joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4345f0
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push 0
push 0
push 0
push 0
push eax
mov eax, dword [esp + 0x18]
push ecx
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
neg eax
sbb eax, eax
inc eax
ret

Function at 0x434620
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
push ecx
mov ecx, dword [esp + 0xc]
push edx
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
neg eax
sbb eax, eax
inc eax
ret

Function at 0x434650
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
push ecx
mov ecx, dword [esp + 0xc]
push edx
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
neg eax
sbb eax, eax
inc eax
ret

Function at 0x435c50
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
sub esp, 0x808
push esi
push edi
mov ecx, 0x1ff
xor eax, eax
lea edi, [esp + 0x12]
mov word [esp + 0x10], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0xc]
lea ecx, [esp + 0x10]
push eax
lea edx, [esp + 0xc]
push ecx
push edx
push str.Path
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x20], 1
mov dword [esp + 0x24], 0x800
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x435cb4
pop edi
mov eax, 1
pop esi
add esp, 0x808
ret
lea eax, [esp + 0x10]
push str.360ver.dll
lea ecx, [esp + 0x14]
push eax
push ecx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x435ce6
pop edi
mov eax, 1
pop esi
add esp, 0x808
ret
lea eax, [esp + 0x10]
push eax
call fcn.00435d50
add esp, 4
test eax, eax
jne 0x435d05
pop edi
mov eax, 1
pop esi
add esp, 0x808
ret
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
jne 0x435d24
pop edi
mov eax, 1
pop esi
add esp, 0x808
ret
push str.IsBetaVersion
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, edi
pop edi
pop esi
add esp, 0x808
ret
Function at 0x435e30
Capabilities:
Create process on windows
Terminate process

Disassembly:
mov eax, 0x1000
call fcn.004364f0
push esi
push edi
mov ecx, 0x400
xor eax, eax
lea edi, [esp + 8]
push 0x800
rep stosd dword es:[edi], eax
lea eax, [esp + 0xc]
push 0x4578d0
push eax
call fcn.004364a8
mov esi, dword [esp + 0x101c]
push 0x800
lea ecx, [esp + 0x18]
push esi
push ecx
call fcn.00438ed3
push 0x800
lea edx, [esp + 0x24]
push 0x4578a4
push edx
call fcn.00438ed3
push 0x800
lea eax, [esp + 0x30]
push esi
push eax
call fcn.00438ed3
push 0x800
lea ecx, [esp + 0x3c]
push str.vL
push ecx
call fcn.00438ed3
mov edx, dword [esp + 0x1048]
push 0x800
lea eax, [esp + 0x48]
push edx
push eax
call fcn.00438ed3
add esp, 0x48
lea ecx, [esp + 8]
push 0x800
push 0x457864
push ecx
call fcn.00438ed3
add esp, 0xc
lea edx, [esp + 8]
push 0x14
push esi
push edx
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
mov esi, eax
cmp esi, 6
jne 0x435f30
call fcn.00435c30
test eax, eax
je 0x435f18
call fcn.00435c50
test eax, eax
je 0x435f18
push 5
push 0
push 0
push str.http:__down.360safe.com_setupbeta.exe
jmp 0x435f23
push 5
push 0
push 0
push 0x4574f0
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [esp + 0x1014]
test eax, eax
je 0x435f42
push 0
call fcn.00438dc2
mov eax, esi
pop edi
pop esi
add esp, 0x1000
ret

Function at 0x435f50
Capabilities:
Parse pe header
Read file on windows

Disassembly:
sub esp, 0x13c
mov eax, dword [esp + 0x140]
push ebx
xor ebx, ebx
push esi
push ebx
push ebx
push 3
push ebx
push 1
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x435f86
pop esi
xor eax, eax
pop ebx
add esp, 0x13c
ret
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
lea ecx, [esp + 0xc]
push 0
push ecx
lea edx, [esp + 0x18]
push 0x40
push edx
push esi
call edi
test eax, eax
je 0x436001
cmp dword [esp + 0xc], 0x40
jne 0x436001
cmp word [esp + 0x10], 0x5a4d
jne 0x436001
mov eax, dword [esp + 0x4c]
push 0
push 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, dword [esp + 0x4c]
jne 0x436001
lea ecx, [esp + 0xc]
push 0
push ecx
lea edx, [esp + 0x58]
push 0xf8
push edx
push esi
call edi
test eax, eax
je 0x436001
cmp dword [esp + 0xc], 0xf8
jne 0x436001
cmp dword [esp + 0x50], 0x4550
jne 0x436001
cmp word [esp + 0x56], 0
je 0x436001
mov ebx, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, ebx
pop esi
pop ebx
add esp, 0x13c
ret

Function at 0x436050
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push eax
mov eax, dword [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x10]
push edx
mov edx, dword [esp + 0x10]
push eax
push ecx
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
ret

Function at 0x436080
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
ret
Function at 0x446ea0
Capabilities:
Get storage device properties

Disassembly:
mov eax, 0x2c10
call fcn.004364f0
mov eax, dword [esp + 0x2c14]
push ebx
xor ebx, ebx
push esi
cmp eax, ebx
je 0x44700a
mov esi, dword [esp + 0x2c20]
cmp esi, ebx
je 0x44700a
push ebp
push edi
xor edi, edi
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], edi
push edi
push str..PhysicalDrive_d
lea eax, [esp + 0x30]
push pe_nt_image_headers32
push eax
call fcn.00446ca0
add esp, 0x10
lea ecx, [esp + 0x28]
push ebx
push ebx
push 3
push ebx
push 3
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x446fed
xor edx, edx
mov ecx, 0x9c4
xor eax, eax
lea edi, [esp + 0x510]
mov dword [esp + 0x18], edx
push ebx
rep stosd dword es:[edi], eax
lea eax, [esp + 0x28]
mov dword [esp + 0x20], edx
push eax
lea ecx, [esp + 0x518]
mov dword [esp + 0x28], edx
push 0x2710
push ecx
lea edx, [esp + 0x28]
push 0xc
push edx
push 0x2d1400
push ebp
mov dword [esp + 0x44], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x446fd5
mov ecx, 0xfa
xor eax, eax
lea edi, [esp + 0x128]
lea edx, [esp + 0x510]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x528]
lea eax, [esp + 0x128]
push eax
push 1
push ecx
push edx
call fcn.004483d0
add esp, 0x10
cmp esi, 0x7fffffff
ja 0x446fd5
mov eax, dword [esp + 0x2c24]
lea edx, [esp + 0x128]
xor edi, edi
sub edx, eax
mov cl, byte [edx + eax]
cmp cl, bl
je 0x446fbd
mov byte [eax], cl
inc eax
dec esi
jne 0x446fae
jmp 0x446fc1
cmp esi, ebx
jne 0x446fc7
dec eax
mov edi, 0x8007007a
cmp edi, ebx
mov byte [eax], bl
jne 0x446fd5
mov dword [esp + 0x10], 1
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x10], ebx
jne 0x446ffb
mov esi, dword [esp + 0x2c28]
mov edi, dword [esp + 0x14]
inc edi
cmp edi, 0x10
mov dword [esp + 0x14], edi
jl 0x446ed8
mov eax, dword [esp + 0x10]
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x2c10
ret
pop esi
xor eax, eax
pop ebx
add esp, 0x2c10
ret
Function at 0x447670
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x2e8
test eax, eax
push esi
push edi
je 0x44785c
mov esi, dword [esp + 0x2f8]
test esi, esi
je 0x44785c
mov ecx, 0x19
xor eax, eax
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
push eax
push 8
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionNetworkCards
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4477f6
push ebx
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [esp + 0x14], eax
mov ebx, 0x104
mov eax, dword [esp + 0x14]
push 0
push 0
push 0
lea ecx, [esp + 0x2c]
push 0
lea edx, [esp + 0x100]
push ecx
mov ecx, dword [esp + 0x24]
push edx
push eax
push ecx
mov dword [esp + 0x40], ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x4477e2
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x18]
push edx
push 1
push eax
lea eax, [esp + 0xfc]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4477d9
lea edx, [esp + 0x1c]
lea eax, [esp + 0x1f4]
push edx
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x28]
push eax
push ecx
push 0
push str.ServiceName
push edx
mov dword [esp + 0x3c], 1
mov dword [esp + 0x34], ebx
call ebp
test eax, eax
jne 0x4477ce
mov ecx, 0x19
lea edi, [esp + 0x8c]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x8c]
push 0x64
lea ecx, [esp + 0x1f8]
push eax
push ecx
call fcn.00447870
add esp, 0xc
test eax, eax
je 0x4477ce
mov al, byte [esp + 0x28]
test al, al
je 0x4477a1
lea edx, [esp + 0x28]
lea eax, [esp + 0x8c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jge 0x4477ce
lea edx, [esp + 0x8c]
lea ecx, [esp + 0x28]
mov esi, 0x64
lea eax, [esp + 0x28]
sub edx, ecx
mov cl, byte [edx + eax]
test cl, cl
je 0x4477c6
mov byte [eax], cl
inc eax
dec esi
jne 0x4477b7
jmp 0x4477ca
test esi, esi
jne 0x4477cb
dec eax
mov byte [eax], 0
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [esp + 0x14]
jmp 0x4476d2
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [esp + 0x300]
pop ebp
pop ebx
mov al, byte [esp + 0x20]
test al, al
je 0x44785c
cmp esi, 0x7fffffff
jbe 0x44781d
mov eax, 0x80070057
xor ecx, ecx
test eax, eax
setge cl
pop edi
mov eax, ecx
pop esi
add esp, 0x2e8
ret
mov eax, dword [esp + 0x2f4]
lea edx, [esp + 0x20]
xor edi, edi
sub edx, eax
mov cl, byte [edx + eax]
test cl, cl
je 0x44783b
mov byte [eax], cl
inc eax
dec esi
jne 0x44782c
jmp 0x44783f
test esi, esi
jne 0x447845
dec eax
mov edi, 0x8007007a
mov byte [eax], 0
mov eax, edi
xor ecx, ecx
pop edi
test eax, eax
setge cl
mov eax, ecx
pop esi
add esp, 0x2e8
ret
pop edi
xor eax, eax
pop esi
add esp, 0x2e8
ret
Function at 0x447f80
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x508
push ebx
push ebp
mov ebp, dword [esp + 0x514]
push esi
test ebp, ebp
push edi
je 0x448139
mov ebx, dword [esp + 0x520]
cmp ebx, 0x20
jb 0x448139
mov ecx, pe_nt_image_headers32
xor eax, eax
lea edi, [esp + 0x118]
lea edx, [esp + 0x14]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
lea ecx, [esp + 0x118]
push eax
push ecx
push edx
push 0x45b2dc
push str.Software360SafeLiveup
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x2c], 1
mov dword [esp + 0x28], 0x400
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x448139
lea edi, [esp + 0x118]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 0x40
jne 0x448139
lea edx, [esp + 0x118]
lea ecx, [esp + 0x18]
mov esi, 0x80
lea eax, [esp + 0x18]
sub edx, ecx
lea ecx, [esi - 0x60]
test ecx, ecx
je 0x44803c
mov cl, byte [edx + eax]
test cl, cl
je 0x44803c
mov byte [eax], cl
inc eax
dec esi
jne 0x448026
jmp 0x448040
test esi, esi
jne 0x448041
dec eax
lea edx, [esp + 0x138]
lea ecx, [esp + 0x98]
mov byte [eax], 0
mov esi, 0x80
lea eax, [esp + 0x98]
sub edx, ecx
mov cl, byte [edx + eax]
test cl, cl
je 0x44806f
mov byte [eax], cl
inc eax
dec esi
jne 0x448060
jmp 0x448073
test esi, esi
jne 0x448074
dec eax
mov byte [eax], 0
mov ecx, pe_nt_image_headers32
xor eax, eax
lea edi, [esp + 0x118]
rep stosd dword es:[edi], eax
lea edx, [esp + 0x118]
push 0x400
lea eax, [esp + 0x1c]
push edx
push eax
call fcn.00447d90
add esp, 0xc
lea ecx, [esp + 0x98]
lea edx, [esp + 0x118]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x448139
cmp ebx, 0x7fffffff
jbe 0x4480dc
mov eax, 0x80070057
xor ecx, ecx
test eax, eax
pop edi
pop esi
sete cl
pop ebp
mov eax, ecx
pop ebx
add esp, 0x508
ret
xor edi, edi
mov edx, ebx
test ebx, ebx
mov eax, ebp
jne 0x448101
mov edi, 0x80070057
xor ecx, ecx
mov eax, edi
pop edi
test eax, eax
sete cl
pop esi
pop ebp
mov eax, ecx
pop ebx
add esp, 0x508
ret
lea esi, [esp + 0x18]
sub esi, ebp
mov cl, byte [esi + eax]
test cl, cl
je 0x448116
mov byte [eax], cl
inc eax
dec edx
jne 0x448107
jmp 0x44811a
test edx, edx
jne 0x448120
dec eax
mov edi, 0x8007007a
mov byte [eax], 0
mov eax, edi
xor ecx, ecx
pop edi
test eax, eax
sete cl
pop esi
pop ebp
mov eax, ecx
pop ebx
add esp, 0x508
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x508
ret
Function at 0x448150
Capabilities:
Set registry value

Disassembly:
sub esp, 0x188
mov ecx, 0x20
xor eax, eax
push esi
mov esi, dword [esp + 0x190]
push edi
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
lea eax, [esp + 0xc]
push 0x80
push eax
push esi
call fcn.00447d90
mov edx, esi
lea ecx, [esp + 0x98]
add esp, 0xc
mov edi, 0x104
lea eax, [esp + 0x8c]
sub edx, ecx
mov cl, byte [edx + eax]
test cl, cl
je 0x4481a5
mov byte [eax], cl
inc eax
dec edi
jne 0x448196
jmp 0x4481a9
test edi, edi
jne 0x4481aa
dec eax
mov byte [eax], 0
mov ecx, 0x104
lea eax, [esp + 0x8c]
cmp byte [eax], 0
je 0x4481c4
inc eax
dec ecx
jne 0x4481b9
jmp 0x44820a
test ecx, ecx
je 0x44820a
lea edx, [esp + 8]
test edx, edx
je 0x4481d9
mov eax, 0x104
sub eax, ecx
jmp 0x4481dd
mov eax, dword [esp + 8]
mov edx, 0x104
sub edx, eax
lea eax, [esp + eax + 0x8c]
je 0x44820a
lea esi, [esp + 0xc]
sub esi, eax
mov cl, byte [esi + eax]
test cl, cl
je 0x448202
mov byte [eax], cl
inc eax
dec edx
jne 0x4481f3
jmp 0x448206
test edx, edx
jne 0x448207
dec eax
mov byte [eax], 0
lea edi, [esp + 0x8c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x8c]
push ecx
push eax
push 1
push 0x45b2dc
push str.Software360SafeLiveup
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
pop edi
pop esi
add esp, 0x188
ret

Function at 0x402176
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebx
push esi
xor esi, esi
push edi
push esi
push dword [esp + 0x14]
call dword [0x40b1bc]
push esi
push esi
push esi
push 2
push esi
mov edi, eax
push dword [esp + 0x24]
call dword [0x40b1b8]
push edi
push esi
mov ebx, eax
push esi
push 4
push ebx
call dword [0x40b1d0]
shr edi, 2
mov ecx, eax
je 0x4021bd
xor esi, dword [ecx]
add ecx, 4
mov edx, ecx
sub edx, eax
sar edx, 2
cmp edx, edi
jb 0x4021ad
push eax
call dword [0x40b1cc]
push ebx
call dword [0x40b248]
mov eax, esi
pop edi
pop esi
pop ebx
ret
Function at 0x40d389
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x41f320
call fcn.0041e0b0
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [edi]
test eax, eax
mov dword [esi], eax
je 0x40d3ac
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
mov eax, dword [edi + 4]
and dword [ebp - 4], 0
test eax, eax
mov dword [esi + 4], eax
je 0x40d3c0
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
mov eax, dword [edi + 8]
mov byte [ebp - 4], 1
test eax, eax
mov dword [esi + 8], eax
je 0x40d3d4
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
lea eax, [edi + 0xc]
lea ecx, [esi + 0xc]
push eax
mov byte [ebp - 4], 2
call fcn.00402813
lea eax, [edi + 0x18]
lea ecx, [esi + 0x18]
push eax
mov byte [ebp - 4], 3
call fcn.00402813
mov eax, dword [edi + 0x24]
lea ecx, [esi + 0x38]
mov dword [esi + 0x24], eax
mov eax, dword [edi + 0x28]
mov dword [esi + 0x28], eax
mov eax, dword [edi + 0x2c]
mov dword [esi + 0x2c], eax
mov eax, dword [edi + 0x30]
mov dword [esi + 0x30], eax
mov al, byte [edi + 0x34]
mov byte [esi + 0x34], al
lea eax, [edi + 0x38]
push eax
mov byte [ebp - 4], 4
call fcn.00402813
mov al, byte [edi + 0x44]
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0x44], al
mov al, byte [edi + 0x45]
mov byte [esi + 0x45], al
mov al, byte [edi + 0x46]
mov byte [esi + 0x46], al
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x40e7b9
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get ntdll base address

Disassembly:
mov eax, 0x41f61a
call fcn.0041e0b0
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
or eax, 0xffffffff
mov dword [ebp - 0x10], esi
mov dword [esi + 8], eax
mov dword [esi + 0x10], ebx
mov dword [esi + 0x18], eax
mov dword [esi + 0x20], ebx
mov dword [esi + 0x28], eax
mov dword [esi + 0x30], eax
lea ecx, [esi + 0x38]
mov byte [esi], bl
mov byte [esi + 1], bl
mov byte [esi + 2], 1
mov dword [esi + 0xc], eax
mov dword [esi + 0x14], ebx
mov dword [esi + 0x1c], eax
mov dword [esi + 0x24], ebx
mov dword [esi + 0x2c], eax
mov dword [esi + 0x34], eax
call fcn.00402794
lea ecx, [esi + 0x44]
mov dword [ebp - 4], ebx
call fcn.00402794
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
lea ecx, [esi + 0x5c]
mov byte [ebp - 4], 2
call fcn.00402794
lea ecx, [esi + 0x68]
mov byte [ebp - 4], 3
call fcn.00402794
lea ecx, [esi + 0x74]
mov byte [ebp - 4], 4
call fcn.00402794
lea ecx, [esi + 0x80]
mov byte [ebp - 4], 5
call fcn.00402794
lea ecx, [esi + 0x8c]
call fcn.0041cff0
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x41c6d0
Capabilities:
Hash data using sha256

Disassembly:
xor eax, eax
mov dword [ecx], 0x6a09e667
mov dword [ecx + 4], 0xbb67ae85
mov dword [ecx + 8], 0x3c6ef372
mov dword [ecx + 0xc], 0xa54ff53a
mov dword [ecx + 0x10], 0x510e527f
mov dword [ecx + 0x14], 0x9b05688c
mov dword [ecx + 0x18], 0x1f83d9ab
mov dword [ecx + 0x1c], 0x5be0cd19
mov dword [ecx + 0x20], eax
mov dword [ecx + 0x24], eax
ret
Function at 0x42cc4c
Capabilities:
Get number of processors

Disassembly:
mov eax, 0x41333c
call fcn.00430c3c
sub esp, 0x34
push ebx
push ebp
push esi
push edi
mov edi, dword [fcn.0041421c]
mov esi, ecx
push 0x3e8
push dword [esi + 0xd48]
or dword [esi + 0xd44], 0xffffffff
call edi
push 0x3e9
mov dword [esp + 0x14], eax
push dword [esi + 0xd48]
call edi
push 0x3ea
mov dword [esp + 0x20], eax
push dword [esi + 0xd48]
call edi
push 0x3ff
mov dword [esp + 0x18], eax
push dword [esi + 0xd48]
call edi
push 0x3ec
mov dword [esp + 0x1c], eax
push dword [esi + 0xd48]
call edi
push 0x3ed
mov dword [esp + 0x28], eax
push dword [esi + 0xd48]
call edi
push 0x3eb
mov dword [esp + 0x24], eax
push dword [esi + 0xd48]
call edi
mov ebp, dword [0x41422c]
push 5
push dword [esp + 0x18]
mov dword [esp + 0x30], eax
call ebp
push 5
push dword [esp + 0x1c]
call ebp
xor ebx, ebx
push ebx
push dword [esp + 0x28]
call ebp
push 5
push dword [esp + 0x24]
call ebp
push ebx
push dword [esp + 0x2c]
call ebp
lea ecx, [esp + 0x2c]
call fcn.00428c00
lea ecx, [esi + 0xcac]
mov dword [esp + 0x4c], ebx
call fcn.00428dcc
mov ebp, dword [fcn.00414200]
push eax
push dword [esp + 0x14]
call ebp
push 1
push dword [esi + 0xd4c]
push 0x30
push dword [esp + 0x1c]
call dword [fcn.004141c4]
lea eax, [esp + 0x2c]
push eax
push 0x54
push ebx
call fcn.0042998b
add esp, 0xc
lea ecx, [esp + 0x2c]
call fcn.00428dcc
push eax
push dword [esp + 0x20]
call ebp
lea eax, [esp + 0x2c]
push eax
push 0x56
push ebx
call fcn.0042998b
add esp, 0xc
lea ecx, [esp + 0x2c]
call fcn.00428dcc
push eax
push dword [esp + 0x18]
call ebp
lea ebp, [esi + 0xcc4]
push ebx
push 0x32
lea eax, [esp + 0x40]
push ebp
push eax
call fcn.00429b18
add esp, 0x10
lea ecx, [esp + 0x38]
mov byte [esp + 0x4c], 1
call fcn.00428df0
mov edx, eax
mov ecx, ebp
mov dword [esp + 0x28], edx
call fcn.00428df0
mov ecx, dword [esp + 0x28]
cmp ecx, eax
jae 0x42cdd2
push 0x4172cc
lea ecx, [esp + 0x3c]
call fcn.00428e66
lea ecx, [esp + 0x38]
call fcn.00428dcc
push eax
push dword [esp + 0x1c]
call dword [fcn.00414200]
mov ebp, dword [fcn.004141d0]
push ebx
push 0x23
push 0x15e
push 0x14
push 0x14
push dword [esp + 0x24]
call ebp
push ebx
push 0x55
push 0x15e
push 0x3c
push 0x14
push dword [esp + 0x30]
call ebp
push 5
mov ebp, dword [fcn.004141cc]
push ebx
push ebx
push 0x96
push 0x12
push ebx
push dword [esp + 0x38]
call ebp
push 5
push ebx
push ebx
push 0x9b
push 0x14
push ebx
push dword [esp + 0x2c]
call ebp
push 5
push ebx
push ebx
push 0xad
push 0x14
push ebx
push dword [esp + 0x30]
call ebp
push ebx
push 0x64
push 0x402
push 0x3e8
push dword [esi + 0xd10]
call edi
push eax
call dword [fcn.004141c4]
push 1
push ebx
push dword [esi + 0xd48]
call dword [fcn.00414240]
lea ecx, [esp + 0x38]
mov byte [esp + 0x4c], bl
call fcn.00428d0e
or dword [esp + 0x4c], 0xffffffff
lea ecx, [esp + 0x2c]
call fcn.00428d0e
mov ecx, dword [esp + 0x44]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x410050
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x10020
call fcn.00425e10
xor eax, eax
lea esp, [esp]
mov cl, byte [eax + 0x492380]
mov dl, byte [eax + 0x492378]
mov byte [esp + eax + 0xc], cl
mov byte [esp + eax + 0x14], dl
inc eax
cmp eax, 8
jl 0x410060
lea eax, [esp]
push 0x4876e8
push eax
call fcn.00414590
push 4
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x2c]
push edx
call fcn.00411b70
add esp, 0x14
push ebx
push ebp
push esi
mov dword [esp + 0x14], 0
push edi
jmp 0x4100b0
mov eax, dword [esp + 0x10034]
mov ecx, dword [eax]
push ecx
push 0x10000
lea edx, [esp + 0x38]
push 1
push edx
call fcn.00415db0
add esp, 0x10
invalid
clc

Function at 0x4101e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1a8
push ebx
push esi
mov ebx, 0x4848e8
call fcn.00410180
mov esi, eax
lea eax, [esp + 0xa8]
push esi
push eax
call fcn.00414590
push esi
call fcn.00411eef
add esp, 0xc
lea esi, [esp + 0x18]
call fcn.004102a0
lea eax, [esp + 0xa8]
mov ecx, esi
call fcn.004102d0
xor ebx, ebx
mov dword [edi + 8], ebx
xor ecx, ecx
mov eax, ebx
movzx edx, byte [esp + ecx + 0x18]
add eax, edx
movzx edx, byte [esp + ecx + 0x19]
add eax, edx
movzx edx, byte [esp + ecx + 0x1a]
add eax, edx
movzx edx, byte [esp + ecx + 0x1b]
add ecx, 4
add eax, edx
cmp ecx, 0x10
jl 0x410231
mov dword [edi + 8], eax
mov eax, dword [ebp + 8]
push 0x4876c8
push eax
call fcn.00415a06
add esp, 8
mov dword [edi], eax
cmp eax, ebx
je 0x42beee
push edi
call fcn.00410050
cmp eax, ebx
je 0x42bef8
mov ecx, dword [edi]
push ecx
mov esi, eax
call fcn.00415a94
add esp, 4
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, 1
jmp 0x410290
mov edx, dword [edi]
push edx
push 0x10
lea eax, [esp + 0x10]
push 1
push eax
call fcn.00415db0
add esp, 0x10
push 0x99f2
push 0x10
lea ecx, [esp + 0x10]
push ecx
call fcn.0044bbdc
xor eax, eax
mov dword [edi + 8], ebx
xor ecx, ecx
movzx edx, byte [esp + eax + 8]
inc eax
imul ecx, edx
cmp eax, 0x10
jl 0x42bf24
mov eax, dword [edi]
push eax
mov dword [edi + 8], ecx
call fcn.00416084
add esp, 4
mov dword [edi + 4], eax
xor eax, eax
jmp 0x410290

Function at 0x4102a0
Capabilities:
Hash data with md5

Disassembly:
push 8
lea eax, [esi + 0x44]
push 0
push eax
call fcn.00413df0
add esp, 0xc
mov dword [esi + 0x34], 0x67452301
mov dword [esi + 0x38], 0xefcdab89
mov dword [esi + 0x3c], 0x98badcfe
mov dword [esi + 0x40], 0x10325476
ret

Function at 0x435d52
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0x464]
test eax, eax
je 0x435d68
cmp eax, 0x10000
jne 0x435d8c
mov eax, dword [esi + 0x1c]
mov ecx, dword [esi + 0x45c]
push eax
push 0x10000
push 1
push ecx
call fcn.00415db0
add esp, 0x10
mov dword [esi + 0x464], 0
mov ecx, dword [esi + 0x464]
mov edx, dword [esi + 0x45c]
mov al, byte [ecx + edx]
inc ecx
mov dword [esi + 0x464], ecx
pop esi
ret 4