joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43fbb0
Capabilities:
Send data
Send data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x48
mov eax, dword [0x4fa078]
xor eax, esp
mov dword [esp + 0x44], eax
mov eax, dword [ecx]
mov dword [esp + 0x14], ecx
push esi
mov esi, dword [ebp + 8]
push edi
cmp eax, 0xffffffff
je 0x43fd21
push 4
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], 1
push ecx
push 0x20
push 0xffff
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
push esi
mov edx, 0x53503251
lea ecx, [esp + 0x38]
call fcn.0043f350
mov ecx, dword [esp + 0x20]
add esp, 4
mov dword [esp + 0x14], 0
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 8]
sub eax, edx
sar eax, 2
test eax, eax
je 0x43fcd1
mov eax, dword [esp + 0x14]
lea edi, [esp + 0x34]
mov ecx, dword [ecx]
xorps xmm0, xmm0
cmp dword [esp + 0x48], 0x10
mov esi, dword [esp + 0x44]
movzx eax, word [edx + eax*4]
cmovae edi, dword [esp + 0x34]
mov dword [esp + 0x18], ecx
mov ecx, 2
movaps xmmword [esp + 0x20], xmm0
push eax
mov word [esp + 0x24], cx
call dword [sym.imp.WS2_32.dll_htons]
push str.255.255.255.255
mov word [esp + 0x26], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
push 0x10
mov dword [esp + 0x28], eax
lea eax, [esp + 0x24]
push eax
push 0
push esi
push edi
push dword [esp + 0x2c]
call dword [sym.imp.WS2_32.dll_sendto]
test eax, eax
jle 0x43fcb1
nop dword [eax]
cmp eax, esi
jae 0x43fcb1
push 0x10
add edi, eax
sub esi, eax
lea eax, [esp + 0x24]
push eax
push 0
push esi
push edi
push dword [esp + 0x2c]
call dword [sym.imp.WS2_32.dll_sendto]
test eax, eax
jg 0x43fc90
mov ecx, dword [esp + 0x1c]
mov esi, dword [esp + 0x14]
inc esi
mov dword [esp + 0x14], esi
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 8]
sub eax, edx
sar eax, 2
cmp esi, eax
jb 0x43fc26
push 4
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0
push eax
push 0x20
push 0xffff
push dword [ecx]
call dword [sym.imp.WS2_32.dll_setsockopt]
mov edx, dword [esp + 0x48]
cmp edx, 0x10
jb 0x43fd21
mov ecx, dword [esp + 0x34]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x43fd17
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43fd34
push edx
push ecx
call fcn.0044bf44
add esp, 8
mov ecx, dword [esp + 0x4c]
pop edi
pop esi
xor ecx, esp
call fcn.0044b7d5
mov esp, ebp
pop ebp
ret 4
call fcn.004aba6c
int3
Function at 0x4409f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, ecx
mov dword [esp + 8], eax
add eax, 0x28
push edi
push eax
mov dword [esp + 0x40], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, esi
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0xf
mov byte [esp + 0x10], 0
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x440a30
sub ecx, edx
push ecx
push esi
lea ecx, [esp + 0x18]
call fcn.00407000
cmp dword [esp + 0x24], 0x10
lea esi, [esp + 0x10]
mov ebx, dword [esp + 0x10]
mov edx, 0x811c9dc5
mov edi, dword [esp + 0x20]
cmovae esi, ebx
xor ecx, ecx
test edi, edi
je 0x440a74
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x440a63
mov edi, dword [esp + 0xc]
mov eax, dword [edi + 0x58]
mov ecx, dword [edi + 0x4c]
and eax, edx
mov edi, dword [edi + 0x44]
mov dword [esp + 0x28], edi
mov esi, dword [ecx + eax*8]
add eax, eax
mov edx, dword [ecx + eax*4]
inc eax
mov dword [esp + 0x2c], edx
lea eax, [ecx + eax*4]
mov dword [esp + 0x30], eax
nop dword [eax + eax]
cmp edx, edi
jne 0x440aa8
mov eax, edi
jmp 0x440aac
mov eax, dword [eax]
mov eax, dword [eax]
cmp esi, eax
je 0x440b26
cmp dword [esp + 0x24], 0x10
lea edx, [esp + 0x10]
mov edi, dword [esi + 0x1c]
lea ecx, [esi + 8]
cmovae edx, ebx
mov dword [esp + 0x34], edi
cmp edi, 0x10
mov edi, dword [esp + 0x28]
jb 0x440ad2
mov ecx, dword [esi + 8]
push dword [esp + 0x20]
mov eax, dword [esi + 0x18]
push edx
mov edx, eax
mov dword [esp + 0x40], eax
call fcn.00409ec0
add esp, 8
test al, al
jne 0x440af8
mov esi, dword [esi]
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x30]
jmp 0x440aa0
cmp dword [esp + 0x34], 0x10
lea eax, [esi + 8]
jb 0x440b04
mov eax, dword [eax]
cmp dword [esp + 0x24], 0x10
lea ecx, [esp + 0x10]
push dword [esp + 0x38]
mov edx, dword [esp + 0x24]
cmovae ecx, ebx
push eax
call fcn.00409ec0
add esp, 8
test al, al
cmovne edi, esi
mov eax, dword [esp + 0x24]
cmp eax, 0x10
jb 0x440b56
lea ecx, [eax + 1]
mov eax, ebx
cmp ecx, 0x1000
jb 0x440b4c
mov ebx, dword [ebx - 4]
add ecx, 0x23
sub eax, ebx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x440b79
push ecx
push ebx
call fcn.0044bf44
add esp, 8
mov eax, dword [esp + 0xc]
cmp edi, dword [eax + 0x44]
je 0x440b66
mov eax, dword [edi + 0x20]
mov byte [eax + 0x44], 1
push dword [esp + 0x3c]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
call fcn.004aba6c
int3
Function at 0x441930
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, ebx
cmp dword [ebx + 0x14], 0x10
mov edi, dword [ebx + 0x10]
mov dword [ebp - 0xc], eax
jb 0x441952
mov esi, dword [ebx]
xor ecx, ecx
mov edx, 0x811c9dc5
test edi, edi
je 0x441971
nop dword [eax]
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x441960
mov edi, dword [ebp - 4]
mov eax, dword [edi + 0x18]
mov ecx, dword [edi + 0xc]
and eax, edx
mov edi, dword [edi + 4]
mov dword [ebp - 0x10], edi
mov esi, dword [ecx + eax*8]
add eax, eax
mov edx, dword [ecx + eax*4]
inc eax
mov dword [ebp - 0x14], edx
lea eax, [ecx + eax*4]
mov dword [ebp - 0x18], eax
cmp edx, edi
jne 0x44199c
mov eax, edi
jmp 0x4419a0
mov eax, dword [eax]
mov eax, dword [eax]
cmp esi, eax
je 0x441a22
cmp dword [ebx + 0x14], 0x10
mov edx, ebx
jb 0x4419ae
mov edx, dword [ebx]
mov edi, dword [esi + 0x1c]
lea ecx, [esi + 8]
mov dword [ebp - 0x1c], edi
cmp edi, 0x10
mov edi, dword [ebp - 0x10]
jb 0x4419c2
mov ecx, dword [esi + 8]
push dword [ebx + 0x10]
mov eax, dword [esi + 0x18]
push edx
mov edx, eax
mov dword [ebp - 8], eax
call fcn.00409ec0
add esp, 8
test al, al
jne 0x4419e4
mov esi, dword [esi]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
jmp 0x441994
cmp dword [ebp - 0x1c], 0x10
lea eax, [esi + 8]
jb 0x4419ef
mov eax, dword [eax]
cmp dword [ebx + 0x14], 0x10
mov ecx, ebx
jb 0x4419f9
mov ecx, dword [ebx]
push dword [ebp - 8]
mov edx, dword [ebx + 0x10]
push eax
call fcn.00409ec0
add esp, 8
test al, al
jne 0x441a15
test al, al
mov ecx, edi
cmovne edi, esi
jmp 0x441a24
mov ecx, dword [ebp - 4]
test al, al
cmovne edi, esi
mov ecx, dword [ecx + 4]
jmp 0x441a24
mov ecx, edi
mov eax, edi
cmp edi, ecx
jne 0x441a7e
mov esi, dword [ecx]
lea eax, [ebp - 8]
push ecx
push eax
push ecx
mov edi, dword [esi + 4]
push edi
push esi
mov dword [ebp - 8], ebx
call fcn.00441df0
mov ebx, dword [ebp - 4]
mov ecx, eax
mov eax, 0x6666665
mov edx, dword [ebx + 8]
sub eax, edx
cmp eax, 1
jb 0x441a92
lea eax, [edx + 1]
mov dword [ebx + 8], eax
mov dword [esi + 4], ecx
mov esi, dword [ebp - 0xc]
mov dword [edi], ecx
mov ecx, ebx
mov edx, dword [ebx + 4]
mov edx, dword [edx]
push edx
add edx, 8
push edx
push esi
call fcn.00441ba0
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword [ecx], eax
mov eax, ecx
mov byte [ecx + 4], 0
mov esp, ebp
pop ebp
ret 8
push str.list_T__too_long
call fcn.00448701
int3
Function at 0x441e50
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
cmp dword [edi + 0x1c], 0x10
lea esi, [edi + 8]
mov ebx, dword [edi + 0x18]
jb 0x441e74
mov esi, dword [edi + 8]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x441e91
nop
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x441e80
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0xc]
and eax, edx
lea edx, [eax*8]
mov eax, dword [ecx + edx]
add ecx, edx
cmp dword [ecx + 4], edi
jne 0x441eca
cmp eax, edi
jne 0x441ec2
mov eax, dword [ebx + 4]
mov dword [ecx], eax
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 4]
mov dword [edx + ecx + 4], eax
jmp 0x441ed2
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x441ed2
cmp eax, edi
jne 0x441ed2
mov eax, dword [edi]
mov dword [ecx], eax
mov eax, dword [edi + 4]
lea ecx, [edi + 8]
mov esi, dword [edi]
mov dword [eax], esi
mov edx, dword [edi]
mov eax, dword [edi + 4]
mov dword [edx + 4], eax
dec dword [ebx + 8]
call fcn.00441750
push 0x28
push edi
call fcn.0044bf44
mov eax, dword [ebp - 8]
add esp, 8
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x442a90
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cadb8
mov eax, dword fs:[0]
push eax
sub esp, 0x88
mov eax, dword [0x4fa078]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0x509948]
cmp eax, dword [ecx + 4]
jle 0x442b18
push 0x509948
call fcn.0044b9a8
add esp, 4
cmp dword [0x509948], 0xffffffff
jne 0x442b18
push 0x4cf540
mov dword [0x50995c], 0
mov dword [0x509960], 0xf
mov byte [0x50994c], 0
call fcn.0044bf2f
push 0x509948
call fcn.0044b95e
add esp, 8
cmp dword [0x50995c], 0
jne 0x442be8
push 6
push str.mutex:
lea ecx, [ebp - 0x5c]
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 0xf
mov byte [ebp - 0x5c], 0
call fcn.00407000
push 0x5082f8
lea ecx, [ebp - 0x5c]
mov dword [ebp - 4], 0
call fcn.00406c00
push str.:p2p
lea ecx, [ebp - 0x5c]
call fcn.00406c00
push 7
push str.Global_
mov ecx, 0x50994c
call fcn.00407000
push 0x32
lea eax, [ebp - 0x44]
push 0
push eax
call fcn.004a4b20
cmp dword [ebp - 0x48], 0x10
lea eax, [ebp - 0x44]
mov edx, dword [ebp - 0x4c]
lea ecx, [ebp - 0x5c]
cmovae ecx, dword [ebp - 0x5c]
push eax
call fcn.004239b0
add esp, 0x10
lea eax, [ebp - 0x44]
mov ecx, 0x50994c
push eax
call fcn.00406c00
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x48]
cmp edx, 0x10
jb 0x442be8
mov ecx, dword [ebp - 0x5c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x442bde
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x442cb0
push edx
push ecx
call fcn.0044bf44
add esp, 8
push 1
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 0
push 0
push 1
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
lea eax, [ebp - 0x70]
mov dword [ebp - 0x7c], 0xc
mov edx, 0x50994c
mov dword [ebp - 0x74], 0
lea ecx, [ebp - 0x94]
mov dword [ebp - 0x78], eax
call fcn.00407fb0
cmp dword [eax + 0x14], 8
jb 0x442c30
mov eax, dword [eax]
push eax
push 1
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov edx, dword [ebp - 0x80]
mov dword [0x5082e8], eax
cmp edx, 8
jb 0x442c80
mov ecx, dword [ebp - 0x94]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x442c71
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x442cb5
push edx
push ecx
call fcn.0044bf44
mov eax, dword [0x5082e8]
add esp, 8
test eax, eax
je 0x442c95
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x442c95
mov al, 1
jmp 0x442c97
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044b7d5
mov esp, ebp
pop ebp
ret
call fcn.004aba6c
call fcn.004aba6c
int3
Function at 0x443770
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4caed8
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x4fa078]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 4], 0
lea edx, [ebp + 8]
cmp dword [ebp + 0x1c], 8
lea ecx, [esi + 0x18]
cmovae edx, dword [ebp + 8]
cmp dword [ecx + 0x14], 0x10
jb 0x4437b9
mov ecx, dword [ecx]
push 0
push 0
push ecx
call fcn.00423f40
add esp, 0xc
cmp eax, dword [esi + 0x60]
jne 0x443814
test edx, edx
jne 0x443814
push 0x32
push edx
lea eax, [ebp - 0x44]
push eax
call fcn.004a4b20
cmp dword [ebp + 0x1c], 8
lea ecx, [ebp + 8]
lea edx, [ebp - 0x44]
cmovae ecx, dword [ebp + 8]
add esp, 8
call fcn.00423a50
lea eax, [esi + 0x30]
add esp, 4
cmp dword [eax + 0x14], 0x10
jb 0x4437ff
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.004ac82e
add esp, 8
test eax, eax
jne 0x443814
mov bl, 1
jmp 0x443828
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor bl, bl
mov edx, dword [ebp + 0x1c]
cmp edx, 8
jb 0x44385e
mov ecx, dword [ebp + 8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x443854
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44387b
push edx
push ecx
call fcn.0044bf44
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044b7d5
mov esp, ebp
pop ebp
ret
call fcn.004aba6c
int3
Function at 0x444b30
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cb130
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x4fa078]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x60], edx
mov ebx, ecx
mov dword [ebp - 4], 0
xor esi, esi
nop dword [eax]
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x5c]
call fcn.00403630
mov byte [ebp - 4], 1
lea edx, [ebp - 0x5c]
cmp dword [ebp - 0x48], 8
lea ecx, [ebx + 0x18]
cmovae edx, dword [ebp - 0x5c]
cmp dword [ebx + 0x2c], 0x10
jb 0x444b97
mov ecx, dword [ebx + 0x18]
push dword [ebp - 0x60]
push 1
push ecx
call fcn.00423f40
add esp, 0xc
cmp eax, dword [ebx + 0x60]
jne 0x444c05
test edx, edx
jne 0x444c05
push 0x32
push edx
lea eax, [ebp - 0x44]
push eax
call fcn.004a4b20
cmp dword [ebp - 0x48], 8
lea ecx, [ebp - 0x5c]
lea edx, [ebp - 0x44]
cmovae ecx, dword [ebp - 0x5c]
add esp, 8
call fcn.00423a50
lea eax, [ebx + 0x30]
add esp, 4
cmp dword [eax + 0x14], 0x10
jb 0x444bde
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.004ac82e
add esp, 8
test eax, eax
je 0x444c88
cmp dword [ebp - 0x48], 8
lea eax, [ebp - 0x5c]
cmovae eax, dword [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x48]
cmp edx, 8
jb 0x444c43
mov ecx, dword [ebp - 0x5c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x444c39
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x444cef
push edx
push ecx
call fcn.0044bf44
add esp, 8
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 5
jl 0x444b70
xor bl, bl
mov edx, dword [ebp + 0x1c]
cmp edx, 8
jb 0x444ccc
mov ecx, dword [ebp + 8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x444cc2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x444cea
jmp 0x444cc2
mov edx, dword [ebp - 0x48]
cmp edx, 8
jb 0x444cbe
mov ecx, dword [ebp - 0x5c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x444cb4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x444cef
push edx
push ecx
call fcn.0044bf44
add esp, 8
mov bl, 1
jmp 0x444c5a
push edx
push ecx
call fcn.0044bf44
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044b7d5
mov esp, ebp
pop ebp
ret
call fcn.004aba6c
call fcn.004aba6c
int3
Function at 0x44cbf0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x4fa078]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov byte [edi + 0x68], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x10], 0
mov dword [edi], 0x67452301
mov dword [edi + 4], 0xefcdab89
mov dword [edi + 8], 0x98badcfe
mov dword [edi + 0xc], 0x10325476
mov eax, dword [esi]
mov eax, dword [eax + 4]
mov eax, dword [eax + esi + 0xc]
test al, 6
jne 0x44cd14
test al, 1
jne 0x44cc8f
nop dword [eax]
push 0
push 0x400
lea eax, [ebp - 0x404]
mov ecx, esi
push eax
call fcn.0044d5a0
cmp dword [esi + 0xc], 0
mov eax, dword [esi + 8]
jl 0x44cc83
jg 0x44cc74
test eax, eax
je 0x44cc83
push eax
lea eax, [ebp - 0x404]
mov ecx, edi
push eax
call fcn.0044df30
mov eax, dword [esi]
mov eax, dword [eax + 4]
test byte [eax + esi + 0xc], 1
je 0x44cc50
cmp dword [esi + 0x5c], 0
push ebx
jne 0x44cca2
mov dword [ebp - 0x408], 0
jmp 0x44ccd8
lea ecx, [esi + 0x10]
call fcn.00428900
push dword [esi + 0x5c]
xor edx, edx
lea ecx, [esi + 0x10]
test al, al
cmove ecx, edx
mov dword [ebp - 0x408], ecx
call fcn.004ac199
xor ecx, ecx
add esp, 4
test eax, eax
mov eax, dword [ebp - 0x408]
cmovne eax, ecx
mov dword [ebp - 0x408], eax
push 2
push 0
lea ecx, [esi + 0x10]
call fcn.004289c0
cmp dword [ebp - 0x408], 0
pop ebx
jne 0x44cd14
mov eax, dword [esi]
mov ecx, dword [eax + 4]
xor eax, eax
add ecx, esi
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
and eax, 0x17
mov dword [ecx + 0xc], eax
mov ecx, dword [ecx + 0x10]
and ecx, eax
jne 0x44cd28
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.0044b7d5
mov esp, ebp
pop ebp
ret 4
test cl, 4
je 0x44cd34
mov esi, str.ios_base::badbit_set
jmp 0x44cd44
test cl, 2
mov esi, str.ios_base::failbit_set
mov eax, str.ios_base::eofbit_set
cmove esi, eax
lea eax, [ebp - 0x40c]
push 1
push eax
call fcn.0040dae0
add esp, 8
lea ecx, [ebp - 0x420]
push eax
push esi
call fcn.0040de80
push 0x4f7a68
lea eax, [ebp - 0x420]
push eax
call fcn.004a452b
int3

Function at 0x44cd80
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
mov esi, ecx
push dword [ebp + 8]
mov byte [esi + 0x68], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
call fcn.0044df30
mov eax, esi
pop esi
pop ebp
ret 8
Function at 0x44ebe0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi]
dec eax
cmp eax, 3
ja case.default.0x44ebf5
jmp dword [eax*4 + 0x44ed94]
mov eax, dword [esi + 0x38]
test eax, eax
jne 0x44ec13
mov eax, dword [ebp + 0x10]
pop edi
pop esi
pop ebx
mov dword [eax], 0
xor eax, eax
pop ebp
ret
mov ebx, dword [ebp + 0x10]
mov dword [ebx], 0x10
cmp eax, 0x10
je 0x44ec2b
pop edi
pop esi
mov eax, 0x1005
pop ebx
pop ebp
ret
mov edi, dword [ebp + 0xc]
mov eax, dword [esi + 0x28]
push edi
mov dword [edi], eax
mov eax, dword [esi + 0x2c]
mov dword [edi + 4], eax
mov eax, dword [esi + 0x30]
mov dword [edi + 8], eax
mov eax, dword [esi + 0x34]
mov dword [edi + 0xc], eax
lea eax, [esi + 0x3c]
push eax
call fcn.0044f480
push dword [esi + 4]
push 0x10
push edi
call fcn.004519b0
mov ecx, eax
add esp, 0x14
cmp ecx, 0xfffffffd
jne 0x44ec6e
pop edi
pop esi
mov eax, 0x1003
pop ebx
pop ebp
ret
cmp ecx, 0xffffffff
je case.default.0x44ebf5
mov eax, 0x10
pop edi
sub eax, ecx
mov dword [ebx], eax
xor eax, eax
pop esi
pop ebx
pop ebp
ret
mov eax, dword [esi + 0x38]
test eax, eax
je 0x44ec03
mov ebx, dword [ebp + 0x10]
mov dword [ebx], 0x10
cmp eax, 0x10
jne 0x44ec21
mov edi, dword [ebp + 0xc]
mov eax, dword [esi + 0x28]
push edi
mov dword [edi], eax
mov eax, dword [esi + 0x2c]
mov dword [edi + 4], eax
mov eax, dword [esi + 0x30]
mov dword [edi + 8], eax
mov eax, dword [esi + 0x34]
mov dword [edi + 0xc], eax
lea eax, [esi + 0x3c]
push eax
call fcn.0044f480
mov eax, dword [esi + 0x18]
xor dword [edi], eax
mov eax, dword [esi + 0x1c]
xor dword [edi + 4], eax
mov eax, dword [esi + 0x20]
xor dword [edi + 8], eax
mov eax, dword [esi + 0x24]
xor dword [edi + 0xc], eax
mov eax, dword [esi + 0x28]
mov dword [esi + 0x18], eax
mov eax, dword [esi + 0x2c]
mov dword [esi + 0x1c], eax
mov eax, dword [esi + 0x30]
mov dword [esi + 0x20], eax
mov eax, dword [esi + 0x34]
mov dword [esi + 0x24], eax
jmp 0x44ec4f
mov ebx, dword [esi + 0x38]
lea edi, [esi + 0x18]
mov eax, dword [ebp + 0x10]
add esi, 0x3c
push edi
push esi
mov dword [eax], ebx
call fcn.004509b0
add esp, 8
test ebx, ebx
je 0x44ed34
mov ecx, dword [ebp + 0xc]
mov edx, ebx
nop dword [eax]
mov al, byte [edi + 0x10]
lea edi, [edi + 1]
xor al, byte [edi - 1]
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
sub edx, 1
jne 0x44ed20
mov eax, dword [ebp + 0x10]
pop edi
pop esi
mov dword [eax], ebx
xor eax, eax
pop ebx
pop ebp
ret
mov ebx, dword [ebp + 0x10]
lea edi, [esi + 0x18]
mov eax, dword [esi + 0x38]
mov dword [ebp + 8], eax
push edi
mov dword [ebx], eax
lea eax, [esi + 0x3c]
push eax
call fcn.004509b0
mov eax, dword [esi + 0x28]
xor dword [edi], eax
mov eax, dword [esi + 0x2c]
xor dword [esi + 0x1c], eax
mov eax, dword [esi + 0x30]
xor dword [esi + 0x20], eax
mov eax, dword [esi + 0x34]
xor dword [esi + 0x24], eax
mov esi, dword [ebp + 8]
push esi
push edi
push dword [ebp + 0xc]
call fcn.004a45a0
add esp, 0x14
mov dword [ebx], esi
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
pop edi
pop esi
mov eax, 0x1001
pop ebx
pop ebp
ret
Function at 0x4502e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi]
dec eax
cmp eax, 3
ja case.default.0x4502f5
jmp dword [eax*4 + 0x450484]
push dword [esi + 4]
lea edi, [esi + 0x28]
push 0x10
push dword [esi + 0x38]
push edi
call fcn.00451a40
add esp, 0x10
cmp eax, 0x10
ja 0x45047f
test eax, eax
jne 0x45032d
mov eax, dword [ebp + 0x10]
pop edi
pop esi
pop ebx
mov dword [eax], 0
xor eax, eax
pop ebp
ret
mov ecx, dword [ebp + 0xc]
mov eax, dword [edi]
push ecx
mov dword [ecx], eax
mov eax, dword [esi + 0x2c]
mov dword [ecx + 4], eax
mov eax, dword [esi + 0x30]
mov dword [ecx + 8], eax
mov eax, dword [esi + 0x34]
add esi, 0x3c
push esi
mov dword [ecx + 0xc], eax
call fcn.004509b0
mov eax, dword [ebp + 0x10]
add esp, 8
pop edi
pop esi
mov dword [eax], 0x10
xor eax, eax
pop ebx
pop ebp
ret
push dword [esi + 4]
lea edi, [esi + 0x28]
push 0x10
push dword [esi + 0x38]
push edi
call fcn.00451a40
add esp, 0x10
cmp eax, 0x10
ja 0x45047f
test eax, eax
jne 0x450394
mov eax, dword [ebp + 0x10]
pop edi
pop esi
pop ebx
mov dword [eax], 0
xor eax, eax
pop ebp
ret
mov eax, dword [edi]
xor eax, dword [esi + 0x18]
mov edi, dword [ebp + 0xc]
push edi
mov dword [edi], eax
mov eax, dword [esi + 0x2c]
xor eax, dword [esi + 0x1c]
mov dword [edi + 4], eax
mov eax, dword [esi + 0x30]
xor eax, dword [esi + 0x20]
mov dword [edi + 8], eax
mov eax, dword [esi + 0x34]
xor eax, dword [esi + 0x24]
mov dword [edi + 0xc], eax
lea eax, [esi + 0x3c]
push eax
call fcn.004509b0
mov eax, dword [edi]
add esp, 8
mov dword [esi + 0x18], eax
mov eax, dword [edi + 4]
mov dword [esi + 0x1c], eax
mov eax, dword [edi + 8]
mov dword [esi + 0x20], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0x24], eax
mov eax, dword [ebp + 0x10]
pop edi
pop esi
pop ebx
mov dword [eax], 0x10
xor eax, eax
pop ebp
ret
mov ebx, dword [esi + 0x38]
lea edi, [esi + 0x18]
mov eax, dword [ebp + 0x10]
add esi, 0x3c
push edi
push esi
mov dword [eax], 0x10
call fcn.004509b0
add esp, 8
test ebx, ebx
je 0x450426
mov ecx, dword [ebp + 0xc]
mov edx, ebx
mov al, byte [edi + 0x10]
lea edi, [edi + 1]
xor al, byte [edi - 1]
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
sub edx, 1
jne 0x450412
mov eax, dword [ebp + 0x10]
pop edi
pop esi
mov dword [eax], ebx
xor eax, eax
pop ebx
pop ebp
ret
mov ebx, dword [ebp + 0x10]
lea edi, [esi + 0x18]
mov eax, dword [esi + 0x38]
mov dword [ebp + 8], eax
push edi
mov dword [ebx], eax
lea eax, [esi + 0x3c]
push eax
call fcn.004509b0
mov eax, dword [esi + 0x28]
xor dword [edi], eax
mov eax, dword [esi + 0x2c]
xor dword [esi + 0x1c], eax
mov eax, dword [esi + 0x30]
xor dword [esi + 0x20], eax
mov eax, dword [esi + 0x34]
xor dword [esi + 0x24], eax
mov esi, dword [ebp + 8]
push esi
push edi
push dword [ebp + 0xc]
call fcn.004a45a0
add esp, 0x14
mov dword [ebx], esi
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
mov eax, 0x1001
pop edi
pop esi
pop ebx
pop ebp
ret