joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41e750
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a0270
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x629a40]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x30], edi
cmp dword [edi + 8], 0
je 0x41e7e8
cmp byte [edi + 1], 0
je 0x41e7e8
call fcn.0041fe70
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
nop dword [eax]
cmp esi, 0x14
jl 0x41e7ab
cmp byte [edi + 3], 0
je 0x41e7bb
cmp byte [edi + 2], 0
jne 0x41e7e8
push 0x1f4
inc esi
call ebx
jmp 0x41e7a0
cmp byte [edi + 2], 0
jne 0x41e7e8
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
push eax
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push dword [ebp - 0x2c]
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [edi + 8], 0
mov eax, dword [edi + 8]
test eax, eax
je 0x41e7f6
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ebx, [edi + 0x2c]
mov dword [edi + 8], 0
push ebx
mov dword [ebp - 0x2c], ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 4], 0
mov esi, dword [edi + 0xf8]
mov edi, dword [edi + 0xfc]
cmp esi, edi
je 0x41e8bd
push 0xffffffffffffffff
push 0
push esi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
call fcn.004076c0
mov ecx, dword [ebp - 0x30]
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
cmp dword [ebp - 0x14], 0x10
push 0
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.0041fb70
test eax, eax
jne 0x41e869
push 0x61db14
jmp 0x41e86e
push str.Exit
push 2
call fcn.00423900
mov byte [ebp - 4], 0
add esp, 8
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x41e8b2
mov ecx, dword [ebp - 0x28]
inc eax
cmp eax, 0x1000
jb 0x41e8a9
test cl, 0x1f
jne 0x41e8e0
mov eax, dword [ecx - 4]
cmp eax, ecx
jae 0x41e8e0
sub ecx, eax
cmp ecx, 4
jb 0x41e8e0
cmp ecx, 0x23
ja 0x41e8e0
mov ecx, eax
push ecx
call fcn.00572ac4
add esp, 4
add esi, 0x18
cmp esi, edi
jne 0x41e825
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00572ac9
mov esp, ebp
pop ebp
ret
call fcn.0057ef83
int3
Function at 0x422720
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59e726
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x629a40]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00572ada
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.00438944
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x422990
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a0828
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x629a40]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2c], ecx
call fcn.00437e30
test al, al
je 0x4229e1
xchg ecx, eax
cmp al, 0xd5
adc eax, 0x52aa435e
aad 0x15
pop esi
inc ebx
stosb byte es:[edi], al
push edx
xor eax, 0x3c4aae2c
pop eax
xor dword [ebp + 0x29], eax
jae 0x4229c9
push ds
mov al, 0x27
mov esi, 0xe8fdab2c
call fcn.00438140
pop edx
push edi
add dword [eax], eax
test al, al
je 0x422a00
adc bl, byte [eax - 0x63]
push ebx
jle 0x4229e2
mov edi, 0x61c3e5da
sbb eax, 0xdf55c0a5
inc ecx
cmp cl, byte [ebx - 0x172d4884]
pop ebx
push esi
add dword [eax], eax
call fcn.00438060
test al, al
je 0x422a21
aad 0x85
pop esi
pop ss
iretd
call fcn.00437b90
test al, al
je 0x422a44
rcl dword [eax]
and dword [edx + 0x61], esp
push edi
invalid
mov edx, str.18126659046756381259294368452525
lea ecx, [ebp - 0x28]
call fcn.00420ac0
mov dword [ebp - 4], 0
cmp dword [eax + 0x14], 8
jb 0x422a60
mov eax, dword [eax]
mov ecx, dword [ebp - 0x2c]
mov edx, eax
call fcn.0042c870
mov ecx, dword [ebp - 0x14]
mov bl, al
cmp ecx, 8
jb 0x422a81
inc ecx
push ecx
push dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
call fcn.004043b0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00572ac9
mov esp, ebp
pop ebp
ret
Function at 0x425880
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x629a40]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x62f77b], 0
push ebx
push esi
push edi
je 0x4258cd
call fcn.00438290
test al, al
je 0x4259a8
daa
jg 0x4258d4
out dx, al
sahf
sbb dword [edx - 0x14780519], 0xfffffff2
stosb byte es:[edi], al
ror byte [ecx + 0x37], 1
pop eax
or bl, bl
in eax, dx
imul byte [ebx + 0x626aca76]
jmp 0x4259a8
call fcn.00437e30
test al, al
je 0x4258e6
sub edi, ebp
inc esi
mov edx, 0xf78fe7d2
in al, dx
xchg edx, eax
daa
call 0xcaf4e41f
call fcn.00438140
test al, al
je 0x4258ff
mov ecx, dword [edx + 0x2388a57d]
cwde
jo 0x425935
jp 0x425964
and dword [edx - 0x2d], 0x58
test al, ch
sub al, 0x2c
add dword [eax], eax
call fcn.00438530
test al, al
je 0x42591d
sahf
test byte [eax + 0x31], al
pop eax
push ss
fistp qword [ecx]
push ds
invalid
push 0x208
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.00578b50
add esp, 0xc
lea eax, [ebp - 0x210]
push 1
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x42598d
test eax, esi
std
invalid
invalid
lea eax, [ebp - 0x210]
push eax
call fcn.005858a6
lea eax, [ebp - 0x210]
push 0x61da14
push eax
call fcn.00577d2d
add esp, 0xc
and edx, dword [0xcc48300]
test eax, eax
jne 0x425986
lea eax, [ebp - 0x210]
push str.documents_and_settingslocalservice
push eax
call fcn.00577d2d
add esp, 8
test eax, eax
je 0x42598d
mov byte [0x62f77b], 1
call fcn.00438450
test al, al
je 0x4259a8
out dx, al
mov cl, 0xc8
cmp eax, dword [edx]
push ebx
xchg ebx, eax
or ecx, ecx
sub ch, byte [eax - 0x6302d61e]
int 0xf5
jo 0x425934
mov ecx, dword [ebp - 4]
dec ebp
cld
mov al, byte [0x62f77b]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00572ac9
mov esp, ebp
pop ebp
ret
Function at 0x426bd0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a0b9b
mov eax, dword fs:[0]
push eax
sub esp, 0x140
mov eax, dword [0x629a40]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov al, byte [0x62f77c]
test al, al
jne 0x426d58
push 0x104
lea eax, [ebp - 0x118]
push 0
push eax
call fcn.00578b50
add esp, 0xc
lea eax, [ebp - 0x118]
push 1
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x426d53
push 0x14
push str.config_systemprofile
lea ecx, [ebp - 0x148]
mov dword [ebp - 0x134], 0xf
mov dword [ebp - 0x138], 0
mov byte [ebp - 0x148], 0
call fcn.004075c0
mov dword [ebp - 4], 0
cmp byte [ebp - 0x118], 0
mov dword [ebp - 0x11c], 0xf
mov dword [ebp - 0x120], 0
mov byte [ebp - 0x130], 0
jne 0x426c95
xor ecx, ecx
jmp 0x426ca9
lea ecx, [ebp - 0x118]
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x426ca0
sub ecx, edx
push ecx
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x130]
call fcn.004075c0
push dword [ebp - 0x138]
cmp dword [ebp - 0x134], 0x10
lea eax, [ebp - 0x148]
push 0
cmovae eax, dword [ebp - 0x148]
lea ecx, [ebp - 0x130]
push eax
call fcn.0040dbd0
movzx ecx, byte [0x62f77c]
cmp eax, 0xffffffff
mov eax, dword [ebp - 0x11c]
mov edx, 1
cmovne ecx, edx
mov byte [0x62f77c], cl
cmp eax, 0x10
jb 0x426d1a
inc eax
lea ecx, [ebp - 0x130]
push eax
push dword [ebp - 0x130]
call fcn.00407ab0
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0x11c], 0xf
mov dword [ebp - 0x120], 0
mov byte [ebp - 0x130], 0
cmp eax, 0x10
jb 0x426d53
inc eax
lea ecx, [ebp - 0x148]
push eax
push dword [ebp - 0x148]
call fcn.00407ab0
mov al, byte [0x62f77c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00572ac9
mov esp, ebp
pop ebp
ret
Function at 0x429470
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a0dc6
mov eax, dword fs:[0]
push eax
sub esp, 0x24c
mov eax, dword [0x629a40]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x258], edx
mov ebx, ecx
mov dword [ebp - 0x250], ebx
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 0x24c], 0
push 0
push eax
call fcn.00578b50
add esp, 0xc
call fcn.00437f80
test al, al
je 0x4294e5
pop ds
lahf
inc ebp
insd dword es:[edi], dx
mov ecx, 0x9fa90cf1
pop eax
push 0x64c7d44b
imul byte [eax + 4]
add dword [eax], eax
add byte [ebp - 0x2177b], cl
inc edi
test dword [ebp + edi*8 + 0xffff], ebp
add byte [eax], al
push 0x104
lea eax, [ebp - 0x218]
mov dword [ebp - 0x254], 0
push eax
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x429668
nop dword [eax]
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x218]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x42963f
call fcn.00437ce0
test al, al
je 0x429546
jg 0x4295b4
push esp
invalid
call fcn.00438220
add byte [eax], al
test al, al
je 0x42955f
int1
jg 0x42959b
lds esi, [edi + 0x87355bd]
fild dword [ebx]
insd dword es:[edi], dx
sub ah, byte [ecx]
dec esp
mov gs, eax
jl 0x429549
call fcn.00437ce0
add byte [eax], al
test al, al
je 0x429580
into
cmp byte [eax], ah
and byte [ecx - 0x2bd2676a], ch
loope 0x429573
inc edi
inc ecx
mov dh, ah
adc al, 0x62
inc eax
ror dword [eax + ecx*8 - 0x2c], cl
scasb al, byte es:[edi]
cmp cl, byte [ebp - 0x2177b]
call dword [eax - 0x73]
invalid
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.00403d10
lea edx, [ebp - 0x230]
mov dword [ebp - 4], 0
add byte [eax], al
add byte [eax], al
lea ecx, [ebp - 0x248]
call fcn.004298b0
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x21c]
cmp eax, 8
jb 0x4295cc
inc eax
lea ecx, [ebp - 0x230]
push eax
push dword [ebp - 0x230]
call fcn.004043b0
mov ecx, dword [ebp - 0x258]
lea edx, [ebp - 0x248]
xor eax, eax
mov dword [ebp - 0x21c], 7
cmp dword [ebp - 0x234], 0x10
mov dword [ebp - 0x220], 0
cmovae edx, dword [ebp - 0x248]
mov word [ebp - 0x230], ax
call fcn.00427790
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x234]
cmp eax, 0x10
jb 0x429639
inc eax
lea ecx, [ebp - 0x248]
push eax
push dword [ebp - 0x248]
call fcn.00407ab0
mov ebx, dword [ebp - 0x250]
mov eax, dword [ebp - 0x254]
lea ecx, [ebp - 0x218]
push 0x104
inc eax
push ecx
push eax
push ebx
mov dword [ebp - 0x254], eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x429510
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00572ac9
mov esp, ebp
pop ebp
ret
Function at 0x42a070
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a0e78
mov eax, dword fs:[0]
push eax
sub esp, 0xd4
mov eax, dword [0x629a40]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0xd8], eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 0xdc], 0
call fcn.004298b0
mov byte [ebp - 0x47], 0
mov dword [ebp - 0xbc], 0
mov dword [ebp - 0xc0], 0
mov dword [ebp - 0xd0], 0x67452301
mov dword [ebp - 0xcc], 0xefcdab89
mov dword [ebp - 0xc8], 0x98badcfe
mov dword [ebp - 0xc4], 0x10325476
cmp dword [eax + 0x14], 0x10
mov ecx, dword [eax + 0x10]
jb 0x42a109
mov eax, dword [eax]
push ecx
push eax
lea ecx, [ebp - 0xd0]
call fcn.00406610
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x42a12b
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00407ab0
call fcn.00437ce0
test al, al
je 0x42a14d
sahf
imul dword [ecx + 0x91953cb]
dec ebp
or eax, 0xb8031541
xchg edx, eax
out 0xdd, al
cmp dh, byte [esi - 0x176a1332]
movsd dword es:[edi], dword [esi]
dec esi
call fcn.00438450
test al, al
je 0x42a16d
ficom word [edi + edi*2 + 0x55c6786c]
stc
adc edx, dword [edi - 0x2fa3bbfa]
mov dh, 0x9d
invalid
call fcn.00437ce0
test al, al
je 0x42a18d
push ecx
xchg dword [0xba1497c1], esi
mov eax, 0xcc44abd9
pop ebx
inc eax
inc ebp
test dword [edi + esi*4], esi
dec edx
inc ah
invalid
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0xd0]
call fcn.004070c0
mov esi, dword [ebp - 0xd4]
mov edx, eax
mov ecx, esi
mov dword [ebp - 4], 0
call fcn.00429690
mov ecx, dword [ebp - 0x2c]
cmp ecx, 0x10
jb 0x42a1c7
inc ecx
push ecx
push dword [ebp - 0x40]
lea ecx, [ebp - 0x40]
call fcn.00407ab0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00572ac9
mov esp, ebp
pop ebp
ret
Function at 0x42bb00
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
mov eax, edx
mov dword [ebp - 0x1c], ecx
mov ebx, eax
mov dword [ebp - 0x14], eax
push esi
push edi
lea esi, [ebx + 2]
mov ax, word [ebx]
add ebx, 2
test ax, ax
jne 0x42bb16
sub ebx, esi
lea edx, [ecx + 2]
sar ebx, 1
mov dword [ebp - 0x20], ebx
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x42bb30
sub ecx, edx
mov dword [ebp - 4], 0
sar ecx, 1
mov edi, 1
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], edi
test ebx, ebx
jle 0x42bc9b
nop dword [eax]
call fcn.00437ce0
test al, al
je 0x42bb82
add byte [eax + eax*8 + 0x7f321974], al
fucompp
xchg ecx, eax
mov ebx, 0x445d33db
int3
xor bh, byte [edi - 0x26]
jmp 0x341e7702
call fcn.00438450
test al, al
je 0x42bba2
nop
or bl, byte [edx - 0x18]
invalid
call fcn.00437ce0
test al, al
je 0x42bbc2
notrack call 0xb0680966
push es
push ecx
dec esi
adc dword [ebx + 0x4c], edi
xor al, 0xa3
push 0x1a
adc ecx, 0x69
cwde
je 0x42bb64
cmpsb byte [esi], byte es:[edi]
cmp dword [ebp - 0xc], 0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 8], 0
movzx eax, word [ecx + eax*2]
mov dword [ebp - 0x18], eax
jle 0x42bc68
mov cs, word [eax - 0x18000000]
pop ebx
mov esi, 0xc0840000
call fcn.00437a40
test al, al
je 0x42bc08
bnd ja 0x42bbdb
add dword [eax - 6], esi
wait
fld qword [edx]
dec edi
cwde
push eax
shl dword [0x7212e4eb], cl
pop esi
mov byte [0xe809172c], al
int1
dec edx
and ah, byte [eax + ebx*2 - 0x4c170ddd]
rol dword [eax], 0
call fcn.00437dc0
test al, al
je 0x42bc2d
mov ebp, 0x391e4112
mov edi, 0xe7a1ba
invalid
call fcn.00437ea0
test al, al
je 0x42bc4c
test eax, 0x38580f3e
jecxz 0x42bcb9
sub eax, 0x78e02e93
jg 0x42bbef
cmp ebp, ebx
bound esp, qword [ecx - 0x74f1f095]
pop ebp
clc
mov ebx, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
cmp word [ecx + ebx*2], ax
je 0x42bc88
inc ebx
mov dword [ebp - 8], ebx
cmp ebx, dword [ebp - 0xc]
jl 0x42bbe0
call fcn.00437f80
test al, al
je 0x42bc81
test al, 0x79
add bl, byte [edx - 0x6c]
or al, 0x3f
pop eax
mov al, 0x4e
xchg esp, eax
sub al, 0xae
test dword [esi - 0x23], ecx
xor edi, edi
mov dword [ebp - 0x10], edi
jmp 0x42bc8b
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 4]
inc esi
mov dword [ebp - 4], esi
cmp esi, dword [ebp - 0x20]
jl 0x42bb60
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
add byte [ecx], ah
add byte [eax], al
add byte [eax - 0x7f], dl
in al, dx
mov ah, 0
add byte [eax], al
Function at 0x42bcb0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a1020
mov eax, dword fs:[0]
push eax
sub esp, 0xb4
mov eax, dword [0x629a40]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0xc0], 0
mov dword [ebp - 4], 0
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp - 0xb4]
push dword [ebp + 0x18]
invalid
cmovae eax, dword [ebp + 8]
push eax
mov byte [ebp - 0x2b], 0
mov dword [ebp - 0xa0], 0
mov dword [ebp - 0xa4], 0
mov dword [ebp - 0xb4], 0x67452301
inc dword [eax]
add byte [eax], al
add bh, al
test dword [edi + edi*8 - 1], ebx
inc dword [eax]
add byte [eax], al
add bh, al
test dword [edi + edi*8 - 1], ecx
inc dword [ecx]
and eax, dword [ebp + 0x67]
mov dword [ebp - 0xb0], 0xefcdab89
mov dword [ebp - 0xac], 0x98badcfe
mov dword [ebp - 0xa8], 0x10325476
call fcn.00406610
call fcn.00437a40
test al, al
je 0x42bd7f
invalid
adc ebp, dword [eax + edx*8 - 0x7f]
jns 0x42bd09
cmpsb byte [esi], byte es:[edi]
or byte [0x172fdf84], 0x56
or eax, 0x172fdf84
push esi
loope 0x42bd0d
jge 0x42bd1b
jne 0x42bd7e
or eax, 0x6e9f1365
cmpsb byte [esi], byte es:[edi]
jmp 0x42bd9d
jl 0x42bd68
call fcn.00437dc0
cmp al, 0xc0
add byte [eax], al
test al, al
je 0x42bda4
mov dh, 0x6d
jne 0x42bd4c
fstp xword [ebx + 0x14f86807]
imul ebp, dword [eax - 0x25ead4a6], 0xffffffbf
or byte [eax - 0x1c7fbf9e], dh
bound esi, qword [edx - 0x817e290]
rol byte [eax], 0
and bl, 0x62
mov ah, 0x62
jo 0x42bdc1
call fcn.00437ea0
test al, al
je 0x42bdc3
push eax
ret
out 0xf7, eax
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0xb4]
call fcn.004070c0
mov esi, dword [ebp - 0xb8]
mov edx, eax
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.00429690
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x42bdfa
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00407ab0
mov ecx, dword [ebp + 0x1c]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
cmp ecx, 0x10
jb 0x42be21
inc ecx
push ecx
push dword [ebp + 8]
lea ecx, [ebp + 8]
call fcn.00407ab0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00572ac9
mov esp, ebp
pop ebp
ret
Function at 0x42be40
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a1058
mov eax, dword fs:[0]
push eax
sub esp, 0x9c
mov eax, dword [0x629a40]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0xa4], edi
mov dword [ebp - 0xa8], 0
mov dword [ebp - 4], 0
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp - 0xa0]
push dword [ebp + 0x18]
cmovae eax, dword [ebp + 8]
push eax
mov byte [ebp - 0x17], 0
mov dword [ebp - 0x8c], 0
mov dword [ebp - 0x90], 0
mov dword [ebp - 0xa0], 0x67452301
mov dword [ebp - 0x9c], 0xefcdab89
mov dword [ebp - 0x98], 0x98badcfe
mov dword [ebp - 0x94], 0x10325476
call fcn.00406610
call fcn.00437e30
test al, al
je 0x42bf01
fist word [ecx + 0x16]
mov edi, 0xd99f6663
jle 0x42bf41
xchg edx, eax
push eax
pop es
mov byte [0x986fd882], al
jmp 0x42bf10
push edi
lea ecx, [ebp - 0xa0]
call fcn.004070c0
mov ecx, dword [ebp + 0x1c]
cmp ecx, 0x10
jb 0x42bf22
inc ecx
push ecx
push dword [ebp + 8]
lea ecx, [ebp + 8]
call fcn.00407ab0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00572ac9
mov esp, ebp
pop ebp
ret

Function at 0x42bf40
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xbc
mov eax, dword [0x629a40]
xor eax, esp
mov dword [esp + 0xb8], eax
push esi
mov esi, ecx
mov dword [esp + 0xc], 0
lea ecx, [esp + 0x10]
mov dword [esp + 8], esi
call fcn.004298b0
mov byte [esp + 0xb1], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x28], 0x67452301
mov dword [esp + 0x2c], 0xefcdab89
mov dword [esp + 0x30], 0x98badcfe
mov dword [esp + 0x34], 0x10325476
cmp dword [eax + 0x14], 0x10
mov ecx, dword [eax + 0x10]
jb 0x42bfb5
mov eax, dword [eax]
push ecx
push eax
lea ecx, [esp + 0x30]
call fcn.00406610
mov eax, dword [esp + 0x24]
cmp eax, 0x10
jb 0x42bfd8
inc eax
lea ecx, [esp + 0x10]
push eax
push dword [esp + 0x14]
call fcn.00407ab0
push esi
lea ecx, [esp + 0x2c]
call fcn.004070c0
mov ecx, dword [esp + 0xbc]
mov eax, esi
pop esi
xor ecx, esp
call fcn.00572ac9
mov esp, ebp
pop ebp
ret
Function at 0x42bf41
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xbc
mov eax, dword [0x629a40]
xor eax, esp
mov dword [esp + 0xb8], eax
push esi
mov esi, ecx
mov dword [esp + 0xc], 0
lea ecx, [esp + 0x10]
mov dword [esp + 8], esi
call fcn.004298b0
mov byte [esp + 0xb1], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x28], 0x67452301
mov dword [esp + 0x2c], 0xefcdab89
mov dword [esp + 0x30], 0x98badcfe
mov dword [esp + 0x34], 0x10325476
cmp dword [eax + 0x14], 0x10
mov ecx, dword [eax + 0x10]
jb 0x42bfb5
mov eax, dword [eax]
push ecx
push eax
lea ecx, [esp + 0x30]
call fcn.00406610
mov eax, dword [esp + 0x24]
cmp eax, 0x10
jb 0x42bfd8
inc eax
lea ecx, [esp + 0x10]
push eax
push dword [esp + 0x14]
call fcn.00407ab0
push esi
lea ecx, [esp + 0x2c]
call fcn.004070c0
mov ecx, dword [esp + 0xbc]
mov eax, esi
pop esi
xor ecx, esp
call fcn.00572ac9
mov esp, ebp
pop ebp
ret

Function at 0x42c000
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a1088
mov eax, dword fs:[0]
push eax
sub esp, 0xcc
mov eax, dword [0x629a40]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0xd4], eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 0xd8], 0
call fcn.004298b0
mov byte [ebp - 0x43], 0
mov dword [ebp - 0xb8], 0
mov dword [ebp - 0xbc], 0
mov dword [ebp - 0xcc], 0x67452301
mov dword [ebp - 0xc8], 0xefcdab89
mov dword [ebp - 0xc4], 0x98badcfe
mov dword [ebp - 0xc0], 0x10325476
cmp dword [eax + 0x14], 0x10
mov ecx, dword [eax + 0x10]
jb 0x42c099
mov eax, dword [eax]
push ecx
push eax
lea ecx, [ebp - 0xcc]
call fcn.00406610
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x42c0bb
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00407ab0
call fcn.00437ce0
test al, al
je 0x42c0dd
mov bl, bh
mov edx, dword [0xa90794b3]
xchg esp, eax
add edx, dword [edx + 0x604e2eab]
in al, dx
push esi
pop ebx
jo 0x42c0f6
scasd eax, dword es:[edi]
ja 0x42c0fe
jnp 0x42c0c6
call fcn.00438450
test al, al
je 0x42c0fd
outsb dx, byte [esi]
ret
add byte [eax + eax*8 + 0x5a2d1774], al
inc ecx
invalid
sub eax, 0x31fe415a
test al, 0xa8
inc ebx
mov esp, 0x6c1c4375
sbb eax, 0x36d8bf1b
fdiv dword [esi]
jmp 0x42c0e1
call fcn.00437ce0
test al, al
fidivr word [ebx - 0x3f7c0000]
je 0x42c11d
vfnmsub231ss xmm3, xmm6, xmm7, {rz-sae}
mov bh, 0x2f
sbb eax, 0x1d7d7dc
mov edi, 0xf2b4cf4c
lcall 0x458d, 0xd8b9cf96
rcl byte [eax - 0x73], 0x8d
xor al, 0xff
invalid
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0xcc]
call fcn.004070c0
mov esi, dword [ebp - 0xd0]
mov edx, eax
mov ecx, esi
mov dword [ebp - 4], 0
call fcn.00429690
mov ecx, dword [ebp - 0x2c]
cmp ecx, 0x10
jb 0x42c157
inc ecx
push ecx
push dword [ebp - 0x40]
lea ecx, [ebp - 0x40]
call fcn.00407ab0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00572ac9
mov esp, ebp
pop ebp
ret