joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408f60
Capabilities:
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x46babb
mov eax, dword fs:[0]
push eax
sub esp, 0x264
mov eax, dword [0x489ec0]
xor eax, esp
mov dword [esp + 0x260], eax
push ebx
push esi
push edi
mov eax, dword [0x489ec0]
xor eax, esp
push eax
lea eax, [esp + 0x274]
mov dword fs:[0], eax
mov edi, dword [esp + 0x284]
push 0x7d0
mov esi, ecx
xor ebx, ebx
call dword [0x46f090]
push 0x44
lea eax, [esp + 0x28]
push ebx
push eax
call fcn.0044e890
xor eax, eax
push edi
lea ecx, [esi + 0x18]
push ecx
lea edx, [esp + 0x24]
push edx
mov dword [esp + 0x3c], 0x44
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
call fcn.004066b0
add esp, 0x18
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx - 0xc]
cmp eax, 0x104
mov dword [esp + 0x27c], ebx
jl 0x40902c
lea eax, [ecx - 0x10]
mov dword [esp + 0x27c], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409025
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
jmp 0x4090f1
push ecx
push str.__s___S
lea ecx, [esp + 0x70]
push 0x104
push ecx
call fcn.0044f022
add esi, 0x3c
push esi
call fcn.00416f90
add esp, 0x14
lea edi, [esp + 0x10]
call fcn.00408ea0
test al, al
jne 0x409061
mov ebx, 0x80040078
jmp 0x4090c4
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x28]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea ecx, [esp + 0x88]
push ecx
push ebx
call dword [0x46f0e4]
test eax, eax
jne 0x4090a0
call dword [0x46f07c]
cmp eax, ebx
jg 0x409092
mov ebx, eax
jmp 0x4090c4
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
jmp 0x4090c4
mov edx, dword [esp + 0x14]
push 0x493e0
push edx
call dword [0x46f14c]
mov eax, dword [esp + 0x14]
mov esi, dword [0x46f184]
push eax
call esi
mov ecx, dword [esp + 0x18]
push ecx
call esi
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov dword [esp + 0x27c], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4090ef
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, ebx
mov ecx, dword [esp + 0x274]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x260]
xor ecx, esp
call fcn.0044e030
add esp, 0x270
ret 4
Function at 0x4095a0
Capabilities:
Enumerate process modules

Disassembly:
push 0xffffffffffffffff
push 0x46bb5b
mov eax, dword fs:[0]
push eax
mov eax, 0x1224
call fcn.0044e650
mov eax, dword [0x489ec0]
xor eax, esp
mov dword [esp + 0x1220], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x489ec0]
xor eax, esp
push eax
lea eax, [esp + 0x1238]
mov dword fs:[0], eax
mov eax, dword [esp + 0x1248]
mov ebp, dword [esp + 0x124c]
push eax
push 0
push 0x410
mov ebx, ecx
mov byte [esp + 0x23], 0
call dword [0x46f0f0]
mov esi, eax
test esi, esi
jne 0x40960f
xor al, al
jmp 0x409700
lea ecx, [esp + 0x1c]
push ecx
push 0x1000
lea edx, [esp + 0x34]
push edx
push esi
call fcn.0046b3ee
test eax, eax
je 0x4096f5
xor edi, edi
test dword [esp + 0x1c], 0xfffffffc
jbe 0x4096f5
lea esp, [esp]
mov ecx, dword [esp + edi*4 + 0x2c]
push 0x104
lea eax, [esp + 0x1030]
push eax
push ecx
push esi
call fcn.0046b3e8
test eax, eax
je 0x409674
mov eax, dword [ebp]
lea edx, [esp + 0x102c]
push edx
push eax
call fcn.0044ee22
add esp, 8
test eax, eax
je 0x409682
mov eax, dword [esp + 0x1c]
inc edi
shr eax, 2
cmp edi, eax
jb 0x409640
jmp 0x4096f5
push 0x104
lea ecx, [esp + 0x1030]
push ecx
push 0
push esi
call fcn.0046b3e8
lea edx, [esp + 0x102c]
push edx
lea ecx, [esp + 0x1c]
call fcn.00408550
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x24]
push ecx
lea ecx, [ebx + 0x40]
mov dword [esp + 0x1248], 0
call fcn.00407e90
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov dword [esp + 0x1240], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4096f0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x17], 1
push esi
call dword [0x46f184]
mov al, byte [esp + 0x17]
mov ecx, dword [esp + 0x1238]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1220]
xor ecx, esp
call fcn.0044e030
add esp, 0x1230
ret 8

Function at 0x409d20
Capabilities:
Enumerate process modules

Disassembly:
mov eax, 0x1008
call fcn.0044e650
push ebx
lea eax, [esp + 8]
push eax
mov ebx, ecx
push 0x1000
lea ecx, [esp + 0x14]
push ecx
mov byte [esp + 0x13], 0
call fcn.0046b3f4
test eax, eax
jne 0x409d56
xor al, al
pop ebx
add esp, 0x1008
ret 4
push esi
push edi
mov edi, dword [esp + 0x10]
shr edi, 2
xor esi, esi
test edi, edi
jbe 0x409d9c
push ebp
mov ebp, dword [esp + 0x101c]
lea ecx, [ecx]
mov eax, dword [esp + esi*4 + 0x18]
test eax, eax
je 0x409d96
push ebp
push eax
mov ecx, ebx
call fcn.004095a0
test al, al
je 0x409d96
call dword [0x46f0f4]
cmp dword [esp + esi*4 + 0x18], eax
jne 0x409d96
mov byte [esp + 0x13], 1
inc esi
cmp esi, edi
jb 0x409d70
pop ebp
mov al, byte [esp + 0xf]
pop edi
pop esi
pop ebx
add esp, 0x1008
ret 4
Function at 0x40d6f0
Capabilities:
Query or enumerate registry value

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x14]
mov eax, dword [edi]
add eax, eax
lea edx, [esp + 0x14]
push edx
mov edx, dword [esp + 0x10]
push esi
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x18]
push eax
push 0
mov dword [edi], 0
mov eax, dword [ecx]
push edx
push eax
call dword [0x46f030]
test eax, eax
jne 0x40d766
mov eax, dword [esp + 0x10]
cmp eax, 1
je 0x40d735
cmp eax, 2
jne 0x40d751
mov eax, dword [esp + 0x14]
test esi, esi
je 0x40d760
test eax, eax
je 0x40d75b
test al, 1
jne 0x40d751
mov ecx, eax
shr ecx, 1
cmp word [esi + ecx*2 - 2], 0
je 0x40d760
pop edi
mov eax, 0xd
pop esi
ret 0xc
xor edx, edx
mov word [esi], dx
shr eax, 1
mov dword [edi], eax
xor eax, eax
pop edi
pop esi
ret 0xc

Function at 0x40e2d0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x46bff4
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x489ec0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
mov eax, dword [edi]
sub eax, 0x10
push eax
call fcn.004051c0
add eax, 0x10
mov dword [esi], eax
mov eax, dword [edi + 4]
sub eax, 0x10
push eax
mov dword [esp + 0x20], 0
call fcn.004051c0
add eax, 0x10
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0xc], ecx
mov eax, dword [edi + 0x10]
sub eax, 0x10
push eax
mov byte [esp + 0x24], 1
call fcn.004051c0
add eax, 0x10
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x14]
sub eax, 0x10
push eax
mov byte [esp + 0x28], 2
call fcn.004051c0
add eax, 0x10
mov dword [esi + 0x14], eax
mov eax, dword [edi + 0x18]
sub eax, 0x10
push eax
mov byte [esp + 0x2c], 3
call fcn.004051c0
add eax, 0x10
mov dword [esi + 0x18], eax
mov edi, dword [edi + 0x1c]
sub edi, 0x10
push edi
mov byte [esp + 0x30], 4
call fcn.004051c0
add esp, 0x18
add eax, 0x10
mov dword [esi + 0x1c], eax
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x4105a0
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x46c2e3
mov eax, dword fs:[0]
push eax
sub esp, 0x128
mov eax, dword [0x489ec0]
xor eax, esp
mov dword [esp + 0x124], eax
push ebp
push esi
push edi
mov eax, dword [0x489ec0]
xor eax, esp
push eax
lea eax, [esp + 0x138]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x14c]
mov eax, dword [esp + 0x148]
push 0x46ff44
push eax
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x14c], 0
mov dword [esp + 0x1c], 0
call fcn.0044f7be
add esp, 0xc
test eax, eax
jne 0x410651
mov ecx, dword [esp + 0x10]
push 2
push eax
push ecx
call fcn.0044fd63
mov edx, dword [esp + 0x1c]
push edx
call fcn.0044fc6b
push 0
mov edi, eax
mov eax, dword [esp + 0x24]
push 0
push eax
call fcn.0044fd63
add esp, 0x1c
cmp edi, 0x100000
jl 0x410686
mov ecx, dword [esp + 0x10]
push ecx
call fcn.0044f665
add esp, 4
mov eax, dword [esp + 0x148]
add eax, 0xfffffff0
mov dword [esp + 0x140], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41067f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
jmp 0x41074d
lea ecx, [edi + 0xa]
push ecx
call fcn.0044e10b
mov edx, dword [esp + 0x14]
push edx
push edi
mov esi, eax
push 1
push esi
call fcn.0044fab1
mov eax, dword [esp + 0x24]
push eax
call fcn.0044f665
add esp, 0x18
lea ecx, [esp + 0x11c]
call fcn.00414b30
lea ecx, [esp + 0x14]
push ecx
push esi
push edi
push esi
lea ecx, [esp + 0x12c]
call fcn.00414c30
mov edx, dword [esp + 0x14]
push 3
lea eax, [esp + 0x20]
push esi
lea ecx, [esp + 0x20]
mov byte [edx + esi], 0
mov dword [esp + 0x20], eax
call fcn.0040d960
mov ecx, dword [esp + 0x18]
push ecx
mov ecx, ebp
mov byte [esp + 0x144], 1
call fcn.00407e50
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x1c]
cmp eax, edx
je 0x410711
push eax
call fcn.0044e1d5
add esp, 4
push esi
call fcn.0044e1d5
mov eax, dword [esp + 0x14c]
add eax, 0xfffffff0
add esp, 4
mov dword [esp + 0x140], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x410748
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x138]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x124]
xor ecx, esp
call fcn.0044e030
add esp, 0x134
ret 8
Function at 0x417070
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x46cd38
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
push edi
mov eax, dword [0x489ec0]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x3c]
mov edx, dword [esi]
mov ecx, dword [edx - 0xc]
xor edi, edi
cmp ecx, edi
je 0x417141
lea eax, [ecx - 1]
cmp eax, edi
jl 0x417155
cmp eax, ecx
jg 0x417155
movzx ecx, word [edx + eax*2]
cmp cx, 0x5c
jne 0x417106
push eax
lea eax, [esp + 0x40]
push eax
mov ecx, esi
call fcn.0040e190
push eax
mov ecx, esi
mov dword [esp + 0x38], edi
call fcn.004068e0
mov eax, dword [esp + 0x3c]
add eax, 0xfffffff0
mov dword [esp + 0x34], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x417106
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push edi
mov ecx, esi
call fcn.004160d0
mov edx, dword [esi]
lea eax, [esp + 0xc]
mov ecx, 0x14
push eax
mov word [esp + 0x20], cx
mov dword [esp + 0x26], edi
mov dword [esp + 0x10], edi
mov dword [esp + 0x2a], edi
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], 3
call dword [0x46f310]
mov al, 1
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x2c
ret
push 0x80070057
call fcn.00401210
int3

Function at 0x417160
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x46cd70
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x489ec0]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx - 0xc]
lea eax, [edx - 1]
mov dword [esp + 0x10], 0
test eax, eax
jl 0x417260
cmp eax, edx
jg 0x417260
movzx eax, word [ecx + eax*2]
cmp ax, 0x5c
je 0x41720f
push 0x5c
push ecx
call fcn.00450155
add esp, 8
test eax, eax
jne 0x4171c1
or eax, 0xffffffff
jmp 0x4171c7
sub eax, dword [esp + 0x18]
sar eax, 1
inc eax
push eax
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x20]
call fcn.0040e190
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x14], 1
call fcn.004068e0
mov eax, dword [esp + 4]
add eax, 0xfffffff0
mov byte [esp + 0x10], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41720b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x18]
push ecx
call dword [0x46f320]
test eax, eax
jne 0x417226
mov ecx, dword [esp + 0x18]
push ecx
push eax
call dword [0x46f308]
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov dword [esp + 0x10], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41724e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov al, 1
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
add esp, 0x10
ret
push 0x80070057
call fcn.00401210
int3
Function at 0x41a060
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x46cfd9
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x489ec0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x30]
xor esi, esi
mov dword [esp + 0x18], esi
lea edi, [ebp + 4]
xor eax, eax
mov dword [ebp + 0x18], 7
mov dword [ebp + 0x14], esi
mov dword [esp + 0x1c], ebp
mov word [edi], ax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x28], esi
mov dword [esp + 0x18], 1
mov ebx, eax
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x41a0c0
sub eax, edx
mov esi, dword [ebp + 0x14]
sar eax, 1
mov ecx, eax
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
lea eax, [ecx + eax + 7]
cmp esi, eax
ja 0x41a111
cmp dword [ebp + 0x18], eax
je 0x41a111
push 1
push eax
mov ecx, ebp
call fcn.00404130
test al, al
je 0x41a111
cmp dword [ebp + 0x18], 8
mov dword [ebp + 0x14], esi
jb 0x41a10b
mov edi, dword [edi]
xor ecx, ecx
mov word [edi + esi*2], cx
movzx eax, word [ebx]
test ax, ax
je 0x41a22b
mov esi, dword [esp + 0x38]
and esi, 0x100
mov dword [esp + 0x14], esi
test esi, esi
je 0x41a148
lea edx, [eax - 0x22]
cmp dx, 0x1c
ja 0x41a211
movzx ecx, ax
movsx edi, byte [ecx + 0x47499e]
jmp 0x41a15f
lea edx, [eax - 0x26]
cmp dx, 0x18
ja 0x41a211
movzx ecx, ax
movsx edi, byte [ecx + 0x47497e]
test edi, edi
je 0x41a211
test byte [esp + 0x38], 8
je 0x41a1e7
cmp ax, 0x26
jne 0x41a1e7
movzx eax, word [ebx + 2]
lea esi, [ebx + 2]
lea edx, [eax - 0x23]
cmp dx, 0x57
ja 0x41a192
movzx ecx, ax
movsx ecx, byte [ecx + 0x474925]
test ecx, ecx
jne 0x41a198
cmp ax, 0x7f
jbe 0x41a1e7
movzx eax, word [esi + 2]
add esi, 2
cmp ax, 0x3b
je 0x41a1cf
lea edx, [eax - 0x2d]
cmp dx, 0x4d
ja 0x41a1bc
movzx ecx, ax
movsx ecx, byte [ecx + 0x4748cb]
test ecx, ecx
jne 0x41a1c2
cmp ax, 0x7f
jbe 0x41a1e7
movzx eax, word [esi + 2]
add esi, 2
cmp ax, 0x3b
jne 0x41a1a5
mov eax, esi
sub eax, ebx
sar eax, 1
inc eax
push eax
push ebx
mov ecx, ebp
call fcn.004048c0
mov ebx, esi
mov esi, dword [esp + 0x14]
jmp 0x41a21b
mov edx, dword [edi*4 + 0x489190]
mov eax, edx
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41a1f3
sub eax, esi
sar eax, 1
push eax
push edx
mov ecx, ebp
call fcn.004048c0
mov esi, dword [esp + 0x14]
jmp 0x41a21b
push 1
push ebx
mov ecx, ebp
call fcn.004048c0
movzx eax, word [ebx + 2]
add ebx, 2
test ax, ax
jne 0x41a12b
mov eax, ebp
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x41b4d0
Capabilities:
Write file on windows

Disassembly:
mov edx, dword [esp + 4]
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, ecx
mov eax, dword [esi + 0x1c]
mov ecx, dword [esi + 0x18]
imul ecx, eax
push edi
mov dword [esi + 8], ecx
test ebp, ebp
jne 0x41b4f0
mov ebp, edx
mov ecx, dword [esi + 4]
xor edi, edi
test cl, cl
jns 0x41b566
test edx, edx
jne 0x41b529
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0044cdb6
mov edi, eax
mov eax, dword [esi + 0x1c]
add eax, eax
push eax
push ebp
push edi
call fcn.0044fdf0
add esp, 0x10
mov edx, edi
mov ebp, edi
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x41b542
movzx ecx, word [edx + eax*2 - 2]
dec eax
rol cx, 8
mov word [edx + eax*2], cx
test eax, eax
jne 0x41b530
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push ecx
mov eax, esp
push ecx
mov dword [eax], 0
mov eax, esp
lea ecx, [esi + 0x20]
push ecx
mov dword [eax], str.endian_swap
call fcn.0041e3d0
add esp, 0x18
mov edx, dword [esi]
mov eax, dword [esi + 8]
push edx
push 1
push eax
push ebp
call fcn.0044f1c3
add esp, 0x10
cmp eax, 1
sete bl
test edi, edi
je 0x41b58b
push edi
call fcn.0044e80a
add esp, 4
test bl, bl
je 0x41b5ce
mov edx, dword [esi + 0x1c]
mov ecx, dword [esi + 8]
add dword [esi + 0x14], ecx
cmp dword [esi + 0x54], 8
push 0xffffffffffffffff
push edx
push 0x18
push ecx
mov ecx, esp
jb 0x41b5ab
mov eax, dword [esi + 0x40]
jmp 0x41b5ae
lea eax, [esi + 0x40]
push ecx
mov dword [ecx], eax
mov eax, esp
add esi, 0x20
push esi
mov dword [eax], str.write
call fcn.0041e3d0
add esp, 0x18
mov al, bl
pop edi
pop esi
pop ebp
pop ebx
ret 8
mov ecx, esi
call fcn.0041b290
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
ret 8
Function at 0x41e320
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x46d283
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x489ec0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov eax, 7
xor edi, edi
xor ecx, ecx
mov dword [esi + 0x18], eax
mov dword [esi + 0x14], edi
mov word [esi + 4], cx
xor edx, edx
mov dword [esi + 0x34], eax
mov dword [esi + 0x30], edi
mov dword [esp + 0x18], edi
mov word [esi + 0x20], dx
push 4
mov byte [esp + 0x1c], 1
mov dword [esi + 0x5c], edi
call fcn.0044dbe5
add esp, 4
cmp eax, edi
je 0x41e386
mov dword [eax], edi
jmp 0x41e388
xor eax, eax
push 0xc
mov dword [esi + 0x60], eax
call fcn.0044dbe5
add esp, 4
cmp eax, edi
je 0x41e3a3
mov dword [eax + 8], edi
mov dword [eax + 4], edi
mov dword [eax], edi
jmp 0x41e3a5
xor eax, eax
mov dword [esi + 0x64], eax
mov eax, dword [esp + 0x20]
push eax
mov ecx, esi
mov dword [esi + 0x58], edi
call fcn.0041e1e0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x41ea40
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
mov esi, ecx
mov eax, dword [esi]
mov ecx, dword [esi + 8]
push eax
push 1
push ecx
push edi
call fcn.0044fab1
mov ecx, dword [esi + 8]
add esp, 0x10
cmp eax, 1
mov eax, ecx
sete bl
cdq
idiv dword [esi + 0x18]
mov byte [esp + 0x12], bl
mov dword [esi + 0x1c], eax
test bl, bl
je 0x41eba4
add dword [esi + 0x14], ecx
cmp dword [esi + 0x54], 8
push 0xffffffffffffffff
push eax
push 0x18
push ecx
mov ecx, esp
jb 0x41ea93
mov eax, dword [esi + 0x40]
jmp 0x41ea96
lea eax, [esi + 0x40]
mov dword [ecx], eax
push ecx
mov eax, esp
mov dword [eax], str.read
lea eax, [esi + 0x20]
push eax
mov dword [esp + 0x2c], eax
call fcn.0041e3d0
mov ecx, dword [esi + 0x18]
mov ebx, dword [esi + 0x1c]
add esp, 0x18
xor ebp, ebp
xor eax, eax
cmp ecx, 1
sete byte [esp + 0x13]
test ebx, ebx
je 0x41eb54
xor edx, edx
dec ebx
cmp byte [esp + 0x13], dl
je 0x41ead8
cmp byte [edi], dl
jmp 0x41eadc
cmp word [edi], 0
sete dl
test edx, edx
je 0x41eb06
test eax, eax
je 0x41eaff
cmp edi, eax
je 0x41eaff
imul ecx, ebp
mov edx, edi
sub edx, eax
push edx
push eax
sub eax, ecx
push eax
call fcn.00450be0
add esp, 0xc
mov ecx, dword [esi + 0x18]
lea eax, [ecx + edi]
inc ebp
add edi, ecx
test ebx, ebx
jne 0x41eacb
test eax, eax
je 0x41eb29
cmp edi, eax
je 0x41eb29
mov ecx, dword [esi + 0x18]
imul ecx, ebp
sub edi, eax
push edi
push eax
sub eax, ecx
push eax
call fcn.00450be0
add esp, 0xc
test ebp, ebp
je 0x41eb54
mov edx, dword [esp + 0x14]
push 0xffffffffffffffff
push ebp
push 1
push ecx
mov eax, esp
push ecx
mov dword [eax], 0
mov eax, esp
push edx
mov dword [eax], str.nulls_removed
call fcn.0041e3d0
add esp, 0x18
sub dword [esi + 0x1c], ebp
cmp dword [esi + 0x18], 1
jle 0x41eb96
test byte [esi + 4], 0x80
je 0x41eb96
mov eax, dword [esi + 0x1c]
mov ecx, dword [esp + 0x1c]
push eax
push ecx
call fcn.00418380
mov edx, dword [esp + 0x1c]
add esp, 8
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push ecx
mov eax, esp
push ecx
mov dword [eax], 0
mov eax, esp
push edx
mov dword [eax], str.endian_swap
call fcn.0041e3d0
add esp, 0x18
mov al, byte [esp + 0x12]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
mov ecx, esi
call fcn.0041b290
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 8
ret 4
Function at 0x421320
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
push esi
mov esi, ecx
mov byte [esi + 0x68], al
mov dword [esi + 0x14], eax
mov dword [esi + 0x10], eax
mov eax, dword [esp + 8]
push eax
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
call fcn.00421270
mov eax, esi
pop esi
ret 4
Function at 0x422050
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x42205b
xor eax, eax
ret
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 4]
push esi
not eax
cmp edx, 8
jb 0x422139
mov esi, edx
shr esi, 3
push edi
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4764f0]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0x4764f0]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0x4764f0]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4764f0]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4764f0]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4764f0]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4764f0]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4764f0]
inc ecx
sub edx, 8
sub esi, 1
jne 0x422075
pop edi
test edx, edx
je 0x42215b
lea ecx, [ecx]
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x4764f0]
inc ecx
sub edx, 1
jne 0x422140
not eax
pop esi
ret

Function at 0x422160
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [edx]
movsx ecx, byte [esp + 8]
xor ecx, eax
shr eax, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4764f0]
xor ecx, eax
movzx eax, cl
add eax, dword [edx + 4]
mov dword [edx], ecx
mov ecx, dword [edx + 8]
imul eax, eax, 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x4764f0]
mov dword [edx + 8], ecx
ret

Function at 0x4221b0
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
mov ecx, dword [esi + 8]
mov eax, ecx
and eax, 0xfffd
or eax, 2
mov edx, eax
xor edx, 1
imul edx, eax
mov al, byte [esp + 0x10]
shr edx, 8
xor al, dl
mov edx, dword [esi]
push edi
movsx edi, al
xor edi, edx
shr edx, 8
and edi, 0xff
mov ebx, dword [edi*4 + 0x4764f0]
xor ebx, edx
movzx edx, bl
add edx, dword [esi + 4]
mov dword [esi], ebx
imul edx, edx, 0x8088405
inc edx
mov dword [esi + 4], edx
shr edx, 0x18
xor edx, ecx
and edx, 0xff
shr ecx, 8
xor ecx, dword [edx*4 + 0x4764f0]
pop edi
mov dword [esi + 8], ecx
pop esi
pop ebx
ret