joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401300
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x43f590
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x454654]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov eax, dword [0x45a98c]
mov edx, dword [eax + 0xc]
mov ecx, 0x45a98c
xor ebx, ebx
call edx
add eax, 0x10
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
push eax
push ecx
push edx
push 0x443b5c
lea edi, [esp + 0x24]
mov dword [esp + 0x34], ebx
call fcn.004018c0
mov edx, dword [esp + 0x24]
push ebx
lea ecx, [esp + 0x2c]
call fcn.00422160
add esp, 0x14
mov byte [esp + 0x24], 1
call fcn.00401560
lea esi, [esp + 0x18]
mov byte [esp + 0x24], bl
call fcn.004015c0
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4013a7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x18]
push 0x443b70
push ecx
lea ecx, [esp + 0x1c]
call fcn.00401450
mov eax, dword [eax]
add esp, 8
push eax
push ebx
push 0x20000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
lea esi, [esp + 0x18]
mov edi, eax
call fcn.004015c0
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4013f7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp edi, ebx
je 0x401407
push edi
mov ebx, 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea esi, [esp + 0x14]
mov dword [esp + 0x24], 0xffffffff
call fcn.004015c0
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401438
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, ebx
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x18
ret

Function at 0x401980
Capabilities:
Acquire debug privileges

Disassembly:
sub esp, 0x24
lea eax, [esp + 4]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4019bc
lea ecx, [esp + 8]
push ecx
push 0x443b80
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x4019c2
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add esp, 0x24
ret
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push 0
push 0
push 0x10
lea edx, [esp + 0x1c]
push edx
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x14]
push 0
push eax
mov dword [esp + 0x28], 1
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x401a0f
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add esp, 0x24
ret
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
add esp, 0x24
ret
Function at 0x403320
Capabilities:
Create process on windows
Self delete
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x43ee80
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x454654]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov eax, dword [0x45a98c]
mov edx, dword [eax + 0xc]
mov ecx, 0x45a98c
call edx
lea esi, [eax + 0x10]
mov dword [esp + 0xc], esi
mov dword [esp + 0x1c], 0
mov eax, dword [0x45a98c]
mov edx, dword [eax + 0xc]
mov ecx, 0x45a98c
call edx
add eax, 0x10
mov dword [esp + 0x10], eax
push pe_nt_image_headers32
mov byte [esp + 0x20], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push 0xf
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov ecx, dword [esi - 8]
mov eax, 1
sub eax, dword [esi - 4]
sub ecx, 0x104
or eax, ecx
jge 0x4033c6
mov ecx, 0x104
lea eax, [esp + 0xc]
call fcn.004017c0
mov esi, dword [esp + 0xc]
push 0x104
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, dword [esi - 8]
push eax
push esi
call fcn.004283f2
add esp, 8
test eax, eax
jl 0x403428
cmp eax, dword [esi - 8]
jg 0x403428
xor edx, edx
push esi
mov dword [esi - 0xc], eax
push str._c_timeout__t_1__del__Q__F___s_
lea edi, [esp + 0x18]
mov word [esi + eax*2], dx
call fcn.004018c0
mov eax, dword [esp + 0x18]
add esp, 8
push 0
push 0
push eax
push str.cmd.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x80070057
call fcn.00401960
int3

Function at 0x4053b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push edi
push ebx
push ebp
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4053c7
pop edi
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4053f8
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, esi
and edi, 0xf
jbe 0x4053f4
cmp esi, eax
jae 0x4053f8
sub edi, 1
movzx ecx, word [esi]
lea esi, [esi + ecx*2 + 2]
jne 0x4053e4
cmp esi, eax
jb 0x4053fe
pop esi
pop edi
xor eax, eax
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebp
ret
Function at 0x406b50
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x43f768
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x454654]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
lea eax, [esi + 4]
push eax
call fcn.00407cf0
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esi + 0x34], 0xf
mov dword [esi + 0x30], eax
mov byte [esi + 0x20], al
lea eax, [esi + 0x40]
push eax
mov byte [esp + 0x18], 1
call fcn.00407cf0
fldz
fstp qword [esi + 0x38]
mov dword [esi], 5
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4
Function at 0x409ca0
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x230
mov eax, dword [0x454654]
xor eax, esp
mov dword [esp + 0x22c], eax
push esi
push edi
push 0x228
lea eax, [esp + 0x10]
push 0
push eax
mov edi, ecx
mov dword [esp + 0x14], 0
call fcn.00429470
add esp, 0xc
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
test esi, esi
je 0x409dbb
cmp esi, 0xffffffff
je 0x409dbb
lea ecx, [esp + 8]
push ecx
push esi
mov dword [esp + 0x10], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x409d99
jmp 0x409d10
lea edx, [esp + 0x2c]
push str.EXPLORER.EXE
push edx
call fcn.00428146
add esp, 8
test eax, eax
je 0x409d58
lea eax, [esp + 8]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x409d10
push esi
lea edi, [eax + 1]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
mov ecx, dword [esp + 0x22c]
xor ecx, esp
call fcn.0042761e
add esp, 0x230
ret
mov ecx, dword [esp + 0x10]
push ecx
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push edi
push 0xf01ff
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
mov ecx, dword [esp + 0x22c]
xor ecx, esp
call fcn.0042761e
add esp, 0x230
ret
push esi
xor edi, edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
mov ecx, dword [esp + 0x22c]
xor ecx, esp
call fcn.0042761e
add esp, 0x230
ret
mov ecx, dword [esp + 0x234]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.0042761e
add esp, 0x230
ret
Function at 0x40adb0
Capabilities:
Get token membership

Disassembly:
sub esp, 0x14
mov eax, dword [0x454654]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
xor ebx, ebx
lea eax, [esp + 8]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea ecx, [esp + 0x34]
push ecx
mov byte [esp + 0x38], bl
mov byte [esp + 0x39], bl
mov byte [esp + 0x3a], bl
mov byte [esp + 0x3b], bl
mov byte [esp + 0x3c], bl
mov byte [esp + 0x3d], 5
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x40ae0d
pop ebx
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.0042761e
add esp, 0x14
ret
mov eax, dword [esp + 8]
lea edx, [esp + 4]
push edx
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x40ae26
mov dword [esp + 4], ebx
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 4]
pop ebx
xor ecx, esp
call fcn.0042761e
add esp, 0x14
ret

Function at 0x40ae50
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x254
mov eax, dword [0x454654]
xor eax, esp
mov dword [esp + 0x250], eax
push ebx
push esi
push edi
xor ebx, ebx
lea edi, [esp + 0x10]
lea esi, [esp + 0xc]
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebx
call fcn.0040ad00
test eax, eax
je 0x40aefe
cmp dword [esp + 0xc], 6
jbe 0x40aefe
call fcn.0040adb0
test eax, eax
jne 0x40aefe
push 0x208
lea ecx, [esp + 0x56]
push ebx
push ecx
mov word [esp + 0x5c], ax
call fcn.00429470
add esp, 0xc
lea edx, [esp + 0x50]
push 0x104
push edx
call fcn.004174c0
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x38
lea eax, [esp + 0x1c]
push ebx
push eax
mov dword [esp + 0x20], 0x3c
call fcn.00429470
add esp, 0xc
lea edx, [esp + 0x14]
lea ecx, [esp + 0x50]
push edx
mov dword [esp + 0x24], str.runas
mov dword [esp + 0x28], ecx
mov dword [esp + 0x34], ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
lea eax, [ebx + 1]
jne 0x40af00
mov eax, ebx
mov ecx, dword [esp + 0x25c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0042761e
add esp, 0x254
ret
Function at 0x40c9a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x43f6c8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x454654]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esp + 0x40]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov ebp, dword [eax]
mov eax, dword [0x45a98c]
xor edi, edi
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], edx
mov edx, dword [eax + 0xc]
mov ecx, 0x45a98c
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], ebp
call edx
add eax, 0x10
mov dword [esp + 0x40], eax
mov ebx, dword [esp + 0x44]
lea eax, [esp + 0x40]
mov dword [esp + 0x38], edi
call fcn.00403a10
mov edi, dword [esp + 0x40]
cmp dword [edi - 4], 1
jle 0x40ca2e
mov eax, dword [edi - 0xc]
push eax
lea ecx, [esp + 0x44]
push ecx
call fcn.00403b20
mov edi, dword [esp + 0x40]
mov ecx, dword [esp + 0x24]
push ebp
mov edx, edi
lea ebx, [esp + 0x1c]
call fcn.0041dde0
add esp, 4
test eax, eax
je 0x40cb72
mov ebx, dword [esp + 0x18]
test ebx, ebx
je 0x40cb72
push ebx
call fcn.00424394
add esp, 4
push ebx
mov ebp, eax
push 0
push ebp
call fcn.00429470
add esp, 0xc
cmp dword [edi - 4], 1
jle 0x40ca84
mov edx, dword [edi - 0xc]
push edx
lea eax, [esp + 0x44]
push eax
call fcn.00403b20
mov edi, dword [esp + 0x40]
mov ecx, dword [esp + 0x1c]
push ebp
push ecx
mov ecx, dword [esp + 0x2c]
mov edx, edi
call fcn.0041de80
add esp, 8
test eax, eax
jne 0x40cafc
mov esi, str._ustr
call fcn.00401b60
test ebp, ebp
je 0x40cab3
push ebp
call fcn.00427613
add esp, 4
lea esi, [esp + 0x40]
mov dword [esp + 0x38], 0xffffffff
call fcn.00403ac0
mov eax, dword [esp + 0x40]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40cae4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
lea edx, [esp + 0x20]
push edx
push ebx
xor edi, edi
push ebp
mov dword [esp + 0x2c], edi
call fcn.0041b5c0
add esp, 0xc
test eax, eax
jne 0x40cb1c
mov esi, str._u6pf
jmp 0x40caa1
cmp ebp, edi
je 0x40cb65
cmp ebx, edi
jne 0x40cb28
cmp edi, edi
je 0x40cb65
mov eax, dword [esi]
cmp eax, edi
jne 0x40cb39
push ebx
call fcn.0042770a
add esp, 4
jmp 0x40cb48
mov ecx, dword [esi + 8]
add ecx, ebx
push ecx
push eax
call fcn.004277d4
add esp, 8
mov dword [esi], eax
test eax, eax
je 0x40cb65
mov edx, dword [esi + 8]
push ebx
push ebp
add edx, eax
push ebx
push edx
call fcn.004279ef
add esp, 0x10
add dword [esi + 8], ebx
adc dword [esi + 0xc], edi
mov dword [esp + 0x14], 1
jmp 0x40caa6
push 0x443bf0
push 0x45bac8
mov edx, 1
call fcn.00404040
push str._ulen
push 0x45bac8
mov edx, 5
call fcn.00404040
jmp 0x40cab3
Function at 0x40cba0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x43f129
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x454654]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, dword [esp + 0x30]
xor esi, esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x18], esi
mov eax, dword [0x45a98c]
mov edx, dword [eax + 0xc]
mov ecx, 0x45a98c
call edx
add eax, 0x10
mov dword [edi], eax
push ecx
mov dword [esp + 0x2c], esi
mov eax, esp
mov dword [esp + 0x20], esp
push eax
mov ecx, 0x443f74
mov dword [esp + 0x20], 1
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
call fcn.00403530
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x18]
push edx
push eax
call fcn.0041b1a0
mov ebx, dword [esp + 0x20]
add esp, 0x10
cmp ebx, esi
je 0x40cc41
mov edx, dword [esp + 0x14]
push ebx
push edi
call fcn.00404040
push ebx
call fcn.0042762d
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret
Function at 0x4124e0
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x4c
mov eax, dword [0x454654]
xor eax, esp
mov dword [esp + 0x48], eax
push esi
mov esi, ecx
xor eax, eax
cmp dword [esi + 4], eax
je 0x4125cd
mov ecx, dword [0x45b904]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov byte [esp + 0x3c], al
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x54]
push ecx
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], 0x3e8
mov dword [esp + 0x1c], eax
call dword [sym.imp.WS2_32.dll_ntohl]
mov dx, word [esi]
mov dword [esp + 0x40], eax
mov word [esp + 0x44], dx
test edi, edi
je 0x412582
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x412562
sub eax, edx
cmp eax, 0x20
jne 0x412582
push edi
lea eax, [esp + 0x20]
push 0x21
push eax
call fcn.00429211
add esp, 0xc
jmp 0x4125a8
xor eax, eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov byte [esp + 0x3c], al
mov esi, dword [esi + 4]
mov eax, dword [esi + 8]
push 0x10
lea ecx, [esi + 0xc]
push ecx
push 0
push 0x40
lea edx, [esp + 0x18]
push edx
push eax
call dword [sym.imp.WS2_32.dll_sendto]
xor ecx, ecx
test eax, eax
setg cl
mov eax, ecx
mov ecx, dword [esp + 0x4c]
pop esi
xor ecx, esp
call fcn.0042761e
add esp, 0x4c
ret 4

Function at 0x4126c0
Capabilities:
Terminate thread

Disassembly:
push 0xffffffffffffffff
push 0x43fc95
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x454654]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov edi, dword [esp + 0x24]
mov dword [esp + 0x1c], 0
mov eax, dword [edi + 8]
test eax, eax
je 0x41270b
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [edi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [edi + 0x4c]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea esi, [edi + 0x2c]
mov dword [esp + 0x10], esi
mov byte [esp + 0x1c], 2
call fcn.00413e50
mov esi, dword [esi]
push esi
call fcn.00427613
lea esi, [edi + 0xc]
add esp, 4
mov dword [esp + 0x10], esi
mov byte [esp + 0x1c], 3
call fcn.00413e50
mov edx, dword [esi]
push edx
call fcn.00427613
mov eax, dword [edi]
add esp, 4
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret 4

Function at 0x412770
Capabilities:
Terminate thread

Disassembly:
cmp dword [esi + 8], 0
je 0x4127af
mov eax, dword [esi]
test eax, eax
je 0x412789
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [esi], 0
mov eax, dword [esi + 8]
push 0x1388
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4127a8
mov ecx, dword [esi + 8]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [esi + 8], 0
mov eax, 1
ret
Function at 0x414c60
Capabilities:
Terminate thread

Disassembly:
mov eax, dword [esi]
push ebx
xor ebx, ebx
push ebp
mov ebp, dword [sym.imp.WS2_32.dll_closesocket]
push edi
mov dword [esi + 0x1c], ebx
cmp eax, ebx
je 0x414c79
push eax
call ebp
mov dword [esi], ebx
mov eax, dword [esi + 8]
cmp eax, ebx
je 0x414c86
push eax
call ebp
mov dword [esi + 8], ebx
mov eax, dword [esi + 0x20]
cmp eax, ebx
je 0x414c99
push eax
call fcn.00427613
add esp, 4
mov dword [esi + 0x20], ebx
mov edi, dword [esi + 0x24]
cmp edi, ebx
je 0x414cf9
cmp dword [edi + 8], ebx
je 0x414cd2
mov eax, dword [edi]
cmp eax, ebx
je 0x414cb0
push eax
call ebp
mov dword [edi], ebx
mov eax, dword [edi + 8]
push 0x1388
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x414ccf
mov ecx, dword [edi + 8]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [edi + 8], ebx
mov edi, dword [esi + 0x24]
mov eax, dword [edi]
cmp eax, ebx
je 0x414ce0
push eax
call ebp
mov dword [edi], ebx
mov edi, dword [esi + 0x24]
cmp edi, ebx
je 0x414cf6
push edi
call fcn.004126c0
push edi
call fcn.00427613
add esp, 4
mov dword [esi + 0x24], ebx
pop edi
pop ebp
mov eax, 1
pop ebx
ret
Function at 0x416f50
Capabilities:
Terminate thread

Disassembly:
mov eax, dword [edi + 0x1c]
test eax, eax
je 0x416f6a
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [edi + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
lea esi, [edi + 0xc]
call fcn.004015c0
mov eax, dword [esi]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x416f91
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea esi, [edi + 8]
call fcn.004015c0
mov eax, dword [esi]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x416fb7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea esi, [edi + 4]
call fcn.004015c0
mov eax, dword [esi]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
pop esi
test edx, edx
jg 0x416fde
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
ret
Function at 0x417250
Capabilities:
Get file size
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt
Read file via mapping

Disassembly:
sub esp, 0x20
push ebp
xor ebp, ebp
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], ebp
mov dword [esp + 8], ebp
mov dword [esp + 0xc], ebp
mov dword [esp + 0x18], ebp
cmp ebx, ebp
je 0x417449
push esi
push edi
push ebp
push ebp
push 3
push ebp
push 1
push closesocket
push eax
mov byte [ebx], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [esp + 0x28], edi
cmp edi, 0xffffffff
je 0x4173f1
cmp edi, ebp
je 0x4173f1
push 0xf0000000
push 1
push ebp
push ebp
lea ecx, [esp + 0x2c]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x4173f1
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x10]
push edx
push ebp
push ebp
push 0x8003
push eax
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x4173f1
lea ecx, [esp + 0x24]
push ecx
push edi
mov dword [esp + 0x2c], ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
je 0x4173f1
mov edx, dword [esp + 0x24]
push ebp
push esi
push edx
push 2
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [esp + 0x14], eax
test eax, eax
je 0x4173f1
cmp eax, 0xffffffff
je 0x4173f1
push esi
push ebp
push ebp
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esp + 0x20], eax
test eax, eax
je 0x4173f1
mov edx, dword [esp + 0x10]
push ebp
push esi
mov ecx, eax
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x4173f1
mov ecx, dword [esp + 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
push ebp
lea eax, [esp + 0x10]
push eax
push ebp
push 2
push ecx
mov dword [esp + 0x20], 4
call esi
test eax, eax
je 0x4173f1
mov edx, dword [esp + 0xc]
push edx
call fcn.00424394
mov ebp, eax
add esp, 4
test ebp, ebp
je 0x4173ed
mov ecx, dword [esp + 0x10]
push 0
lea eax, [esp + 0x10]
push eax
push ebp
push 2
push ecx
call esi
test eax, eax
je 0x4173e4
mov eax, dword [esp + 0xc]
cmp eax, 0x80
jae 0x4173e4
xor esi, esi
test eax, eax
jbe 0x4173dc
xor edi, edi
mov edi, edi
movzx edx, byte [esi + ebp]
push edx
mov eax, pe_nt_image_headers32
push 0x44e4c4
sub eax, edi
push eax
lea ecx, [edi + ebx]
push ecx
call fcn.0042896c
inc esi
add esp, 0x10
add edi, 2
cmp esi, dword [esp + 0xc]
jb 0x4173b0
mov edi, dword [esp + 0x28]
mov dword [esp + 0x18], 1
push ebp
call fcn.00427613
add esp, 4
mov ebp, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x417400
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x417411
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, dword [esp + 0x20]
test eax, eax
je 0x417420
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
cmp dword [esp + 0x14], 0
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x417439
mov eax, dword [esp + 0x14]
cmp eax, 0xffffffff
je 0x417439
push eax
call esi
test edi, edi
je 0x417440
push edi
call esi
pop edi
pop esi
mov eax, ebp
pop ebp
add esp, 0x20
ret
mov eax, ebp
pop ebp
add esp, 0x20
ret