joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41fb60
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 0x18]
push ebx
push ebp
push esi
test eax, eax
push edi
mov esi, ecx
jne 0x41fcc4
mov edi, dword [esp + 0x18]
mov ebp, dword [esp + 0x20]
mov ebx, dword [esp + 0x1c]
cmp edi, 1
jne 0x41fbaf
push 1
call fcn.0041ec00
push ebp
mov ecx, esi
call fcn.0041fcd0
mov ecx, dword [esp + 0x24]
mov dword [ecx], eax
mov ecx, esi
call fcn.0041ebf0
test eax, eax
je 0x41fbe9
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 0x18
cmp edi, 0x111
jne 0x41fbe9
cmp bx, 0x6f
jne 0x41fbd0
mov ecx, esi
call fcn.004214f0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 0x18
cmp bx, 0x6d
jne 0x41fbe9
mov ecx, esi
call fcn.00412570
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 0x18
cmp edi, 5
lea eax, [esi + 0x80]
jne 0x41fc67
test eax, eax
je 0x41fbfd
lea esi, [eax - 0x80]
jmp 0x41fbff
xor esi, esi
mov cl, byte [eax + 0x1c]
test cl, cl
je 0x41fc34
mov edx, dword [esi + 4]
push 0xe801
push edx
call dword [0x489614]
cmp ebx, 2
jne 0x41fc25
push 0
push eax
call dword [0x489544]
jmp 0x41fc39
test ebx, ebx
jne 0x41fc34
push 5
push eax
call dword [0x489544]
jmp 0x41fc39
cmp ebx, 1
je 0x41fc87
mov eax, ebp
shr eax, 0x10
movsx ecx, ax
movsx edx, bp
push ecx
push edx
lea ecx, [esi + 0x80]
call fcn.00421a30
mov eax, dword [esp + 0x24]
pop edi
pop esi
pop ebp
mov dword [eax], 0
mov eax, 1
pop ebx
ret 0x18
cmp edi, 0x24
jne 0x41fc9d
mov edx, dword [eax + 0x14]
or ecx, 0xffffffff
cmp edx, ecx
je 0x41fc87
cmp dword [eax + 0x18], ecx
je 0x41fc87
mov ecx, dword [eax + 0x14]
mov dword [ebp + 0x18], ecx
mov edx, dword [eax + 0x18]
mov dword [ebp + 0x1c], edx
mov eax, dword [esp + 0x24]
pop edi
pop esi
pop ebp
mov dword [eax], 0
mov eax, 1
pop ebx
ret 0x18
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x14]
push 0
push ecx
push ebp
push ebx
push edi
push edx
lea ecx, [esi + 0x20]
call fcn.00425ff0
test eax, eax
je 0x41fcc4
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 0x18
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0x18
Function at 0x421ff0
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
cmp eax, ecx
jne 0x422000
mov eax, 1
ret
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x60], ecx
mov dword [eax + 0x64], ecx
xor eax, eax
ret
Function at 0x424e30
Capabilities:
Get common file path
Get program files directory

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4847ab
push eax
mov dword fs:[0], esp
mov eax, dword [ecx + 0xec]
sub esp, 0x40c
push ebp
lea ebp, [ecx + 0xec]
mov ecx, dword [eax - 8]
push esi
xor esi, esi
push edi
cmp ecx, esi
jne 0x425014
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x10]
push esi
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x14]
push 0x26
push ecx
push esi
call dword [0x4894c4]
test eax, eax
je 0x425014
mov edx, dword [0x498080]
push ebx
mov dword [esp + 0x10], edx
mov eax, dword [0x4a3db0]
mov ebx, dword [0x489550]
lea ecx, [esp + 0x21c]
push 0x100
mov eax, dword [eax + 8]
push ecx
push 0x96
push eax
mov dword [esp + 0x434], esi
call ebx
cmp eax, esi
jne 0x424ecc
mov word [esp + 0x21c], si
mov edx, 0x100
sub edx, eax
cmp edx, 1
jle 0x424f05
lea eax, [esp + 0x21c]
test eax, eax
je 0x424ef1
lea ecx, [esp + 0x21c]
push ecx
call dword [0x4891e0]
lea edx, [esp + 0x21c]
lea ecx, [esp + 0x10]
push edx
push eax
call fcn.00403900
jmp 0x424f64
push 0x1ff
lea ecx, [esp + 0x14]
mov edi, 0x200
call fcn.004036e0
mov esi, eax
test esi, esi
je 0x424f59
mov eax, dword [0x4a3db0]
push edi
push esi
push 0x96
mov eax, dword [eax + 8]
push eax
call ebx
test eax, eax
jne 0x424f37
mov word [esi], ax
mov ecx, edi
sub ecx, eax
cmp ecx, 1
jg 0x424f59
add edi, 0x100
lea ecx, [esp + 0x10]
lea edx, [edi - 1]
push edx
call fcn.004036e0
mov esi, eax
test esi, esi
jne 0x424f1e
push 0xffffffffffffffff
lea ecx, [esp + 0x14]
call fcn.004037a0
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
lea edx, [esp + 0x18]
push ecx
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [esp + 0x14]
test eax, eax
jne 0x424f85
xor ebx, ebx
jmp 0x424f92
lea ecx, [esp + 0x14]
push ecx
call dword [0x4891e0]
mov ebx, eax
mov eax, dword [ebp]
cmp dword [eax - 0xc], 1
jg 0x424fa0
cmp ebx, dword [eax - 4]
jle 0x424fb3
mov ecx, ebp
call fcn.00403b90
push ebx
mov ecx, ebp
call fcn.004038a0
test eax, eax
je 0x424fe4
lea eax, [ebx + ebx]
lea edx, [ebx + ebx + 2]
cmp edx, eax
jb 0x424fd5
mov edi, dword [ebp]
mov ecx, eax
mov edx, ecx
lea esi, [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp]
mov dword [ecx - 8], ebx
mov edx, dword [ebp]
mov word [edx + eax], 0
mov eax, dword [esp + 0x10]
mov edx, dword [0x498084]
pop ebx
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x425014
add eax, 0xfffffff4
push eax
call dword [0x4891e4]
test eax, eax
jg 0x425014
mov edx, dword [esp + 0xc]
add edx, 0xfffffff4
push edx
call fcn.0047ab00
add esp, 4
mov ecx, dword [esp + 0x418]
pop edi
mov eax, ebp
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x418
ret
Function at 0x425940
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4847e8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [0x498080]
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], eax
xor edi, edi
lea ecx, [esi + 4]
mov dword [esp + 0x18], edi
call fcn.00423440
mov ecx, dword [0x498080]
mov dword [esi + 0x14], ecx
mov edx, dword [0x498080]
mov dword [esi + 0x18], edx
mov eax, dword [0x498080]
mov dword [esi + 0x1c], eax
mov ecx, dword [0x498080]
mov dword [esi + 0x20], ecx
mov edx, dword [0x498080]
mov dword [esi + 0x24], edx
mov dword [esi + 0x28], 0x80000002
mov eax, dword [0x498080]
mov dword [esi + 0x2c], eax
mov ecx, dword [0x498080]
mov dword [esi + 0x30], ecx
mov edx, dword [0x498080]
mov dword [esi + 0x34], edx
mov eax, dword [0x498080]
mov dword [esi + 0x38], eax
mov ecx, dword [0x498080]
mov dword [esi + 0x3c], ecx
mov edx, dword [0x498080]
mov dword [esi + 0x40], edx
mov eax, dword [0x498080]
mov dword [esi + 0x44], eax
mov ecx, dword [0x498080]
mov dword [esi + 0x48], ecx
mov edx, dword [0x498080]
mov dword [esi + 0x4c], edx
mov eax, dword [0x498080]
mov dl, byte [esp + 0xb]
mov dword [esi + 0x50], eax
mov ecx, dword [0x498080]
mov eax, 0x14
mov dword [esi + 0x54], ecx
mov ecx, dword [esp + 0x10]
mov byte [esi + 0x58], dl
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x68], edi
mov dword [esi + 0x6c], 0x3e8
mov dword [esi + 0x70], eax
mov dword [esi + 0x74], eax
mov dword [esi + 0x78], edi
mov dword [esi + 0x7c], 1
mov dword [esi + 0x80], edi
mov dword [esi + 0x84], edi
mov dword [esi + 0x88], edi
mov dword [esi + 0x8c], edi
mov dword [esi + 0x90], edi
mov dword [esi + 0x94], edi
mov eax, dword [0x498080]
pop edi
mov dword [esi + 0x98], eax
or eax, 0xffffffff
mov dword [esi + 0x9c], eax
mov dword [esi + 0xa0], eax
mov dword [esi + 0xa4], 0xb4
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x425bd0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x484828
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x68
push ebx
push ebp
push esi
push edi
mov esi, ecx
mov eax, dword [esi]
xor ebx, ebx
mov dword [esp + 0x80], ebx
call dword [eax + 4]
lea ecx, [esp + 0x38]
mov edi, eax
push ecx
push edi
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], edi
call dword [0x489564]
mov dword [esp + 0x30], eax
lea edx, [esp + 0x20]
mov dword [esp + 0x20], ebx
push edx
push edi
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
call dword [0x48965c]
mov ebx, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov edi, dword [esp + 0x20]
sub ebx, ebp
mov ebp, dword [esp + 0x28]
sub ebp, edi
mov eax, dword [esp + 0x30]
push eax
call dword [0x48903c]
mov ecx, dword [esp + 0x30]
push ebx
mov edi, eax
push ebp
push ecx
mov dword [esp + 0x28], edi
call dword [0x489030]
push eax
push edi
mov dword [esp + 0x1c], eax
call dword [0x489048]
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], edi
mov edx, dword [esi]
lea eax, [esp + 0x20]
lea ecx, [esp + 0x10]
push eax
push ecx
mov ecx, esi
mov byte [esp + 0x88], 4
call dword [edx + 8]
mov edx, dword [esi]
lea eax, [esp + 0x20]
lea ecx, [esp + 0x10]
push eax
push ecx
mov ecx, esi
call dword [edx + 0x10]
mov edx, dword [esi]
lea eax, [esp + 0x20]
lea ecx, [esp + 0x10]
push eax
push ecx
mov ecx, esi
call dword [edx + 0x14]
mov edx, dword [esi]
lea eax, [esp + 0x20]
lea ecx, [esp + 0x10]
push eax
push ecx
mov ecx, esi
call dword [edx + 0xc]
mov edx, dword [esp + 0x30]
push 0xcc0020
push 0
push 0
push edi
push ebx
push ebp
push 0
push 0
push edx
call dword [0x489054]
mov eax, dword [esp + 0x18]
push eax
push edi
call dword [0x489048]
mov esi, dword [esp + 0x14]
mov ebx, dword [0x489050]
push esi
call ebx
test eax, eax
je 0x425d08
mov dword [esp + 0x14], 0
mov esi, dword [esp + 0x14]
mov ebp, dword [0x489040]
test edi, edi
je 0x425d1b
push edi
call ebp
test eax, eax
je 0x425d1b
xor edi, edi
test esi, esi
je 0x425d22
push esi
call ebx
test edi, edi
je 0x425d29
push edi
call ebp
mov edx, dword [esp + 0x34]
lea ecx, [esp + 0x38]
push ecx
push edx
call dword [0x489568]
mov ecx, dword [esp + 0x78]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x74
ret 4

Function at 0x427760
Capabilities:
Create thread

Disassembly:
push esi
push 1
mov esi, ecx
push str.SeManageVolumePrivilege
call fcn.00429130
add esp, 8
lea ecx, [esi + 0x1c]
push 0
push 0
push 0
push 0
push 0x4000
call fcn.004291f0
cmp eax, 1
je 0x427790
xor eax, eax
pop esi
ret
push 0
push 0
push esi
push 0x427290
push 0
push 0
mov dword [esi + 8], 1
call dword [0x489454]
xor ecx, ecx
add esp, 0x18
cmp ecx, eax
mov dword [esi], eax
sbb eax, eax
pop esi
neg eax
ret
Function at 0x4343bd
Capabilities:
Get number of processors

Disassembly:
mov ecx, 0x4a4270
jmp 0x4343a0
push 0xffffffffffffffff
push 0x4850f9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov al, byte [esp + 3]
push ebx
push esi
mov esi, ecx
mov cl, byte [esp + 0xb]
xor ebx, ebx
mov byte [esi + 0x15], cl
push edi
lea ecx, [esp + 0x10]
mov byte [esi + 0x14], al
mov byte [esi + 0x1c], bl
call dword [0x489298]
mov eax, dword [0x4a4314]
mov dword [esp + 0x1c], ebx
cmp eax, ebx
jne 0x43440b
push 0x18
call fcn.0047c85e
mov dword [eax + 4], ebx
mov dword [eax + 0x14], 1
mov dword [0x4a4314], eax
mov dword [eax], ebx
mov edx, dword [0x4a4314]
add esp, 4
mov dword [edx + 8], ebx
mov edi, dword [0x4a4310]
push 0x18
inc edi
mov dword [0x4a4310], edi
mov edi, dword [0x4a4314]
call fcn.0047c85e
mov dword [eax + 4], edi
mov dword [eax + 0x14], ebx
mov dword [esi + 0x18], eax
mov dword [esi + 0x20], ebx
mov dword [eax], eax
mov eax, dword [esi + 0x18]
add esp, 4
lea ecx, [esp + 0x10]
mov dword [eax + 8], eax
mov dword [esp + 0x1c], 0xffffffff
call dword [0x48929c]
lea ecx, [esi + 0x58]
xor eax, eax
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x74], ebx
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x80], ebx
mov dword [esi + 0x24], 0x489cf8
mov dword [ecx], eax
xor edx, edx
push ebx
mov dword [ecx + 4], eax
push ebx
push ebx
push ebx
mov dword [ecx + 8], eax
lea eax, [esi + 0x64]
mov dword [esi + 0x64], edx
mov dword [eax + 4], edx
mov dword [eax + 8], edx
mov dword [esi], ebx
mov dword [esi + 8], 1
mov dword [esi + 0x10], ebx
call dword [0x489154]
mov ecx, dword [esp + 0x14]
mov dword [esi + 4], eax
mov dword [esi + 0x84], ebx
mov dword [esi + 0x88], ebx
mov dword [esi + 0x8c], ebx
mov dword [esi + 0x90], ebx
mov dword [esi + 0x94], ebx
mov dword [esi + 0x98], ebx
mov dword [esi + 0x9c], ebx
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x4346b0
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
call fcn.00434920
push 0
push 0
push 0
push 0
push 0x4000
lea ecx, [esi + 0x24]
call fcn.004362a0
cmp eax, 1
je 0x4346d6
xor eax, eax
pop esi
ret
mov dword [esi + 0x10], 1
call dword [0x489108]
push 0
push 0
push esi
push 0x434190
push 0
push 0
mov dword [esi + 0xc], eax
call dword [0x489454]
xor ecx, ecx
add esp, 0x18
cmp ecx, eax
mov dword [esi], eax
sbb eax, eax
pop esi
neg eax
ret
Function at 0x437a40
Capabilities:
Delete file

Disassembly:
sub esp, 0x38
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi], 0
je 0x437b98
mov ebx, dword [esp + 0x48]
mov eax, dword [esi + 4]
cmp ebx, eax
jb 0x437b98
mov eax, dword [esi + 0x18]
test eax, eax
jne 0x437a73
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x38
ret 8
mov edi, dword [esp + 0x4c]
test edi, edi
jne 0x437a87
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x38
ret 8
cmp ebx, 4
jb 0x437a98
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x38
ret 8
mov eax, dword [esi + 0xc]
test eax, eax
jne 0x437aa4
mov eax, dword [0x489294]
lea ecx, [esp + 0x20]
push ecx
push eax
call dword [0x489394]
add esp, 8
test eax, eax
jne 0x437b1d
cmp dword [esp + 0x34], 0x8000000
jle 0x437b1d
mov eax, dword [esi + 0x18]
test eax, eax
je 0x437ad9
push eax
call dword [0x48935c]
add esp, 4
mov dword [esi + 0x18], 0
mov eax, dword [esi + 0xc]
test eax, eax
jne 0x437ae5
mov eax, dword [0x489294]
push eax
call dword [0x489390]
mov eax, dword [esi + 0xc]
add esp, 4
test eax, eax
jne 0x437afb
mov eax, dword [0x489294]
push 0x49ad78
push eax
call dword [0x489364]
add esp, 8
mov dword [esi + 0x18], eax
test eax, eax
jne 0x437b1d
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x38
ret 8
lea edx, [esp + 0xc]
push edx
call dword [0x489180]
mov ecx, dword [esp + 0x1a]
mov eax, dword [ebx*4 + 0x49b284]
mov edx, dword [esp + 0x18]
push edi
and ecx, 0xffff
push eax
mov eax, dword [esp + 0x1e]
push ecx
mov ecx, dword [esp + 0x20]
and edx, 0xffff
and eax, 0xffff
push edx
mov edx, dword [esp + 0x22]
and ecx, 0xffff
push eax
mov eax, dword [esp + 0x22]
push ecx
mov ecx, dword [esp + 0x24]
and edx, 0xffff
and eax, 0xffff
push edx
mov edx, dword [esi + 0x18]
and ecx, 0xffff
push eax
push ecx
push 0x49b2c8
push edx
call dword [0x4893a8]
mov eax, dword [esi + 0x18]
push eax
call dword [0x4893a4]
add esp, 0x30
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x38
ret 8
Function at 0x437d8d
Capabilities:
Get number of processors

Disassembly:
mov ecx, 0x4a4318
jmp 0x437d70
push 0xffffffffffffffff
push 0x4852f9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov al, byte [esp + 3]
push ebx
push esi
mov esi, ecx
mov cl, byte [esp + 0xb]
xor ebx, ebx
mov byte [esi + 5], cl
push edi
lea ecx, [esp + 0x10]
mov byte [esi + 4], al
mov byte [esi + 0xc], bl
call dword [0x489298]
mov eax, dword [0x4a443c]
mov dword [esp + 0x1c], ebx
cmp eax, ebx
jne 0x437ddb
push 0x18
call fcn.0047c85e
mov dword [eax + 4], ebx
mov dword [eax + 0x14], 1
mov dword [0x4a443c], eax
mov dword [eax], ebx
mov edx, dword [0x4a443c]
add esp, 4
mov dword [edx + 8], ebx
mov edi, dword [0x4a4440]
push 0x18
inc edi
mov dword [0x4a4440], edi
mov edi, dword [0x4a443c]
call fcn.0047c85e
mov dword [eax + 4], edi
mov dword [eax + 0x14], ebx
mov dword [esi + 8], eax
mov dword [esi + 0x10], ebx
mov dword [eax], eax
mov eax, dword [esi + 8]
or edi, 0xffffffff
add esp, 4
lea ecx, [esp + 0x10]
mov dword [eax + 8], eax
mov dword [esp + 0x1c], edi
call dword [0x48929c]
lea ecx, [esi + 0x48]
xor eax, eax
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x70], ebx
mov dword [esi + 0x14], 0x489cfc
mov dword [ecx], eax
xor edx, edx
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
lea eax, [esi + 0x54]
mov ecx, dword [esp + 0x14]
mov dword [eax], edx
mov dword [eax + 4], edx
mov dword [eax + 8], edx
mov dword [esi + 0x74], edi
mov dword [esi], 0x64
mov dword [esi + 0x78], ebx
mov dword [esi + 0x80], ebx
mov dword [esi + 0x7c], ebx
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x43f3b0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x24
push ebx
mov ebx, dword [esp + 0x2c]
push ebp
push esi
mov ebp, ecx
push edi
push ebx
lea esi, [ebp + 0x44]
call dword [0x489450]
mov edi, eax
add esp, 4
cmp edi, 0x7ffffffd
jbe 0x43f3da
call dword [0x48927c]
mov ecx, dword [esi + 4]
xor edx, edx
cmp ecx, edx
je 0x43f402
mov al, byte [ecx - 1]
test al, al
je 0x43f402
cmp al, 0xff
je 0x43f402
cmp edi, edx
jne 0x43f428
dec al
mov byte [ecx - 1], al
mov dword [esi + 4], edx
mov dword [esi + 8], edx
mov dword [esi + 0xc], edx
jmp 0x43f45b
cmp edi, edx
jne 0x43f412
push 1
mov ecx, esi
call dword [0x489300]
jmp 0x43f45b
mov eax, dword [esi + 0xc]
cmp eax, 0x1f
ja 0x43f41e
cmp eax, edi
jae 0x43f431
push 1
mov ecx, esi
call dword [0x489300]
push edi
mov ecx, esi
call dword [0x489290]
mov eax, dword [esi + 4]
mov ecx, ebx
test edi, edi
jbe 0x43f44f
mov edx, edi
mov bx, word [ecx]
add ecx, 2
mov word [eax], bx
add eax, 2
dec edx
jne 0x43f43c
mov ebx, dword [esp + 0x38]
mov eax, dword [esi + 4]
mov dword [esi + 8], edi
mov word [eax + edi*2], 0
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x43f473
push eax
call dword [0x48934c]
add esp, 4
mov dword [ebp + 0x10], 0
push 0x49bc98
push ebx
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
mov esi, eax
test esi, esi
je 0x43f520
mov edi, dword [0x489450]
push ebx
call edi
push 0x49bc98
mov ebx, eax
call edi
add esp, 8
cmp ebx, eax
jbe 0x43f520
push 0x49bc98
call edi
lea ecx, [esp + 0x14]
lea esi, [esi + eax*2]
push ecx
push esi
call dword [0x489394]
add esp, 0xc
test eax, eax
jne 0x43f520
mov edx, dword [esp + 0x24]
inc edx
push edx
call dword [0x489324]
add esp, 4
mov dword [ebp + 0x10], eax
test eax, eax
je 0x43f520
push 0x4987d0
push esi
call dword [0x489364]
mov esi, eax
add esp, 8
test esi, esi
je 0x43f520
mov eax, dword [esp + 0x24]
mov ecx, dword [ebp + 0x10]
push esi
push eax
push 1
push ecx
call dword [0x489360]
mov edx, dword [ebp + 0x10]
mov eax, dword [esp + 0x34]
push esi
mov byte [edx + eax], 0
call dword [0x48935c]
add esp, 0x14
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x24
ret 4
Function at 0x43f530
Capabilities:
Create thread

Disassembly:
push ebx
mov ebx, ecx
mov eax, dword [ebx + 0x64]
test eax, eax
je 0x43f540
xor eax, eax
pop ebx
ret 8
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
push ebp
lea esi, [ebx + 0x44]
call dword [0x489450]
mov edi, eax
add esp, 4
cmp edi, 0x7ffffffd
jbe 0x43f564
call dword [0x48927c]
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x43f58a
mov al, byte [ecx - 1]
test al, al
je 0x43f58a
cmp al, 0xff
je 0x43f58a
test edi, edi
jne 0x43f5b0
dec al
push edi
mov byte [ecx - 1], al
mov ecx, esi
call dword [0x489300]
jmp 0x43f5d3
test edi, edi
jne 0x43f59a
push 1
mov ecx, esi
call dword [0x489300]
jmp 0x43f5d3
mov eax, dword [esi + 0xc]
cmp eax, 0x1f
ja 0x43f5a6
cmp eax, edi
jae 0x43f5b9
push 1
mov ecx, esi
call dword [0x489300]
push edi
mov ecx, esi
call dword [0x489290]
mov eax, dword [esi + 4]
push edi
push ebp
push eax
call fcn.0040c5b0
mov ecx, dword [esi + 4]
mov dword [esi + 8], edi
add esp, 0xc
mov word [ecx + edi*2], 0
push 0x1008
call fcn.0047c85e
mov esi, eax
add esp, 4
test esi, esi
je 0x43f627
lea edx, [esi + 4]
push ebp
mov dword [esi], 0
mov dword [esi + 0x1004], 0
push edx
mov dword [esi], ebx
call dword [0x489448]
mov eax, dword [esp + 0x20]
push 0
push 0
push esi
push 0x43dcf0
push 0
push 0
mov dword [esi + 0x1004], eax
call dword [0x489454]
add esp, 0x20
mov dword [ebx + 0x64], eax
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 8
Function at 0x440ca0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4859a8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
push edi
mov edi, ecx
mov dword [esp + 8], 0
lea eax, [esp + 0xc]
mov dword [esp + 0x24], 0
push eax
call dword [0x48947c]
mov esi, dword [esp + 0x30]
test esi, esi
je 0x440ce3
mov eax, dword [esi]
jmp 0x440ce5
xor eax, eax
mov ecx, dword [edi]
lea edx, [esp + 0xc]
push edx
mov edx, dword [esp + 0x38]
push edx
push eax
push edi
call dword [ecx + 0x74]
test eax, eax
jge 0x440d06
push 0x49b978
push edi
push eax
call fcn.00426ea2
mov edi, dword [esp + 0x2c]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov eax, edi
test esi, esi
mov dword [eax], ecx
mov ecx, dword [esp + 0x14]
mov word [esp + 0xc], 0
mov dword [eax + 4], edx
mov edx, dword [esp + 0x18]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
je 0x440d66
lea eax, [esi + 8]
push eax
call dword [0x4891e4]
test eax, eax
jne 0x440d66
mov eax, dword [esi]
test eax, eax
je 0x440d4d
push eax
call dword [0x489488]
mov eax, dword [esi + 4]
test eax, eax
je 0x440d5d
push eax
call fcn.0047ab00
add esp, 4
push esi
call fcn.0047ab00
add esp, 4
mov ecx, dword [esp + 0x1c]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x20
ret 0xc

Function at 0x441c20
Capabilities:
Get mac address on windows

Disassembly:
mov eax, 0x190c
call fcn.0047c8c0
push ebp
mov ebp, dword [esp + 0x1914]
test ebp, ebp
push esi
je 0x441c88
lea eax, [esp + 8]
lea ecx, [esp + 0x14]
push eax
push ecx
lea esi, [esp + 0x1c]
mov dword [esp + 0x10], 0x1900
call fcn.00480846
test eax, eax
jne 0x441c88
lea edx, [esp + 0x14]
test edx, edx
je 0x441c88
mov eax, dword [esi + 0x190]
xor ecx, ecx
cmp eax, 6
jne 0x441c82
xor eax, eax
xor edx, edx
mov dl, byte [esi + eax + 0x194]
add ecx, edx
inc eax
cmp eax, 6
jb 0x441c6d
test ecx, ecx
jne 0x441c93
mov esi, dword [esi]
test esi, esi
jne 0x441c5e
pop esi
xor al, al
pop ebp
add esp, 0x190c
ret
push ebx
push edi
call dword [0x489108]
mov ebx, dword [0x4893b8]
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x16]
add eax, ecx
add word [esi + 0x194], ax
mov byte [ebp], 0
xor edi, edi
xor edx, edx
mov dl, byte [esi + edi + 0x194]
push edx
push ebp
push str._s_02X
push ebp
call ebx
add esp, 0x10
inc edi
cmp edi, 6
jb 0x441cb8
pop edi
pop ebx
pop esi
mov al, 1
pop ebp
add esp, 0x190c
ret
Function at 0x441cf0
Capabilities:
Hash data with md5

Disassembly:
push 0xffffffffffffffff
push 0x485a68
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xa8
push esi
lea eax, [esp + 8]
push edi
push eax
call dword [0x489178]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
mov eax, dword [0x49bf38]
push ecx
push edx
push eax
lea ecx, [esp + 0x20]
push str.360P_04d_012I64X
push ecx
call dword [0x4893b8]
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x34]
mov ecx, 5
lea esi, [esp + 0x28]
mov edi, 0x4a56f0
add esp, 0x14
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x54]
mov dword [esp + 8], 0x67452301
lea esi, [edx + eax]
call fcn.004597b0
push 0x432aff97
push 5
push esi
push 0x10325476
push 0x98badcfe
lea ecx, [esp + 0x1c]
push 0xefcdab89
push ecx
lea ecx, [esp + 0x70]
mov dword [esp + 0xd4], 0
call fcn.00459690
push 0x2441453
push 0x14
push esi
push 0x10325476
push 0x98badcfe
lea edx, [esp + 0x1c]
push 0xefcdab89
push edx
lea ecx, [esp + 0x70]
call fcn.004596e0
push 0xf57c0faf
push 0x10
push esi
push 0x10325476
push 0x98badcfe
lea eax, [esp + 0x1c]
push 0xefcdab89
push eax
lea ecx, [esp + 0x70]
call fcn.00459730
push 0x4bdecfa9
push 0x16
push esi
push 0x10325476
push 0x98badcfe
lea ecx, [esp + 0x1c]
push 0xefcdab89
push ecx
lea ecx, [esp + 0x70]
call fcn.00459770
mov ecx, dword [esp + 8]
pop edi
mov eax, ecx
pop esi
shr eax, 0x10
xor eax, ecx
mov cx, ax
shr cx, 0xc
cmp cl, 9
jbe 0x441e24
add cl, 0x37
jmp 0x441e27
add cl, 0x30
mov byte [0x4a56f8], cl
xor ecx, ecx
mov cl, ah
and cl, 0xf
cmp cl, 9
jbe 0x441e3e
add cl, 0x37
jmp 0x441e41
add cl, 0x30
mov byte [0x4a56f9], cl
mov cl, al
shr cl, 4
and cl, 0xf
cmp cl, 9
jbe 0x441e59
add cl, 0x37
jmp 0x441e5c
add cl, 0x30
and al, 0xf
mov byte [0x4a56fa], cl
cmp al, 9
jbe 0x441e6c
add al, 0x37
jmp 0x441e6e
add al, 0x30
mov ecx, dword [esp + 0xa8]
mov byte [0x4a56fb], al
mov dword fs:[0], ecx
add esp, 0xb4
ret