joyce8/EMBER2024-capa huggingface dataset:
Function at 0x420ac4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [ebp - 4], ebx
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], ebx
jb 0x420ae1
mov eax, dword [esi]
jmp 0x420ae3
mov eax, esi
xor ecx, ecx
mov edi, str.00000000_0000_0000_0000_000000000000
push edi
mov word [eax], cx
call fcn.0040133f
pop ecx
push eax
push edi
mov ecx, esi
call fcn.004065c1
push 0x495db8
push str.kernel32
mov dword [ebp - 0xc], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x420b35
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call edi
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, dword [ebp - 0xc]
jmp 0x420b38
mov ecx, dword [ebp - 0xc]
xor edi, edi
mov edx, 0x101
inc edi
test ecx, ecx
lea ecx, [ebp - 4]
mov eax, edi
push ecx
cmovne eax, edx
push eax
push ebx
push str.SOFTWAREMicrosoftCryptography
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x420c02
lea eax, [ebp - 8]
mov dword [ebp - 8], ebx
push eax
push ebx
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], edi
push eax
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push str.MachineGuid
push dword [ebp - 4]
call ebx
test eax, eax
jne 0x420bf9
mov eax, dword [ebp - 8]
test eax, eax
je 0x420bf9
add eax, 2
push eax
call fcn.0044a832
pop ecx
mov edi, eax
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp - 0x10]
push eax
push 0
push str.MachineGuid
push dword [ebp - 4]
call ebx
test eax, eax
jne 0x420bf9
mov eax, dword [ebp - 8]
test eax, eax
je 0x420bf9
xor ecx, ecx
mov word [edi + eax], cx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [esi + 0x10], 0
cmp dword [esi + 0x14], 8
jb 0x420bd9
mov eax, dword [esi]
jmp 0x420bdb
mov eax, esi
xor ecx, ecx
push edi
mov word [eax], cx
call fcn.0040133f
pop ecx
push eax
push edi
mov ecx, esi
call fcn.004065c1
push edi
call fcn.00428740
pop ecx
jmp 0x420c02
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4214c1
Capabilities:
Get local ipv4 addresses
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x4a9074]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x178
push edi
mov edi, ecx
mov dword [ebp - 0x30], eax
push eax
mov dword [ebp - 0x38], edi
call fcn.0044a832
mov esi, dword [sym.imp.IPHLPAPI.DLL_GetAdaptersAddresses]
mov ebx, eax
pop ecx
lea eax, [ebp - 0x30]
push eax
push ebx
push 0
push 0x10
push 2
call esi
cmp eax, 0x6f
jne 0x421614
push ebx
call fcn.00428740
push dword [ebp - 0x30]
call fcn.0044a832
pop ecx
pop ecx
mov ebx, eax
lea eax, [ebp - 0x30]
push eax
push ebx
push 0
push 0x10
push 2
call esi
test eax, eax
jne 0x4215f5
mov esi, ebx
mov dword [ebp - 0x34], esi
test ebx, ebx
je 0x4215f5
cmp dword [esi + 0x34], 6
jne 0x4215e5
push 9
pop ecx
xor eax, eax
lea edi, [ebp - 0x2c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
movzx eax, byte [esi + 0x31]
push eax
movzx eax, byte [esi + 0x30]
push eax
movzx eax, byte [esi + 0x2f]
push eax
movzx eax, byte [esi + 0x2e]
push eax
movzx eax, byte [esi + 0x2d]
push eax
movzx eax, byte [esi + 0x2c]
push eax
push str._02X__02X__02X__02X__02X__02X
lea eax, [ebp - 0x2c]
push 0x13
push eax
call fcn.004011aa
mov edi, dword [ebp - 0x38]
add esp, 0x24
cmp dword [esi + 0x40], 0x47
jne 0x4215e5
mov eax, dword [edi]
mov esi, dword [eax]
cmp esi, eax
je 0x4215b3
lea eax, [esi + 8]
cmp dword [eax + 0x14], 8
jb 0x42159d
mov eax, dword [eax]
lea ecx, [ebp - 0x2c]
push ecx
push eax
call fcn.0044a1ec
pop ecx
pop ecx
test eax, eax
je 0x4215b3
mov esi, dword [esi]
cmp esi, dword [edi]
jne 0x421592
cmp esi, dword [edi]
je 0x4215e2
mov ecx, dword [esi + 4]
mov eax, dword [esi]
push 0
push 1
mov dword [ecx], eax
mov ecx, dword [esi]
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
lea ecx, [esi + 8]
dec dword [edi + 4]
call fcn.0040626d
push 0x20
push 1
push esi
call fcn.0040140c
add esp, 0xc
mov esi, dword [ebp - 0x34]
mov eax, dword [esi + 8]
mov esi, eax
mov dword [ebp - 0x34], eax
test eax, eax
jne 0x42153a
push ebx
call fcn.00428740
cmp dword [edi + 4], 1
sete al
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00437519
mov esp, ebp
pop ebp
ret
test eax, eax
je 0x421518
push ebx
call fcn.00428740
xor al, al
jmp 0x421602
Function at 0x42185f
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x224
mov eax, 0x47c926
call fcn.00437feb
mov edi, ecx
mov dword [ebp - 0x228], edi
push 0x495ef8
push str.ReadUIIDFromRegistry
push 0x8d
xor ebx, ebx
lea ecx, [ebp - 0x220]
push 3
mov dword [ebp - 0x230], ebx
call fcn.00409a60
mov dword [ebp - 4], ebx
mov edx, str.Entering_ReadUIIDFromRegistry
mov ecx, dword [eax]
call fcn.004112cc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x220]
call fcn.00409aa0
mov esi, 0x208
mov dword [ebp - 0x224], ebx
push esi
lea eax, [ebp - 0x21c]
push ebx
push eax
call fcn.0043d1d0
add esp, 0xc
mov dword [ebp - 0x228], esi
lea eax, [ebp - 0x224]
push eax
push 0x20219
push ebx
push str.SOFTWAREMcAfeePartnerCustomization
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x42198d
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x21c]
push eax
push ebx
push ebx
push str.UIID
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, 0x495ef8
lea ecx, [ebp - 0x220]
mov esi, eax
push ebx
push str.ReadUIIDFromRegistry
test esi, esi
jne 0x421967
push 0x96
push 3
call fcn.00409a60
mov dword [ebp - 4], 1
mov edx, str.UIID_from_registry_:
mov ecx, dword [eax]
call fcn.004112cc
lea edx, [ebp - 0x21c]
mov ecx, eax
call fcn.00411504
jmp 0x4219df
push 0x99
push 4
call fcn.00409a60
mov dword [ebp - 4], 2
mov edx, str.Failed_to_read_registry_value_of_:
mov ecx, dword [eax]
call fcn.004112cc
mov edx, str.UIID
jmp 0x4219c2
mov ebx, 0x495ef8
lea ecx, [ebp - 0x220]
push ebx
push str.ReadUIIDFromRegistry
push 0x9d
push 4
call fcn.00409a60
mov dword [ebp - 4], 3
mov edx, str.Failed_to_open_registry_key_:
mov ecx, dword [eax]
call fcn.004112cc
mov edx, str.SOFTWAREMcAfeePartnerCustomization
push esi
push ecx
mov ecx, eax
call fcn.00411504
mov edx, str.._Error:
mov ecx, eax
call fcn.004112cc
pop ecx
mov ecx, eax
call fcn.0040ef8c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x220]
call fcn.00409aa0
cmp dword [ebp - 0x224], 0
je 0x421a03
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
push str.ReadUIIDFromRegistry
push 0xa2
push 3
lea ecx, [ebp - 0x22c]
call fcn.00409a60
mov dword [ebp - 4], 4
mov edx, str.Leaving_ReadUIIDFromRegistry
mov ecx, dword [eax]
call fcn.004112cc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x22c]
call fcn.00409aa0
lea eax, [ebp - 0x21c]
mov ecx, edi
push eax
call fcn.0040e4c4
mov eax, edi
call fcn.00437f95
ret
Function at 0x421a53
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14
mov eax, 0x47c976
call fcn.00437fb7
mov ebx, 0x495ef8
lea ecx, [ebp - 0x18]
push ebx
push str.ReadPollingTimeFromRegistry
push 0xa8
push 3
call fcn.00409a60
xor edi, edi
mov edx, str.Entering_ReadPollingTimeFromRegistry
mov dword [ebp - 4], edi
mov ecx, dword [eax]
call fcn.004112cc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00409aa0
or dword [ebp - 0x14], 0xffffffff
lea eax, [ebp - 0x10]
push eax
push 0x20219
push edi
push str.SOFTWAREMcAfeePartnerCustomization
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x1c], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x421b5b
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
push edi
push edi
push str.PollingTimeForPurchaseMonitoring
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
lea ecx, [ebp - 0x18]
mov edi, str.ReadPollingTimeFromRegistry
push ebx
push edi
test esi, esi
jne 0x421b27
push 0xb3
push 3
call fcn.00409a60
mov dword [ebp - 4], 1
mov edx, str.Polling_time_is
mov ecx, dword [eax]
call fcn.004112cc
push dword [ebp - 0x14]
mov ecx, eax
call fcn.0040ef8c
mov edx, str._milliseconds
mov ecx, eax
call fcn.004112cc
jmp 0x421ba6
push 0xb7
push 4
call fcn.00409a60
mov dword [ebp - 4], 2
mov edx, str.Failed_to_read_registry_value_of_:
mov ecx, dword [eax]
call fcn.004112cc
push esi
push ecx
mov edx, str.PollingTimeForPurchaseMonitoring
mov ecx, eax
call fcn.00411504
mov edx, str.__Error:
jmp 0x421b97
push ebx
mov edi, str.ReadPollingTimeFromRegistry
lea ecx, [ebp - 0x18]
push edi
push 0xbc
push 4
call fcn.00409a60
mov dword [ebp - 4], 3
mov edx, str.Failed_to_open_registry_key_:
mov ecx, dword [eax]
call fcn.004112cc
push esi
push ecx
mov edx, str.SOFTWAREMcAfeePartnerCustomization
mov ecx, eax
call fcn.00411504
mov edx, str.._Error:
mov ecx, eax
call fcn.004112cc
pop ecx
mov ecx, eax
call fcn.0040ef8c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00409aa0
cmp dword [ebp - 0x10], 0
je 0x421bc1
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
push edi
push 0xc2
push 3
lea ecx, [ebp - 0x20]
call fcn.00409a60
mov dword [ebp - 4], 4
mov edx, str.Leaving_ReadPollingTimeFromRegistry
mov ecx, dword [eax]
call fcn.004112cc
lea ecx, [ebp - 0x20]
call fcn.00409aa0
mov eax, dword [ebp - 0x14]
call fcn.00437f80
ret
Function at 0x421d3f
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x244
mov eax, 0x47ca57
call fcn.00437feb
mov esi, ecx
push 0x495ef8
push str.IsProductInstalled
push 0xe1
push 3
lea ecx, [ebp - 0x244]
call fcn.00409a60
xor ebx, ebx
mov edx, str.Entering_IsProductInstalled
mov dword [ebp - 4], ebx
mov ecx, dword [eax]
call fcn.004112cc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x244]
call fcn.00409aa0
mov edi, 0x208
mov dword [ebp - 0x248], ebx
push edi
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.0043d1d0
add esp, 0xc
mov dword [ebp - 0x24c], edi
lea eax, [ebp - 0x248]
push eax
push 0xf023f
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallMSC
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
sub esp, 0x28
mov dword [esi], eax
mov eax, dword [ebp - 0x248]
mov ecx, esp
mov dword [ecx], vtable.std::_Func_impl_class__lambda_9d1d1ee315376f20ff2f9b369ee32c87___class_std::allocator_int___void___.0
mov dword [ecx + 4], eax
mov dword [ecx + 0x24], ecx
lea ecx, [ebp - 0x240]
call fcn.00409ea8
inc ebx
xor edi, edi
mov dword [ebp - 4], ebx
cmp dword [esi], edi
jne 0x421e93
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x218]
push eax
push edi
push edi
push str.DisplayName
push dword [ebp - 0x248]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [esi], eax
lea ecx, [ebp - 0x244]
push 0x495ef8
push str.IsProductInstalled
test eax, eax
jne 0x421e70
push 0xf0
push 3
call fcn.00409a60
mov byte [ebp - 4], 2
mov edx, str.Display_Name_is
mov ecx, dword [eax]
call fcn.004112cc
lea edx, [ebp - 0x218]
mov ecx, eax
call fcn.00411504
lea ecx, [ebp - 0x244]
mov byte [ebp - 4], bl
call fcn.00409aa0
jmp 0x421ef2
push 0xf6
push 4
call fcn.00409a60
mov byte [ebp - 4], 3
mov edx, str.Failed_to_read_registry_value_of_:
mov ecx, dword [eax]
call fcn.004112cc
mov edx, str.DisplayName
jmp 0x421ec4
push 0x495ef8
push str.IsProductInstalled
push 0xfc
push 4
lea ecx, [ebp - 0x244]
call fcn.00409a60
mov byte [ebp - 4], 4
mov edx, str.Failed_to_open_registry_key_:
mov ecx, dword [eax]
call fcn.004112cc
mov edx, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallMSC
push dword [esi]
push ecx
mov ecx, eax
call fcn.00411504
mov edx, str.._Error:
mov ecx, eax
call fcn.004112cc
pop ecx
mov ecx, eax
call fcn.0040eeaa
lea ecx, [ebp - 0x244]
mov byte [ebp - 4], bl
call fcn.00409aa0
mov ebx, edi
push 0x495ef8
push str.IsProductInstalled
push 0x100
push 3
lea ecx, [ebp - 0x250]
call fcn.00409a60
mov byte [ebp - 4], 5
mov edx, str.Leaving_IsProductInstalled
mov ecx, dword [eax]
call fcn.004112cc
lea ecx, [ebp - 0x250]
call fcn.00409aa0
lea ecx, [ebp - 0x240]
call fcn.00409ee9
mov eax, ebx
call fcn.00437f95
ret
Function at 0x4229d4
Capabilities:
Get common file path

Disassembly:
push 0x34
mov eax, 0x47cc3d
call fcn.00437feb
xor ebx, ebx
mov dword [ebp - 0x18], 7
xor eax, eax
mov dword [ebp - 0x1c], ebx
mov word [ebp - 0x2c], ax
lea eax, [ebp - 0x34]
mov dword [ebp - 4], ebx
push eax
push ebx
push ebx
push 0x480838
mov dword [ebp - 0x34], ebx
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
mov esi, eax
test esi, esi
jns 0x422a4e
push str.McInstrumentation.cpp
push str.CreateTaskInScheduler
push 0x6e
push 4
lea ecx, [ebp - 0x30]
call fcn.00409a60
push esi
mov byte [ebp - 4], 1
mov edx, str.Unable_to_get_Program_data_path_Error:
push ecx
mov ecx, dword [eax]
call fcn.00411504
pop ecx
mov ecx, eax
call fcn.0040ef8c
lea ecx, [ebp - 0x30]
call fcn.00409aa0
mov esi, ebx
jmp 0x422b53
push dword [ebp - 0x34]
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x1c], ebx
call fcn.0040e491
push dword [ebp - 0x34]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push 0x48e794
lea ecx, [ebp - 0x2c]
call fcn.0040e491
push str.McAfeeMcInstruTrackMcInstruTrack.exe
lea ecx, [ebp - 0x2c]
call fcn.0040e491
push 0x34
call fcn.0044a832
pop ecx
mov dword [ebp - 0x30], eax
mov byte [ebp - 4], 2
test eax, eax
je 0x422a9b
mov ecx, eax
call fcn.00409f36
jmp 0x422a9d
mov eax, ebx
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x3c]
push eax
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], ebx
call fcn.00423e6c
sub esp, 0x18
mov byte [ebp - 4], 3
mov ecx, esp
mov dword [ebp - 0x30], esp
push 0x496730
call fcn.0040e4c4
sub esp, 0x18
mov byte [ebp - 4], 4
mov ecx, esp
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x40], ecx
push eax
call fcn.00406245
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ecx]
mov byte [ebp - 4], 3
call dword [eax + 0x78]
lea ecx, [ebp - 0x30]
push str.McInstrumentation.cpp
push str.CreateTaskInScheduler
test al, al
je 0x422b1d
push 0x7c
push 3
call fcn.00409a60
mov byte [ebp - 4], 5
mov edx, str.Successfully_created_ScheduledTask
mov ecx, dword [eax]
call fcn.004112cc
lea ecx, [ebp - 0x30]
call fcn.00409aa0
xor esi, esi
inc esi
jmp 0x422b43
push 0x80
push 4
call fcn.00409a60
mov byte [ebp - 4], 6
mov edx, str.Failed_to_create_ScheduledTask
mov ecx, dword [eax]
call fcn.004112cc
lea ecx, [ebp - 0x30]
call fcn.00409aa0
mov esi, ebx
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x38]
test ecx, ecx
je 0x422b53
call fcn.00406bbc
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.0040626d
mov eax, esi
call fcn.00437f95
ret

Function at 0x42a210
Capabilities:
Hash data using sha1
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 8]
lea esi, [edi + 8]
test eax, eax
je 0x42a22b
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov dword [esi], 0
mov eax, dword [edi + 4]
test eax, eax
je 0x42a25e
cmp dword [edi + 0x98], 0x20000
push esi
push 0
push 0
jne 0x42a252
push 0x8003
push eax
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
pop edi
pop esi
ret
push 0x8004
push eax
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
pop edi
pop esi
ret
Function at 0x42a290
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47dcca
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x4a9074]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 4], 0
cmp dword [edi + 0x90], 0
je 0x42a2d7
mov al, 1
jmp 0x42a3d9
movups xmm0, xmmword [str.winmgmt]
lea eax, [ebp - 0x24]
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], eax
movups xmmword [ebp - 0x24], xmm0
mov dword [ebp - 0x2c], 0xa
mov dword [ebp - 0x28], 3
push 0
push 0
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 1
push eax
push 0x429290
push 0
push 0
call fcn.0044fea5
add esp, 0x18
mov dword [ebp - 0x34], eax
lea ecx, [ebp - 0x34]
call fcn.00429650
mov byte [ebp - 4], 0
mov esi, eax
mov ecx, dword [ebp - 0x34]
test ecx, ecx
je 0x42a339
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 1
jne 0x42a3d7
push 0x30
call fcn.0044a832
mov esi, eax
add esp, 4
mov dword [ebp - 0x38], esi
mov byte [ebp - 4], 2
test esi, esi
je 0x42a3ba
lea ecx, [esi + 4]
mov dword [esi], vtable.CMcLock.0
push ecx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov byte [ebp - 4], 3
lea ebx, [esi + 0x28]
mov dword [esi], vtable.CWMIData.0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [esi + 0x24], 0
mov dword [ebp - 0x3c], ebx
mov dword [ebx], 0
mov dword [ebx + 4], 0
call fcn.0042e8e0
mov dword [ebx], eax
mov ecx, esi
mov byte [ebp - 4], 4
call fcn.0042da50
test esi, esi
mov dword [esi + 0x1c], eax
mov dword [edi + 0x90], esi
setne al
jmp 0x42a3d9
xor esi, esi
test esi, esi
mov dword [edi + 0x90], esi
setne al
jmp 0x42a3d9
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00437519
mov esp, ebp
pop ebp
ret
Function at 0x42b540
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x54
mov eax, dword [0x4a9074]
xor eax, esp
mov dword [esp + 0x50], eax
push ebx
push esi
push edi
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
cmp eax, 1
jne 0x42b611
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
call fcn.00479310
addsd xmm0, qword [0x4993c0]
call fcn.00479630
movsd qword [esp + 0x10], xmm0
movsd xmm0, qword [0x4993c8]
call fcn.00479630
movsd xmm1, qword [esp + 0x10]
divsd xmm1, xmm0
movaps xmm0, xmm1
call fcn.004791e1
mov ebx, eax
shr eax, 0x1f
movd xmm0, ebx
cvtdq2pd xmm0, xmm0
addsd xmm0, qword [eax*8 + 0x4993f0]
call fcn.00479380
call fcn.004791e1
mov edi, eax
lea eax, [edi*2 + 4]
push eax
call fcn.0044a832
mov esi, eax
add esp, 4
test esi, esi
je 0x42b613
push ebx
push 0x499120
lea eax, [edi + 2]
push eax
push esi
call fcn.004011aa
add esp, 0x10
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x50]
xor ecx, esp
call fcn.00437519
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [esp + 0x5c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00437519
mov esp, ebp
pop ebp
ret

Function at 0x42c4a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, ecx
push edi
test ebx, ebx
je 0x42c4b8
lea eax, [ebx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push esi
mov esi, dword [ebp + 0x10]
mov edi, 1
test esi, esi
je 0x42c564
cmp dword [ebx + 0x40], 0
lea eax, [ebp - 8]
push eax
mov ecx, 0x20019
mov eax, 0x20119
cmove eax, ecx
push eax
push 0
push str.SOFTWAREMicrosoftCryptography
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, 2
jne 0x42c4fe
mov dword [esi], 0
jmp 0x42c566
test eax, eax
jne 0x42c55e
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jne 0x42c53c
test esi, esi
je 0x42c53c
lea eax, [ebp - 4]
push eax
push ecx
push ecx
push ecx
push str.MachineGuid
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 2
jne 0x42c52f
mov dword [esi], 0
jmp 0x42c566
test eax, eax
jne 0x42c55e
mov eax, dword [ebp - 4]
shr eax, 1
mov dword [esi], eax
jmp 0x42c566
mov eax, dword [esi]
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push ecx
push 0
push 0
push str.MachineGuid
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x42c566
mov dword [esi], 0
xor edi, edi
pop esi
test ebx, ebx
je 0x42c575
lea ecx, [ebx + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x42d460
Capabilities:
Encrypt data using rc4 via winapi
Encrypt or decrypt via wincrypt
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, ecx
test ebx, ebx
je 0x42d567
cmp dword [ebp + 8], 0
je 0x42d567
mov eax, dword [esi]
push edi
test eax, eax
je 0x42d55c
lea ecx, [ebp + 0xc]
mov dword [ebp - 8], 0
push ecx
push 0
push 0
push 0x8003
push eax
lea edi, [esi + 4]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x42d4e2
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x42d4e2
push 0
push 0x20
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x42d4d9
lea eax, [ebp - 8]
push eax
push 1
push dword [ebp + 0xc]
push 0x6801
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov edi, dword [ebp - 8]
test edi, edi
je 0x42d55c
mov eax, dword [ebx]
xor esi, esi
push eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push esi
push esi
push 1
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
je 0x42d54a
mov eax, dword [ebp - 4]
test eax, eax
je 0x42d548
push eax
call fcn.0044a832
mov esi, eax
add esp, 4
test esi, esi
je 0x42d54a
push dword [ebx]
push dword [ebp + 8]
push esi
call fcn.0043cc50
add esp, 0xc
push dword [ebp - 4]
push ebx
push esi
push 0
push 1
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
jne 0x42d54a
push esi
call fcn.00448c6c
add esp, 4
xor esi, esi
push edi
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x42d580
Capabilities:
Encrypt data using rc4 via winapi
Encrypt or decrypt via wincrypt
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, ecx
test ebx, ebx
jne 0x42d599
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [esi]
push edi
xor edi, edi
test eax, eax
je 0x42d614
lea ecx, [ebp + 0xc]
mov dword [ebp - 4], edi
push ecx
push edi
push edi
push 0x8003
push eax
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x42d5f3
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x42d5f3
push edi
push 0x20
lea ecx, [esi + 4]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x42d5ea
lea eax, [ebp - 4]
push eax
push 1
push dword [ebp + 0xc]
push 0x6801
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov esi, dword [ebp - 4]
test esi, esi
je 0x42d614
push ebx
push dword [ebp + 8]
push 0
push 1
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
push esi
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10