joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401440
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x68
mov eax, dword [0x4a9150]
xor eax, esp
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x6c]
xor ecx, ecx
push esi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], ecx
push eax
mov eax, dword [esp + 0x78]
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.00407960
add esp, 4
lea esi, [esp + 8]
mov ecx, edi
call fcn.00407a00
mov ecx, dword [esp + 0x64]
pop esi
xor ecx, esp
call fcn.0043f097
add esp, 0x68
ret

Function at 0x4014b0
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x68
mov eax, dword [0x4a9150]
xor eax, esp
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x6c]
xor ecx, ecx
push esi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], ecx
push eax
mov eax, dword [esp + 0x78]
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.00407960
add esp, 4
lea esi, [esp + 8]
mov ecx, edi
call fcn.00407a00
mov ecx, dword [esp + 0x64]
pop esi
xor ecx, esp
call fcn.0043f097
add esp, 0x68
ret

Function at 0x401da0
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x6c
mov eax, dword [0x4a9150]
xor eax, esp
mov dword [esp + 0x68], eax
push esi
lea eax, [esp + 8]
mov esi, edx
push eax
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x18], 0x67452301
mov dword [esp + 0x1c], 0xefcdab89
mov dword [esp + 0x20], 0x98badcfe
mov dword [esp + 0x24], 0x10325476
call fcn.00405820
add esp, 8
test eax, eax
jne 0x401e0b
pop esi
mov ecx, dword [esp + 0x68]
xor ecx, esp
call fcn.0043f097
add esp, 0x6c
ret
mov eax, dword [esp + 0x74]
test eax, eax
jbe 0x401e20
push esi
lea ecx, [esp + 0x14]
call fcn.00407960
add esp, 4
lea esi, [esp + 0x10]
mov ecx, ebx
call fcn.00407a00
test edi, edi
je 0x401e3e
mov ecx, dword [esp + 0xc]
xor eax, eax
cmp ecx, dword [esp + 8]
sete al
mov dword [edi], eax
mov ecx, dword [esp + 0x6c]
pop esi
xor ecx, esp
mov eax, 1
call fcn.0043f097
add esp, 0x6c
ret

Function at 0x401ed0
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x64
mov eax, dword [0x4a9150]
xor eax, esp
mov dword [esp + 0x5c], eax
xor eax, eax
push esi
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
push edi
lea eax, [esp + 8]
mov edi, ecx
push eax
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.00405a20
add esp, 4
test eax, eax
jne 0x401f2e
pop edi
pop esi
mov ecx, dword [esp + 0x5c]
xor ecx, esp
call fcn.0043f097
add esp, 0x64
ret
lea esi, [esp + 8]
mov ecx, ebx
call fcn.00407a00
mov ecx, dword [esp + 0x64]
pop edi
pop esi
xor ecx, esp
mov eax, 1
call fcn.0043f097
add esp, 0x64
ret
Function at 0x401f50
Capabilities:
Hash data using sha256

Disassembly:
sub esp, 0x74
mov eax, dword [0x4a9150]
xor eax, esp
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x78]
xor ecx, ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ecx
push edi
lea ecx, [esp + 8]
push ecx
push eax
mov dword [esp + 0x10], 0x6a09e667
mov dword [esp + 0x14], 0xbb67ae85
mov dword [esp + 0x18], 0x3c6ef372
mov dword [esp + 0x1c], 0xa54ff53a
mov dword [esp + 0x20], 0x510e527f
mov dword [esp + 0x24], 0x9b05688c
mov dword [esp + 0x28], 0x1f83d9ab
mov dword [esp + 0x2c], 0x5be0cd19
call fcn.00405b10
add esp, 8
test eax, eax
jne 0x401fcf
pop edi
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.0043f097
add esp, 0x74
ret
mov eax, esi
lea edi, [esp + 8]
call fcn.00407010
mov ecx, dword [esp + 0x74]
pop edi
xor ecx, esp
mov eax, 1
call fcn.0043f097
add esp, 0x74
ret
Function at 0x41baf0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x489676
mov eax, dword fs:[0]
push eax
sub esp, 0x210
mov eax, dword [0x4a9150]
xor eax, esp
mov dword [esp + 0x20c], eax
push esi
push edi
mov eax, dword [0x4a9150]
xor eax, esp
push eax
lea eax, [esp + 0x21c]
mov dword fs:[0], eax
mov eax, dword [0x4ab834]
mov edx, dword [eax + 0xc]
mov esi, ecx
mov ecx, 0x4ab834
mov dword [esp + 0xc], esi
call edx
add eax, 0x10
mov dword [esi], eax
mov eax, dword [0x4ab834]
mov edx, dword [eax + 0xc]
mov ecx, 0x4ab834
mov dword [esp + 0x224], 0
call edx
add eax, 0x10
mov dword [esi + 4], eax
mov eax, dword [0x4ab834]
mov edx, dword [eax + 0xc]
mov ecx, 0x4ab834
mov byte [esp + 0x224], 1
call edx
add eax, 0x10
mov dword [esi + 8], eax
mov eax, dword [0x4ab834]
mov edx, dword [eax + 0xc]
mov ecx, 0x4ab834
mov byte [esp + 0x224], 2
call edx
add eax, 0x10
mov dword [esi + 0xc], eax
mov eax, dword [0x4ab834]
mov edx, dword [eax + 0xc]
mov ecx, 0x4ab834
mov byte [esp + 0x224], 3
lea edi, [esi + 0x10]
call edx
add eax, 0x10
mov dword [edi], eax
mov eax, dword [0x4ab834]
mov edx, dword [eax + 0xc]
mov ecx, 0x4ab834
mov byte [esp + 0x224], 4
call edx
add eax, 0x10
mov dword [esi + 0x14], eax
mov eax, dword [0x4ab834]
mov edx, dword [eax + 0xc]
mov ecx, 0x4ab834
mov byte [esp + 0x224], 5
call edx
add eax, 0x10
mov dword [esi + 0x18], eax
mov eax, dword [0x4ab834]
mov edx, dword [eax + 0xc]
mov ecx, 0x4ab834
mov byte [esp + 0x224], 6
call edx
add eax, 0x10
mov dword [esi + 0x1c], eax
mov eax, dword [0x4ab834]
mov edx, dword [eax + 0xc]
mov ecx, 0x4ab834
mov byte [esp + 0x224], 7
call edx
add eax, 0x10
mov dword [esi + 0x20], eax
mov eax, dword [0x4ab834]
mov edx, dword [eax + 0xc]
mov ecx, 0x4ab834
mov byte [esp + 0x224], 8
call edx
add eax, 0x10
mov dword [esi + 0x28], eax
lea ecx, [esi + 0x38]
mov byte [esp + 0x224], 9
call fcn.00419dc0
lea ecx, [esi + 0x54]
mov byte [esp + 0x224], 0xa
call fcn.00419e30
lea ecx, [esi + 0x70]
mov byte [esp + 0x224], 0xb
call fcn.00419d50
lea ecx, [esi + 0x8c]
mov byte [esp + 0x224], 0xc
call fcn.00419d50
lea ecx, [esi + 0xa8]
mov byte [esp + 0x224], 0xd
call fcn.00419d50
lea ecx, [esi + 0xc4]
mov byte [esp + 0x224], 0xe
call fcn.00419ea0
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x1a]
push ecx
mov byte [esp + 0x230], 0xf
mov byte [esi + 0x2c], 0
mov word [esp + 0x1c], ax
call fcn.0043f2b0
add esp, 0xc
lea edx, [esp + 0x10]
push edx
push 0x104
call dword [0x48c0c0]
call dword [0x48c2c0]
push eax
lea eax, [esp + 0x14]
push eax
push 0x48d118
push edi
call fcn.00414dd0
add esp, 0x10
mov dword [esi + 0x30], 0
mov eax, esi
mov ecx, dword [esp + 0x21c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.0043f097
add esp, 0x21c
ret
Function at 0x431850
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
mov ebp, ecx
test ebx, ebx
jne 0x43186d
push ebx
push ebx
push ebx
push 2
call fcn.00434940
pop ebp
xor al, al
pop ebx
ret 8
push edi
call fcn.004314d0
push 2
or eax, 0xffffffff
push 0
push ebx
mov dword [ebp + 8], eax
mov dword [ebp + 4], eax
call fcn.00442902
push ebx
call fcn.0044280a
push 0
push 0
push ebx
mov edi, eax
call fcn.00442902
add esp, 0x1c
test edi, edi
jg 0x4318b6
push 0
push 0
push 0
push 0xc
mov ecx, ebp
call fcn.00434940
pop edi
pop ebp
xor al, al
pop ebx
ret 8
lea eax, [edi + 1]
push esi
push eax
call fcn.0043ab80
push ebx
push 1
mov esi, eax
push edi
push esi
mov byte [esi], 0
call fcn.00442650
add esp, 0x14
cmp eax, 1
je 0x4318f8
push esi
call fcn.0043abb0
add esp, 4
push 0
push 0
push 0
push 2
mov ecx, ebp
call fcn.00434940
pop esi
pop edi
pop ebp
xor al, al
pop ebx
ret 8
mov byte [esi + edi], 0
cmp byte [esi], 0
mov eax, esi
mov ecx, esi
je 0x431921
mov dl, byte [eax]
cmp dl, 0xd
jne 0x431918
mov byte [ecx], 0xa
inc eax
inc ecx
cmp byte [eax], 0xa
jne 0x43191c
jmp 0x43191b
mov byte [ecx], dl
inc ecx
inc eax
cmp byte [eax], 0
jne 0x431905
mov eax, dword [esp + 0x18]
push eax
mov byte [ecx], 0
mov edx, dword [ebp]
mov edx, dword [edx + 8]
push 0
push esi
mov ecx, ebp
call edx
push esi
call fcn.0043abb0
add esp, 4
pop esi
xor eax, eax
cmp byte [ebp + 0x2c], al
pop edi
pop ebp
sete al
pop ebx
ret 8
Function at 0x407864
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x40c55c
mov eax, esi
mov edx, 8
test al, 1
je 0x407880
shr eax, 1
xor eax, 0xedb88320
jmp 0x407882
shr eax, 1
dec edx
jne 0x407873
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x40786c
pop esi
ret

Function at 0x4078af
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x40c558], 0
jne 0x4078bb
call fcn.00407864
push 1
push 0x40c558
call fcn.004043d0
mov eax, edi
test esi, esi
je 0x4078e6
mov edx, ebx
and dx, 0xff
xor ecx, ecx
mov cl, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x40c55c]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x4078c1
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x4542df
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test edx, 0xf082da5
mov edi, dword [ebx + ecx*4]
shld si, dx, 5
add edi, eax
jmp 0x462c57
jmp 0x466bc3
mov esi, dword [ebp + 0xc]
jmp 0x459a00
push 0xa28da206
lea esi, [eax + 0xe4de89e]
jmp 0x45bd65

Function at 0x459353
Capabilities:
Resolve function by parsing pe exports

Disassembly:
aaa
mov dword [esp], edx
test ch, ah
shl ah, cl
aas
mov eax, dword [ebp + 8]
jns 0x45c9bb
bt ax, 6
cmp dh, 0x5a
clc
test eax, eax
pushal
jmp 0x4627cd
shrd di, cx, 1
mov edi, dword [edx + 0x1c]
call fcn.00459450
pushfd
mov byte [esp], 0x54
test eax, eax
pushfd
lea esp, [esp + 8]
je 0x45abc7
add si, dx
bsf edx, ebx
sub dl, dh
pushfd
mov esi, dword [eax + 0x3c]
sar dh, cl
setle dl
add esi, eax
movzx edx, cl
mov edx, dword [esi + 0x78]
push esp
test edx, edx
mov dword [esp], ebx
lea esp, [esp + 8]
je 0x45abc7
inc cx
add edx, eax
not ecx
mov ecx, dword [esi + 0x7c]
push 0x700996f6
mov byte [esp], 0x48
cmp dl, dl
clc
add ecx, edx
cmc
mov dword [ebp - 0x10], ecx
test ch, cl
rcr cl, cl
xor ch, 0x62
movsx cx, dl
mov ecx, dword [ebp + 0xc]
cmc
cmp ecx, 0xffff
mov byte [esp], cl
mov byte [esp], dl
pushfd
jmp 0x45ab6a
lea esp, [esp + 8]
jbe 0x45c63b
not ebx
bsr edi, ebx
shl cx, 9
bswap bx
mov edi, dword [edx + 0x24]
rcl bx, 5
add edi, eax
and bx, cx
movzx cx, bl
mov ebx, dword [edx + 0x20]
pushal
add ch, cl
and cl, cl
add ebx, eax
bsf cx, cx
btc cx, 1
neg cl
pop ecx
mov dword [ebp - 8], 0
pop ecx
movzx cx, al
stc
mov ecx, dword [edx + 0x18]
call fcn.00466fbd
and ebx, 0xfff
cmc
call fcn.00464a5f
stc
push 0xe43aa7e
sub ecx, dword [edx + 0x10]
bt dx, 0xb
stc
cmp ecx, dword [edx + 0x14]
mov word [esp], 0xc00d
lea esp, [esp + 4]
jae 0x45abc7
pushal
mov byte [esp], 0xcc
push esi
lea esp, [esp + 0x24]
jmp 0x45a73b
jmp 0x45a969
mov dword [esp + 4], eax
jmp 0x4658db
lea esp, [esp + 0x20]
je 0x45abc7
adc dl, ch
bswap edx
shld si, ax, cl
mov esi, dword [eax + 0x3c]
bsf dx, cx
add esi, eax
neg dh
sub dh, 0x58
mov edx, dword [esi + 0x78]
call fcn.0045957b

Function at 0x45acf9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushfd
mov byte [esp + 4], ch
lea esp, [esp + 0xc]
je 0x4589e4
clc
pushal
clc
sub al, 0x30
bt esp, 0x16
pushal
pushfd
cmp al, 9
call fcn.004599cd

Function at 0x45c78b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
bt ecx, 0xa
test al, al
push ebx
pushfd
lea esp, [esp + 0x14]
je 0x4589e4
clc
call fcn.00463512

Function at 0x45c9a7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
ror al, 4
stc
clc
bt cx, di
bt di, bx
xor al, 0x53
call fcn.00465903
add byte [eax], al

Function at 0x463204
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x465aa6
lea esp, [esp + 8]
jne 0x4589ee
rcr al, 3
shr ah, 3
bt dx, di
sub edx, edx
dec ax
mov eax, edx
Function at 0x4652ba
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0x18]
je 0x45abc7
clc
test ebx, 0x2d3acc2a
add eax, edi
pushfd
push 0xd603829c
push dword [esp + 4]
pushal
lea esp, [esp + 0x2c]
jmp 0x45684e
Function at 0x401000
Capabilities:
Get routing table

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
xor esi, esi
inc esi
push esi
lea eax, [ebp - 4]
xor ebx, ebx
push eax
push ebx
mov dword [ebp - 4], ebx
call fcn.00486dac
cmp dword [ebp - 4], ebx
je 0x4010d4
push dword [ebp - 4]
call fcn.0045b82e
mov edi, eax
cmp edi, ebx
pop ecx
je 0x4010d4
push dword [ebp - 4]
push ebx
push edi
call fcn.0045c2f0
add esp, 0xc
push esi
lea eax, [ebp - 4]
push eax
push edi
call fcn.00486dac
test eax, eax
je 0x401079
cmp dword [0x4b1b70], 2
jne 0x401071
push str.GetIpForwardTable_fail_n
call fcn.00461b52
add eax, 0x40
push eax
call fcn.0045f40d
pop ecx
pop ecx
push edi
call fcn.0045b8f1
jmp 0x4010f1
cmp dword [edi], ebx
mov dword [ebp - 8], ebx
jbe 0x4010bd
lea esi, [edi + 4]
cmp dword [0x4b1b70], 2
jne 0x4010a7
push dword [esi + 4]
push dword [esi]
push str.MIB_IPFORWARDROW__lu__lu_n
call fcn.00461b52
add eax, 0x40
push eax
call fcn.0045f40d
add esp, 0x10
cmp dword [esi], ebx
jne 0x4010b0
cmp dword [esi + 4], ebx
je 0x4010c8
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
add esi, 0x38
cmp eax, dword [edi]
jb 0x401083
push edi
call fcn.0045b8f1
pop ecx
xor eax, eax
jmp 0x4010f4
push edi
call fcn.0045b8f1
xor eax, eax
pop ecx
inc eax
jmp 0x4010f4
cmp dword [0x4b1b70], 2
jne 0x4010f2
push str.size__0__malloc_fail_n
call fcn.00461b52
add eax, 0x40
push eax
call fcn.0045f40d
pop ecx
pop ecx
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4010f9
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x814
mov eax, dword [0x4ac13c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor edi, edi
push 0x7fe
lea eax, [ebp - 0x802]
push edi
push eax
mov word [ebp - 0x804], di
call fcn.0045c2f0
push 0xffffffffffffffff
push str.SOFTWARETencent_bugReport_
mov esi, 0x400
lea eax, [ebp - 0x804]
push esi
push eax
call fcn.0045ba89
push 0x4b1b98
lea eax, [ebp - 0x804]
push esi
push eax
call fcn.0045da61
add esp, 0x28
lea eax, [ebp - 0x810]
push eax
push 0x20019
push edi
lea eax, [ebp - 0x804]
push eax
push 0x80000001
call dword [0x49100c]
test eax, eax
jne 0x4011d8
push 4
pop esi
lea eax, [ebp - 0x814]
push eax
lea eax, [ebp - 0x808]
push eax
lea eax, [ebp - 0x80c]
push eax
push edi
push str.lcdbg
push dword [ebp - 0x810]
mov dword [ebp - 0x808], edi
mov dword [ebp - 0x814], esi
mov dword [ebp - 0x80c], edi
call dword [0x49101c]
push dword [ebp - 0x810]
call dword [0x491004]
cmp dword [ebp - 0x80c], esi
je 0x4011d0
mov dword [ebp - 0x808], edi
mov eax, dword [ebp - 0x808]
jmp 0x4011da
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0045b7a6
leave
ret
Function at 0x4017e1
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [0x4ac13c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
cmp byte [0x4b1be0], bl
push esi
jne 0x4018c5
cmp eax, ebx
mov byte [0x4b1be0], 1
je 0x4018c5
cmp word [eax], bx
je 0x4018c5
push 0xffffffffffffffff
push eax
push 0x21
mov esi, 0x4b1b98
push esi
call fcn.0045ba89
push 0x63
lea eax, [ebp - 0x67]
push ebx
push eax
mov byte [ebp - 0x68], bl
call fcn.0045c2f0
add esp, 0x1c
push ebx
push ebx
push 0x63
lea eax, [ebp - 0x68]
push eax
push 0xffffffffffffffff
push esi
push ebx
push 0xfde9
call dword [0x491340]
push 0xffffffffffffffff
lea eax, [ebp - 0x68]
push eax
push 0x21
push 0x4b1b74
call fcn.0045cf24
add esp, 0x10
cmp byte [0x4b1b74], bl
je 0x4018c5
movzx eax, word [ebp + 0xc]
movzx ecx, word [ebp + 0x10]
imul eax, eax, 0x64
add eax, ecx
imul eax, eax, 0x2710
add eax, dword [ebp + 0x14]
mov dword [ebp - 0x6c], ebx
mov dword [0x4b1bdc], eax
lea eax, [ebp - 0x6c]
push eax
push 4
push ebx
push 0x4011e8
push ebx
push ebx
call dword [0x4912b0]
mov esi, eax
cmp esi, ebx
je 0x4018c5
push 0xffffffffffffffff
push esi
call dword [0x491268]
push esi
call dword [0x4910cc]
push esi
call dword [0x491360]
xor eax, eax
jmp 0x4018c8
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0045b7a6
leave
ret

Function at 0x401b8a
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x4ac13c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
push esi
push esi
push 3
push esi
push 3
push esi
push str..PhysicalDrive0
mov dword [ebp - 0x414], eax
call dword [0x491280]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x401c64
push edi
push 0xc
lea eax, [ebp - 0x410]
push esi
push eax
call fcn.0045c2f0
mov edi, 0x400
push edi
lea eax, [ebp - 0x404]
push esi
push eax
mov dword [ebp - 0x410], esi
mov dword [ebp - 0x40c], esi
mov dword [ebp - 0x418], esi
call fcn.0045c2f0
add esp, 0x18
push esi
lea eax, [ebp - 0x418]
push eax
push edi
lea eax, [ebp - 0x404]
push eax
push 0xc
lea eax, [ebp - 0x410]
push eax
push 0x2d1400
push ebx
call dword [0x491294]
test eax, eax
pop edi
je 0x401c5d
mov esi, dword [ebp - 0x3f4]
lea esi, [ebp + esi - 0x404]
movsx eax, byte [esi]
push eax
call fcn.0045e1df
test eax, eax
pop ecx
je 0x401c5d
mov ecx, dword [ebp - 0x414]
push esi
call fcn.00402125
push ebx
call dword [0x491360]
xor eax, eax
inc eax
jmp 0x401c66
push ebx
call dword [0x491360]
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0045b7a6
leave
ret 4

Function at 0x4028b5
Capabilities:
Hash data with md5

Disassembly:
push 0x5c
push 0
push esi
call fcn.0045c2f0
and dword [esi + 0x10], 0
and dword [esi + 0x14], 0
and dword [esi + 0x58], 0
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
ret
Function at 0x4036ca
Capabilities:
Get local ipv4 addresses

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
push esi
xor esi, esi
and dword [ebp - 4], esi
push edi
lea eax, [ebp - 8]
push eax
push esi
push 0
push 0
push 2
call fcn.00486db8
mov edi, eax
cmp edi, 0x6f
jne 0x403715
test esi, esi
je 0x4036fd
push esi
call fcn.00451fd9
pop ecx
push dword [ebp - 8]
call fcn.00451fde
mov esi, eax
test esi, esi
pop ecx
je 0x40374d
inc dword [ebp - 4]
cmp dword [ebp - 4], 5
jl 0x4036db
test edi, edi
jne 0x403742
test esi, esi
je 0x40374d
push dword [ebp + 8]
mov ecx, esi
call fcn.00403755
mov edi, eax
test edi, edi
je 0x403737
push dword [ebp + 8]
call fcn.00404073
mov edi, eax
push esi
call fcn.00451fd9
pop ecx
mov eax, edi
jmp 0x40374f
test esi, esi
je 0x40374d
push esi
call fcn.00451fd9
pop ecx
xor eax, eax
pop edi
pop esi
leave
ret 4

Function at 0x404c10
Capabilities:
Set registry value

Disassembly:
mov edx, dword [esp + 4]
push 4
lea eax, [esp + 0xc]
push eax
mov eax, dword [ecx]
push 4
push 0
push edx
push eax
call dword [0x491010]
ret 8

Function at 0x404c30
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
push edi
mov edi, ecx
jne 0x404c46
push 0x80004005
call fcn.00404970
push esi
call dword [0x4913b4]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
lea eax, [eax + eax + 2]
push eax
mov eax, dword [edi]
push esi
push ecx
push 0
push edx
push eax
call dword [0x491010]
pop edi
pop esi
ret 0xc

Function at 0x404c70
Capabilities:
Set registry value

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0x10]
test ebp, ebp
mov dword [esp + 4], ecx
jne 0x404c88
push 0x80004005
call fcn.00404970
push ebx
mov ebx, dword [0x4913b4]
push esi
push edi
xor edi, edi
mov esi, ebp
push esi
call ebx
add eax, 1
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x404c95
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx]
push edi
push ebp
push 7
push 0
push eax
push edx
call dword [0x491010]
pop edi
pop esi
pop ebx
pop ebp
pop ecx
ret 8

Function at 0x4055a0
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x4ac13c]
xor eax, esp
mov dword [esp + 0x190], eax
push esi
mov esi, dword [esp + 0x19c]
push esi
call dword [0x4913a0]
cmp eax, 1
jne 0x4055ef
xor ecx, ecx
mov ch, byte [esp + 0x1a4]
lea eax, [esp + 4]
push eax
mov cl, byte [esp + 0x1a4]
push ecx
call dword [0x49162c]
push eax
add esi, 4
push esi
call dword [0x491394]
mov ecx, dword [esp + 0x194]
pop esi
xor ecx, esp
call fcn.0045b7a6
add esp, 0x194
ret
Function at 0x4061f0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 0x21c
mov eax, dword [0x4ac13c]
xor eax, esp
mov dword [esp + 0x218], eax
push ebp
push esi
push edi
mov edi, dword [esp + 0x22c]
mov ebp, ecx
mov eax, dword [ebp]
lea ecx, [esp + 0x14]
push ecx
push 0x2001f
push 0
push edi
push eax
mov dword [esp + 0x2c], edi
mov dword [esp + 0x20], 0
mov dword [esp + 0x28], 0
call dword [0x49100c]
mov ecx, dword [esp + 0xc]
mov esi, eax
test esi, esi
jne 0x40625e
test ecx, ecx
je 0x406250
push ecx
call dword [0x491004]
test eax, eax
mov ecx, dword [esp + 0x14]
mov esi, eax
mov dword [esp + 0xc], ecx
je 0x40626c
test ecx, ecx
je 0x406311
push ecx
jmp 0x40630b
mov esi, dword [0x491018]
lea edx, [esp + 0x1c]
push edx
push 0
push 0
push 0
lea eax, [esp + 0x20]
push eax
lea edx, [esp + 0x38]
push edx
push 0
push ecx
mov dword [esp + 0x30], pe_nt_image_headers32
call esi
test eax, eax
jne 0x4062de
jmp 0x4062a0
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x10]
call fcn.004061f0
mov edi, eax
test edi, edi
jne 0x40632d
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x10]
push eax
push eax
push eax
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x38]
push eax
push edi
push ecx
mov dword [esp + 0x30], pe_nt_image_headers32
call esi
test eax, eax
je 0x4062a0
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4062f5
push eax
call dword [0x491004]
mov dword [esp + 0xc], 0
mov edx, dword [ebp]
push edi
push edx
call dword [0x491024]
mov esi, eax
mov eax, dword [esp + 0xc]
test eax, eax
je 0x406311
push eax
call dword [0x491004]
mov eax, esi
mov ecx, dword [esp + 0x224]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.0045b7a6
add esp, 0x21c
ret 4
mov eax, dword [esp + 0xc]
test eax, eax
je 0x40633c
push eax
call dword [0x491004]
mov eax, edi
jmp 0x406313

Function at 0x406e40
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x48736b
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4ac13c]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0xc], edi
lea esi, [edi + 0xc]
mov dword [edi + 4], 0
mov ecx, esi
mov dword [edi], 0x492b28
call fcn.00426140
mov eax, dword [esp + 0x20]
mov dword [esi], 0x492a48
mov dword [esi + 4], 0x492a34
mov dword [esi + 8], 0x492a14
mov dword [esi + 0x30], 0x4929a0
mov dword [esi + 0x34], 0x492978
mov dword [esi + 0x38], 0x492958
mov dword [esi + 0x3c], 0x492928
mov dword [esi + 0x40], 0x492908
mov dword [esi + 0x44], eax
mov ecx, dword [0x4ae7ac]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
mov dword [esp + 0x18], 0
call eax
mov eax, edi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4