joyce8/EMBER2024-capa huggingface dataset:
Function at 0x445f00
Capabilities:
Hash data using crc32b

Disassembly:
cmp byte [0x6bddd4], 0
push edi
jne 0x44606d
mov al, byte [0x6bddd5]
push esi
test al, al
jne 0x446047
cmp dword [0x6bddd8], 0
jne 0x44606c
push 0x100
mov byte [0x6bddd5], 1
call fcn.0040f7c0
mov edi, eax
add esp, 4
test edi, edi
je 0x44606c
xor esi, esi
push ebx
nop word [eax + eax]
push 8
push esi
call fcn.004461a0
shl eax, 0x18
add esp, 8
mov ecx, eax
add eax, eax
sar ecx, 0x1f
and ecx, 0x4c11db7
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov ebx, ecx
sar ebx, 0x1f
and ebx, 0x4c11db7
lea eax, [ecx + ecx]
xor ebx, eax
xor edx, edx
mov dword [edi + esi*4], ebx
lea eax, [edx + 1]
test bl, 1
je 0x445ff4
mov ecx, 0x20
sub ecx, eax
bts edx, ecx
inc eax
shr ebx, 1
cmp eax, 0x21
jl 0x445fe5
mov dword [edi + esi*4], edx
inc esi
cmp esi, 0xff
jbe 0x445f50
cmp dword [0x6bddd8], 0
pop ebx
jne 0x44602d
pop esi
mov dword [0x6bddd8], edi
mov byte [0x6bddd4], 1
mov byte [0x6bddd5], 0
pop edi
ret
push edi
call sub.mfc140.dll_Ordinal_266
add esp, 4
mov byte [0x6bddd4], 1
mov byte [0x6bddd5], 0
pop esi
pop edi
ret
xor esi, esi
test al, al
je 0x44606c
nop dword [eax]
push 2
call fcn.004308f0
inc esi
add esp, 4
cmp esi, 0xc8
ja 0x44606c
cmp byte [0x6bddd5], 0
jne 0x446050
pop esi
pop edi
ret
Function at 0x446070
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
mov dword [ebp - 0x10], ebx
test esi, esi
je 0x44618f
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x44618e
cmp edi, 0x10
jb 0x446161
mov eax, dword [ebx + 4]
lea ecx, [esi + 1]
mov edx, edi
mov dword [ebp - 8], ecx
shr edx, 4
mov dword [ebp - 0xc], edx
nop
mov edi, dword [ebp - 0x10]
mov ebx, ecx
mov dword [ebp - 4], esi
sub esi, ecx
mov dword [ebp - 4], 4
movzx edx, byte [esi + ebx]
lea ebx, [ebx + 4]
movzx ecx, al
xor edx, ecx
shr eax, 8
mov ecx, dword [0x6bddd8]
xor eax, dword [ecx + edx*4]
mov dword [edi + 4], eax
movzx ecx, byte [ebx - 4]
movzx edx, al
xor edx, ecx
shr eax, 8
mov ecx, dword [0x6bddd8]
mov edx, dword [ecx + edx*4]
xor edx, eax
mov eax, 1
mov dword [edi + 4], edx
movzx ecx, byte [eax + ebx - 4]
movzx eax, dl
xor ecx, eax
shr edx, 8
mov eax, dword [0x6bddd8]
mov eax, dword [eax + ecx*4]
mov ecx, 2
xor eax, edx
mov dword [edi + 4], eax
movzx edx, byte [ecx + ebx - 4]
movzx ecx, al
xor edx, ecx
shr eax, 8
mov ecx, dword [0x6bddd8]
xor eax, dword [ecx + edx*4]
sub dword [ebp - 4], 1
mov dword [edi + 4], eax
jne 0x4460c1
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
sub edi, 0x10
mov ecx, dword [ebp - 8]
add esi, 0x10
add ecx, 0x10
mov dword [ebp + 0xc], edi
sub dword [ebp - 0xc], 1
mov dword [ebp + 8], esi
mov dword [ebp - 8], ecx
jne 0x4460b0
mov ebx, dword [ebp - 0x10]
test edi, edi
je 0x44618e
mov edx, dword [ebx + 4]
nop dword [eax + eax]
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, dl
xor ecx, eax
shr edx, 8
mov eax, dword [0x6bddd8]
xor edx, dword [eax + ecx*4]
mov dword [ebx + 4], edx
sub edi, 1
jne 0x446170
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x446750
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5eebfb
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x6baac0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ecx + 8]
mov edi, dword [ebp + 8]
cmp eax, 0xffffffff
je 0x4467f8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4467f4
test edi, edi
je 0x4467f4
push 0x74
lea eax, [ebp - 0x84]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x84]
call fcn.00420e20
lea ecx, [ebp - 0x84]
mov dword [ebp - 4], 0
call fcn.00421820
mov esi, dword [edi]
lea ecx, [ebp - 0x84]
call fcn.00414900
push eax
mov ecx, edi
call dword [esi + 0x14]
mov eax, dword [edi]
mov ecx, edi
push str.Failed_to_get_file_size__32_
call dword [eax + 0x14]
lea ecx, [ebp - 0x84]
call fcn.00420e70
mov eax, ebx
jmp 0x446815
mov eax, dword [ecx + 4]
test eax, eax
je 0x446812
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fileno]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__filelength]
add esp, 8
jmp 0x446815
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005ebe04
mov esp, ebp
pop ebp
ret 4
Function at 0x446840
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f198b
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
mov eax, dword [0x6baac0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 8]
mov edi, dword [ebp + 8]
cmp eax, 0xffffffff
je 0x446934
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x446926
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x446926
test edi, edi
je 0x446904
push 0x74
lea eax, [ebp - 0x88]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x88]
call fcn.00420e20
lea ecx, [ebp - 0x88]
mov dword [ebp - 4], 0
call fcn.00421820
mov esi, dword [edi]
lea ecx, [ebp - 0x88]
call fcn.00414900
push eax
mov ecx, edi
call dword [esi + 0x14]
mov eax, dword [edi]
mov ecx, edi
push str.Failed_to_get_file_size__64_
call dword [eax + 0x14]
lea ecx, [ebp - 0x88]
call fcn.00420e70
or eax, 0xffffffff
or edx, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005ebe04
mov esp, ebp
pop ebp
ret 4
push dword [ebp - 0x14]
push esi
call fcn.004463e0
add esp, 8
jmp 0x446909
mov eax, dword [esi + 4]
test eax, eax
je 0x446904
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
push dword [esi + 4]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fileno]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__filelengthi64]
add esp, 0xc
jmp 0x446909
Function at 0x446af0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x6baac0]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0x10]
mov eax, ecx
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x18], edx
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 0x18]
mov byte [ebx], 0
mov dword [edx], 0
test ecx, ecx
jne 0x446b4a
test esi, esi
je 0x446b36
mov eax, dword [esi]
mov ecx, esi
push str.NULL_buf_pointer.
call dword [eax + 0x14]
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005ebe04
mov esp, ebp
pop ebp
ret 0x14
mov edx, dword [ebp + 0xc]
push edi
test edx, edx
je 0x446c6a
mov dword [ebp - 0x14], 0x10000
nop dword [eax]
cmp edx, 0x10000
mov byte [ebx], 0
mov edi, edx
mov dword [ebp - 8], 0
cmova edi, dword [ebp - 0x14]
test edi, edi
je 0x446c2e
test ecx, ecx
je 0x446c2e
mov eax, dword [eax + 8]
cmp eax, 0xffffffff
je 0x446bdb
push 0
lea edx, [ebp - 8]
push edx
push edi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x446bcb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x26
jne 0x446bb9
mov byte [ebx], 1
mov edx, dword [ebp + 0xc]
mov al, 1
jmp 0x446c43
test esi, esi
je 0x446c3e
push eax
mov ecx, esi
call fcn.00431ed0
jmp 0x446c3e
cmp dword [ebp - 8], 0
jne 0x446baf
mov edx, dword [ebp + 0xc]
mov al, 1
mov byte [ebx], 1
jmp 0x446c43
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
test eax, eax
je 0x446c23
push eax
push edi
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov ecx, eax
add esp, 0x10
mov dword [ebp - 8], ecx
cmp ecx, edi
jne 0x446c03
mov edx, dword [ebp + 0xc]
mov al, 1
jmp 0x446c43
mov eax, dword [ebp - 0x10]
push dword [eax + 4]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ferror]
add esp, 4
test eax, eax
je 0x446bac
test esi, esi
je 0x446c3e
mov ecx, esi
call fcn.00431cd0
jmp 0x446c3e
test esi, esi
je 0x446c41
push str.No_file_is_open.
jmp 0x446c37
test esi, esi
je 0x446c41
push str.NULL_buf_or_bufSize
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x14]
mov edx, dword [ebp + 0xc]
xor al, al
mov edi, dword [ebp - 0x18]
mov ecx, dword [ebp - 8]
sub edx, ecx
add dword [ebp - 0xc], ecx
mov dword [ebp + 0xc], edx
add dword [edi], ecx
test al, al
je 0x446c7f
cmp byte [ebx], 0
jne 0x446c6a
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
test edx, edx
jne 0x446b60
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005ebe04
mov esp, ebp
pop ebp
ret 0x14
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005ebe04
mov esp, ebp
pop ebp
ret 0x14
Function at 0x446fc0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x6baac0]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
mov eax, ecx
mov ecx, dword [ebp + 0x18]
push edi
mov edi, dword [ebp + 0x14]
cmp dword [eax + 8], 0xffffffff
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x18], ecx
jne 0x447012
cmp dword [eax + 4], 0
jne 0x447012
test ecx, ecx
je 0x446fff
mov eax, dword [ecx]
push str.Failed_to_write_because_file_is_not_open.
call dword [eax + 0x14]
xor al, al
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005ebe04
mov esp, ebp
pop ebp
ret 0x14
test edi, edi
je 0x447023
mov dword [edi], 0
mov dword [edi + 4], 0
push ebx
mov ebx, dword [ebp + 0xc]
mov eax, ebx
push esi
mov esi, dword [ebp + 0x10]
or eax, esi
mov dword [ebp - 0x14], esi
je 0x447108
mov ecx, dword [ebp - 8]
nop dword [eax + eax]
test esi, esi
jl 0x447055
jg 0x44704e
cmp ebx, 0x989680
jbe 0x447055
mov esi, 0x989680
jmp 0x447057
mov esi, ebx
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
cmp eax, 0xffffffff
je 0x4470bf
push 0
lea ecx, [ebp - 8]
mov dword [ebp - 8], 0
push ecx
push esi
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x447083
mov ecx, dword [ebp - 8]
cmp ecx, esi
je 0x4470e1
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x44712e
mov eax, dword [ebx]
mov ecx, ebx
push 1
push str.WriteFileError
call dword [eax + 0x24]
mov ecx, ebx
call fcn.00431cd0
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x28]
pop esi
pop ebx
xor al, al
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005ebe04
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
test eax, eax
je 0x4470e4
push eax
push 1
push esi
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp eax, 1
jne 0x44711d
mov ecx, esi
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0xc]
add edx, esi
sub ebx, esi
mov esi, dword [ebp - 0x14]
sbb esi, 0
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x14], esi
test edi, edi
je 0x4470fe
add dword [edi], ecx
adc dword [edi + 4], 0
mov eax, ebx
or eax, esi
jne 0x447040
pop esi
pop ebx
mov al, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005ebe04
mov esp, ebp
pop ebp
ret 0x14
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x44712e
mov eax, dword [ecx]
push str.fwrite_failed.
call dword [eax + 0x14]
mov ecx, dword [ebp - 4]
xor al, al
pop esi
pop ebx
xor ecx, ebp
pop edi
call fcn.005ebe04
mov esp, ebp
pop ebp
ret 0x14
Function at 0x472680
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f45e1
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x6baac0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0x10]
mov dword [esi], vtable._ckSymSettings.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0x100
call fcn.004118f0
lea ecx, [esi + 0x30]
mov dword [ebp - 4], 0
mov dword [esi + 0x2c], 0
call fcn.004118f0
lea ecx, [esi + 0x4c]
mov byte [ebp - 4], 1
call fcn.004118f0
lea ecx, [esi + 0x68]
mov byte [ebp - 4], 2
call fcn.004118f0
mov dword [esi + 0x84], 0
mov eax, esi
mov dword [esi + 0x88], 0x80
mov byte [esi + 0x8c], 0
mov byte [esi + 0x28], 1
mov byte [esi + 0x48], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x484500
Capabilities:
Hash data with md5

Disassembly:
mov dword [ecx], vtable._ckMd5.0
mov eax, ecx
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 4], 0x67452301
mov dword [ecx + 8], 0xefcdab89
mov dword [ecx + 0xc], 0x98badcfe
mov dword [ecx + 0x10], 0x10325476
ret

Function at 0x484c90
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push edi
mov edi, ecx
xor ebx, ebx
mov dword [edi + 0x18], 0
mov dword [edi + 0x14], 0
mov dword [edi + 4], 0x67452301
mov dword [edi + 8], 0xefcdab89
mov dword [edi + 0xc], 0x98badcfe
mov dword [edi + 0x10], 0x10325476
cmp dword [eax + 0x804], ebx
jbe 0x484cf1
push esi
lea esi, [eax + 4]
push dword [esi + 0x400]
mov ecx, edi
push dword [esi]
call fcn.00485060
mov eax, dword [ebp + 8]
lea esi, [esi + 4]
inc ebx
cmp ebx, dword [eax + 0x804]
jb 0x484cd2
pop esi
push dword [ebp + 0xc]
mov ecx, edi
call fcn.00484f60
pop edi
pop ebx
pop ebp
ret 8

Function at 0x484d10
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
mov esi, ecx
push dword [ebp + 8]
mov dword [esi + 0x18], 0
mov dword [esi + 0x14], 0
mov dword [esi + 4], 0x67452301
mov dword [esi + 8], 0xefcdab89
mov dword [esi + 0xc], 0x98badcfe
mov dword [esi + 0x10], 0x10325476
call fcn.00485060
push dword [ebp + 0x10]
mov ecx, esi
call fcn.00484f60
pop esi
pop ebp
ret 0xc

Function at 0x484d60
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
mov ecx, dword [ebp + 8]
mov dword [edi + 0x18], 0
mov dword [edi + 0x14], 0
mov dword [edi + 4], 0x67452301
mov dword [edi + 8], 0xefcdab89
mov dword [edi + 0xc], 0x98badcfe
mov dword [edi + 0x10], 0x10325476
call fcn.00401c90
mov ecx, dword [ebp + 8]
push eax
call fcn.00414910
push eax
mov ecx, edi
call fcn.00485060
push dword [ebp + 0xc]
mov ecx, edi
call fcn.00484f60
pop edi
pop ebp
ret 8
Function at 0x484dc0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x6baac0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
push esi
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x18]
push 0x4e28
mov dword [ebp - 0x18], eax
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x14], 0
mov dword [ebx + 4], 0x67452301
mov dword [ebx + 8], 0xefcdab89
mov dword [ebx + 0xc], 0x98badcfe
mov dword [ebx + 0x10], 0x10325476
call fcn.0040f690
mov esi, eax
add esp, 4
test esi, esi
jne 0x484e42
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005ebe04
mov esp, ebp
pop ebp
ret 0x14
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 8], 0
mov byte [ebp - 9], 1
call fcn.004a9cf0
test al, al
jne 0x484ed1
nop dword [eax]
push dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 8]
push edi
push eax
push 0x4e20
push esi
call fcn.004a9f50
test al, al
je 0x484ed1
mov eax, dword [ebp - 8]
test eax, eax
je 0x484eb2
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x484e92
push eax
push esi
call fcn.00412010
mov eax, dword [ebp - 8]
push eax
push esi
mov ecx, ebx
call fcn.00485060
test edi, edi
je 0x484eb2
push dword [ebp - 0x14]
mov ecx, edi
push 0
push dword [ebp - 8]
call fcn.00480a20
test al, al
jne 0x484ec0
mov ecx, dword [ebp - 0x10]
call fcn.004a9cf0
test al, al
je 0x484e60
jmp 0x484ed1
mov ecx, dword [ebp - 0x14]
push str.Digest_MD5_aborted_by_application
mov eax, dword [ecx]
call dword [eax + 0x14]
mov byte [ebp - 9], 0
push esi
call sub.mfc140.dll_Ordinal_266
add esp, 4
mov ecx, ebx
push dword [ebp - 0x1c]
call fcn.00484f60
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 9]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.005ebe04
mov esp, ebp
pop ebp
ret 0x14

Function at 0x484f00
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
mov ecx, dword [ebp + 8]
mov dword [edi + 0x18], 0
mov dword [edi + 0x14], 0
mov dword [edi + 4], 0x67452301
mov dword [edi + 8], 0xefcdab89
mov dword [edi + 0xc], 0x98badcfe
mov dword [edi + 0x10], 0x10325476
call fcn.004239b0
mov ecx, dword [ebp + 8]
push eax
call fcn.00414900
push eax
mov ecx, edi
call fcn.00485060
push dword [ebp + 0xc]
mov ecx, edi
call fcn.00484f60
pop edi
pop ebp
ret 8

Function at 0x485030
Capabilities:
Hash data with md5

Disassembly:
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 4], 0x67452301
mov dword [ecx + 8], 0xefcdab89
mov dword [ecx + 0xc], 0x98badcfe
mov dword [ecx + 0x10], 0x10325476
ret
Function at 0x48afb0
Capabilities:
Hash data using sha1
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5eed38
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x6baac0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.00420610
mov dword [ebp - 4], 0
mov dword [esi], vtable._ckSha2.0
call fcn.0040d5b0
mov byte [0x6afc28], al
call fcn.0048c1d0
mov ecx, dword [ebp + 8]
test ecx, ecx
jle 0x48b1d2
cmp ecx, 0x180
jg 0x48b124
je 0x48b0a2
mov eax, ecx
sub eax, 0xa0
je 0x48b06c
sub eax, 0x60
jne 0x48b1d2
mov dword [esi + 0xc], 0x6a09e667
mov dword [esi + 0x10], 0xbb67ae85
mov dword [esi + 0x14], 0x3c6ef372
mov dword [esi + 0x18], 0xa54ff53a
mov dword [esi + 0x1c], 0x510e527f
mov dword [esi + 0x20], 0x9b05688c
mov dword [esi + 0x24], 0x1f83d9ab
mov dword [esi + 0x28], 0x5be0cd19
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
jmp 0x48b1d2
mov dword [esi + 0xc], 0x67452301
mov dword [esi + 0x10], 0xefcdab89
mov dword [esi + 0x14], 0x98badcfe
mov dword [esi + 0x18], 0x10325476
mov dword [esi + 0x1c], 0xc3d2e1f0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
jmp 0x48b1d2
mov eax, dword [0x6bee38]
mov dword [esi + 0x38], eax
mov eax, dword [0x6bee3c]
mov dword [esi + 0x3c], eax
mov eax, dword [0x6bee40]
mov dword [esi + 0x40], eax
mov eax, dword [0x6bee44]
mov dword [esi + 0x44], eax
mov eax, dword [0x6bee48]
mov dword [esi + 0x48], eax
mov eax, dword [0x6bee4c]
mov dword [esi + 0x4c], eax
mov eax, dword [0x6bee50]
mov dword [esi + 0x50], eax
mov eax, dword [0x6bee54]
mov dword [esi + 0x54], eax
mov eax, dword [0x6bee58]
mov dword [esi + 0x58], eax
mov eax, dword [0x6bee5c]
mov dword [esi + 0x5c], eax
mov eax, dword [0x6bee60]
mov dword [esi + 0x60], eax
mov eax, dword [0x6bee64]
mov dword [esi + 0x64], eax
mov eax, dword [0x6bee68]
mov dword [esi + 0x68], eax
mov eax, dword [0x6bee6c]
mov dword [esi + 0x6c], eax
mov eax, dword [0x6bee70]
mov dword [esi + 0x70], eax
mov eax, dword [0x6bee74]
jmp 0x48b1ad
cmp ecx, 0x200
jne 0x48b1d2
mov eax, dword [0x6bf0f8]
mov dword [esi + 0x38], eax
mov eax, dword [0x6bf0fc]
mov dword [esi + 0x3c], eax
mov eax, dword [0x6bf100]
mov dword [esi + 0x40], eax
mov eax, dword [0x6bf104]
mov dword [esi + 0x44], eax
mov eax, dword [0x6bf108]
mov dword [esi + 0x48], eax
mov eax, dword [0x6bf10c]
mov dword [esi + 0x4c], eax
mov eax, dword [0x6bf110]
mov dword [esi + 0x50], eax
mov eax, dword [0x6bf114]
mov dword [esi + 0x54], eax
mov eax, dword [0x6bf118]
mov dword [esi + 0x58], eax
mov eax, dword [0x6bf11c]
mov dword [esi + 0x5c], eax
mov eax, dword [0x6bf120]
mov dword [esi + 0x60], eax
mov eax, dword [0x6bf124]
mov dword [esi + 0x64], eax
mov eax, dword [0x6bf128]
mov dword [esi + 0x68], eax
mov eax, dword [0x6bf12c]
mov dword [esi + 0x6c], eax
mov eax, dword [0x6bf130]
mov dword [esi + 0x70], eax
mov eax, dword [0x6bf134]
mov dword [esi + 0x74], eax
mov dword [esi + 0x78], 0
mov dword [esi + 0x7c], 0
mov dword [esi + 0x80], 0
mov dword [esi + 0x84], 0
mov dword [esi + 8], ecx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x48b240
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
cmp dword [ecx + 8], 0x100
jg 0x48b252
pop ebp
jmp fcn.0048cad0
pop ebp
jmp fcn.0048ef60

Function at 0x48b260
Capabilities:
Hash data using sha1
Hash data using sha256

Disassembly:
mov eax, dword [ecx + 8]
cmp eax, 0x180
jg 0x48b377
je 0x48b2f5
sub eax, 0xa0
je 0x48b2c3
sub eax, 0x60
jne 0x48b424
mov dword [ecx + 0xc], 0x6a09e667
mov dword [ecx + 0x10], 0xbb67ae85
mov dword [ecx + 0x14], 0x3c6ef372
mov dword [ecx + 0x18], 0xa54ff53a
mov dword [ecx + 0x1c], 0x510e527f
mov dword [ecx + 0x20], 0x9b05688c
mov dword [ecx + 0x24], 0x1f83d9ab
mov dword [ecx + 0x28], 0x5be0cd19
mov dword [ecx + 0x2c], eax
mov dword [ecx + 0x30], eax
ret
mov dword [ecx + 0xc], 0x67452301
mov dword [ecx + 0x10], 0xefcdab89
mov dword [ecx + 0x14], 0x98badcfe
mov dword [ecx + 0x18], 0x10325476
mov dword [ecx + 0x1c], 0xc3d2e1f0
mov dword [ecx + 0x2c], 0
mov dword [ecx + 0x30], 0
ret
mov eax, dword [0x6bee38]
mov dword [ecx + 0x38], eax
mov eax, dword [0x6bee3c]
mov dword [ecx + 0x3c], eax
mov eax, dword [0x6bee40]
mov dword [ecx + 0x40], eax
mov eax, dword [0x6bee44]
mov dword [ecx + 0x44], eax
mov eax, dword [0x6bee48]
mov dword [ecx + 0x48], eax
mov eax, dword [0x6bee4c]
mov dword [ecx + 0x4c], eax
mov eax, dword [0x6bee50]
mov dword [ecx + 0x50], eax
mov eax, dword [0x6bee54]
mov dword [ecx + 0x54], eax
mov eax, dword [0x6bee58]
mov dword [ecx + 0x58], eax
mov eax, dword [0x6bee5c]
mov dword [ecx + 0x5c], eax
mov eax, dword [0x6bee60]
mov dword [ecx + 0x60], eax
mov eax, dword [0x6bee64]
mov dword [ecx + 0x64], eax
mov eax, dword [0x6bee68]
mov dword [ecx + 0x68], eax
mov eax, dword [0x6bee6c]
mov dword [ecx + 0x6c], eax
mov eax, dword [0x6bee70]
mov dword [ecx + 0x70], eax
mov eax, dword [0x6bee74]
jmp 0x48b3ff
cmp eax, 0x200
jne 0x48b424
mov eax, dword [0x6bf0f8]
mov dword [ecx + 0x38], eax
mov eax, dword [0x6bf0fc]
mov dword [ecx + 0x3c], eax
mov eax, dword [0x6bf100]
mov dword [ecx + 0x40], eax
mov eax, dword [0x6bf104]
mov dword [ecx + 0x44], eax
mov eax, dword [0x6bf108]
mov dword [ecx + 0x48], eax
mov eax, dword [0x6bf10c]
mov dword [ecx + 0x4c], eax
mov eax, dword [0x6bf110]
mov dword [ecx + 0x50], eax
mov eax, dword [0x6bf114]
mov dword [ecx + 0x54], eax
mov eax, dword [0x6bf118]
mov dword [ecx + 0x58], eax
mov eax, dword [0x6bf11c]
mov dword [ecx + 0x5c], eax
mov eax, dword [0x6bf120]
mov dword [ecx + 0x60], eax
mov eax, dword [0x6bf124]
mov dword [ecx + 0x64], eax
mov eax, dword [0x6bf128]
mov dword [ecx + 0x68], eax
mov eax, dword [0x6bf12c]
mov dword [ecx + 0x6c], eax
mov eax, dword [0x6bf130]
mov dword [ecx + 0x70], eax
mov eax, dword [0x6bf134]
mov dword [ecx + 0x74], eax
mov dword [ecx + 0x78], 0
mov dword [ecx + 0x7c], 0
mov dword [ecx + 0x80], 0
mov dword [ecx + 0x84], 0
ret