joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42fb7b
Capabilities:
Authenticate hmac
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x210
mov eax, dword [0x596804]
xor eax, esp
mov dword [esp + 0x20c], eax
mov eax, dword [esp + 0x21c]
mov cl, byte [esp + 0x22c]
push ebx
mov ebx, dword [esp + 0x218]
push ebp
push esi
mov esi, dword [esp + 0x234]
push edi
mov edi, dword [esp + 0x230]
push edi
push eax
lea edx, [esp + 0x1a4]
mov dword [esp + 0x18], 0
push edx
mov dword [esp + 0x20], ebx
mov byte [esp + 0x1f], cl
call fcn.0046bc9b
mov eax, dword [esp + 0x1c]
mov ebp, dword [esp + 0x234]
lea ecx, [esp + 0xe4]
push ecx
mov dword [esp + edi + 0x1ac], eax
add edi, 4
push edi
lea edx, [esp + 0x1b0]
push edx
push ebp
push ebx
call fcn.0042fa1b
mov eax, dword [esp + 0xf8]
mov ecx, dword [esp + 0xfc]
mov edx, dword [esp + 0x100]
mov dword [esi], eax
mov eax, dword [esp + 0x104]
mov dword [esi + 4], ecx
mov ecx, dword [esp + 0x108]
mov dword [esi + 8], edx
mov dword [esi + 0xc], eax
mov eax, dword [esp + 0x254]
add esp, 0x20
mov dword [esi + 0x10], ecx
cmp eax, 1
jle 0x42fda4
mov ebx, esi
lea edx, [esp + 0xec]
sub ebx, edx
dec eax
mov dword [esp + 0x10], eax
jmp 0x42fc5b
mov esi, dword [esp + 0x14]
mov edi, ebp
cmp ebp, 0x40
jle 0x42fca5
lea eax, [esp + 0x78]
push eax
call fcn.0043397b
push ebp
mov ecx, esi
push ecx
lea edx, [esp + 0x84]
push edx
call fcn.004353cb
lea eax, [esp + 0x88]
push eax
lea ecx, [esp + 0x114]
push ecx
call fcn.0043548b
add esp, 0x18
lea esi, [esp + 0x100]
mov edi, 0x14
push 0x41
lea edx, [esp + 0x15c]
push 0x36
push edx
call fcn.0046c6ab
push 0x41
lea eax, [esp + 0x124]
push 0x5c
push eax
call fcn.0046c6ab
add esp, 0x18
test edi, edi
jle 0x42fcec
mov eax, esi
neg esi
lea edx, [esp + esi + 0x158]
lea esi, [esp + esi + 0x114]
mov cl, byte [eax]
xor byte [edx + eax], cl
xor byte [esi + eax], cl
inc eax
dec edi
jne 0x42fce0
lea ecx, [esp + 0x18]
push ecx
call fcn.0043397b
push 0x40
lea edx, [esp + 0x160]
push edx
lea eax, [esp + 0x24]
push eax
call fcn.004353cb
push 0x14
lea ecx, [esp + 0xec]
push ecx
lea edx, [esp + 0x30]
push edx
call fcn.004353cb
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x10c]
push ecx
call fcn.0043548b
lea edx, [esp + 0x3c]
push edx
call fcn.0043397b
push 0x40
lea eax, [esp + 0x140]
push eax
lea ecx, [esp + 0x48]
push ecx
call fcn.004353cb
push 0x14
lea edx, [esp + 0x124]
push edx
lea eax, [esp + 0x54]
push eax
call fcn.004353cb
add esp, 0x40
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0xf0]
push edx
call fcn.0043548b
add esp, 8
xor eax, eax
mov dl, byte [esp + eax + 0xec]
lea ecx, [esp + eax + 0xec]
xor byte [ebx + ecx], dl
mov byte [esp + eax + 0xd8], dl
inc eax
cmp eax, 0x14
jl 0x42fd7c
dec dword [esp + 0x10]
jne 0x42fc5b
mov ecx, dword [esp + 0x21c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0046c68f
add esp, 0x210
ret
Function at 0x42fdcb
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xd0
mov eax, dword [0x596804]
xor eax, esp
mov dword [esp + 0xcc], eax
mov eax, dword [esp + 0xdc]
mov ecx, dword [esp + 0xec]
mov dword [esp + 8], eax
mov eax, 0x66666667
imul ecx
sar edx, 3
mov eax, edx
push ebx
shr eax, 0x1f
add eax, edx
push ebp
mov ebp, dword [esp + 0xdc]
push esi
mov esi, dword [esp + 0xf4]
lea edx, [eax + eax*4]
add edx, edx
push edi
add edx, edx
mov edi, ecx
sub edi, edx
je 0x42fe22
inc eax
mov edi, dword [esp + 0xe8]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
sub ecx, edx
add ecx, 0x14
mov ebx, 1
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], ecx
cmp eax, ebx
jle 0x42ff33
nop
mov eax, dword [esp + 0xf0]
mov ecx, dword [esp + 0x18]
push eax
push ecx
lea edx, [esp + 0x64]
mov dword [esp + 0x18], 0
push edx
mov byte [esp + 0x1f], bl
call fcn.0046bc9b
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0xfc]
mov dword [esp + eax + 0x68], ecx
lea edx, [esp + 0x40]
push edx
add eax, 4
push eax
lea eax, [esp + 0x70]
push eax
push edi
push ebp
call fcn.0042fa1b
mov eax, dword [esp + 0x5c]
mov ecx, dword [esp + 0x54]
mov edx, dword [esp + 0x58]
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x114]
mov dword [esp + 0x40], ecx
mov ecx, dword [esp + 0x60]
mov dword [esp + 0x44], edx
mov edx, dword [esp + 0x64]
add esp, 0x20
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], edx
cmp eax, 1
jle 0x42ff03
dec eax
mov dword [esp + 0x10], eax
lea eax, [esp + 0x48]
push eax
push 0x14
lea ecx, [esp + 0x3c]
push ecx
push edi
push ebp
call fcn.0042fa1b
add esp, 0x14
xor eax, eax
jmp 0x42feeb
mov cl, byte [esp + eax + 0x48]
xor byte [esp + eax + 0x20], cl
mov byte [esp + eax + 0x34], cl
inc eax
cmp eax, 0x14
jl 0x42feeb
dec dword [esp + 0x10]
jne 0x42fece
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov dword [esi], edx
mov edx, dword [esp + 0x2c]
mov dword [esi + 4], eax
mov eax, dword [esp + 0x30]
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
mov dword [esi + 0x10], eax
inc ebx
add esi, 0x14
cmp ebx, dword [esp + 0x14]
jl 0x42fe4b
mov edx, dword [esp + 0xf4]
mov eax, dword [esp + 0xf0]
push ebx
lea ecx, [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x20]
push edx
push eax
push ecx
push edi
push ebp
call fcn.0042fb7b
mov edx, dword [esp + 0x38]
push edx
lea eax, [esp + 0x40]
push eax
push esi
call fcn.0046bc9b
mov ecx, dword [esp + 0x104]
add esp, 0x28
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0046c68f
add esp, 0xd0
ret
Function at 0x42ff8b
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
sub esp, 0x300
mov eax, dword [0x596804]
xor eax, esp
mov dword [esp + 0x2fc], eax
mov eax, dword [esp + 0x314]
push ebx
mov ebx, dword [esp + 0x310]
push esi
mov esi, dword [esp + 0x310]
push edi
mov edi, dword [esp + 0x310]
mov dword [esp + 0xc], eax
cmp esi, 0x40
jle 0x43000e
lea ecx, [esp + 0x160]
push ecx
call fcn.00436ecb
lea edx, [esp + 0x164]
push edx
lea eax, [esi*8]
push eax
push edi
call fcn.00436f4b
lea ecx, [esp + 0x2d8]
push ecx
lea edx, [esp + 0x174]
push edx
call fcn.0043710b
add esp, 0x18
lea edi, [esp + 0x2c8]
mov esi, 0x40
lea eax, [esp + 0xb8]
push eax
call fcn.00436ecb
add esp, 4
xor eax, eax
test esi, esi
jle 0x430050
push ebp
mov ebp, edi
lea ecx, [esp + 0x20c]
sub ebp, ecx
jmp 0x43003b
lea ecx, [esp + eax + 0x20c]
mov dl, byte [ecx + ebp]
xor dl, 0x36
inc eax
mov byte [ecx], dl
cmp eax, esi
jl 0x43003b
pop ebp
cmp esi, 0x40
jge 0x43006f
mov ecx, 0x40
sub ecx, esi
push ecx
lea eax, [esp + esi + 0x20c]
push 0x36
push eax
call fcn.0046c6ab
add esp, 0xc
lea edx, [esp + 0xb8]
push edx
lea eax, [esp + 0x20c]
push 0x200
push eax
call fcn.00436f4b
mov edx, dword [esp + 0x328]
lea ecx, [esp + 0xc4]
push ecx
lea eax, [edx*8]
push eax
push ebx
call fcn.00436f4b
lea ecx, [esp + 0x260]
push ecx
lea edx, [esp + 0xd4]
push edx
call fcn.0043710b
lea eax, [esp + 0x30]
push eax
call fcn.00436ecb
add esp, 0x24
xor eax, eax
test esi, esi
jle 0x4300ef
lea ecx, [esp + 0x208]
sub edi, ecx
lea esp, [esp]
lea ecx, [esp + eax + 0x208]
mov dl, byte [edi + ecx]
xor dl, 0x5c
inc eax
mov byte [ecx], dl
cmp eax, esi
jl 0x4300db
cmp esi, 0x40
jge 0x43010e
mov ecx, 0x40
sub ecx, esi
push ecx
lea eax, [esp + esi + 0x20c]
push 0x5c
push eax
call fcn.0046c6ab
add esp, 0xc
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x20c]
push 0x200
push eax
call fcn.00436f4b
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x258]
push 0x200
push edx
call fcn.00436f4b
lea eax, [esp + 0x2a0]
push eax
lea ecx, [esp + 0x2c]
push ecx
call fcn.0043710b
mov eax, dword [esp + 0x344]
add esp, 0x20
pop edi
pop esi
pop ebx
cmp eax, 0x40
jle 0x430165
mov eax, 0x40
test eax, eax
jle 0x43017f
push eax
mov eax, dword [esp + 4]
lea edx, [esp + 0x280]
push edx
push eax
call fcn.0046bc9b
add esp, 0xc
mov ecx, dword [esp + 0x2fc]
xor ecx, esp
call fcn.0046c68f
add esp, 0x300
ret
Function at 0x43019b
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
sub esp, 0x404
mov eax, dword [0x596804]
xor eax, esp
mov dword [esp + 0x400], eax
mov eax, dword [esp + 0x410]
mov cl, byte [esp + 0x420]
push ebp
mov ebp, dword [esp + 0x420]
push esi
mov esi, dword [esp + 0x41c]
push edi
mov edi, dword [esp + 0x414]
push esi
push eax
lea edx, [esp + 0x394]
mov dword [esp + 0x14], 0
push edx
mov dword [esp + 0x1c], edi
mov byte [esp + 0x1b], cl
call fcn.0046bc9b
mov eax, dword [esp + 0x18]
push 0x40
mov dword [esp + esi + 0x39c], eax
mov eax, dword [esp + 0x428]
lea ecx, [esp + 0x25c]
push ecx
add esi, 4
push esi
lea edx, [esp + 0x3a4]
push edx
push eax
push edi
call fcn.0042ff8b
mov eax, dword [esp + 0x448]
add esp, 0x24
mov ecx, 0x10
lea esi, [esp + 0x24c]
mov edi, ebp
rep movsd dword es:[edi], dword [esi]
cmp eax, 1
jle 0x430434
push ebx
mov ebx, ebp
lea ecx, [esp + 0x290]
sub ebx, ecx
dec eax
mov dword [esp + 0x10], eax
lea esp, [esp]
mov esi, dword [esp + 0x41c]
mov edi, dword [esp + 0x14]
cmp esi, 0x40
jle 0x4302b2
lea edx, [esp + 0x168]
push edx
call fcn.00436ecb
lea eax, [esp + 0x16c]
push eax
lea ecx, [esi*8]
push ecx
push edi
call fcn.00436f4b
lea edx, [esp + 0x2e0]
push edx
lea eax, [esp + 0x17c]
push eax
call fcn.0043710b
add esp, 0x18
lea edi, [esp + 0x2d0]
mov esi, 0x40
lea ecx, [esp + 0xc0]
push ecx
call fcn.00436ecb
add esp, 4
xor eax, eax
test esi, esi
jle 0x4302ef
mov ebp, edi
lea edx, [esp + 0x210]
sub ebp, edx
jmp 0x4302db
lea ecx, [esp + eax + 0x210]
mov dl, byte [ecx + ebp]
xor dl, 0x36
inc eax
mov byte [ecx], dl
cmp eax, esi
jl 0x4302db
cmp esi, 0x40
jge 0x43030e
mov ecx, 0x40
sub ecx, esi
push ecx
lea eax, [esp + esi + 0x214]
push 0x36
push eax
call fcn.0046c6ab
add esp, 0xc
lea edx, [esp + 0xc0]
push edx
lea eax, [esp + 0x214]
push 0x200
push eax
call fcn.00436f4b
lea ecx, [esp + 0xcc]
push ecx
lea edx, [esp + 0x260]
push 0x200
push edx
call fcn.00436f4b
lea eax, [esp + 0x368]
push eax
lea ecx, [esp + 0xdc]
push ecx
call fcn.0043710b
lea edx, [esp + 0x38]
push edx
call fcn.00436ecb
add esp, 0x24
xor eax, eax
test esi, esi
jle 0x43038f
lea ecx, [esp + 0x210]
sub edi, ecx
jmp 0x43037b
lea ecx, [esp + eax + 0x210]
mov dl, byte [edi + ecx]
xor dl, 0x5c
inc eax
mov byte [ecx], dl
cmp eax, esi
jl 0x43037b
cmp esi, 0x40
jge 0x4303ae
mov ecx, 0x40
sub ecx, esi
push ecx
lea eax, [esp + esi + 0x214]
push 0x5c
push eax
call fcn.0046c6ab
add esp, 0xc
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x214]
push 0x200
push eax
call fcn.00436f4b
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x360]
push 0x200
push edx
call fcn.00436f4b
lea eax, [esp + 0x328]
push eax
lea ecx, [esp + 0x34]
push ecx
call fcn.0043710b
push 0x40
lea edx, [esp + 0x334]
push edx
lea eax, [esp + 0x2b8]
push eax
call fcn.0046bc9b
add esp, 0x2c
xor eax, eax
nop
mov dl, byte [esp + eax + 0x290]
lea ecx, [esp + eax + 0x290]
xor byte [ebx + ecx], dl
mov byte [esp + eax + 0x250], dl
inc eax
cmp eax, 0x40
jl 0x43040b
dec dword [esp + 0x10]
jne 0x43025b
pop ebx
mov ecx, dword [esp + 0x40c]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.0046c68f
add esp, 0x404
ret
Function at 0x43045b
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x15c
mov eax, dword [0x596804]
xor eax, esp
mov dword [esp + 0x158], eax
mov ecx, dword [esp + 0x168]
mov eax, dword [esp + 0x160]
mov edx, dword [esp + 0x174]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x178]
mov dword [esp], eax
mov eax, ecx
and eax, 0x8000003f
mov dword [esp + 8], edx
jns 0x4304a4
dec eax
or eax, 0xffffffc0
inc eax
mov eax, ecx
cdq
je 0x4304b4
and edx, 0x3f
add eax, edx
sar eax, 6
inc eax
jmp 0x4304bc
and edx, 0x3f
add eax, edx
sar eax, 6
mov edx, eax
shl edx, 6
push ebx
sub ecx, edx
add ecx, 0x40
mov ebx, 1
push ebp
mov ebp, dword [esp + 0x16c]
mov dword [esp + 0xc], eax
mov dword [esp + 0x1c], ecx
cmp eax, ebx
jle 0x4305c8
push esi
push edi
jmp 0x4304eb
mov esi, dword [esp + 0x17c]
mov eax, dword [esp + 0x1c]
push esi
push eax
lea ecx, [esp + 0xf0]
mov dword [esp + 0x28], 0
push ecx
mov byte [esp + 0x2f], bl
call fcn.0046bc9b
mov edx, dword [esp + 0x2c]
push 0x40
lea eax, [esp + 0x78]
push eax
lea eax, [esi + 4]
push eax
lea ecx, [esp + 0x100]
push ecx
mov dword [esp + esi + 0x104], edx
mov edx, dword [esp + 0x2c]
push ebp
push edx
call fcn.0042ff8b
mov ecx, 0x10
lea esi, [esp + 0x8c]
lea edi, [esp + 0x4c]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [esp + 0x1a4]
add esp, 0x24
cmp esi, 1
jle 0x4305a3
dec esi
mov edx, dword [esp + 0x10]
push 0x40
lea eax, [esp + 0xac]
push eax
push 0x40
lea ecx, [esp + 0x74]
push ecx
push ebp
push edx
call fcn.0042ff8b
add esp, 0x18
xor eax, eax
jmp 0x43058b
mov cl, byte [esp + eax + 0xa8]
xor byte [esp + eax + 0x28], cl
mov byte [esp + eax + 0x68], cl
inc eax
cmp eax, 0x40
jl 0x43058b
dec esi
jne 0x43055c
mov eax, dword [esp + 0x18]
mov edi, eax
add eax, 0x40
inc ebx
mov ecx, 0x10
lea esi, [esp + 0x28]
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x18], eax
cmp ebx, dword [esp + 0x14]
jl 0x4304eb
pop edi
pop esi
mov ecx, dword [esp + 0x178]
mov edx, dword [esp + 0x174]
push ebx
lea eax, [esp + 0x24]
push eax
mov eax, dword [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x14]
push edx
push eax
push ebp
push ecx
call fcn.0043019b
mov edx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
push edx
lea eax, [esp + 0x40]
push eax
push ecx
call fcn.0046bc9b
mov ecx, dword [esp + 0x188]
add esp, 0x28
pop ebp
pop ebx
xor ecx, esp
call fcn.0046c68f
add esp, 0x15c
ret
Function at 0x43064b
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xa4
mov eax, dword [0x596804]
xor eax, esp
mov dword [esp + 0xa0], eax
mov eax, dword [0x5965bc]
dec eax
je 0x43067e
xor eax, eax
mov ecx, dword [esp + 0xa0]
xor ecx, esp
call fcn.0046c68f
add esp, 0xa4
ret
push esi
xor esi, esi
mov eax, dword [0x5965bc]
dec eax
jne 0x4306bb
lea eax, [esp + 4]
push eax
call fcn.0043397b
mov ecx, dword [0x5a07b4]
push 0x140
push ecx
lea edx, [esp + 0x10]
push edx
call fcn.004353cb
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x78]
push ecx
call fcn.0043548b
add esp, 0x18
mov edx, dword [0x5a07b4]
xor eax, eax
lea ecx, [edx + esi + 1]
lea esp, [esp]
movzx edx, byte [esp + eax + 0x64]
xor byte [ecx + eax - 1], dl
movzx edx, byte [esp + eax + 0x65]
xor byte [ecx + eax], dl
movzx edx, byte [esp + eax + 0x66]
xor byte [ecx + eax + 1], dl
movzx edx, byte [esp + eax + 0x67]
xor byte [ecx + eax + 2], dl
movzx edx, byte [esp + eax + 0x68]
xor byte [ecx + eax + 3], dl
add eax, 5
cmp eax, 0x14
jl 0x4306cb
add esi, 0x14
cmp esi, 0x140
jl 0x430681
mov ecx, dword [esp + 0xa4]
pop esi
xor ecx, esp
mov eax, 1
call fcn.0046c68f
add esp, 0xa4
ret

Function at 0x43072b
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xa4
mov eax, dword [0x596804]
xor eax, esp
mov dword [esp + 0xa0], eax
push ebx
xor ebx, ebx
cmp dword [esp + 0xb0], ebx
jle 0x430870
mov eax, dword [0x5a07bc]
push ebp
mov ebp, dword [0x5965bc]
push esi
push edi
mov edi, dword [0x5a07b4]
cmp eax, 0x140
jne 0x430771
xor eax, eax
mov dword [0x5a07bc], eax
mov ecx, dword [esp + 0xb8]
mov dl, byte [ebx + ecx]
add byte [edi + eax], dl
mov ecx, eax
and ecx, 0x80000007
jns 0x43078d
dec ecx
or ecx, 0xfffffff8
inc ecx
jne 0x430859
mov ecx, ebp
dec ecx
jne 0x430859
xor esi, esi
mov eax, ebp
dec eax
jne 0x4307e3
lea edx, [esp + 0x10]
push edx
call fcn.0043397b
mov eax, dword [0x5a07b4]
push 0x140
push eax
lea ecx, [esp + 0x1c]
push ecx
call fcn.004353cb
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x84]
push eax
call fcn.0043548b
mov edi, dword [0x5a07b4]
mov ebp, dword [0x5965bc]
add esp, 0x18
xor eax, eax
lea ecx, [edi + esi + 1]
mov edi, edi
movzx edx, byte [esp + eax + 0x70]
xor byte [ecx + eax - 1], dl
movzx edx, byte [esp + eax + 0x71]
xor byte [ecx + eax], dl
movzx edx, byte [esp + eax + 0x72]
xor byte [ecx + eax + 1], dl
movzx edx, byte [esp + eax + 0x73]
xor byte [ecx + eax + 2], dl
movzx edx, byte [esp + eax + 0x74]
xor byte [ecx + eax + 3], dl
add eax, 5
cmp eax, 0x14
jl 0x4307eb
add esi, 0x14
cmp esi, 0x140
jl 0x43079e
push 0x40
lea eax, [esp + 0x74]
push 0
push eax
call fcn.0046c6ab
mov eax, ebp
add esp, 0xc
dec eax
jne 0x430854
push 0x60
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.0046c6ab
add esp, 0xc
mov eax, dword [0x5a07bc]
inc eax
inc ebx
mov dword [0x5a07bc], eax
cmp ebx, dword [esp + 0xbc]
jl 0x430763
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0xa4]
pop ebx
xor ecx, esp
call fcn.0046c68f
add esp, 0xa4
ret
Function at 0x43378b
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
mov dword [eax + 0x18], 0xc3d2e1f0
ret

Function at 0x43397b
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
ret
Function at 0x43b37b
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xa4
mov eax, dword [0x596804]
xor eax, esp
mov dword [esp + 0xa0], eax
mov eax, dword [esp + 0xb8]
push ebx
mov ebx, dword [esp + 0xb0]
push ebp
mov ebp, dword [esp + 0xb8]
push esi
mov esi, dword [esp + 0xb4]
cmp dword [esi + 0x2d8], 0
push edi
je case.default.0x43b3db
test eax, eax
je case.default.0x43b3db
mov eax, dword [eax + 0x84]
test eax, eax
je case.default.0x43b3db
lea edx, [ebx - 1]
mov ecx, 0x526d06
cmp edx, 3
ja case.default.0x43b3db
jmp dword [edx*4 + 0x43b4f7]
mov ecx, 0x5335be
mov edx, 0x5335b6
jmp 0x43b3f8
mov ecx, 0x5335be
mov edx, 0x5335b2
push eax
push edx
push ecx
push 0x5335a6
lea eax, [esp + 0x20]
push 0xa0
push eax
call fcn.00439c0b
lea eax, [esp + 0x28]
add esp, 0x18
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x43b41b
sub eax, edx
mov edi, eax
mov eax, dword [esi + 0x1a8]
test eax, eax
je 0x43b470
mov ecx, dword [esi + 0x134]
push ecx
push edi
lea edx, [esp + 0x18]
push edx
push 0
push esi
call eax
add esp, 0x14
test eax, eax
jne 0x43b4db
mov eax, dword [esi + 0x1a8]
test eax, eax
je 0x43b49e
mov ecx, dword [esi + 0x134]
mov edx, dword [esp + 0xc4]
push ecx
push edx
push ebp
push ebx
push esi
call eax
add esp, 0x14
jmp 0x43b4db
mov eax, dword [esi + 0x130]
push eax
push 1
push 2
push 0x53358e
call fcn.0046dd41
mov ecx, dword [esi + 0x130]
push ecx
push 1
lea edx, [esp + 0x28]
push edi
push edx
call fcn.0046dd41
add esp, 0x20
jmp case.default.0x43b3db
test ebx, ebx
js 0x43b4d9
cmp ebx, 2
jg 0x43b4d9
mov eax, dword [esi + 0x130]
push eax
push 1
lea ecx, [ebx + ebx*2 + 0x53358e]
push 2
push ecx
call fcn.0046dd41
mov edx, dword [esi + 0x130]
mov eax, dword [esp + 0xd4]
push edx
push 1
push eax
push ebp
call fcn.0046dd41
add esp, 0x20
xor eax, eax
mov ecx, dword [esp + 0xb0]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0046c68f
add esp, 0xa4
ret
Function at 0x43b59b
Capabilities:
Write file on windows

Disassembly:
push ecx
mov eax, dword [0x596804]
xor eax, esp
mov dword [esp], eax
mov ecx, dword [esp + 0xc]
push ebx
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
push ecx
lea ebx, [esi + 0x5ac]
push 0x4000
push ebx
call fcn.00439bab
mov eax, dword [esi + 0x138]
add esp, 0x10
test eax, eax
je 0x43b5fb
cmp dword [esi + 0x85d8], 0
jne 0x43b5fb
push ebx
push 0x5335c6
push 0x100
push eax
call fcn.00439c0b
add esp, 0x10
mov dword [esi + 0x85d8], 1
cmp dword [esi + 0x324], 0
je 0x43b682
mov eax, ebx
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x43b60b
sub eax, edx
push edi
mov edi, eax
cmp edi, 0x3fff
jae 0x43b62f
mov byte [esi + edi + 0x5ac], 0xa
inc edi
mov byte [esi + edi + 0x5ac], cl
mov eax, dword [esi + 0x1a8]
test eax, eax
je 0x43b659
mov edx, dword [esi + 0x134]
push edx
push edi
push ebx
push 0
push esi
call eax
add esp, 0x14
pop edi
pop esi
pop ebx
mov ecx, dword [esp]
xor ecx, esp
call fcn.0046c68f
pop ecx
ret
mov eax, dword [esi + 0x130]
push eax
push 1
push 2
push 0x53358e
call fcn.0046dd41
mov ecx, dword [esi + 0x130]
push ecx
push 1
push edi
push ebx
call fcn.0046dd41
add esp, 0x20
pop edi
mov ecx, dword [esp + 8]
pop esi
pop ebx
xor ecx, esp
call fcn.0046c68f
pop ecx
ret
Function at 0x43b819
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xb8
mov eax, dword [0x596804]
xor eax, esp
mov dword [esp + 0xb4], eax
mov ecx, dword [esp + 0xc4]
push ebx
mov ebx, dword [esp + 0xc4]
push esi
mov esi, dword [ebx]
push edi
lea eax, [esp + 0xd4]
push eax
push ecx
call fcn.0043a6bb
mov edi, eax
add esp, 8
mov dword [esp + 0x18], edi
test edi, edi
jne 0x43b6f8
lea eax, [edi + 0x1b]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb4]
xor ecx, esp
call fcn.0046c68f
add esp, 0xb8
ret
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x43b6fb
sub eax, edx
mov ecx, eax
mov dword [esp + 0xc], edi
push ebp
mov edx, dword [esp + 0xcc]
xor eax, eax
cmp edx, dword [ebx + 0x13c]
lea edx, [esp + 0x18]
push edx
sete al
push ecx
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x18]
push ecx
mov dword [esp + 0x24], 0
mov edx, dword [ebx + eax*4 + 0x150]
push eax
push ebx
call edx
mov ebp, eax
xor ecx, ecx
add esp, 0x14
cmp ebp, ecx
jge 0x43b761
mov eax, dword [esp + 0x18]
cmp eax, ecx
je 0x43b844
cmp eax, 0x51
jne 0x43b83e
xor ebp, ebp
mov dword [esp + 0x14], ecx
cmp dword [esi + 0x324], ecx
je 0x43b7f9
cmp dword [esi + 0x2d8], ecx
je 0x43b7da
mov eax, dword [ebx + 0x84]
cmp eax, ecx
je 0x43b7da
push eax
push 0x5335b2
push 0x526d06
push 0x5335a6
lea eax, [esp + 0x34]
push 0xa0
push eax
call fcn.00439c0b
lea eax, [esp + 0x3c]
add esp, 0x18
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x43b7ac
sub eax, edx
mov edi, eax
mov eax, dword [esi + 0x1a8]
test eax, eax
je 0x43b810
mov ecx, dword [esi + 0x134]
push ecx
push edi
lea edx, [esp + 0x2c]
push edx
push 0
push esi
call eax
add esp, 0x14
test eax, eax
jne 0x43b7f9
mov eax, dword [esi + 0x1a8]
test eax, eax
je 0x43b7f9
mov ecx, dword [esi + 0x134]
mov edx, dword [esp + 0x10]
push ecx
push ebp
push edx
push 4
push esi
call eax
add esp, 0x14
mov ecx, dword [esp + 0x20]
mov edi, dword [esp + 0x1c]
cmp ebp, ecx
je 0x43b84c
sub ecx, ebp
add dword [esp + 0x10], ebp
jmp 0x43b70b
mov eax, dword [esi + 0x130]
push eax
push 1
push 2
push 0x53358e
call fcn.0046dd41
mov ecx, dword [esi + 0x130]
push ecx
push 1
lea edx, [esp + 0x3c]
push edi
push edx
call fcn.0046dd41
add esp, 0x20
jmp 0x43b7da
mov dword [esp + 0x14], eax
jmp 0x43b84c
mov dword [esp + 0x14], 0x37
push edi
call dword [fcn.00596608]
mov ecx, dword [esp + 0xc8]
mov eax, dword [esp + 0x18]
add esp, 4
pop ebp
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0046c68f
add esp, 0xb8
ret
Function at 0x44778b
Capabilities:
Check os version

Disassembly:
sub esp, 0xa4
mov eax, dword [0x596804]
xor eax, esp
mov dword [esp + 0xa0], eax
cmp dword [0x5a0804], 0
mov dword [esp], 0x4020
mov dword [esp + 4], 0
mov dword [esp + 8], 4
jne 0x44781a
push 0x94
lea eax, [esp + 0x10]
push 0
push eax
call fcn.0046c6ab
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
mov dword [esp + 0x10], 0x94
mov dword [0x5a0804], 1
call dword [sym.imp.KERNEL32.DLL_GetVersionExA]
test eax, eax
je 0x44781a
cmp dword [esp + 0x10], 6
jb 0x44781a
mov dword [0x5a0804], 2
mov ecx, dword [esp + 0xa0]
xor ecx, esp
call fcn.0046c68f
add esp, 0xa4
ret
cmp dword [0x5a0804], 2
je 0x44786d
push esi
mov esi, dword [esp + 0xac]
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0xc]
push eax
push 0x1001
push 0xffff
push esi
call dword [fcn.00525e4a]
test eax, eax
jne 0x447854
mov ecx, dword [esp + 8]
cmp ecx, dword [esp + 4]
jg 0x44786c
push 4
lea edx, [esp + 8]
push edx
push 0x1001
push 0xffff
push esi
call dword [fcn.00525e5e]
pop esi
mov ecx, dword [esp + 0xa0]
xor ecx, esp
call fcn.0046c68f
add esp, 0xa4
ret

Function at 0x44820b
Capabilities:
Parse pe header

Disassembly:
mov al, byte [esp + 4]
movsx ecx, al
add ecx, 0xffffff9f
cmp ecx, 0x19
ja case.default.0x44821a
jmp dword [ecx*4 + 0x44826f]
mov al, 0x41
ret
mov al, 0x42
ret
mov al, 0x43
ret
mov al, 0x44
ret
mov al, 0x45
ret
mov al, 0x46
ret
mov al, 0x47
ret
mov al, 0x48
ret
mov al, 0x49
ret
mov al, 0x4a
ret
mov al, 0x4b
ret
mov al, 0x4c
ret
mov al, 0x4d
ret
mov al, 0x4e
ret
mov al, 0x4f
ret
mov al, 0x50
ret
mov al, 0x51
ret
mov al, 0x52
ret
mov al, 0x53
ret
mov al, 0x54
ret
mov al, 0x55
ret
mov al, 0x56
ret
mov al, 0x57
ret
mov al, 0x58
ret
mov al, 0x59
ret
mov al, 0x5a
ret