joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40bae0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x120
mov eax, dword [0x43e040]
xor eax, esp
mov dword [esp + 0x11c], eax
push ebp
mov ebp, dword [esp + 0x128]
push esi
push 1
push 0x1a
lea esi, [ebp + 0x520]
push esi
push 0
call dword [0x4351dc]
lea eax, [esi + 1]
mov cl, byte [esi]
inc esi
test cl, cl
jne 0x40bb13
push ebx
push edi
sub esi, eax
lea eax, [ebp + 0x41c]
push eax
push 0x104
mov byte [esi + ebp + 0x521], cl
lea ecx, [esp + 0x30]
push ecx
push 0x437420
push str.CompanyName
lea ebx, [ebp + 0x318]
mov byte [esi + ebp + 0x520], 0x5c
push ebx
inc esi
call dword [0x435048]
mov edi, eax
cmp edi, 2
jl 0x40bbca
lea eax, [esp + 0x28]
mov byte [esp + edi + 0x28], 0x5c
mov byte [esp + edi + 0x29], 0
lea edx, [esi + ebp + 0x520]
mov ecx, eax
inc edi
sub edx, ecx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x40bb77
xor eax, eax
lea edx, [esp + 0x1c]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
push edx
lea eax, [ebp + 0x520]
push eax
call dword [0x435154]
test eax, eax
je 0x40bba9
add esi, edi
jmp 0x40bbca
call dword [0x43519c]
cmp eax, 0xb7
jne 0x40bbba
add esi, edi
jmp 0x40bbca
mov byte [esi + ebp + 0x520], 0x5c
mov byte [esi + ebp + 0x521], 0
lea edx, [esi + ebp + 0x520]
mov eax, ebx
sub edx, ebx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x40bbd5
lea edi, [ebp + 0x520]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40bbe6
mov ax, word [0x43747c]
lea ecx, [esp + 0x10]
mov word [edi], ax
xor eax, eax
push ecx
lea esi, [ebp + 0x520]
push esi
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
call dword [0x435154]
pop edi
pop ebx
test eax, eax
je 0x40bc24
mov eax, 1
jmp 0x40bc44
call dword [0x43519c]
cmp eax, 0xb7
je 0x40bc1d
lea eax, [ebp + 0xc]
mov edx, esi
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x40bc38
xor eax, eax
mov ecx, dword [esp + 0x124]
pop esi
pop ebp
xor ecx, esp
call fcn.00423ac7
add esp, 0x120
ret 4
Function at 0x40cbd0
Capabilities:
Encode data using xor

Disassembly:
movzx eax, word [eax + 8]
and eax, 0xf
sub eax, 1
je 0x40cc11
sub eax, 1
je 0x40cbfc
sub eax, 1
jne 0x40cc3a
push ebx
mov ebx, dword [edx + 0x74c]
push ecx
mov eax, edi
call fcn.0040b6a0
pop ebx
mov eax, 1
ret
xor edx, edx
test edi, edi
jbe 0x40cc3a
xor byte [edx + ecx], 0xaa
inc edx
cmp edx, edi
jb 0x40cc02
mov eax, 1
ret
push esi
mov esi, edi
shr esi, 3
xor edx, edx
test edi, edi
jbe 0x40cc39
lea ecx, [ecx]
imul esi, esi, 0x343fd
add esi, 0x269ec3
mov eax, esi
sar eax, 0x10
xor byte [edx + ecx], al
inc edx
cmp edx, edi
jb 0x40cc20
pop esi
mov eax, 1
ret

Function at 0x40d640
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffffffffff
push 0x4340f8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x43e040]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x2c]
xor esi, esi
push 0x48
mov dword [esp + 0x30], esi
call fcn.00423abc
push 0x1000
mov dword [esp + 0x1c], eax
call fcn.00423abc
add esp, 8
mov dword [esp + 0x18], eax
lea eax, [ebp + 0x14]
lea ecx, [esi + 0x10]
lea edi, [esp + 0x14]
mov dword [esp + 0x24], esi
call fcn.0040b260
mov esi, dword [esp + 0x30]
mov eax, dword [ebp + 0x10]
push esi
mov ecx, esi
mov ebx, edi
call fcn.0040b6a0
call fcn.0040a850
mov eax, dword [ebp + 0x10]
call fcn.0040a940
call fcn.0040a8d0
movzx eax, ax
cmp word [ebp + 0xe], ax
je 0x40d6ea
mov eax, dword [esp + 0x14]
push eax
call fcn.00423bf8
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.00423cdd
add esp, 8
xor eax, eax
jmp 0x40d773
mov eax, dword [ebp + 0x10]
test eax, eax
ja 0x40d6f5
mov eax, dword [esp + 0x2c]
lea esi, [eax + 7]
and esi, 0xfffffff8
lea edi, [esi + 7]
and edi, 0xfffffff8
push edi
call fcn.00423abc
push edi
push 0
push eax
mov dword [ebp + 0x24], eax
mov dword [ebp + 0x28], edi
call fcn.00425270
movzx ecx, word [ebp + 0xc]
xor eax, eax
add esp, 0x10
cmp dword [ebp + 0x10], eax
jbe 0x40d754
jmp 0x40d730
mov edi, dword [esp + 0x30]
imul ecx, ecx, 0x343fd
add ecx, 0x269ec3
mov edx, ecx
sar edx, 0x10
xor dl, byte [eax + edi]
mov edi, dword [ebp + 0x24]
mov byte [eax + edi], dl
inc eax
cmp eax, dword [ebp + 0x10]
jb 0x40d730
mov eax, dword [esp + 0x14]
push eax
mov dword [ebp + 0x10], esi
call fcn.00423bf8
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.00423cdd
add esp, 8
mov eax, 1
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 8

Function at 0x4105e0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [edx]
push edi
mov edi, ecx
movzx ecx, word [eax + 0xc]
movzx eax, word [eax + 0xe]
test eax, eax
jle 0x410630
push ebx
push ebp
push esi
lea ebx, [edx*4]
lea esi, [ecx - 1]
mov edx, eax
test esi, esi
jle 0x410626
lea eax, [edi + 4]
mov ecx, esi
lea esp, [esp]
mov ebp, dword [eax - 4]
xor ebp, dword [eax]
add eax, 4
and ebp, 0xffffff
sub ecx, 1
mov dword [eax - 4], ebp
jne 0x410610
add edi, ebx
sub edx, 1
jne 0x410600
pop esi
pop ebp
pop ebx
mov eax, 1
pop edi
ret
Function at 0x410640
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
mov ebx, dword [edx]
push edi
movzx edi, word [eax + 0xc]
movzx eax, word [eax + 0xe]
dec eax
test eax, eax
jle 0x410686
push ebp
mov dword [esp + 0xc], eax
push esi
lea esi, [ecx + ebx*4]
test edi, edi
jle 0x41067b
mov eax, esi
sub ecx, esi
mov edx, edi
mov ebp, dword [ecx + eax]
xor ebp, dword [eax]
add eax, 4
and ebp, 0xffffff
sub edx, 1
mov dword [eax - 4], ebp
jne 0x410665
sub dword [esp + 0x10], 1
mov ecx, esi
jne 0x410658
pop esi
pop ebp
pop edi
mov eax, 1
pop ebx
pop ecx
ret

Function at 0x410ac0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x434098
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x43e040]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0x10], vtable.CLZDecode.0
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x28], 0
movzx ecx, word [eax + 0xc]
movzx edi, word [eax + 0xe]
imul edi, ecx
add edi, edi
lea ecx, [eax + 0x14]
mov eax, dword [esp + 0x34]
add edi, edi
lea esi, [esp + 0x10]
call fcn.0040a260
cmp dword [esp + 0x1c], 0
je 0x410b40
mov eax, dword [esp + 0x14]
test eax, eax
je 0x410b40
push eax
call fcn.00423bf8
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret
Function at 0x410b60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x434068
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push ebp
push esi
mov eax, dword [0x43e040]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
xor eax, eax
mov dword [esp + 0x20], vtable.CLZDecode.0
mov dword [esp + 0x24], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x38], eax
movzx eax, word [esi + 0xc]
movzx ecx, word [esi + 0xe]
imul eax, ecx
lea ebp, [eax + eax*2]
push ebp
lea ebx, [esi + 0x14]
call fcn.00423d54
movzx ecx, byte [ebx]
add esp, 4
sub ecx, 1
mov dword [esp + 0x24], eax
mov dword [esp + 0x2c], 1
je 0x410c09
sub ecx, 1
je 0x410bfc
sub ecx, 1
je 0x410bef
test eax, eax
je 0x410be5
push eax
call fcn.00423bf8
add esp, 4
xor eax, eax
mov dword [esp + 0x2c], 0
jmp 0x410c19
push ebp
lea edx, [esp + 0x24]
push edx
call fcn.0040a4d0
jmp 0x410c15
push ebp
lea eax, [esp + 0x24]
push eax
call fcn.0040a370
jmp 0x410c15
push ebp
push ebx
lea ecx, [esp + 0x28]
push ecx
call fcn.0040a2e0
mov eax, dword [esp + 0x24]
movzx ebx, word [esi + 0xc]
movzx esi, word [esi + 0xe]
xor edx, edx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], esi
xor ebp, ebp
lea ecx, [ecx]
mov ecx, ebp
test esi, esi
jle 0x410c6e
mov dword [esp + 0x14], esi
lea ebx, [ebx]
mov ebx, dword [esp + 0x18]
test ebx, ebx
jle 0x410c63
mov esi, ebx
lea ebx, [ebx]
mov bl, byte [eax + edx]
mov byte [ecx + edi], bl
inc edx
add ecx, 4
sub esi, 1
jne 0x410c50
mov esi, dword [esp + 0x1c]
sub dword [esp + 0x14], 1
jne 0x410c40
mov ebx, dword [esp + 0x18]
inc ebp
cmp ebp, 3
jl 0x410c30
mov ecx, 3
test esi, esi
jle 0x410c97
lea ecx, [ecx]
test ebx, ebx
jle 0x410c92
mov edx, ebx
mov byte [ecx + edi], 0
add ecx, 4
sub edx, 1
jne 0x410c86
sub esi, 1
jne 0x410c80
cmp dword [esp + 0x2c], 0
je 0x410cab
test eax, eax
je 0x410cab
push eax
call fcn.00423bf8
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
Function at 0x411080
Capabilities:
Create tcp socket
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x19c
mov eax, dword [0x43e040]
xor eax, esp
mov dword [esp + 0x198], eax
mov eax, dword [esi + 0x734]
push edi
mov edi, 9
test eax, eax
je 0x4110ec
cmp eax, edi
je 0x4110ec
mov eax, dword [esi + 0x73c]
mov dword [esi + 0x728], 0xffffffff
mov dword [esi + 0x734], edi
test eax, eax
je 0x4110d5
mov ecx, dword [esi + 0x740]
push ecx
push edi
call eax
add esp, 8
xor eax, eax
pop edi
mov ecx, dword [esp + 0x198]
xor ecx, esp
call fcn.00423ac7
mov esp, ebp
pop ebp
ret 0x10
test byte [ebp + 0x14], 2
je 0x411130
mov eax, dword [esi + 0x73c]
mov dword [esi + 0x728], 0xffffffee
mov dword [esi + 0x734], edi
test eax, eax
je 0x4110d5
mov edx, dword [esi + 0x740]
push edx
push edi
call eax
add esp, 8
xor eax, eax
pop edi
mov ecx, dword [esp + 0x198]
xor ecx, esp
call fcn.00423ac7
mov esp, ebp
pop ebp
ret 0x10
lea eax, [esp + 8]
push eax
push 2
call dword [0x43534c]
test eax, eax
je 0x411183
mov eax, dword [esi + 0x73c]
mov dword [esi + 0x728], 0xfffffffe
mov dword [esi + 0x734], edi
test eax, eax
je 0x4110d5
mov ecx, dword [esi + 0x740]
push ecx
push edi
call eax
add esp, 8
xor eax, eax
pop edi
mov ecx, dword [esp + 0x198]
xor ecx, esp
call fcn.00423ac7
mov esp, ebp
pop ebp
ret 0x10
push 6
push 1
push 2
call dword [0x435324]
mov dword [esi + 0x738], eax
cmp eax, 0xffffffff
jne 0x4111e2
call dword [0x435320]
mov eax, dword [esi + 0x73c]
mov dword [esi + 0x728], 0xfffffffd
mov dword [esi + 0x734], edi
test eax, eax
je 0x4110d5
mov edx, dword [esi + 0x740]
push edx
push edi
call eax
add esp, 8
xor eax, eax
pop edi
mov ecx, dword [esp + 0x198]
xor ecx, esp
call fcn.00423ac7
mov esp, ebp
pop ebp
ret 0x10
lea edx, [esi + 0x18]
mov eax, ebx
sub edx, ebx
lea esp, [esp]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4111f0
mov eax, dword [ebp + 8]
lea edx, [esi + 0x118]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x411205
mov eax, dword [ebp + 0xc]
lea edx, [esi + 0x218]
sub edx, eax
lea ebx, [ebx]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x411220
mov edx, dword [esi + 0x72c]
mov eax, dword [ebp + 0x10]
imul edx, edx, 0x3e8
mov ecx, dword [ebp + 0x14]
mov dword [esi + 0x31c], eax
xor eax, eax
push eax
mov dword [esi + 0x324], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x728], eax
mov eax, dword [esi + 8]
push edx
mov dword [esi + 0x320], ecx
mov ecx, dword [esi + 4]
push eax
push ecx
call dword [0x435298]
push ebx
call dword [0x435328]
mov dword [esi + 0x318], eax
cmp eax, 0xffffffff
jne 0x411297
mov eax, esi
call fcn.004112c0
pop edi
mov ecx, dword [esp + 0x198]
xor ecx, esp
call fcn.00423ac7
mov esp, ebp
pop ebp
ret 0x10
mov ecx, esi
call fcn.00411350
mov ecx, dword [esp + 0x19c]
pop edi
xor ecx, esp
call fcn.00423ac7
mov esp, ebp
pop ebp
ret 0x10
Function at 0x411350
Capabilities:
Connect socket

Disassembly:
sub esp, 0x18
mov eax, dword [0x43e040]
xor eax, esp
mov dword [esp + 0x10], eax
push esi
xor eax, eax
mov esi, ecx
movzx ecx, word [esi + 0x31c]
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov eax, 2
push ecx
mov word [esp + 8], ax
call dword [0x435330]
mov edx, dword [esi + 0x318]
mov ecx, dword [esi + 4]
push 0x10
mov word [esp + 0xa], ax
mov eax, dword [esi + 8]
push eax
mov dword [esp + 0x10], edx
mov edx, dword [esi + 0x738]
push ecx
push edx
call dword [0x435334]
cmp eax, 0xffffffff
jne 0x4113f9
call fcn.00411470
mov dword [esi + 0x728], 0xfffffffc
mov eax, dword [esi + 0x73c]
mov dword [esi + 0x734], 9
test eax, eax
je 0x4113e7
mov ecx, dword [esi + 0x740]
push ecx
push 9
call eax
add esp, 8
xor eax, eax
pop esi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.00423ac7
add esp, 0x18
ret
mov eax, dword [esi + 0x738]
push 0x10
lea edx, [esp + 8]
push edx
push eax
call dword [0x435338]
cmp eax, 0xffffffff
jne 0x411430
call dword [0x43533c]
cmp eax, 0x2733
je 0x411430
call fcn.00411470
mov dword [esi + 0x728], 0xfffffffb
jmp 0x4113c5
mov eax, dword [esi + 0x73c]
mov dword [esi + 0x734], 2
test eax, eax
je 0x411452
mov edx, dword [esi + 0x740]
push edx
push 2
call eax
add esp, 8
mov ecx, dword [esp + 0x14]
pop esi
xor ecx, esp
mov eax, 1
call fcn.00423ac7
add esp, 0x18
ret
Function at 0x411820
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x98
mov eax, dword [0x43e040]
xor eax, esp
mov dword [esp + 0x94], eax
push esi
push edi
push 0x437520
mov ecx, ebx
call fcn.00411df0
test eax, eax
jge 0x411883
mov esi, ebx
call fcn.00411470
mov eax, dword [ebx + 0x73c]
mov dword [ebx + 0x728], 0xfffffff7
mov dword [ebx + 0x734], 9
test eax, eax
je 0x411a0b
mov ecx, dword [ebx + 0x740]
push ecx
push 9
jmp 0x411a06
test byte [ebx + 0x320], 1
je 0x4119cc
push 0x437524
mov ecx, ebx
call fcn.00411df0
push 0x437528
mov ecx, ebx
mov edi, eax
call fcn.00411df0
mov dword [esp + 0xc], eax
test edi, edi
jle 0x41199c
test eax, eax
jle 0x41199c
cmp eax, edi
jle 0x41199c
lea ecx, [ebx + 0x218]
mov eax, ecx
mov dword [ebx + 0x14], 0
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4118d8
sub eax, esi
mov esi, eax
mov eax, dword [ebx + 0x10]
lea edx, [esi + 1]
push edx
push ecx
mov ecx, dword [esp + 0x14]
lea edx, [ecx + eax + 1]
push edx
call fcn.004252f0
xor eax, eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x2c], eax
add esp, 0xc
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x67452301
mov dword [esp + 0x14], 0xefcdab89
mov dword [esp + 0x18], 0x98badcfe
mov dword [esp + 0x1c], 0x10325476
call fcn.00420ce0
mov ecx, dword [ebx + 0x10]
mov eax, dword [esp + 0xc]
add ecx, edi
sub esi, edi
push ecx
lea eax, [esi + eax + 1]
lea ecx, [esp + 0x14]
call fcn.00420d10
lea edi, [esp + 0x68]
lea esi, [esp + 0x10]
call fcn.00420db0
lea edx, [esp + 0x78]
push edx
mov ecx, edi
call fcn.00411f00
lea eax, [esp + 0x78]
push eax
lea ecx, [ebx + 0x118]
push ecx
push str.APOP__s__s_r_n
mov edi, ebx
call fcn.00411d70
add esp, 0xc
mov edx, 0xa
mov eax, ebx
call fcn.00411060
pop edi
pop esi
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.00423ac7
mov esp, ebp
pop ebp
ret
mov esi, ebx
call fcn.00411470
mov eax, dword [ebx + 0x73c]
mov dword [ebx + 0x728], 0xfffffff0
mov dword [ebx + 0x734], 9
test eax, eax
je 0x411a0b
mov edx, dword [ebx + 0x740]
push edx
push 9
jmp 0x411a06
lea eax, [ebx + 0x118]
push eax
push str.USER__s_r_n
mov edi, ebx
mov dword [ebx + 0x14], 0
call fcn.00411d70
mov eax, dword [ebx + 0x73c]
add esp, 8
mov dword [ebx + 0x734], 4
test eax, eax
je 0x411a0b
mov ecx, dword [ebx + 0x740]
push ecx
push 4
call eax
add esp, 8
mov ecx, dword [esp + 0x9c]
pop edi
pop esi
xor ecx, esp
call fcn.00423ac7
mov esp, ebp
pop ebp
ret

Function at 0x411d70
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x404
mov eax, dword [0x43e040]
xor eax, esp
mov dword [esp + 0x400], eax
mov ecx, dword [esp + 0x408]
lea eax, [esp + 0x40c]
push eax
push ecx
lea edx, [esp + 8]
push 0x400
push edx
call fcn.00423fd9
lea eax, [esp + 0x10]
add esp, 0x10
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x411db0
mov ecx, dword [edi + 0x738]
push esi
sub eax, edx
push 0
mov esi, eax
push esi
lea eax, [esp + 0xc]
push eax
push ecx
call dword [0x435348]
mov ecx, dword [esp + 0x404]
inc eax
neg eax
sbb eax, eax
and eax, esi
pop esi
xor ecx, esp
call fcn.00423ac7
add esp, 0x404
ret
Function at 0x4167a0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, eax
push edi
mov edi, ecx
test ebx, ebx
jge 0x4167b9
mov ebx, edi
lea ecx, [ebx + 1]
nop
mov al, byte [ebx]
inc ebx
test al, al
jne 0x4167b0
sub ebx, ecx
mov eax, dword [esi + 0xbe8]
test eax, eax
je 0x4167cd
mov ecx, dword [esi + 0xbe4]
mov byte [eax + ecx], 4
inc dword [esi + 0xbe4]
mov eax, dword [esi + 0xbe8]
mov ecx, dword [esi + 0xbe4]
test eax, eax
je 0x416808
mov byte [ecx + eax], bl
inc dword [esi + 0xbe4]
mov eax, dword [esi + 0xbe4]
mov ecx, dword [esi + 0xbe8]
mov edx, ebx
shr edx, 8
mov byte [eax + ecx], dl
inc dword [esi + 0xbe4]
jmp 0x416811
add ecx, 2
mov dword [esi + 0xbe4], ecx
mov eax, dword [esi + 0xbe8]
test eax, eax
je 0x41685d
mov edx, dword [esi + 0xbe4]
push ebx
add edx, eax
push edi
push edx
call fcn.004252f0
add esp, 0xc
cmp dword [esi + 0xb48], 0
jle 0x41685d
xor eax, eax
test ebx, ebx
jle 0x41685d
lea ecx, [ecx]
mov ecx, dword [esi + 0xbe8]
add ecx, dword [esi + 0xbe4]
mov dl, byte [esi + 0xb48]
xor byte [ecx + eax], dl
lea edi, [ecx + eax]
inc eax
cmp eax, ebx
jl 0x416840
add dword [esi + 0xbe4], ebx
pop edi
pop ebx
ret
Function at 0x41eb50
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x24
fld dword [esp + 0x28]
push ebx
fld qword [0x4388c0]
push ebp
push esi
fmul st(1), st(0)
push edi
fxch st(1)
mov esi, eax
call fcn.004312a0
fmul dword [esp + 0x3c]
mov ebx, eax
mov dword [esp + 0x10], ebx
call fcn.004312a0
mov dword [esp + 0x38], eax
mov edx, dword [esi]
movzx ebp, byte [esi + 0xd]
mov ecx, 0x100
sub ecx, eax
movzx eax, byte [esi + 1]
mov dword [esp + 0x24], eax
movzx eax, byte [esi + 5]
mov dword [esp + 0x28], eax
movzx eax, byte [esi + 6]
mov dword [esp + 0x18], eax
movzx eax, byte [esi + 9]
mov dword [esp + 0x3c], ecx
movzx ecx, byte [esi + 2]
mov dword [esp + 0x2c], eax
movzx eax, byte [esi + 0xa]
mov dword [esp + 0x14], ecx
mov ecx, dword [esi + 4]
mov edi, 0x100
sub edi, ebx
mov ebx, dword [esi + 8]
mov dword [esp + 0x1c], eax
mov eax, dword [esi + 0xc]
movzx esi, byte [esi + 0xe]
and ecx, 0xff
and edx, 0xff
imul ecx, edi
and ebx, 0xff
imul edx, edi
mov dword [esp + 0x20], esi
mov esi, dword [esp + 0x10]
and eax, 0xff
imul ebx, esi
imul eax, esi
add ecx, eax
imul ecx, dword [esp + 0x38]
add edx, ebx
mov ebx, dword [esp + 0x3c]
imul edx, ebx
add ecx, edx
sar ecx, 0x10
test ecx, ecx
jge 0x41ec1c
xor ecx, ecx
jmp 0x41ec29
cmp ecx, 0xff
jle 0x41ec29
mov ecx, 0xff
mov eax, dword [esp + 0x28]
imul ebp, esi
mov edx, dword [esp + 0x24]
imul eax, edi
add eax, ebp
imul edx, edi
mov ebp, dword [esp + 0x2c]
imul eax, dword [esp + 0x38]
imul ebp, esi
add edx, ebp
imul edx, ebx
add eax, edx
sar eax, 0x10
mov ebp, eax
test ebp, ebp
jge 0x41ec5c
xor ebp, ebp
jmp 0x41ec69
cmp ebp, 0xff
jle 0x41ec69
mov ebp, 0xff
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x20]
imul eax, edi
imul edx, esi
add eax, edx
mov edx, dword [esp + 0x14]
imul eax, dword [esp + 0x38]
imul edx, edi
mov edi, dword [esp + 0x1c]
imul edi, esi
add edx, edi
imul edx, ebx
add eax, edx
sar eax, 0x10
test eax, eax
jge 0x41ecb0
xor eax, eax
shl eax, 8
pop edi
add eax, ebp
pop esi
shl eax, 8
pop ebp
add eax, ecx
pop ebx
add esp, 0x24
ret 8
cmp eax, 0xff
jle 0x41ecbc
mov eax, 0xff
shl eax, 8
pop edi
add eax, ebp
pop esi
shl eax, 8
pop ebp
add eax, ecx
pop ebx
add esp, 0x24
ret 8
Function at 0x41ecd0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x44
fld dword [esp + 0x48]
push ebx
fld qword [0x4388c0]
push ebp
push esi
fmul st(1), st(0)
push edi
fxch st(1)
mov esi, eax
call fcn.004312a0
fmul dword [esp + 0x5c]
mov ebx, eax
call fcn.004312a0
mov dword [esp + 0x10], eax
mov ecx, 0x100
sub ecx, eax
movzx eax, byte [esi + 1]
mov dword [esp + 0x14], eax
movzx eax, byte [esi + 3]
mov dword [esp + 0x24], eax
movzx eax, byte [esi + 5]
mov dword [esp + 0x18], eax
movzx eax, byte [esi + 6]
mov dword [esp + 0x38], eax
movzx eax, byte [esi + 7]
mov edx, dword [esi]
mov ebp, dword [esi + 8]
mov dword [esp + 0x28], eax
movzx eax, byte [esi + 9]
mov dword [esp + 0x1c], eax
movzx eax, byte [esi + 0xa]
mov dword [esp + 0x3c], eax
movzx eax, byte [esi + 0xb]
mov dword [esp + 0x58], ecx
movzx ecx, byte [esi + 2]
mov dword [esp + 0x2c], eax
mov eax, dword [esi + 0xc]
and eax, 0xff
mov dword [esp + 0x50], eax
movzx eax, byte [esi + 0xd]
mov dword [esp + 0x34], ecx
mov ecx, dword [esi + 4]
mov dword [esp + 0x20], eax
movzx eax, byte [esi + 0xe]
movzx esi, byte [esi + 0xf]
and ecx, 0xff
mov dword [esp + 0x30], esi
mov esi, dword [esp + 0x50]
mov edi, 0x100
imul esi, ebx
sub edi, ebx
and edx, 0xff
imul ecx, edi
and ebp, 0xff
imul edx, edi
imul ebp, ebx
add ecx, esi
mov esi, dword [esp + 0x10]
add edx, ebp
imul ecx, esi
imul edx, dword [esp + 0x58]
add ecx, edx
sar ecx, 0x10
test ecx, ecx
jge 0x41edbc
xor ecx, ecx
jmp 0x41edc9
cmp ecx, 0xff
jle 0x41edc9
mov ecx, 0xff
mov edx, dword [esp + 0x18]
mov ebp, dword [esp + 0x20]
imul edx, edi
imul ebp, ebx
add edx, ebp
mov ebp, dword [esp + 0x1c]
imul edx, esi
mov esi, dword [esp + 0x14]
imul ebp, ebx
imul esi, edi
add esi, ebp
imul esi, dword [esp + 0x58]
add edx, esi
sar edx, 0x10
mov dword [esp + 0x5c], edx
test edx, edx
jge 0x41ee08
mov dword [esp + 0x5c], 0
jmp 0x41ee18
cmp edx, 0xff
jle 0x41ee18
mov dword [esp + 0x5c], 0xff
mov esi, dword [esp + 0x38]
imul eax, ebx
mov ebp, dword [esp + 0x34]
imul esi, edi
mov edx, dword [esp + 0x10]
imul ebp, edi
add esi, eax
mov eax, dword [esp + 0x3c]
imul esi, edx
imul eax, ebx
add ebp, eax
imul ebp, dword [esp + 0x58]
add esi, ebp
sar esi, 0x10
test esi, esi
jge 0x41ee4d
xor esi, esi
jmp 0x41ee5a
cmp esi, 0xff
jle 0x41ee5a
mov esi, 0xff
mov ebp, dword [esp + 0x28]
mov eax, dword [esp + 0x30]
imul ebp, edi
imul eax, ebx
add ebp, eax
imul ebp, edx
mov edx, dword [esp + 0x24]
imul edx, edi
mov edi, dword [esp + 0x2c]
imul edi, ebx
add edx, edi
imul edx, dword [esp + 0x58]
add ebp, edx
sar ebp, 0x10
test ebp, ebp
jge 0x41ee8f
xor ebp, ebp
jmp 0x41ee9c
cmp ebp, 0xff
jle 0x41ee9c
mov ebp, 0xff
mov eax, ebp
shl eax, 8
add eax, esi
shl eax, 8
add eax, dword [esp + 0x5c]
pop edi
pop esi
shl eax, 8
pop ebp
add eax, ecx
pop ebx
add esp, 0x44
ret 8
Function at 0x420ce0
Capabilities:
Hash data with md5

Disassembly:
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
ret