joyce8/EMBER2024-capa huggingface dataset:
Function at 0x419360
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x4f6fc0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x108], 0
mov al, byte [0x4f9f09]
mov byte [ebp - 0x104], al
push 0xfe
push 0
lea ecx, [ebp - 0x103]
push ecx
call fcn.004b6780
add esp, 0xc
mov edx, 1
imul edx, edx, 0
mov dword [ebp - 0x10c], edx
cmp dword [ebp - 0x10c], 0xff
jae 0x4193ba
jmp 0x4193bf
call fcn.004b64ae
mov eax, dword [ebp - 0x10c]
mov byte [ebp + eax - 0x104], 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.004196c0
add esp, 4
test eax, eax
jne 0x4193e8
mov eax, dword [ebp - 0x108]
jmp 0x41947f
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov edx, dword [ebp + 8]
push edx
call fcn.004b9887
add esp, 4
mov dword [ebp - 0x108], eax
push 0
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
cmp dword [ebp - 0x108], 0xffffffff
jne 0x419456
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x419456
mov ecx, dword [ebp + 8]
push ecx
push 0x4dd900
push 0
call fcn.004417b0
add esp, 0xc
push 0x80
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, dword [ebp + 8]
push eax
call fcn.004b9887
add esp, 4
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0xffffffff
jne 0x419479
mov ecx, dword [ebp - 0x108]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0x4dd924
push 1
call fcn.004417b0
add esp, 0x10
mov eax, dword [ebp - 0x108]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b6253
mov esp, ebp
pop ebp
ret
Function at 0x41a8a0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
mov eax, dword [0x4f6fc0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x40c], 1
mov al, byte [0x4fa00f]
mov byte [ebp - 0x204], al
push 0x1ff
push 0
lea ecx, [ebp - 0x203]
push ecx
call fcn.004b6780
add esp, 0xc
cmp dword [0x526bb8], 1
jne 0x41a8ee
xor eax, eax
jmp 0x41aa79
push 0x4ed098
push 0x4fef80
push 0x4fa370
call fcn.0045b150
add esp, 0xc
mov dword [ebp - 0x408], eax
cmp dword [ebp - 0x408], 0
jne 0x41a920
mov dword [0x526bb8], 1
jmp 0x41a92a
mov dword [0x526bb8], 0
push 0x4fef80
push 0x4fa370
push 0x4dda48
lea edx, [ebp - 0x204]
push edx
call fcn.004b6e08
add esp, 0x10
lea eax, [ebp - 0x204]
push eax
call fcn.004196c0
add esp, 4
test eax, eax
jne 0x41a9bd
mov ecx, 1
imul ecx, ecx, 0
movsx edx, byte [ecx + 0x4fcad8]
test edx, edx
je 0x41a9bb
push 0x4fa370
push 0x4fcad8
call fcn.004bab10
add esp, 8
test eax, eax
je 0x41a9bb
push 1
push 0x4fa370
push 0x4fcad8
push 0x4fef80
call fcn.0049b320
add esp, 0x10
lea eax, [ebp - 0x204]
push eax
call fcn.004196c0
add esp, 4
cmp eax, 1
jne 0x41a9bb
mov dword [ebp - 0x408], 0
jmp 0x41a9f2
push 0x4fcad8
call fcn.0049cb30
add esp, 4
cmp eax, 1
jne 0x41a9e8
push 1
push 0x4fa370
push 0x4fcad8
push 0x4fef80
call fcn.0049b320
add esp, 0x10
mov dword [ebp - 0x408], 0
cmp dword [ebp - 0x408], 0
jne 0x41aa73
mov cl, byte [0x4fa010]
mov byte [ebp - 0x404], cl
push 0x1ff
push 0
lea edx, [ebp - 0x403]
push edx
call fcn.004b6780
add esp, 0xc
mov dword [ebp - 0x410], 0
lea eax, [ebp - 0x204]
push eax
push 0x200
lea ecx, [ebp - 0x404]
push ecx
push 0x4fa011
push 0x4dda50
push 0x4dda60
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov dword [ebp - 0x410], eax
mov edx, 1
imul edx, edx, 0
movsx eax, byte [ebp + edx - 0x404]
test eax, eax
je 0x41aa73
mov dword [ebp - 0x40c], 0
mov eax, dword [ebp - 0x40c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b6253
mov esp, ebp
pop ebp
ret
Function at 0x41c990
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe0
mov eax, dword [0x4f6fc0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xdc], 0
mov dword [ebp - 0xd0], 0
push 0x4ddbfc
mov eax, dword [ebp + 0xc]
push eax
call fcn.0041a470
add esp, 8
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 0
je 0x41cae5
mov ecx, dword [ebp - 0xd0]
push ecx
call fcn.0045c650
add esp, 4
mov dword [ebp - 0xe0], eax
push 0
push 4
mov edx, dword [ebp - 0xd0]
push edx
call fcn.004b8f82
add esp, 0xc
mov dword [ebp - 0xd4], 0
jmp 0x41ca1e
mov eax, dword [ebp - 0xd4]
add eax, 1
mov dword [ebp - 0xd4], eax
mov ecx, dword [ebp - 0xd4]
cmp ecx, dword [ebp - 0xe0]
jge 0x41cacc
push 0xc8
push 0
lea edx, [ebp - 0xcc]
push edx
call fcn.004b6780
add esp, 0xc
mov eax, dword [ebp - 0xd0]
push eax
push 1
push 0xc8
lea ecx, [ebp - 0xcc]
push ecx
call fcn.004b8e47
add esp, 0x10
movsx edx, word [ebp - 0xcc]
cmp edx, 1
jne 0x41cac7
movsx eax, word [ebp - 0xca]
cmp eax, 0xf
jne 0x41cac7
movsx ecx, word [ebp - 0xc8]
and ecx, 0x7f
mov dword [ebp - 0xd8], ecx
push 0xc8
lea edx, [ebp - 0xcc]
push edx
mov eax, dword [ebp - 0xd8]
sub eax, 1
imul eax, eax, 0xc8
add eax, dword [ebp + 8]
push eax
call fcn.004b8640
add esp, 0xc
cmp dword [ebp - 0xd8], 4
jne 0x41cac7
mov dword [ebp - 0xdc], 1
jmp 0x41cacc
jmp 0x41ca0f
mov ecx, dword [ebp - 0xd0]
push ecx
call fcn.00419ca0
add esp, 4
mov dword [ebp - 0xd0], 0
mov eax, dword [ebp - 0xdc]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b6253
mov esp, ebp
pop ebp
ret

Function at 0x41cbc0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
mov eax, 4
mov ecx, dword [ebp + 8]
mov word [ecx + 0x3a], ax
mov edx, 0xf
mov eax, dword [ebp + 8]
mov word [eax + 0x30], dx
push 0x4ddc00
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0041a470
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x41cc83
mov edx, dword [ebp - 4]
push edx
call fcn.0045c650
add esp, 4
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.00462010
add esp, 8
mov eax, dword [ebp - 8]
sub eax, 1
imul eax, eax, 0xc8
add eax, 4
mov dword [ebp - 0x10], eax
push 0
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.004b8f82
add esp, 0xc
mov eax, dword [ebp - 4]
push eax
push 1
push 0xc8
mov ecx, dword [ebp + 8]
push ecx
call fcn.004b9519
add esp, 0x10
mov edx, dword [ebp - 4]
push edx
call fcn.00419ca0
add esp, 4
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x41ff00
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x4f6fc0]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, byte [0x4fa355]
mov byte [ebp - 0x404], al
push 0x1ff
push 0
lea ecx, [ebp - 0x403]
push ecx
call fcn.004b6780
add esp, 0xc
mov dl, byte [0x4fa356]
mov byte [ebp - 0x204], dl
push 0x1ff
push 0
lea eax, [ebp - 0x203]
push eax
call fcn.004b6780
add esp, 0xc
mov dword [ebp - 0x408], 0
push 0x4de87c
push 0x4fa370
push 0x4de888
lea ecx, [ebp - 0x404]
push ecx
call fcn.004b6e08
add esp, 0x10
lea edx, [ebp - 0x404]
push edx
push 0x200
lea eax, [ebp - 0x204]
push eax
push 0x4fa357
push str.email_SMTP
push 0x4de89c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov dword [ebp - 0x408], eax
mov ecx, 1
imul ecx, ecx, 0
movsx edx, byte [ebp + ecx - 0x204]
test edx, edx
je 0x41ffd3
lea eax, [ebp - 0x204]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004b5e60
add esp, 8
lea edx, [ebp - 0x404]
push edx
push 0x200
lea eax, [ebp - 0x204]
push eax
push 0x4fa358
push str.email_address
push 0x4de8b4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov dword [ebp - 0x408], eax
mov ecx, 1
imul ecx, ecx, 0
movsx edx, byte [ebp + ecx - 0x204]
test edx, edx
je 0x420028
lea eax, [ebp - 0x204]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004b5e60
add esp, 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b6253
mov esp, ebp
pop ebp
ret
Function at 0x420820
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
push 0x4de91c
mov eax, dword [ebp + 8]
push eax
call fcn.0041a470
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x42092e
push 2
push 0
mov ecx, dword [ebp - 4]
push ecx
call fcn.004b8f82
add esp, 0xc
test eax, eax
je 0x420880
mov edx, dword [ebp - 4]
push edx
call fcn.00419ca0
add esp, 4
mov dword [ebp - 4], 0
xor eax, eax
jmp 0x420931
mov eax, dword [ebp - 4]
push eax
call fcn.004b935a
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x4208af
mov ecx, dword [ebp - 4]
push ecx
call fcn.00419ca0
add esp, 4
mov dword [ebp - 4], 0
xor eax, eax
jmp 0x420931
mov edx, dword [ebp - 4]
push edx
call fcn.004b9a1d
add esp, 4
push 0x18
call fcn.004b6c11
add esp, 4
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x10]
add eax, 5
push eax
call fcn.004b6c11
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4208f6
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0x10]
push edx
push 1
mov eax, dword [ebp - 0xc]
push eax
call fcn.004b8e47
add esp, 0x10
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
mov dword [ecx + 4], edx
mov eax, dword [ebp - 8]
mov dword [eax + 8], 0
mov ecx, dword [ebp - 8]
mov dword [ecx + 0xc], 0
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
mov dword [edx], eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00419ca0
add esp, 4
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x42a600
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x4f6fc0]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, byte [0x4fbb37]
mov byte [ebp - 0x104], al
push 0xfe
push 0
lea ecx, [ebp - 0x103]
push ecx
call fcn.004b6780
add esp, 0xc
cmp dword [0x54e900], 0
je 0x42a642
jmp 0x42a7db
push 0x4df844
push 0x4fcbd8
call fcn.004b5ff0
add esp, 8
test eax, eax
jne 0x42a684
push 0x4df84c
push 0x4fcbd8
call fcn.004b5ff0
add esp, 8
test eax, eax
jne 0x42a684
push 0x4df858
push 0x4fcbd8
call fcn.004b5ff0
add esp, 8
test eax, eax
je 0x42a689
jmp 0x42a7db
cmp dword [0x4e0f54], 1
jne 0x42a7db
push 0x4df870
mov edx, dword [ebp + 8]
push edx
call fcn.0041a470
add esp, 8
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0
je 0x42a7db
mov eax, dword [ebp - 0x108]
push eax
push 1
push 0xc
lea ecx, [ebp - 0x104]
push ecx
call fcn.004b8e47
add esp, 0x10
mov edx, dword [ebp - 0x108]
push edx
call fcn.00419ca0
add esp, 4
mov dword [ebp - 0x108], 0
lea eax, [ebp - 0x104]
push eax
call fcn.004ca3dc
add esp, 4
push 0xc
push 0x4df874
lea ecx, [ebp - 0x104]
push ecx
call fcn.004b6970
add esp, 0xc
test eax, eax
je 0x42a74e
push 6
push 0x4df884
lea edx, [ebp - 0x104]
push edx
call fcn.004b6970
add esp, 0xc
test eax, eax
je 0x42a74e
push 5
push str.__xml
lea eax, [ebp - 0x104]
push eax
call fcn.004b6970
add esp, 0xc
test eax, eax
jne 0x42a7db
push 0x4df894
push 0x4fcbd8
call fcn.004b5ff0
add esp, 8
test eax, eax
je 0x42a7a1
push 0x4fcbd8
call fcn.004865a0
add esp, 4
mov ecx, 1
imul ecx, ecx, 0
mov dword [ebp - 0x10c], ecx
cmp dword [ebp - 0x10c], 0xff
jae 0x42a78d
jmp 0x42a792
call fcn.004b64ae
mov edx, dword [ebp - 0x10c]
mov byte [edx + 0x4fcbd8], 0
jmp 0x42a7db
mov eax, dword [ebp + 8]
push eax
push str._s.HTML
lea ecx, [ebp - 0x104]
push ecx
call fcn.004b6e08
add esp, 0xc
lea edx, [ebp - 0x104]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0049b850
add esp, 8
lea ecx, [ebp - 0x104]
push ecx
call fcn.004865a0
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b6253
mov esp, ebp
pop ebp
ret
Function at 0x42a7f0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x308
mov eax, dword [0x4f6fc0]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, byte [0x4fbb60]
mov byte [ebp - 0x104], al
push 0xfe
push 0
lea ecx, [ebp - 0x103]
push ecx
call fcn.004b6780
add esp, 0xc
mov dl, byte [0x4fbb61]
mov byte [ebp - 0x304], dl
push 0x1ff
push 0
lea eax, [ebp - 0x303]
push eax
call fcn.004b6780
add esp, 0xc
mov dword [ebp - 0x308], 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0x14]
push edx
push str.server__03d__s
lea eax, [ebp - 0x104]
push eax
call fcn.004b6e08
add esp, 0x10
mov ecx, dword [ebp + 8]
push ecx
push 0x200
lea edx, [ebp - 0x304]
push edx
push 0x4fbb62
lea eax, [ebp - 0x104]
push eax
push 0x4e00a4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov dword [ebp - 0x308], eax
mov ecx, dword [ebp + 0xc]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x304]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
push 0x4e00ac
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov edx, dword [ebp + 0xc]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea eax, [ebp - 0x304]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
call fcn.004b5e60
add esp, 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b6253
mov esp, ebp
pop ebp
ret
Function at 0x42b620
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x508
mov eax, dword [0x4f6fc0]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, byte [0x4fea7f]
mov byte [ebp - 0x104], al
push 0xfe
push 0
lea ecx, [ebp - 0x103]
push ecx
call fcn.004b6780
add esp, 0xc
mov edx, 1
imul edx, edx, 0
movsx eax, byte [edx + 0x4fccd8]
test eax, eax
je 0x42b671
mov eax, 0x4fccd8
jmp 0x42b84b
cmp dword [0x4fd0f4], 0
jne 0x42b75a
mov cl, byte [0x4feb7f]
mov byte [ebp - 0x304], cl
push 0x1ff
push 0
lea edx, [ebp - 0x303]
push edx
call fcn.004b6780
add esp, 0xc
mov al, byte [0x4fec7f]
mov byte [ebp - 0x504], al
push 0x1ff
push 0
lea ecx, [ebp - 0x503]
push ecx
call fcn.004b6780
add esp, 0xc
mov dword [ebp - 0x508], 0
mov dword [0x4fd0f4], 1
push 0x4e1568
push 0x4fcad8
push 0x4e1578
lea edx, [ebp - 0x304]
push edx
call fcn.004b6e08
add esp, 0x10
lea eax, [ebp - 0x304]
push eax
push 0x200
lea ecx, [ebp - 0x504]
push ecx
push 0x4fed7f
push 0x4e1590
push 0x4e15ac
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov dword [ebp - 0x508], eax
cmp dword [ebp - 0x508], 0
je 0x42b73e
lea edx, [ebp - 0x504]
push edx
call fcn.004b98c7
add esp, 4
mov dword [0x4fd0f4], eax
cmp dword [0x4fd0f4], 1
jl 0x42b750
cmp dword [0x4fd0f4], 0x64
jle 0x42b75a
mov dword [0x4fd0f4], 1
mov eax, 1
imul eax, eax, 0
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx + eax]
test edx, edx
jne 0x42b781
push 0x4fcad8
push 0x4fccd8
call fcn.004b5e60
add esp, 8
jmp 0x42b79f
mov eax, dword [ebp + 8]
push eax
push 0x4fccd8
call fcn.004b5e60
add esp, 8
push 0x4fccd8
call fcn.0042e130
add esp, 4
push 0x4fccd8
call fcn.00429ab0
add esp, 4
push 0x4e15d0
push 0x4fccd8
call fcn.004b5e70
add esp, 8
mov ecx, dword [0x4fd0f4]
push ecx
push 0x4fccd8
push str._s__03d
lea edx, [ebp - 0x104]
push edx
call fcn.004b6e08
add esp, 0x10
lea eax, [ebp - 0x104]
push eax
call fcn.00419490
add esp, 4
test eax, eax
jne 0x42b832
push 0x4fccd8
call fcn.00419490
add esp, 4
test eax, eax
je 0x42b823
lea ecx, [ebp - 0x104]
push ecx
push 0x4fccd8
call fcn.0049b850
add esp, 8
test eax, eax
jne 0x42b821
mov eax, 0x4fccd8
jmp 0x42b84b
jmp 0x42b832
lea edx, [ebp - 0x104]
push edx
call fcn.00419870
add esp, 4
lea eax, [ebp - 0x104]
push eax
push 0x4fccd8
call fcn.004b5e60
add esp, 8
mov eax, 0x4fccd8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b6253
mov esp, ebp
pop ebp
ret
Function at 0x42d100
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xc604
call fcn.004b6e90
mov eax, dword [0x4f6fc0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xc604], 1
mov dword [ebp - 0xc5f8], 0
mov dword [ebp - 0xc5e8], 0
mov dword [ebp - 0xc5ec], 0
push 0x4e1990
mov eax, dword [ebp + 0xc]
push eax
call fcn.0041a470
add esp, 8
mov dword [ebp - 0xc5e8], eax
cmp dword [ebp - 0xc5e8], 0
jne 0x42d166
xor eax, eax
jmp 0x42d395
push 0x4e1994
mov ecx, dword [ebp + 8]
push ecx
call fcn.0041a470
add esp, 8
mov dword [ebp - 0xc5ec], eax
cmp dword [ebp - 0xc5ec], 0
jne 0x42d1a6
mov edx, dword [ebp - 0xc5e8]
push edx
call fcn.00419ca0
add esp, 4
mov dword [ebp - 0xc5e8], 0
xor eax, eax
jmp 0x42d395
mov eax, dword [ebp - 0xc5e8]
push eax
push 0xd
push 1
lea ecx, [ebp - 0x230]
push ecx
call fcn.004b8e47
add esp, 0x10
mov dword [ebp - 0xc5f4], eax
push 4
push 9
lea edx, [ebp - 0x230]
push edx
call fcn.0042cac0
add esp, 0xc
mov dword [ebp - 0xc5f0], eax
push 2
push 0
mov eax, dword [ebp - 0xc5e8]
push eax
call fcn.004b8f82
add esp, 0xc
mov ecx, dword [ebp - 0xc5e8]
push ecx
call fcn.004b935a
add esp, 4
mov dword [ebp - 0xc600], eax
push 0
mov edx, dword [ebp - 0xc600]
sub edx, dword [ebp - 0xc5f0]
push edx
mov eax, dword [ebp - 0xc5e8]
push eax
call fcn.004b8f82
add esp, 0xc
mov ecx, dword [ebp - 0xc5e8]
push ecx
mov edx, dword [ebp - 0xc5f0]
push edx
push 1
lea eax, [ebp - 0x130]
push eax
call fcn.004b8e47
add esp, 0x10
mov dword [ebp - 0xc5f4], eax
mov ecx, dword [ebp - 0xc5f0]
push ecx
lea edx, [ebp - 0x130]
push edx
call fcn.0042e5c0
add esp, 8
mov eax, dword [ebp - 0xc5ec]
push eax
mov ecx, dword [ebp - 0xc5f0]
push ecx
push 1
lea edx, [ebp - 0x130]
push edx
call fcn.004b9519
add esp, 0x10
push 0
push 0xd
mov eax, dword [ebp - 0xc5e8]
push eax
call fcn.004b8f82
add esp, 0xc
mov ecx, dword [ebp - 0xc600]
sub ecx, dword [ebp - 0xc5f0]
sub ecx, 0xd
sub ecx, dword [ebp - 0xc5f8]
mov dword [ebp - 0xc5fc], ecx
cmp dword [ebp - 0xc5fc], 0xc350
jle 0x42d2c3
mov dword [ebp - 0xc5fc], 0xc350
mov edx, dword [ebp - 0xc5e8]
push edx
mov eax, dword [ebp - 0xc5fc]
push eax
push 1
lea ecx, [ebp - 0xc5e4]
push ecx
call fcn.004b8e47
add esp, 0x10
mov dword [ebp - 0xc5f4], eax
mov edx, dword [ebp - 0xc5f8]
add edx, dword [ebp - 0xc5f4]
mov dword [ebp - 0xc5f8], edx
mov eax, dword [ebp - 0xc5f4]
push eax
lea ecx, [ebp - 0xc5e4]
push ecx
call fcn.0042e5c0
add esp, 8
mov edx, dword [ebp - 0xc5ec]
push edx
mov eax, dword [ebp - 0xc5f4]
push eax
push 1
lea ecx, [ebp - 0xc5e4]
push ecx
call fcn.004b9519
add esp, 0x10
mov edx, dword [ebp - 0xc5e8]
push edx
call fcn.004b6ca3
add esp, 4
test eax, eax
jne 0x42d35d
mov eax, dword [ebp - 0xc600]
sub eax, dword [ebp - 0xc5f0]
sub eax, 0xd
cmp dword [ebp - 0xc5f8], eax
jl 0x42d292
mov ecx, dword [ebp - 0xc5e8]
push ecx
call fcn.00419ca0
add esp, 4
mov dword [ebp - 0xc5e8], 0
mov edx, dword [ebp - 0xc5ec]
push edx
call fcn.00419ca0
add esp, 4
mov dword [ebp - 0xc5ec], 0
mov eax, dword [ebp - 0xc604]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b6253
mov esp, ebp
pop ebp
ret
Function at 0x435d50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x4f6fc0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov cx, word [eax + 0x3c]
mov word [ebp - 0x30], cx
mov byte [ebp - 0x2c], 0x54
mov byte [ebp - 0x2b], 0x48
mov byte [ebp - 0x2a], 0x43
mov byte [ebp - 0x29], 0x3b
mov byte [ebp - 0x28], 0x37
mov byte [ebp - 0x27], 0x2c
mov byte [ebp - 0x26], 0x24
mov byte [ebp - 0x25], 0x1c
mov byte [ebp - 0x24], 0x17
mov byte [ebp - 0x23], 0
mov byte [ebp - 0x20], 0x1b
mov byte [ebp - 0x1f], 0x19
mov byte [ebp - 0x1e], 0x16
mov byte [ebp - 0x1d], 0x14
mov byte [ebp - 0x1c], 0x11
mov byte [ebp - 0x1b], 0xf
mov byte [ebp - 0x1a], 0xc
mov byte [ebp - 0x19], 0xa
mov byte [ebp - 0x18], 7
mov byte [ebp - 0x17], 0
mov byte [ebp - 0xc], 0x51
mov byte [ebp - 0xb], 0x43
mov byte [ebp - 0xa], 0x33
mov byte [ebp - 9], 0x25
mov byte [ebp - 8], 0x1b
mov byte [ebp - 7], 0
mov byte [ebp - 0x14], 0xc
mov byte [ebp - 0x13], 0xa
mov byte [ebp - 0x12], 7
mov byte [ebp - 0x11], 5
mov byte [ebp - 0x10], 2
mov byte [ebp - 0xf], 0
mov dword [ebp - 0x34], 0
movsx edx, word [ebp - 0x30]
cmp edx, 0x64
jl 0x435e06
movsx eax, word [ebp - 0x30]
sub eax, 0x64
mov word [ebp - 0x30], ax
movsx ecx, word [ebp - 0x30]
test ecx, ecx
jne 0x435eed
mov edx, dword [ebp + 8]
push edx
call fcn.00432170
add esp, 4
cmp eax, 1
jne 0x435eed
mov eax, dword [ebp + 8]
movsx ecx, word [eax + 0xc]
cmp ecx, 2
jne 0x435e8b
mov edx, dword [ebp + 8]
movsx eax, word [edx + 0xe]
cmp eax, 6
jne 0x435e8b
mov ecx, dword [ebp + 8]
movsx edx, word [ecx + 0x14]
sub edx, 0x3e8
mov word [ebp - 0x3c], dx
mov dword [ebp - 0x34], 0
jmp 0x435e62
mov eax, dword [ebp - 0x34]
add eax, 1
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0xa
jge 0x435e89
movsx ecx, word [ebp - 0x3c]
mov edx, dword [ebp - 0x34]
movsx eax, byte [ebp + edx - 0x2c]
cmp ecx, eax
jle 0x435e87
mov ecx, dword [ebp - 0x34]
movsx dx, byte [ebp + ecx - 0x20]
mov word [ebp - 0x30], dx
jmp 0x435e89
jmp 0x435e59
jmp 0x435eed
mov eax, dword [ebp + 8]
movsx ecx, word [eax + 0xc]
cmp ecx, 1
jne 0x435eed
mov edx, dword [ebp + 8]
movsx eax, word [edx + 0xe]
cmp eax, 0xe
jne 0x435eed
mov ecx, dword [ebp + 8]
movsx edx, word [ecx + 0x14]
sub edx, 0x3e8
mov word [ebp - 0x38], dx
mov dword [ebp - 0x34], 0
jmp 0x435ec6
mov eax, dword [ebp - 0x34]
add eax, 1
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 6
jge 0x435eed
movsx ecx, word [ebp - 0x38]
mov edx, dword [ebp - 0x34]
movsx eax, byte [ebp + edx - 0xc]
cmp ecx, eax
jle 0x435eeb
mov ecx, dword [ebp - 0x34]
movsx dx, byte [ebp + ecx - 0x14]
mov word [ebp - 0x30], dx
jmp 0x435eed
jmp 0x435ebd
mov ax, word [ebp - 0x30]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b6253
mov esp, ebp
pop ebp
ret
Function at 0x441850
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
mov eax, dword [0x4f6fc0]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x808], eax
mov ecx, dword [ebp - 0x808]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0x800
lea eax, [ebp - 0x804]
push eax
call fcn.004b6810
add esp, 0x10
mov dword [ebp - 0x80c], eax
lea ecx, [ebp - 0x804]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [ebp - 0x808], 0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b6253
mov esp, ebp
pop ebp
ret
Function at 0x443a20
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, 4
imul eax, eax, 0
mov ecx, dword [ebp + 8]
mov dword [ecx + eax], 0
mov edx, 4
shl edx, 0
mov eax, dword [ebp + 8]
mov dword [eax + edx], 0
mov ecx, 4
imul ecx, ecx, 0
mov edx, dword [ebp + 8]
mov dword [edx + ecx + 8], 0x67452301
mov eax, 4
shl eax, 0
mov ecx, dword [ebp + 8]
mov dword [ecx + eax + 8], 0xefcdab89
mov edx, 4
shl edx, 1
mov eax, dword [ebp + 8]
mov dword [eax + edx + 8], 0x98badcfe
mov ecx, 4
imul ecx, ecx, 3
mov edx, dword [ebp + 8]
mov dword [edx + ecx + 8], 0x10325476
pop ebp
ret