joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100074c4
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push esi
push edi
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push 0x192
push 0x54d38000
push dword [ebp - 4]
push dword [ebp - 8]
call sub.ntdll.dll__aulldiv
push eax
mov dword [ebp - 8], eax
mov eax, dword [0x1000a348]
lea ecx, [eax + 0x1000b87a]
push ecx
lea eax, [eax + 0x1000b594]
push eax
lea eax, [ebp - 0x34]
push 0x16
push eax
mov dword [ebp - 4], edx
call sub.ntdll.dll__snwprintf
add esp, 0x14
lea eax, [ebp - 0x34]
push eax
push 0x1000
push 0
push 4
push 0x1000a34c
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov esi, eax
test esi, esi
je 0x10007579
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, 0xb7
je 0x10007547
push 2
pop edi
jmp 0x10007570
push 0
push 0
push 0
push 6
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
je 0x10007568
mov ecx, dword [ebp + 8]
mov dword [ecx], esi
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
xor edi, edi
jmp 0x10007581
call edi
mov edi, eax
test edi, edi
je 0x10007581
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10007581
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, edi
pop edi
pop esi
leave
ret 8
Function at 0x10007ac4
Capabilities:
Connect to http server
Create http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
push dword [esi + 4]
mov dword [ebp - 0xc], 0xea60
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, eax
mov dword [ebp - 8], eax
inc eax
push eax
call fcn.10006a51
mov ebx, eax
xor edi, edi
cmp ebx, edi
je 0x10007b16
push edi
lea eax, [ebp - 8]
push eax
push ebx
push dword [esi + 4]
call dword [sym.imp.WININET.dll_InternetCanonicalizeUrlA]
test eax, eax
je 0x10007b10
push dword [esi + 4]
call fcn.1000692b
mov dword [esi + 4], ebx
jmp 0x10007b16
push ebx
call fcn.1000692b
push 0x10000000
push edi
push edi
push edi
push dword [ebp + 8]
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [esi + 0x10], eax
cmp eax, edi
je 0x10007c15
push 0x10007a59
push eax
call dword [sym.imp.WININET.dll_InternetSetStatusCallback]
cmp eax, 0xffffffff
je 0x10007c15
push dword [esi + 0x1c]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push esi
push edi
push 3
push edi
push edi
push 0x50
push dword [esi]
push dword [esi + 0x10]
call dword [sym.imp.WININET.dll_InternetConnectA]
mov dword [esi + 0x14], eax
cmp eax, edi
jne 0x10007b90
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x10007c15
mov eax, dword [esi + 0x1c]
push 0xea60
call fcn.100017ed
test eax, eax
jne 0x10007c15
mov ecx, dword [0x1000a348]
push esi
mov eax, 0x84404000
push eax
push edi
push edi
push edi
push dword [esi + 4]
lea ecx, [ecx + 0x1000b73b]
push ecx
push dword [esi + 0x14]
mov dword [ebp - 4], eax
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
mov dword [esi + 0x18], eax
cmp eax, edi
je 0x10007c15
push 4
pop ebx
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 4]
push ecx
push 0x1f
push eax
mov dword [ebp - 8], ebx
call dword [sym.imp.WININET.dll_InternetQueryOptionA]
mov edi, dword [sym.imp.WININET.dll_InternetSetOptionA]
test eax, eax
je 0x10007bf1
or dword [ebp - 4], 0x100
push ebx
lea eax, [ebp - 4]
push eax
push 0x1f
push dword [esi + 0x18]
call edi
push ebx
lea eax, [ebp - 0xc]
push eax
push 6
push dword [esi + 0x18]
call edi
test eax, eax
je 0x10007c15
push ebx
lea eax, [ebp - 0xc]
push eax
push 5
push dword [esi + 0x18]
call edi
test eax, eax
je 0x10007c15
xor eax, eax
jmp 0x10007c1b
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop ebx
leave
ret 4
Function at 0x405ac0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
movzx eax, byte [ebp + 0x10]
cdq
mov ecx, 0x5f
idiv ecx
add edx, 0x58
mov byte [ebp - 1], dl
mov dword [ebp - 8], 0
jmp 0x405aea
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0xc]
jae 0x405b1f
movzx ecx, byte [ebp - 1]
mov edx, dword [ebp + 8]
movzx eax, byte [edx]
xor eax, ecx
mov ecx, dword [ebp + 8]
mov byte [ecx], al
movzx edx, byte [ebp - 1]
mov eax, dword [ebp + 8]
movzx ecx, byte [eax]
add ecx, edx
mov edx, dword [ebp + 8]
mov byte [edx], cl
mov eax, dword [ebp + 8]
add eax, 1
mov dword [ebp + 8], eax
jmp 0x405ae1
mov esp, ebp
pop ebp
ret
Function at 0x4085e0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x696308
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x75ce68]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x2c]
mov edx, dword [eax + 4]
call edx
lea ecx, [ebp - 0x34]
call fcn.00409f40
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp - 0x4c]
push ecx
mov ecx, dword [ebp - 0x2c]
add ecx, 0x634
call fcn.0040a030
mov edx, dword [eax]
push edx
lea eax, [ebp - 0x50]
push eax
mov ecx, dword [ebp - 0x2c]
add ecx, 0x634
call fcn.0040a090
mov ecx, dword [eax]
push ecx
lea edx, [ebp - 0x54]
push edx
call fcn.0040cf30
add esp, 0x10
mov eax, dword [eax]
mov dword [ebp - 0x34], eax
lea ecx, [ebp - 0x58]
push ecx
mov ecx, dword [ebp - 0x2c]
add ecx, 0x634
call fcn.0040a030
push eax
lea ecx, [ebp - 0x34]
call fcn.00409f00
movzx edx, al
test edx, edx
je 0x4086bd
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x28]
call fcn.0040a840
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
push ecx
mov ecx, dword [ebp - 0x2c]
add ecx, 0x634
call fcn.0040a130
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0040a770
mov edx, dword [ebp - 0x2c]
add edx, 0x5d4
push edx
call dword [0x6ba5e8]
mov eax, dword [ebp - 0x2c]
add eax, 0x5f8
push eax
call dword [0x6ba5f0]
push 8
call fcn.0042d383
add esp, 4
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
mov dword [edx], eax
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp + 8]
mov dword [ecx + 4], edx
lea eax, [ebp - 0x40]
push eax
push 0
mov ecx, dword [ebp - 0x30]
push ecx
push 0x409340
push 0
push 0
call fcn.006393db
add esp, 0x18
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
je 0x408744
mov edx, dword [ebp - 0x40]
mov dword [ebp - 0x44], edx
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x48], eax
lea ecx, [ebp - 0x48]
push ecx
mov ecx, dword [ebp - 0x2c]
add ecx, 0x5bc
call fcn.0040a460
jmp 0x408763
call fcn.00638e1f
mov edx, dword [eax]
push edx
push 0x708d60
push 0x708d6c
push 0x708d88
mov ecx, dword [ebp - 0x2c]
call fcn.00415190
mov eax, dword [ebp - 0x2c]
add eax, 0x5f8
push eax
call dword [0x6ba5ec]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005faac9
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4087a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x630], 0
je 0x4087d9
call fcn.00638e1f
mov ecx, dword [eax]
push ecx
push 0x708d98
push 0x708d9c
push 0x708dcc
mov ecx, dword [ebp - 4]
call fcn.00415190
xor eax, eax
jmp 0x4089bb
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [edx + 0x628], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
mov dword [ecx + 0x62c], edx
mov eax, dword [ebp - 4]
add eax, 0x5f8
push eax
call dword [0x6ba5e4]
mov ecx, dword [ebp - 4]
add ecx, 0x610
push ecx
call dword [0x6ba5e4]
mov ecx, dword [ebp - 4]
call fcn.00408b60
push 0
push 1
push 0
push 0
call dword [0x6ba5e0]
mov edx, dword [ebp - 4]
mov dword [edx + 0x5b4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x5b4]
push ecx
call dword [0x6ba5dc]
mov edx, dword [ebp - 4]
add edx, 0x5a4
push edx
push 0
mov eax, dword [ebp - 4]
push eax
push 0x408d70
push 0
push 0
call fcn.006393db
add esp, 0x18
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x5a0], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0x5a0], 0
jne 0x40889b
call fcn.00638e1f
mov eax, dword [eax]
push eax
push 0x708ddc
push 0x708de0
push 0x708e10
mov ecx, dword [ebp - 4]
call fcn.00415190
xor eax, eax
jmp 0x4089bb
push 0x7530
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x5b4]
push edx
call dword [0x6ba5d8]
test eax, eax
je 0x4088e7
push 0x7530
push 0x708e20
push 0x708e28
push 0x708e70
mov ecx, dword [ebp - 4]
call fcn.00415190
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x5b4]
push ecx
call dword [0x6ba674]
xor eax, eax
jmp 0x4089bb
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x5b4]
push eax
call dword [0x6ba5dc]
mov ecx, dword [ebp - 4]
add ecx, 0x5ac
push ecx
push 0
mov edx, dword [ebp - 4]
push edx
push 0x409dd0
push 0
push 0
call fcn.006393db
add esp, 0x18
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x5a8], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0x5a8], 0
jne 0x408950
call fcn.00638e1f
mov eax, dword [eax]
push eax
push 0x708e24
push 0x708e80
push 0x708eb0
mov ecx, dword [ebp - 4]
call fcn.00415190
xor eax, eax
jmp 0x4089bb
push 0x7530
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x5b4]
push edx
call dword [0x6ba5d8]
test eax, eax
je 0x408999
push 0x7530
push 0x708ec0
push 0x708ed0
push 0x708f18
mov ecx, dword [ebp - 4]
call fcn.00415190
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x5b4]
push ecx
call dword [0x6ba674]
xor eax, eax
jmp 0x4089bb
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x5b4]
push eax
call dword [0x6ba674]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x630], 1
mov eax, 1
mov esp, ebp
pop ebp
ret 8
Function at 0x41f540
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x75ce68]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x20], 0
mov byte [ebp - 0x18], 0x47
mov byte [ebp - 0x17], 0x65
mov byte [ebp - 0x16], 0x74
mov byte [ebp - 0x15], 0x4e
mov byte [ebp - 0x14], 0x61
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x12], 0x69
mov byte [ebp - 0x11], 0x76
mov byte [ebp - 0x10], 0x65
mov byte [ebp - 0xf], 0x53
mov byte [ebp - 0xe], 0x79
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0x74
mov byte [ebp - 0xb], 0x65
mov byte [ebp - 0xa], 0x6d
mov byte [ebp - 9], 0x49
mov byte [ebp - 8], 0x6e
mov byte [ebp - 7], 0x66
mov byte [ebp - 6], 0x6f
mov byte [ebp - 5], 0
lea eax, [ebp - 0x18]
push eax
push 0x716570
call dword [0x6ba5fc]
push eax
call dword [0x6ba574]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x41f5e6
lea ecx, [ebp - 0x44]
push ecx
call dword [ebp - 0x1c]
movzx edx, word [ebp - 0x44]
cmp edx, 9
je 0x41f5df
movzx eax, word [ebp - 0x44]
cmp eax, 6
jne 0x41f5e6
mov dword [ebp - 0x20], 1
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005faac9
mov esp, ebp
pop ebp
ret

Function at 0x420a30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
movzx eax, byte [ebp + 0x10]
cdq
mov ecx, 0x5f
idiv ecx
add edx, 0x58
mov byte [ebp - 1], dl
mov dword [ebp - 8], 0
jmp 0x420a5a
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0xc]
jae 0x420a8f
movzx ecx, byte [ebp - 1]
mov edx, dword [ebp + 8]
movzx eax, byte [edx]
sub eax, ecx
mov ecx, dword [ebp + 8]
mov byte [ecx], al
movzx edx, byte [ebp - 1]
mov eax, dword [ebp + 8]
movzx ecx, byte [eax]
xor ecx, edx
mov edx, dword [ebp + 8]
mov byte [edx], cl
mov eax, dword [ebp + 8]
add eax, 1
mov dword [ebp + 8], eax
jmp 0x420a51
mov esp, ebp
pop ebp
ret
Function at 0x65fed3
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0065fad8

Function at 0x65fede
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0065fc59
Function at 0x4416d0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
cmp byte [eax], 0
je 0x4416f7
jmp 0x4416e0
mov cl, byte [eax]
movzx edx, cl
mov dl, byte [edx + 0x68d8f0]
xor dl, cl
mov byte [eax], dl
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x4416e0
ret
Function at 0x46c670
Capabilities:
Hash data with crc32

Disassembly:
mov edx, dword [esp + 8]
mov eax, ecx
mov ecx, dword [esp + 0xc]
push ebx
mov dword [eax + 4], ecx
xor ecx, ecx
mov dword [eax + 0xc], edx
mov edx, dword [esp + 8]
push esi
mov dword [eax], 0x68ecb0
mov dword [eax + 8], ecx
mov dword [eax + 0x10], edx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
xor ebx, ebx
lea esi, [eax + 0x43c]
mov edx, ebx
shr edx, 1
test bl, 1
je 0x46c6b1
xor edx, 0xedb88320
test dl, 1
je 0x46c6c0
shr edx, 1
xor edx, 0xedb88320
jmp 0x46c6c2
shr edx, 1
test dl, 1
je 0x46c6d1
shr edx, 1
xor edx, 0xedb88320
jmp 0x46c6d3
shr edx, 1
test dl, 1
je 0x46c6e2
shr edx, 1
xor edx, 0xedb88320
jmp 0x46c6e4
shr edx, 1
test dl, 1
je 0x46c6f3
shr edx, 1
xor edx, 0xedb88320
jmp 0x46c6f5
shr edx, 1
test dl, 1
je 0x46c704
shr edx, 1
xor edx, 0xedb88320
jmp 0x46c706
shr edx, 1
test dl, 1
je 0x46c715
shr edx, 1
xor edx, 0xedb88320
jmp 0x46c717
shr edx, 1
test dl, 1
je 0x46c726
shr edx, 1
xor edx, 0xedb88320
jmp 0x46c728
shr edx, 1
mov dword [esi], edx
inc ebx
add esi, 4
cmp ebx, 0x100
jb 0x46c6a2
pop esi
mov byte [eax + 0x93b], cl
pop ebx
ret 0xc

Function at 0x46c7a0
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov edx, dword [ecx + 0x10]
test edx, edx
push ebx
push ebp
push esi
push edi
je 0x46c891
mov edi, dword [ecx + 8]
mov ebp, dword [ecx + 0xc]
lea esi, [edi + 4]
cmp esi, ebp
jae 0x46c891
xor eax, eax
mov dword [ecx + 8], esi
mov ah, byte [edi + edx]
movzx ebx, byte [edi + edx + 2]
mov al, byte [edi + edx + 1]
movzx edi, byte [edi + edx + 3]
shl eax, 8
or eax, ebx
shl eax, 8
or edi, eax
lea eax, [esi + 4]
cmp eax, ebp
jae 0x46c891
xor ebx, ebx
mov dword [ecx + 8], eax
mov bh, byte [esi + edx]
movzx eax, byte [esi + edx + 2]
mov bl, byte [esi + edx + 1]
movzx edx, byte [esi + edx + 3]
shl ebx, 8
or ebx, eax
mov eax, dword [esp + 0x18]
shl ebx, 8
or ebx, edx
mov dword [eax], ebx
mov eax, dword [ecx + 8]
mov esi, dword [ecx + 0xc]
lea edx, [eax + edi + 4]
cmp edx, esi
mov dword [esp + 0x10], ebx
jae 0x46c891
mov esi, 0xfffffffc
or edx, 0xffffffff
cmp edi, esi
jle 0x46c856
mov ebx, dword [ecx + 0x10]
lea ebp, [eax + ebx]
xor ebx, ebx
mov bl, byte [esi + ebp]
xor ebx, edx
and ebx, 0xff
shr edx, 8
xor edx, dword [ecx + ebx*4 + 0x43c]
inc esi
cmp esi, edi
jl 0x46c836
mov ebx, dword [esp + 0x10]
mov ebp, dword [ecx + 0x10]
lea esi, [eax + edi]
movzx ecx, byte [esi + ebp + 2]
xor eax, eax
mov ah, byte [esi + ebp]
add esi, ebp
not edx
mov al, byte [esi + 1]
shl eax, 8
or eax, ecx
movzx ecx, byte [esi + 3]
shl eax, 8
or eax, ecx
cmp edx, eax
jne 0x46c891
cmp ebx, 0x49454e44
je 0x46c891
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
pop ecx
ret 4
Function at 0x47b3a0
Capabilities:
Encode data using xor

Disassembly:
mov al, byte [0x72b980]
test al, al
je 0x47b3d8
mov edx, dword [esp + 4]
mov ecx, dword [edx + 0x4c]
mov eax, dword [ecx]
cmp eax, 0x13
mov dword [esp + 4], edx
jne 0x47b3c0
jmp fcn.0047a5f0
cmp eax, 0x12
jne 0x47b3d3
test byte [ecx + 0x94], 0xc
jne 0x47b3bb
jmp fcn.0047ae60
jmp fcn.0047a070
mov ecx, dword [esp + 4]
mov edx, dword [ecx + 0x4c]
mov eax, dword [edx]
cmp eax, 0x13
mov dword [esp + 4], ecx
jne 0x47b3ef
jmp fcn.0047a9a0
cmp eax, 0x12
jne 0x47b3f9
jmp fcn.0047afc0
jmp fcn.0047a2c0
Function at 0x4834a0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, ecx
mov dword [eax], ecx
shr ecx, 2
and ebx, 3
test ecx, ecx
push esi
jbe 0x4834e2
push edi
mov edi, ecx
movzx ecx, word [edx]
mov esi, dword [eax]
add esi, ecx
mov ecx, esi
mov dword [eax], esi
shl ecx, 0x10
xor ecx, esi
add edx, 2
mov dword [eax], ecx
movzx esi, word [edx]
shl esi, 0xb
xor esi, ecx
mov dword [eax], esi
mov ecx, esi
shr esi, 0xb
add esi, ecx
add edx, 2
dec edi
mov dword [eax], esi
jne 0x4834b3
pop edi
mov ecx, ebx
dec ecx
je 0x483526
dec ecx
je 0x483511
dec ecx
jne 0x48353c
movzx ecx, word [edx]
mov esi, dword [eax]
add esi, ecx
mov ecx, esi
shl ecx, 0x10
xor ecx, esi
mov dword [eax], ecx
movzx edx, byte [edx + 2]
shl edx, 0x12
xor edx, ecx
mov ecx, edx
shr ecx, 0xb
add ecx, edx
mov dword [eax], ecx
jmp 0x48353c
movzx edx, word [edx]
mov ecx, dword [eax]
add edx, ecx
mov ecx, edx
shl ecx, 0xb
xor ecx, edx
mov edx, ecx
shr edx, 0x11
jmp 0x483538
movzx ecx, byte [edx]
mov edx, dword [eax]
add edx, ecx
mov ecx, edx
shl ecx, 0xa
xor ecx, edx
mov edx, ecx
shr edx, 1
add edx, ecx
mov dword [eax], edx
mov edx, dword [eax]
lea ecx, [edx*8]
xor ecx, edx
mov edx, ecx
shr edx, 5
add edx, ecx
lea ecx, [edx*4]
xor ecx, edx
mov edx, ecx
shr edx, 0xf
add ecx, edx
mov edx, ecx
shl edx, 0xa
xor edx, ecx
pop esi
mov dword [eax], edx
pop ebx
ret
Function at 0x4a1b30
Capabilities:
Hash data using sha256

Disassembly:
sub esp, 0x70
mov ecx, dword [esp + 0x74]
xor eax, eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0x78]
push eax
push ecx
lea edx, [esp + 8]
push edx
mov dword [esp + 0xc], 0x6a09e667
mov dword [esp + 0x10], 0xbb67ae85
mov dword [esp + 0x14], 0x3c6ef372
mov dword [esp + 0x18], 0xa54ff53a
mov dword [esp + 0x1c], 0x510e527f
mov dword [esp + 0x20], 0x9b05688c
mov dword [esp + 0x24], 0x1f83d9ab
mov dword [esp + 0x28], 0x5be0cd19
mov dword [esp + 0x78], 0x20
call fcn.004a1650
mov ecx, dword [esp + 0x88]
lea eax, [esp + 0xc]
push eax
push ecx
call fcn.004a1900
add esp, 0x84
ret
Function at 0x4a9ec0
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push esi
push 0x50
mov ebx, ecx
call fcn.00446b60
mov esi, eax
add esp, 4
test esi, esi
je 0x4a9f16
mov ecx, ebx
call fcn.00451a40
test eax, eax
je 0x4a9eef
mov eax, dword [ebx + 4]
mov eax, dword [eax + 0x20]
mov cl, byte [eax + 0x139]
test cl, cl
jne 0x4a9f05
mov eax, dword [ebx + 0x2c]
mov ecx, dword [eax + 8]
cmp eax, dword [ecx + 0x3ec]
jne 0x4a9f05
mov eax, dword [ecx + 0x3e8]
jmp 0x4a9f08
add eax, 0x10
push eax
mov ecx, esi
call fcn.00472a10
mov esi, eax
test esi, esi
jne 0x4a9f1d
pop esi
xor eax, eax
pop ebx
ret 0xc
mov ecx, dword [ebx + 0x50]
mov eax, dword [esp + 0xc]
mov dword [esi + 0x20], ecx
mov dword [ebx + 0x50], esi
push ebp
mov ebp, dword [esp + 0x18]
mov edx, dword [ebp]
mov dword [esi + 0x24], edx
movzx cx, byte [eax + 3]
mov word [esi + 0xe], cx
movzx dx, byte [eax]
mov word [esi + 0xc], dx
movzx cx, byte [eax + 1]
mov word [esi + 0xa], cx
movzx dx, byte [eax + 2]
mov eax, dword [esp + 0x14]
test eax, eax
push edi
lea edi, [esi + 8]
mov word [edi], dx
je 0x4a9f73
lea ecx, [eax + 0x1c]
cmp dword [ecx], 0
je 0x4a9f73
push 1
push edi
call fcn.0047bcd0
movzx eax, word [edi + 6]
cmp eax, 0xff
jge 0x4a9fae
movzx ecx, word [edi + 4]
movzx edx, word [edi + 2]
inc eax
imul ecx, eax
imul edx, eax
sar ecx, 8
mov word [edi + 4], cx
movzx ecx, word [edi]
imul ecx, eax
sar edx, 8
sar ecx, 8
mov word [edi + 2], dx
mov word [edi], cx
mov eax, 1
jmp 0x4a9fb0
xor eax, eax
mov ecx, ebx
mov byte [esi + 0x2c], al
call fcn.00451a40
test eax, eax
je 0x4a9fd3
mov edx, dword [ebx + 4]
mov eax, dword [edx + 0x20]
mov cl, byte [eax + 0x139]
test cl, cl
je 0x4a9fd3
add eax, 0x10
jmp 0x4a9fec
mov ebx, dword [ebx + 0x2c]
mov eax, dword [ebx + 8]
cmp ebx, dword [eax + 0x3ec]
jne 0x4a9fe9
mov eax, dword [eax + 0x3e8]
jmp 0x4a9fec
lea eax, [ebx + 0x10]
mov ecx, dword [eax + 0x80]
test ecx, ecx
je 0x4a9ffd
mov ecx, esi
call fcn.00480600
mov eax, dword [ebp]
inc eax
pop edi
mov dword [ebp], eax
pop ebp
mov eax, esi
pop esi
pop ebx
ret 0xc
Function at 0x4ac910
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x24
push esi
mov esi, ecx
mov eax, dword [esi + 0x18]
test eax, eax
jne 0x4ac931
mov eax, dword [esp + 0x30]
push eax
call fcn.00443a90
add esp, 4
pop esi
add esp, 0x24
ret 8
mov eax, dword [eax + 0x78]
cmp eax, 7
push edi
jne 0x4ac998
mov ecx, dword [esi + 4]
movzx edi, word [ecx + 0x5a]
mov eax, dword [esi + 0x18]
lea edx, [esp + 0x18]
push edx
lea ecx, [eax + 0x10]
push edi
push ecx
add eax, 0x3c
push eax
call fcn.00457450
mov eax, dword [esi + 0x18]
lea edx, [esp + 0x18]
push edx
push edi
push eax
add eax, 0x4c
push eax
call fcn.00457450
mov eax, dword [esi + 0x18]
movzx ecx, byte [eax + 0x20]
mov edx, dword [esp + 0x54]
mov eax, dword [esp + 0x50]
add esp, 0x20
push ecx
push edx
push eax
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x28]
push edx
mov ecx, esi
call fcn.004a9c00
pop edi
pop esi
add esp, 0x24
ret 8
test eax, eax
mov ecx, esi
jne 0x4ac9d1
push eax
call fcn.004ab370
push 1
mov ecx, esi
mov edi, eax
call fcn.004ab370
mov ecx, dword [esi + 0x18]
movzx edx, byte [ecx]
mov ecx, dword [esp + 0x34]
push edx
mov edx, dword [esp + 0x34]
push ecx
push edx
push eax
push edi
mov ecx, esi
call fcn.004a9c00
pop edi
pop esi
add esp, 0x24
ret 8
push ebx
push ebp
push 0
call fcn.004ab370
push 1
mov ecx, esi
mov ebp, eax
call fcn.004ab370
mov edi, eax
push 0
push edi
push ebp
call fcn.00443de0
add esp, 0xc
test eax, eax
jne 0x4aca44
mov eax, dword [esp + 0x38]
push eax
call fcn.00445370
add esp, 4
test eax, eax
jne 0x4aca44
mov ecx, dword [esi + 4]
mov ecx, dword [ecx + 0x28]
test ecx, ecx
je 0x4aca29
mov ecx, dword [ecx + 0x48]
test cl, 2
je 0x4aca1f
mov eax, 1
test cl, 1
je 0x4aca2e
or eax, 2
jmp 0x4aca2e
mov eax, 0xff
mov ebx, dword [esp + 0x3c]
mov edx, dword [esp + 0x38]
push eax
push ebx
push edx
push edi
push ebp
mov ecx, esi
call fcn.004a9c00
jmp 0x4aca57
mov ebx, dword [esp + 0x3c]
mov eax, dword [esp + 0x38]
push ebx
push edi
push eax
call fcn.004446f0
add esp, 0xc
mov ecx, dword [esi + 4]
mov eax, dword [ecx + 0x18]
test eax, eax
je 0x4aca77
push ebx
mov ecx, esi
call fcn.004a7d50
mov edx, dword [eax + 0x38]
neg edx
push edx
call fcn.00445ab0
add esp, 8
mov ecx, dword [esi + 0x18]
cmp dword [ecx + 0x78], 4
jne 0x4acad9
mov eax, dword [esi + 4]
mov eax, dword [eax + 0x1c]
test eax, eax
je 0x4acad9
mov edx, dword [eax + 0xc]
test edx, edx
jbe 0x4acad9
mov ecx, dword [ecx + 0x68]
mov eax, dword [ecx + 0x210]
test eax, eax
jne 0x4acaa3
call fcn.004ba290
lea ecx, [esp + 0x24]
push ecx
mov dword [esp + 0x24], eax
call fcn.00443a90
mov eax, dword [esp + 0x3c]
add esp, 4
lea edx, [esp + 0x20]
push edx
push 0x4a60f0
push eax
mov ecx, esi
call fcn.004a94f0
push ebx
lea ecx, [esp + 0x28]
push ebx
push ecx
call fcn.00445bd0
add esp, 0xc
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x24
ret 8