joyce8/EMBER2024-capa huggingface dataset:
Function at 0x472d50
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push 0xffffffffffffffff
push 0x575ddb
mov eax, dword fs:[0]
push eax
sub esp, 0xa5c
mov eax, dword [0x641030]
xor eax, esp
mov dword [esp + 0xa58], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x641030]
xor eax, esp
push eax
lea eax, [esp + 0xa70]
mov dword fs:[0], eax
mov eax, dword [esp + 0xa80]
mov ebx, dword [esp + 0xa88]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0xa94]
mov dword [esp + 0x18], eax
test eax, eax
jne 0x472db3
xor al, al
jmp 0x472f31
mov eax, dword [esp + 0xa90]
mov esi, 0x40
cmp eax, 3
je 0x472dc9
cmp eax, 2
jne 0x472dce
mov esi, 0x80
push eax
call fcn.004680e0
mov edi, dword [esp + 0xa90]
add esp, 4
cmp edi, esi
mov ebp, eax
jle 0x472e0d
mov edx, dword [esp + 0xa90]
lea ecx, [esp + 0x96c]
push ecx
push edx
push edi
push ebx
call fcn.00468330
add esp, 0x10
cmp ebp, esi
lea ebx, [esp + 0x96c]
mov edi, ebp
jle 0x472e0d
mov edi, esi
push esi
lea eax, [esp + 0x828]
push 0
push eax
call fcn.00554cc0
push esi
lea ecx, [esp + 0x8b8]
push 0
push ecx
call fcn.00554cc0
push edi
lea edx, [esp + 0x840]
push ebx
push edx
call fcn.00554d40
push edi
lea eax, [esp + 0x8d0]
push ebx
push eax
call fcn.00554d40
add esp, 0x30
xor eax, eax
test esi, esi
jle 0x472e75
jmp 0x472e60
xor byte [esp + eax + 0x824], 0x36
xor byte [esp + eax + 0x8a8], 0x5c
inc eax
cmp eax, esi
jl 0x472e60
lea ecx, [esp + 0x1c]
call fcn.00447910
mov edx, dword [esp + 0x14]
mov edi, dword [esp + 0xa90]
mov eax, dword [esp + 0xa84]
lea ecx, [esp + 0x824]
mov dword [esp + 0x20], ecx
lea ecx, [esp + 0x92c]
push ecx
mov dword [esp + 0x28], edx
lea edx, [esp + 0x20]
push edi
push edx
mov dword [esp + 0xa84], 0
mov dword [esp + 0x82c], 2
mov dword [esp + 0x42c], esi
mov dword [esp + 0x430], eax
call fcn.004681f0
push esi
lea eax, [esp + 0x8b8]
push eax
lea ecx, [esp + 0x9c0]
push ecx
call fcn.00554d40
push ebp
lea edx, [esp + 0x948]
push edx
lea eax, [esp + esi + 0x9cc]
push eax
call fcn.00554d40
mov ecx, dword [esp + 0x3c]
push ecx
push edi
add ebp, esi
lea edx, [esp + 0x9d8]
push ebp
push edx
call fcn.00468330
add esp, 0x34
lea ecx, [esp + 0x1c]
mov dword [esp + 0xa78], 0xffffffff
call fcn.00447930
mov al, 1
mov ecx, dword [esp + 0xa70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xa58]
xor ecx, esp
call fcn.005550b0
add esp, 0xa68
ret
Function at 0x472f60
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
sub esp, 0x254
mov eax, dword [0x641030]
xor eax, esp
mov dword [esp + 0x250], eax
mov eax, dword [esp + 0x258]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x268]
push ebx
mov ebx, dword [esp + 0x260]
mov dword [esp + 4], eax
test eax, eax
jne 0x472fae
xor al, al
pop ebx
mov ecx, dword [esp + 0x250]
xor ecx, esp
call fcn.005550b0
add esp, 0x254
ret
mov eax, dword [esp + 0x268]
push ebp
push esi
push edi
mov esi, 0x40
cmp eax, 3
je 0x472fc7
cmp eax, 2
jne 0x472fcc
mov esi, 0x80
push eax
call fcn.004680e0
mov edi, dword [esp + 0x274]
add esp, 4
cmp edi, esi
mov ebp, eax
jle 0x47300b
mov edx, dword [esp + 0x274]
lea ecx, [esp + 0x160]
push ecx
push edx
push edi
push ebx
call fcn.00468330
add esp, 0x10
cmp ebp, esi
lea ebx, [esp + 0x160]
mov edi, ebp
jle 0x47300b
mov edi, esi
push esi
lea eax, [esp + 0xa0]
push 0
push eax
call fcn.00554cc0
push esi
lea ecx, [esp + 0x28]
push 0
push ecx
call fcn.00554cc0
push edi
lea edx, [esp + 0xb8]
push ebx
push edx
call fcn.00554d40
push edi
lea eax, [esp + 0x40]
push ebx
push eax
call fcn.00554d40
add esp, 0x30
xor eax, eax
test esi, esi
jle 0x473062
lea esp, [esp]
xor byte [esp + eax + 0x9c], 0x36
xor byte [esp + eax + 0x18], 0x5c
inc eax
cmp eax, esi
jl 0x473050
mov eax, dword [esp + 0x14]
mov edi, dword [esp + 0x274]
lea edx, [esp + 0x120]
push edx
lea ecx, [esp + 0xa0]
push edi
push eax
mov dword [eax + 4], ecx
mov dword [eax + 0x404], esi
call fcn.004681f0
push esi
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x1b4]
push ecx
call fcn.00554d40
push ebp
lea edx, [esp + 0x13c]
push edx
lea eax, [esp + esi + 0x1c0]
push eax
call fcn.00554d40
mov ecx, dword [esp + 0x34]
push ecx
push edi
add ebp, esi
lea edx, [esp + 0x1cc]
push ebp
push edx
call fcn.00468330
mov ecx, dword [esp + 0x294]
add esp, 0x34
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
mov al, 1
call fcn.005550b0
add esp, 0x254
ret

Function at 0x473890
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x575e18
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
mov eax, dword [0x641030]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esp + 0x30]
push eax
lea ecx, [esp + 0x10]
call fcn.004f4060
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0x2c]
lea edx, [esp + 0x10]
push edx
push eax
push ecx
mov ecx, esi
mov dword [esp + 0x30], 0
call fcn.004735a0
lea ecx, [esp + 0xc]
mov bl, al
mov dword [esp + 0x20], 0xffffffff
call fcn.004f4080
mov al, bl
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x18
ret 0x10
Function at 0x474380
Capabilities:
Hash data using crc32b

Disassembly:
cmp byte [0x6437d8], 0
push edi
jne 0x47451d
mov al, byte [0x6437d9]
push esi
test al, al
jne 0x4744f3
cmp dword [0x6437dc], 0
jne 0x47451c
push 0x100
mov byte [0x6437d9], 1
call fcn.00414380
mov edi, eax
add esp, 4
test edi, edi
je 0x47451c
xor esi, esi
push ebx
lea ebx, [ebx]
push 8
push esi
call fcn.004740b0
shl eax, 0x18
mov ecx, eax
and eax, 0x80000000
add esp, 8
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
lea edx, [eax + eax]
xor ecx, edx
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
lea edx, [eax + eax]
and ecx, 0x4c11db7
xor ecx, edx
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
and eax, 0x4c11db7
add ecx, ecx
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
lea edx, [eax + eax]
and ecx, 0x4c11db7
xor ecx, edx
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
and eax, 0x4c11db7
add ecx, ecx
xor eax, ecx
mov edx, eax
and edx, 0x80000000
neg edx
sbb edx, edx
add eax, eax
and edx, 0x4c11db7
xor edx, eax
mov dword [edi + esi*4], edx
mov eax, edx
xor edx, edx
lea ecx, [edx + 0x1f]
test al, 1
je 0x4744a0
mov ebx, 1
shl ebx, cl
or edx, ebx
dec ecx
shr eax, 1
cmp ecx, 0xffffffff
jg 0x474493
mov dword [edi + esi*4], edx
inc esi
cmp esi, 0xff
jbe 0x4743d0
cmp dword [0x6437dc], 0
pop ebx
jne 0x4744d9
pop esi
mov dword [0x6437dc], edi
mov byte [0x6437d8], 1
mov byte [0x6437d9], 0
pop edi
ret
push edi
call fcn.00554bd9
add esp, 4
pop esi
mov byte [0x6437d8], 1
mov byte [0x6437d9], 0
pop edi
ret
xor esi, esi
test al, al
je 0x47451c
lea esp, [esp]
push 2
call fcn.004357f0
inc esi
add esp, 4
cmp esi, 0xc8
ja 0x47451c
cmp byte [0x6437d9], 0
jne 0x474500
pop esi
pop edi
ret
Function at 0x477420
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x57634c
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x641030]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
lea edi, [esi + 0x20]
mov dword [esi], vtable.HttpConnPool.1.0
mov dword [edi], vtable.HttpConnPool.0
push esi
lea ecx, [esp + 0x1c]
mov dword [esp + 0x30], 4
call fcn.00436260
lea ebp, [esi + 0x2c]
mov ecx, ebp
mov byte [esp + 0x2c], 5
call fcn.0044edb0
lea ebx, [esi + 0x48]
mov ecx, ebx
call fcn.0044edb0
lea ecx, [esp + 0x18]
mov byte [esp + 0x2c], 4
call fcn.00436290
lea ecx, [esi + 0x64]
mov byte [esp + 0x2c], 3
call fcn.0040e320
mov ecx, ebx
mov byte [esp + 0x2c], 2
call fcn.0044f1c0
mov ecx, ebp
mov byte [esp + 0x2c], 1
call fcn.0044f1c0
mov ecx, edi
mov byte [esp + 0x2c], 0
call fcn.00439400
mov ecx, esi
mov dword [esp + 0x2c], 0xffffffff
call fcn.004360f0
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x4778f0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x57d0a1
mov eax, dword fs:[0]
push eax
sub esp, 0x9c
mov eax, dword [0x641030]
xor eax, esp
mov dword [esp + 0x98], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x641030]
xor eax, esp
push eax
lea eax, [esp + 0xb0]
mov dword fs:[0], eax
mov ebx, dword [esp + 0xc0]
mov esi, dword [esp + 0xc4]
mov edi, dword [esp + 0xc8]
mov ebp, ecx
push ebp
lea ecx, [esp + 0x30]
mov dword [esp + 0x1c], ebx
call fcn.00436260
push str.closeConnectionForDomain
push edi
lea ecx, [esp + 0x28]
mov dword [esp + 0xc0], 0
call fcn.00437740
push ebx
push str.domain
mov ecx, edi
mov byte [esp + 0xc0], 1
call fcn.004370f0
add ebp, 0x2c
mov ecx, ebp
call fcn.00550cd0
lea ecx, [esp + 0x38]
mov ebx, eax
call fcn.0042d110
push edi
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x40]
push ecx
push 0
lea ecx, [esi + 0x354]
mov byte [esp + 0xc8], 2
call fcn.0042b890
xor esi, esi
test ebx, ebx
jle 0x477a92
mov edi, edi
push esi
mov ecx, ebp
call fcn.0044e910
mov dword [esp + 0x14], eax
test eax, eax
jne 0x4779df
push esi
mov ecx, ebp
call fcn.0044eb80
dec ebx
dec esi
jmp 0x477a72
cmp dword [eax + 0x590], 0x99b4002d
je 0x477a1d
mov edx, dword [edi]
mov eax, dword [edx + 0x14]
push str.Invalid_HTTP_connection_object_found.
mov ecx, edi
call eax
push 0x64
push str.calledFrom
mov ecx, edi
call fcn.004373b0
push 0
call fcn.0049ce60
add esp, 4
push esi
mov ecx, ebp
call fcn.0044eb80
dec ebx
dec esi
jmp 0x477a72
lea ecx, [esp + 0x38]
call fcn.0042bab0
mov ecx, dword [esp + 0x14]
test eax, eax
je 0x477a5f
call fcn.00454730
cmp eax, dword [esp + 0x1c]
jne 0x477a72
mov ecx, dword [esp + 0x14]
call fcn.00454720
push eax
lea ecx, [esp + 0x3c]
call fcn.0042f1d0
test al, al
je 0x477a72
push esi
mov ecx, ebp
call fcn.0044eb80
mov ecx, dword [esp + 0x14]
push ecx
jmp 0x477a8a
call fcn.00454720
mov ecx, dword [esp + 0x18]
push eax
call fcn.0042f1d0
test al, al
jne 0x477a7d
inc esi
cmp esi, ebx
jl 0x4779c0
jmp 0x477a92
push esi
mov ecx, ebp
call fcn.0044eb80
mov edx, dword [esp + 0x14]
push edx
call fcn.00439410
add esp, 4
lea ecx, [esp + 0x38]
mov byte [esp + 0xb8], 1
call fcn.0042d1d0
lea ecx, [esp + 0x20]
mov byte [esp + 0xb8], 0
call fcn.004377b0
lea ecx, [esp + 0x2c]
mov dword [esp + 0xb8], 0xffffffff
call fcn.00436290
mov ecx, dword [esp + 0xb0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x98]
xor ecx, esp
call fcn.005550b0
add esp, 0xa8
ret 0xc
Function at 0x478590
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x582ee8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x641030]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [esp + 0x3c]
mov ecx, edi
call fcn.0042c960
lea ecx, [esp + 0xc]
call fcn.00447240
lea eax, [esp + 0xc]
push eax
add esi, 0xf0
push 1
mov ecx, esi
mov dword [esp + 0x38], 0
call fcn.0042bab0
push eax
mov ecx, esi
call fcn.0051b3b0
mov esi, dword [esp + 0x44]
push eax
mov ecx, esi
call fcn.0042bab0
push eax
mov ecx, esi
call fcn.0051b3b0
push eax
call fcn.004731d0
add esp, 0x18
push edi
push str.base64
lea ecx, [esp + 0x14]
call fcn.0044be00
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0xffffffff
call fcn.004479b0
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x28
ret 8

Function at 0x47a3e0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x582a88
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x641030]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call fcn.004393f0
xor ebx, ebx
lea ecx, [esi + 0xc]
mov dword [esp + 0x18], ebx
mov dword [esi], vtable.MimeHeader.0
mov dword [esi + 8], ebx
call fcn.0044e8e0
mov byte [esi + 0x28], 1
mov dword [esi + 0x2c], vtable.MimeControl.0
mov byte [esi + 0x30], bl
mov byte [esi + 0x31], bl
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x47db90
Capabilities:
Hash data using djb2

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 8], 0x6119a407
je 0x47dbac
push 0
call fcn.0049ce60
add esp, 4
xor eax, eax
pop esi
ret 4
mov ecx, dword [esp + 8]
call fcn.0051b3b0
mov edx, eax
movsx ecx, byte [edx]
mov eax, 0x1505
test ecx, ecx
je 0x47dbd6
push edi
mov edi, eax
shl edi, 5
inc edx
add edi, ecx
movsx ecx, byte [edx]
add eax, edi
test ecx, ecx
jne 0x47dbc4
pop edi
xor edx, edx
div dword [esi + 0xc]
pop esi
mov eax, edx
ret 4
Function at 0x484eb0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x5775b3
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x641030]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
call fcn.004393f0
lea edi, [esi + 8]
xor ebx, ebx
mov ecx, edi
mov dword [esp + 0x20], ebx
mov dword [esi], vtable.ProgressMonitor.0
call fcn.0046b080
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x28]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x88], eax
mov eax, dword [esp + 0x38]
cmp eax, ebx
mov byte [esp + 0x20], 1
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebp
mov byte [esi + 0x68], bl
mov byte [esi + 0x69], bl
mov dword [esi + 0x80], ebx
mov dword [esi + 0x84], ebx
mov dword [esi + 0x8c], ecx
mov dword [esi + 0x90], ebx
mov byte [esi + 0x94], bl
mov byte [esi + 0x95], bl
mov byte [esi + 0x96], bl
jg 0x484f5b
jl 0x484f55
mov ecx, dword [esp + 0x34]
cmp ecx, ebx
jae 0x484f5f
xor ecx, ecx
xor eax, eax
jmp 0x484f5f
mov ecx, dword [esp + 0x34]
mov dword [esi + 0x78], ebx
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x70], ecx
mov dword [esi + 0x74], eax
call sub.KERNEL32.dll_GetTickCount
mov dword [esi + 0x6c], eax
mov eax, dword [esi + 0x8c]
cmp eax, 0xa
jae 0x484f8a
mov dword [esi + 0x8c], 0x64
jmp 0x484f9b
cmp eax, 0x186a0
jbe 0x484f9b
mov dword [esi + 0x8c], 0x186a0
cmp ebp, ebx
jne 0x484fa2
mov dword [esi + 0x64], edi
mov ecx, dword [esi + 0x64]
cmp ecx, ebx
je 0x484fb1
call fcn.0049cc20
mov byte [esi + 0x68], al
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0x14
Function at 0x488060
Capabilities:
Get socket status

Disassembly:
mov eax, ecx
mov ecx, dword [eax + 0xb08]
test ecx, ecx
je 0x488071
jmp fcn.00503740
cmp dword [eax + 0xb14], 2
jne 0x488085
lea ecx, [eax + 0x164]
jmp fcn.004f9170
lea ecx, [eax + 0x7b8]
jmp fcn.004ac360

Function at 0x48ea60
Capabilities:
Hash data with md5

Disassembly:
mov eax, ecx
xor ecx, ecx
mov dword [eax], vtable._ckMd5.0
mov dword [eax + 0x18], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 4], 0x67452301
mov dword [eax + 8], 0xefcdab89
mov dword [eax + 0xc], 0x98badcfe
mov dword [eax + 0x10], 0x10325476
ret

Function at 0x48ec40
Capabilities:
Hash data with md5

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0xc]
xor eax, eax
mov ecx, edi
mov dword [esi + 0x18], eax
mov dword [esi + 0x14], eax
mov dword [esi + 4], 0x67452301
mov dword [esi + 8], 0xefcdab89
mov dword [esi + 0xc], 0x98badcfe
mov dword [esi + 0x10], 0x10325476
call fcn.0042bab0
push eax
mov ecx, edi
call fcn.0051b3b0
push eax
mov ecx, esi
call fcn.0048eaa0
mov eax, dword [esp + 0x10]
push eax
mov ecx, esi
call fcn.0048eb70
pop edi
pop esi
ret 8

Function at 0x48eca0
Capabilities:
Hash data with md5

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esp + 8]
xor eax, eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x14], eax
mov eax, dword [esp + 0xc]
push eax
push ecx
mov ecx, esi
mov dword [esi + 4], 0x67452301
mov dword [esi + 8], 0xefcdab89
mov dword [esi + 0xc], 0x98badcfe
mov dword [esi + 0x10], 0x10325476
call fcn.0048eaa0
mov edx, dword [esp + 0x10]
push edx
mov ecx, esi
call fcn.0048eb70
pop esi
ret 0xc

Function at 0x48ecf0
Capabilities:
Hash data with md5

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
xor ebx, ebx
push esi
mov esi, ecx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 4], 0x67452301
mov dword [esi + 8], 0xefcdab89
mov dword [esi + 0xc], 0x98badcfe
mov dword [esi + 0x10], 0x10325476
cmp dword [ebp + 0x804], ebx
jbe 0x48ed4e
push edi
lea edi, [ebp + 4]
lea esp, [esp]
mov eax, dword [edi + 0x400]
mov ecx, dword [edi]
push eax
push ecx
mov ecx, esi
call fcn.0048eaa0
inc ebx
add edi, 4
cmp ebx, dword [ebp + 0x804]
jb 0x48ed30
pop edi
mov edx, dword [esp + 0x14]
push edx
mov ecx, esi
call fcn.0048eb70
pop esi
pop ebp
pop ebx
ret 8

Function at 0x48ed60
Capabilities:
Hash data with md5

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0xc]
xor eax, eax
mov ecx, edi
mov dword [esi + 0x18], eax
mov dword [esi + 0x14], eax
mov dword [esi + 4], 0x67452301
mov dword [esi + 8], 0xefcdab89
mov dword [esi + 0xc], 0x98badcfe
mov dword [esi + 0x10], 0x10325476
call fcn.0051d090
push eax
mov ecx, edi
call fcn.00446f60
push eax
mov ecx, esi
call fcn.0048eaa0
mov eax, dword [esp + 0x10]
push eax
mov ecx, esi
call fcn.0048eb70
pop edi
pop esi
ret 8
Function at 0x48edc0
Capabilities:
Hash data with md5

Disassembly:
sub esp, 8
push ebx
mov ebx, ecx
push esi
push edi
xor esi, esi
push 0x4e28
mov dword [ebx + 0x18], esi
mov dword [ebx + 0x14], esi
mov dword [ebx + 4], 0x67452301
mov dword [ebx + 8], 0xefcdab89
mov dword [ebx + 0xc], 0x98badcfe
mov dword [ebx + 0x10], 0x10325476
call fcn.004144e0
mov edi, eax
add esp, 4
cmp edi, esi
jne 0x48ee0a
pop edi
pop esi
xor al, al
pop ebx
add esp, 8
ret 0x14
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x10], esi
mov byte [esp + 0xf], 1
call fcn.004f3490
test al, al
jne 0x48eeae
push ebp
mov ebp, dword [esp + 0x20]
lea esp, [esp]
mov eax, dword [esp + 0x24]
push eax
push ebp
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x28]
push 0x4e20
push edi
call fcn.004f3f80
test al, al
je 0x48eead
mov esi, dword [esp + 0x14]
test esi, esi
je 0x48ee89
mov ecx, dword [esp + 0x2c]
test ecx, ecx
je 0x48ee69
push esi
push edi
call fcn.00448260
mov esi, dword [esp + 0x14]
push esi
push edi
mov ecx, ebx
call fcn.0048eaa0
test ebp, ebp
je 0x48ee89
mov edx, dword [esp + 0x24]
push edx
push 0
push esi
mov ecx, ebp
call fcn.004854e0
test al, al
jne 0x48ee98
mov ecx, dword [esp + 0x1c]
call fcn.004f3490
test al, al
je 0x48ee30
jmp 0x48eead
mov ecx, dword [esp + 0x24]
mov eax, dword [ecx]
mov edx, dword [eax + 0x14]
push str.Digest_MD5_aborted_by_application
call edx
mov byte [esp + 0x13], 0
pop ebp
push edi
call fcn.00554bd9
mov eax, dword [esp + 0x28]
add esp, 4
push eax
mov ecx, ebx
call fcn.0048eb70
mov al, byte [esp + 0xf]
pop edi
pop esi
pop ebx
add esp, 8
ret 0x14
Function at 0x492450
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x5789d8
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x641030]
xor eax, esp
mov dword [esp + 0x40], eax
push esi
push edi
mov eax, dword [0x641030]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
lea ecx, [esp + 0xc]
call fcn.0040d700
lea ecx, [esp + 0xc]
mov dword [esp + 0x58], 0
call fcn.0040db80
movzx eax, word [esp + 0x14]
cdq
mov ecx, 0x64
idiv ecx
mov ecx, 0xa
mov edi, 0xa
mov eax, edx
cdq
idiv ecx
mov esi, edx
cdq
idiv ecx
mov ecx, dword [str.0123456789]
movzx edx, byte [edx + ecx]
mov byte [esp + 0x2c], dl
movzx eax, byte [esi + ecx]
mov byte [esp + 0x2d], al
movzx eax, word [esp + 0x16]
cdq
mov esi, 0xa
idiv esi
mov esi, edx
cdq
idiv edi
movzx edx, byte [edx + ecx]
mov byte [esp + 0x2e], dl
movzx eax, byte [esi + ecx]
mov byte [esp + 0x2f], al
movzx eax, word [esp + 0x1a]
cdq
mov esi, edi
idiv esi
mov esi, edx
cdq
idiv edi
movzx edx, byte [edx + ecx]
mov byte [esp + 0x30], dl
movzx eax, byte [esi + ecx]
mov byte [esp + 0x31], al
movzx eax, word [esp + 0x1c]
cdq
mov esi, edi
idiv esi
mov esi, edx
cdq
idiv edi
movzx edx, byte [edx + ecx]
mov byte [esp + 0x32], dl
movzx eax, byte [esi + ecx]
mov byte [esp + 0x33], al
movzx eax, word [esp + 0x1e]
cdq
mov esi, edi
idiv esi
mov esi, edx
cdq
idiv edi
movzx edx, byte [edx + ecx]
mov byte [esp + 0x34], dl
movzx eax, byte [esi + ecx]
mov byte [esp + 0x35], al
movzx eax, word [esp + 0x20]
cdq
mov esi, edi
idiv esi
mov esi, edx
cdq
idiv edi
movzx edx, byte [edx + ecx]
mov byte [esp + 0x36], dl
movzx eax, byte [esi + ecx]
mov byte [esp + 0x37], al
mov byte [esp + 0x38], 0x5a
call fcn.00491410
mov esi, eax
test esi, esi
jne 0x492594
lea ecx, [esp + 0xc]
mov dword [esp + 0x58], 0xffffffff
call fcn.0040d6c0
xor eax, eax
jmp 0x4925ea
mov ecx, esi
call fcn.004127f0
mov byte [esi + 0x2d], 1
mov dword [esi + 0x30], 0x17
mov dword [esi + 0x34], 0xd
call fcn.0044add0
mov dword [esi + 0x3c], eax
test eax, eax
je 0x49257f
mov ecx, dword [esi + 0x34]
push ecx
mov ecx, eax
call fcn.0044b660
test al, al
je 0x49257f
mov ecx, dword [esi + 0x3c]
push 0xd
lea edx, [esp + 0x30]
push edx
call fcn.00448260
lea ecx, [esp + 0xc]
mov dword [esp + 0x58], 0xffffffff
call fcn.0040d6c0
mov eax, esi
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x40]
xor ecx, esp
call fcn.005550b0
add esp, 0x50
ret
push ebx
mov ebx, dword [esp + 8]
test ebx, ebx
jne 0x49261f
pop ebx
jmp 0x492450
push edi
push ebx
call fcn.004142c0
mov edi, eax
add esp, 4
cmp edi, 4
ja 0x492637
pop edi
pop ebx
jmp 0x492450
push esi
call fcn.00491410
mov esi, eax
test esi, esi
je 0x492673
mov ecx, esi
call fcn.004127f0
mov byte [esi + 0x2d], 1
mov dword [esi + 0x30], 0x17
mov dword [esi + 0x34], edi
call fcn.0044add0
mov dword [esi + 0x3c], eax
test eax, eax
je 0x492673
mov ecx, dword [esi + 0x34]
push ecx
mov ecx, eax
call fcn.0044b660
test al, al
jne 0x492679
pop esi
pop edi
xor eax, eax
pop ebx
ret
mov ecx, dword [esi + 0x3c]
push edi
push ebx
call fcn.00448260
mov eax, esi
pop esi
pop edi
pop ebx
ret