_nt_image_headers32
call edi
test eax, eax
jne 0x46041e
jmp 0x4603e0
lea ecx, [esp + 0x34]
push ecx
lea ecx, [esp + 0x1c]
call fcn.004602e0
mov ebx, eax
cmp ebx, ebp
jne 0x46048e
lea edx, [esp + 0x2c]
push edx
mov edx, dword [esp + 0x1c]
push ebp
push ebp
push ebp
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x48]
push ecx
push ebp
push edx
mov dword [esp + 0x40], pe_nt_image_headers32
call edi
test eax, eax
je 0x4603e0
mov eax, dword [esp + 0x18]
cmp eax, ebp
je 0x460431
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x18], ebp
mov edi, dword [esp + 0x28]
mov dword [esp + 0x1c], ebp
call fcn.004604f0
mov esi, eax
mov dword [esp + 0x244], 0xffffffff
mov eax, dword [esp + 0x18]
cmp eax, ebp
je 0x46045e
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x18], ebp
mov eax, esi
mov dword [esp + 0x1c], ebp
mov ecx, dword [esp + 0x23c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x220]
xor ecx, esp
call fcn.00471eba
add esp, 0x234
ret 4
mov dword [esp + 0x244], 0xffffffff
mov eax, dword [esp + 0x18]
cmp eax, ebp
je 0x4604ac
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x18], ebp
mov eax, ebx
jmp 0x460460
Function at 0x461060
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
lea ebp, [esp - 0x408]
sub esp, 0x408
push 0xffffffffffffffff
push 0x496300
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x4bd450]
xor eax, ebp
mov dword [ebp + 0x404], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0x410]
mov edi, ecx
mov ebx, dword [ebp + 0x414]
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], ecx
mov dword [ebp], ecx
mov byte [ebp - 4], 1
push 2
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
mov dword [ebp - 0x1c], esi
test esi, esi
jne 0x4610de
call fcn.0043aac0
mov edi, eax
jmp 0x461200
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x4610f7
call fcn.0043aac0
jmp 0x4611f7
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x20], ebx
test ebx, ebx
jne 0x461112
call fcn.0043aac0
jmp 0x4611f7
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [ebp - 0x14], edi
lea eax, [edi + 1]
cmp eax, edi
jae 0x461153
mov byte [ebp - 4], 0
lea eax, [ebp + 4]
cmp dword [ebp], eax
je 0x46113a
lea eax, [ebp]
call fcn.0045fd60
mov dword [ebp - 4], 0xffffffff
lea esi, [ebp - 0x18]
call fcn.00461820
mov eax, 0x8007000e
jmp 0x46121d
mov byte [ebp - 4], 2
mov ecx, 2
mul ecx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
test edx, edx
ja 0x46116d
cmp eax, 0xffffffff
jbe 0x461177
push 0x80070057
call fcn.00404ad0
cmp eax, 0x400
jbe 0x461190
lea edx, [ebp]
push edx
call fcn.0045fdc0
mov dword [ebp - 4], 1
jmp 0x4611b5
lea eax, [ebp + 4]
mov dword [ebp], eax
mov dword [ebp - 4], 1
jmp 0x4611b5
mov eax, dword [ebp]
test eax, eax
jne 0x4611c3
mov edi, 0x8007000e
jmp 0x4611f9
push edi
push eax
push edi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x4611dc
call fcn.0043aac0
jmp 0x4611f7
xor ecx, ecx
mov edx, dword [ebp]
mov word [edx + eax*2], cx
mov eax, dword [ebp + 0x418]
push eax
mov ecx, dword [ebp]
lea edx, [ebp - 0x28]
call fcn.00460f10
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov byte [ebp - 4], 0
lea ecx, [ebp + 4]
cmp dword [ebp], ecx
je 0x461214
lea eax, [ebp]
call fcn.0045fd60
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x404]
xor ecx, ebp
call fcn.00471eba
add ebp, 0x408
mov esp, ebp
pop ebp
ret 0xc
Function at 0x461840
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x492daa
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x4bd450]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
lea eax, [esi + 8]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov dword [esi + 0x20], ebx
mov byte [esp + 0x14], 1
mov dword [esi + 0x14c], ebx
mov byte [esp + 0x14], 2
mov dword [esi + 0x16c], ebx
mov byte [esp + 0x14], 3
mov dword [esi + 0x170], ebx
mov byte [esp + 0x14], 4
mov dword [esi + 0x174], ebx
mov byte [esp + 0x14], 5
xor eax, eax
mov dword [esi], 0x178
mov word [esi + 4], ax
xor ecx, ecx
mov word [esi + 6], cx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
xor edx, edx
push pe_nt_image_headers32
mov word [esi + 0x36], dx
lea edx, [esi + 0x4a]
push ebx
push edx
mov byte [esi + 0x34], 0xff
mov byte [esi + 0x38], bl
mov byte [esi + 0x39], bl
mov byte [esi + 0x3a], bl
mov byte [esi + 0x3b], bl
mov byte [esi + 0x3c], bl
mov byte [esi + 0x3d], bl
mov byte [esi + 0x3e], bl
mov dword [esi + 0x40], ebx
mov word [esi + 0x44], ax
mov word [esi + 0x46], cx
mov byte [esi + 0x48], 0xff
call fcn.00476ef0
add esp, 0xc
mov dword [esi + 0x150], ebx
mov dword [esi + 0x154], ebx
mov dword [esi + 0x158], ebx
mov dword [esi + 0x15c], ebx
mov dword [esi + 0x160], ebx
mov dword [esi + 0x164], ebx
mov dword [esi + 0x168], ebx
mov dword [esp + 0x14], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xc
ret 4
Function at 0x463cb0
Capabilities:
Copy file
Get common file path
Get explorer pid

Disassembly:
push 0xffffffffffffffff
push 0x4938f8
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4bd450]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x54]
mov edi, ecx
add edi, 0xfc
xor ebx, ebx
mov dword [esp + 0x14], edi
xor eax, eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x48], eax
mov edx, dword [esp + 0x50]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
lea ecx, [esp + 0x1c]
push ecx
push eax
push edx
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
call esi
test eax, eax
jne 0x463d71
mov dword [esp + 0x54], eax
lea eax, [esp + 0x54]
push eax
call dword [sym.imp.USER32.dll_GetShellWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [esp + 0x54]
call fcn.004698b0
mov ebx, eax
mov dword [esp + 0x18], ebx
test ebx, ebx
je 0x463e38
mov edx, dword [esp + 0x50]
lea ecx, [esp + 0x1c]
push ecx
push 0
push edx
call esi
test eax, eax
je 0x463e38
cmp dword [esp + 0x38], 0
jne 0x463e38
cmp dword [esp + 0x3c], 0x200000
ja 0x463e38
mov eax, dword [esp + 0x50]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov esi, eax
test esi, esi
je 0x463e38
push ebp
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x463e38
push esi
push ebp
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x463e38
mov ecx, 0x104
mov eax, ebp
xor esi, esi
cmp word [eax], 0
je 0x463dd8
add eax, 2
sub ecx, 1
jne 0x463dc8
jmp 0x463ddc
test ecx, ecx
jne 0x463e2f
mov esi, 0x80070057
xor edx, edx
mov eax, esi
test esi, esi
jl 0x463e03
push SysReAllocString
mov ecx, 0x104
sub ecx, edx
push str..ds_
lea edx, [ebp + edx*2]
call fcn.00404a70
test eax, eax
jne 0x463e38
mov ecx, dword [esp + 0x50]
push eax
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov esi, eax
mov dword [esp + 0x48], 0xffffffff
test ebx, ebx
je 0x463e2b
mov eax, dword [edi + 0x10]
test eax, eax
je 0x463e2b
call eax
mov eax, esi
jmp 0x463e4f
mov edx, 0x104
sub edx, ecx
jmp 0x463de3
mov dword [esp + 0x48], 0xffffffff
test ebx, ebx
je 0x463e4d
mov eax, dword [edi + 0x10]
test eax, eax
je 0x463e4d
call eax
xor eax, eax
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x38
ret 8
Function at 0x465000
Capabilities:
Create thread
Resume thread

Disassembly:
push 0xffffffffffffffff
push 0x4995ea
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4bd450]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x28]
xor edi, edi
mov dword [esp + 0x1c], edi
cmp ebx, edi
je 0x4650ac
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0x28]
push eax
push edi
mov dword [esp + 0x30], edi
call fcn.00464db0
mov ecx, dword [esp + 0x28]
cmp ecx, dword [0x511f4c]
jae 0x4650ac
push 0x512dc0
push 8
call fcn.004754b1
mov ebp, eax
add esp, 8
cmp ebp, edi
je 0x4650ac
xor eax, eax
push 0x512dc0
mov dword [ebp], eax
push 0x30
mov dword [ebp + 4], eax
call fcn.004754b1
add esp, 8
mov dword [esp + 0x28], eax
mov byte [esp + 0x1c], 1
cmp eax, edi
je 0x465094
push eax
call fcn.00461a30
mov esi, eax
jmp 0x465096
xor esi, esi
mov byte [esp + 0x1c], 0
mov dword [esp + 0x28], esi
cmp esi, edi
jne 0x4650c4
push ebp
call fcn.00471eaf
add esp, 4
mov dword [esp + 0x1c], 0xffffffff
lea ecx, [esp + 0x2c]
call fcn.00404e20
xor eax, eax
jmp 0x465148
mov edx, dword [ebx]
mov eax, dword [edx + 4]
push ebx
call eax
lea edi, [esi + 0x24]
lea eax, [esp + 0x2c]
mov dword [esi], 0xc1000
call fcn.00431800
mov dword [esi + 4], ebx
call fcn.0045b290
push 0
push 4
push ebp
push 0x464fb0
push 0
push 0
mov dword [ebp], eax
mov dword [ebp + 4], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, eax
test ebx, ebx
je 0x4650a3
mov edi, dword [esp + 0x24]
mov dword [esi + 0x28], ebx
lea esi, [edi + 0x1c]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea ecx, [esp + 0x28]
push ecx
add edi, 4
call fcn.00465280
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [esp + 0x1c], 0xffffffff
lea ecx, [esp + 0x2c]
call fcn.00404e20
mov eax, 1
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0xc
Function at 0x46bec0
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x68
mov eax, dword [0x4bd450]
xor eax, esp
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x6c]
xor ecx, ecx
push esi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], ecx
push eax
mov eax, dword [esp + 0x78]
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.0046fb60
add esp, 4
lea esi, [esp + 8]
mov ecx, edi
call fcn.0046fc00
mov ecx, dword [esp + 0x64]
pop esi
xor ecx, esp
call fcn.00471eba
add esp, 0x68
ret
Function at 0x46c030
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x14
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
push esi
push edi
mov esi, eax
lea eax, [esp + 0x1c]
push eax
push 0x20119
xor edi, edi
push edi
push str.SOFTWARE360MachineSignature
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x34], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x46c1c3
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
lea ecx, [esp + 0x14]
push ecx
mov dword [esi + 0x10], eax
push ebx
mov dword [esi + 0x14], eax
lea edx, [esp + 0x20]
push edx
mov dword [esi + 0x18], eax
push eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov eax, dword [esp + 0x2c]
push str.Operator
mov edi, 0x400
push eax
mov dword [esp + 0x2c], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x46c0c5
cmp dword [esp + 0x18], 1
jne 0x46c1aa
mov eax, dword [esp + 0x14]
sub edi, eax
mov dword [esi], ebx
lea ebx, [eax + ebx]
je 0x46c1aa
mov eax, dword [esp + 0x1c]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [esp + 0x14]
push ecx
push ebx
lea edx, [esp + 0x20]
push edx
push 0
push str.IssueDate
push eax
mov dword [esp + 0x2c], edi
call ebp
test eax, eax
jne 0x46c10a
cmp dword [esp + 0x18], 1
jne 0x46c1aa
mov eax, dword [esp + 0x14]
mov dword [esi + 4], ebx
sub edi, eax
add ebx, eax
test edi, edi
je 0x46c1aa
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x14]
push ecx
push ebx
lea edx, [esp + 0x20]
push edx
push 0
push str.ExpirationDate
push eax
mov dword [esp + 0x2c], edi
call ebp
test eax, eax
jne 0x46c141
cmp dword [esp + 0x18], 1
jne 0x46c1aa
mov eax, dword [esp + 0x14]
mov dword [esi + 8], ebx
sub edi, eax
add ebx, eax
test edi, edi
je 0x46c1aa
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x14]
push ecx
push ebx
lea edx, [esp + 0x20]
push edx
push 0
push str.SignData
push eax
mov dword [esp + 0x2c], edi
call ebp
test eax, eax
jne 0x46c1aa
cmp dword [esp + 0x18], 3
jne 0x46c1aa
mov eax, dword [esp + 0x14]
sub edi, eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], ebx
je 0x46c1aa
lea eax, [esi + 0xc]
call fcn.0046bf30
test eax, eax
je 0x46c1aa
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x2c]
mov ecx, 0x400
sub ecx, edi
push eax
mov dword [edx], ecx
mov esi, 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
mov eax, dword [esp + 0x1c]
mov esi, dword [esp + 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x46c5c0
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x6c
mov eax, dword [0x4bd450]
xor eax, esp
mov dword [esp + 0x64], eax
push ebx
mov ebx, dword [esp + 0x78]
push esi
lea eax, [esp + 8]
mov esi, edx
push eax
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x18], 0x67452301
mov dword [esp + 0x1c], 0xefcdab89
mov dword [esp + 0x20], 0x98badcfe
mov dword [esp + 0x24], 0x10325476
call fcn.0046e650
add esp, 8
test eax, eax
jne 0x46c631
pop esi
pop ebx
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00471eba
add esp, 0x6c
ret
mov eax, dword [esp + 0x78]
test eax, eax
jbe 0x46c646
push esi
lea ecx, [esp + 0x14]
call fcn.0046fb60
add esp, 4
lea esi, [esp + 0x10]
mov ecx, ebx
call fcn.0046fc00
test edi, edi
je 0x46c664
mov ecx, dword [esp + 0xc]
xor eax, eax
cmp ecx, dword [esp + 8]
sete al
mov dword [edi], eax
mov ecx, dword [esp + 0x6c]
pop esi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.00471eba
add esp, 0x6c
ret

Function at 0x46c6a0
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x64
mov eax, dword [0x4bd450]
xor eax, esp
mov dword [esp + 0x60], eax
push ebx
mov ebx, dword [esp + 0x6c]
xor eax, eax
push esi
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], eax
push edi
lea eax, [esp + 0x10]
mov edi, ecx
push eax
mov dword [esp + 0x14], 0x67452301
mov dword [esp + 0x18], 0xefcdab89
mov dword [esp + 0x1c], 0x98badcfe
mov dword [esp + 0x20], 0x10325476
call fcn.0046e840
add esp, 4
test eax, eax
jne 0x46c704
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x60]
xor ecx, esp
call fcn.00471eba
add esp, 0x64
ret
lea esi, [esp + 0x10]
mov ecx, ebx
call fcn.0046fc00
mov ecx, dword [esp + 0x6c]
pop edi
pop esi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.00471eba
add esp, 0x64
ret

Function at 0x46c730
Capabilities:
Hash data using sha256

Disassembly:
sub esp, 0x74
mov eax, dword [0x4bd450]
xor eax, esp
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x78]
xor ecx, ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ecx
push edi
lea ecx, [esp + 8]
push ecx
push eax
mov dword [esp + 0x10], 0x6a09e667
mov dword [esp + 0x14], 0xbb67ae85
mov dword [esp + 0x18], 0x3c6ef372
mov dword [esp + 0x1c], 0xa54ff53a
mov dword [esp + 0x20], 0x510e527f
mov dword [esp + 0x24], 0x9b05688c
mov dword [esp + 0x28], 0x1f83d9ab
mov dword [esp + 0x2c], 0x5be0cd19
call fcn.0046e920
add esp, 8
test eax, eax
jne 0x46c7af
pop edi
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00471eba
add esp, 0x74
ret
mov eax, esi
lea edi, [esp + 8]
call fcn.0046f720
mov ecx, dword [esp + 0x74]
pop edi
xor ecx, esp
mov eax, 1
call fcn.00471eba
add esp, 0x74
ret

Function at 0x46d1b0
Capabilities:
Read file on windows

Disassembly:
push ecx
push 0
lea eax, [esp + 4]
push eax
push esi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x46d1db
push 0x4a5b20
mov eax, 0x4a5b20
call fcn.00470660
add esp, 4
xor eax, eax
pop ecx
ret
mov eax, 1
cmp esi, dword [esp]
je 0x46d1f4
push 0x4a5b20
call fcn.004706d0
add esp, 4
xor eax, eax
pop ecx
ret
Function at 0x46daa0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x28
mov eax, dword [0x4bd450]
xor eax, esp
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x38]
push ebx
push ebp
xor ebx, ebx
push esi
mov esi, ecx
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], ebx
cmp eax, ebx
jne 0x46dad3
mov dword [esp + 0x10], 0xffffffff
jmp 0x46dad9
mov eax, dword [eax]
mov dword [esp + 0x10], eax
mov ebp, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
push ebx
push ebx
push ebp
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x46db07
push 0x4a5b20
mov eax, 0x4a5b20
call fcn.00470660
add esp, 4
jmp 0x46dbe7
push 0
lea edx, [esp + 0x1c]
push edx
push 8
lea eax, [esp + 0x30]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x46db37
push 0x4a5b20
mov eax, 0x4a5b20
call fcn.00470660
add esp, 4
jmp 0x46dbe7
mov eax, 8
cmp dword [esp + 0x18], eax
je 0x46db59
mov eax, 1
push 0x4a5b20
call fcn.004706d0
add esp, 4
jmp 0x46dbe7
cmp dword [esp + 0x40], ebx
je 0x46db95
mov ebx, eax
cmp dword [esp + 0x10], eax
jae 0x46db7b
mov eax, 5
push 0x4a5b20
call fcn.004706d0
add esp, 4
jmp 0x46dbe7
mov ecx, dword [esp + 0x24]
mov dx, word [esp + 0x28]
mov dword [esi], ecx
mov cx, word [esp + 0x2a]
mov word [esi + 4], dx
mov word [esi + 6], cx
jmp 0x46dbdf
mov esi, dword [esp + 0x24]
cmp esi, dword [esp + 0x10]
jbe 0x46dba3
mov ebx, esi
jmp 0x46db67
mov edx, dword [esp + 0x38]
xor ebx, ebx
push ebx
push ebx
push ebp
push edx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x46dbcc
push 0x4a5b20
mov eax, 0x4a5b20
call fcn.00470660
add esp, 4
jmp 0x46dbe7
mov ecx, dword [esp + 0x20]
mov edx, edi
call fcn.0046d1b0
test eax, eax
je 0x46dbe7
mov ebx, dword [esp + 0x24]
mov dword [esp + 0x14], 1
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x46dbf1
mov dword [eax], ebx
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x14]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00471eba
add esp, 0x28
ret