joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42c8a0
Capabilities:
Set file attributes

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x2c
push ebx
push ebp
mov ebp, dword [esp + 0x3c]
push esi
xor esi, esi
push edi
cmp edx, esi
je 0x42c984
cmp ebp, esi
je 0x42c984
lea ecx, [ebp + 0x18]
call fcn.0042c680
push esi
mov ebx, eax
or ebx, 0x2000000
push ebx
push 3
push esi
push 1
push 0x40000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esp + 0x1c], eax
cmp eax, 0xffffffff
je 0x42c984
mov eax, dword [ebp]
or eax, dword [ebp + 4]
mov dword [esp + 0x18], esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], esi
je 0x42c916
lea edi, [esp + 0x20]
mov esi, ebp
call fcn.0042c700
mov ecx, edi
mov dword [esp + 0x18], ecx
mov edx, dword [ebp + 8]
or edx, dword [ebp + 0xc]
lea esi, [ebp + 8]
je 0x42c930
lea edi, [esp + 0x28]
call fcn.0042c700
mov eax, edi
mov dword [esp + 0x10], eax
mov ecx, dword [ebp + 0x10]
or ecx, dword [ebp + 0x14]
lea esi, [ebp + 0x10]
je 0x42c94a
lea edi, [esp + 0x30]
call fcn.0042c700
mov edx, edi
mov dword [esp + 0x14], edx
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
push eax
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x40]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
pop edi
pop esi
pop ebp
mov eax, 0x200
pop ebx
add esp, 0x2c
ret

Function at 0x42c9a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x46cf44
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x490018]
xor eax, esp
mov dword [esp + 0x3c], eax
push esi
mov eax, dword [0x490018]
xor eax, esp
push eax
lea eax, [esp + 0x4c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x5c]
push eax
lea eax, [esp + 0x10]
push eax
call fcn.00406360
xor esi, esi
lea ecx, [esp + 0xc]
mov dword [esp + 0x54], esi
call fcn.0042e330
cmp dword [esp + 0x24], 8
mov eax, dword [esp + 0x10]
jae 0x42c9fc
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x42ca11
test al, 0x10
je 0x42ca11
mov esi, 1
lea ecx, [esp + 0xc]
push ecx
mov dword [esp + 0x58], 0xffffffff
call fcn.004063d0
mov eax, esi
mov ecx, dword [esp + 0x4c]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.00428cb4
add esp, 0x50
ret
Function at 0x42cf70
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [edx + 4]
sub esp, 0x14
test eax, eax
jne 0x42cf8e
cmp dword [edx + 8], eax
jne 0x42cf85
xor eax, eax
add esp, 0x14
ret
test eax, eax
jne 0x42cf8e
cmp dword [edx + 8], eax
je 0x42cf7f
xor ecx, ecx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ecx
test eax, eax
jne 0x42cf9f
mov eax, dword [edx + 8]
lea ecx, [esp + 4]
push ecx
push 0
lea edx, [esp + 0x10]
push edx
push 0
push 0x47e43c
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
neg eax
sbb eax, eax
inc eax
add esp, 0x14
ret
Function at 0x42dcb0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x46c763
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push esi
push edi
mov eax, dword [0x490018]
xor eax, esp
push eax
lea eax, [esp + 0x44]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x14]
test eax, eax
jne 0x42dcfd
add esi, 0x1c
mov ecx, esi
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::clear_void_]
mov eax, esi
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x44
ret
dec eax
push eax
call dword [sym.imp.MSVCP90.dll_public:_wchar_t____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::at_unsigned_int_]
mov ecx, 0x5c
cmp cx, word [eax]
jne 0x42dd8a
mov eax, dword [esi + 0x14]
dec eax
push eax
push 0
lea edx, [esp + 0x30]
push edx
mov ecx, esi
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::substr_unsigned_int__unsigned_int_]
mov dword [esp + 0x4c], 0
mov ecx, dword [sym.imp.MSVCP90.dll_unsigned_int_const_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::npos]
mov edx, dword [ecx]
push edx
lea ecx, [esp + 0x10]
push ecx
mov ecx, eax
call fcn.0041c120
lea edx, [esp + 0xc]
lea edi, [esi + 0x1c]
push edx
mov ecx, edi
mov byte [esp + 0x50], 1
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__]
lea eax, [esp + 0xc]
push eax
mov byte [esp + 0x50], 0
call fcn.00406490
lea ecx, [esp + 0x28]
mov dword [esp + 0x4c], 0xffffffff
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov eax, edi
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x44
ret
lea edi, [esi + 0x1c]
push esi
mov ecx, edi
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__]
mov eax, edi
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x44
ret
Function at 0x42deb0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x46c7bf
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push esi
push edi
mov eax, dword [0x490018]
xor eax, esp
push eax
lea eax, [esp + 0x44]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [sym.imp.MSVCP90.dll_unsigned_int_const_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::npos]
mov ecx, dword [eax]
push ecx
push 0x5c
mov ecx, esi
call dword [sym.imp.MSVCP90.dll_public:_unsigned_int___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::rfind_wchar_t__unsigned_int_const]
mov edx, dword [sym.imp.MSVCP90.dll_unsigned_int_const_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::npos]
mov edi, eax
mov eax, dword [edx]
push eax
push 0x2e
mov ecx, esi
call dword [sym.imp.MSVCP90.dll_public:_unsigned_int___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::rfind_wchar_t__unsigned_int_const]
mov edx, dword [sym.imp.MSVCP90.dll_unsigned_int_const_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::npos]
mov ecx, dword [edx]
cmp eax, ecx
jne 0x42df29
add esi, 0x1c
mov ecx, esi
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::clear_void_]
mov eax, esi
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x44
ret
cmp edi, ecx
je 0x42df31
cmp edi, eax
ja 0x42df0a
push ecx
push eax
lea edx, [esp + 0x30]
push edx
mov ecx, esi
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::substr_unsigned_int__unsigned_int_]
mov dword [esp + 0x4c], 0
mov ecx, dword [sym.imp.MSVCP90.dll_unsigned_int_const_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::npos]
mov edx, dword [ecx]
push edx
lea ecx, [esp + 0x10]
push ecx
mov ecx, eax
call fcn.0041c120
lea edx, [esp + 0xc]
add esi, 0x1c
push edx
mov ecx, esi
mov byte [esp + 0x50], 1
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__]
lea eax, [esp + 0xc]
push eax
mov byte [esp + 0x50], 0
call fcn.00406490
lea ecx, [esp + 0x28]
mov dword [esp + 0x4c], 0xffffffff
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov eax, esi
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x44
ret
Function at 0x431dab
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x18
mov eax, dword [0x490018]
xor eax, esp
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x20]
mov edx, dword [edi + 4]
push ebx
mov ebx, dword [esp + 0x20]
push ebp
push esi
mov esi, ecx
mov ecx, dword [edi]
mov dword [esp + 0xc], eax
mov eax, dword [edi + 8]
mov dword [esp + 0x10], ecx
mov ecx, dword [edi + 0xc]
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
cmp ebx, 0x10
jb 0x431e0d
mov ebp, ebx
shr ebp, 4
mov edx, dword [esi]
mov eax, dword [esi + 4]
xor dword [esp + 0x10], edx
mov ecx, dword [esi + 8]
mov edx, dword [esi + 0xc]
xor dword [esp + 0x14], eax
xor dword [esp + 0x18], ecx
xor dword [esp + 0x1c], edx
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov edx, eax
call fcn.00431610
add esp, 4
sub ebx, 0x10
add esi, 0x10
sub ebp, 1
jne 0x431dd4
test ebx, ebx
je 0x431e41
xor ebp, ebp
test ebx, ebx
jbe 0x431e2e
lea ecx, [esp + 0x10]
sub esi, ecx
lea ecx, [ecx]
lea eax, [esp + ebp + 0x10]
mov dl, byte [esi + eax]
xor byte [eax], dl
inc ebp
cmp ebp, ebx
jb 0x431e20
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov edx, eax
call fcn.00431610
add esp, 4
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov dword [edi], ecx
mov ecx, dword [esp + 0x1c]
pop esi
mov dword [edi + 4], edx
mov dword [edi + 8], eax
mov dword [edi + 0xc], ecx
mov ecx, dword [esp + 0x1c]
pop ebp
pop ebx
xor ecx, esp
call fcn.00428cb4
add esp, 0x18
ret
Function at 0x43cee0
Capabilities:
Encode data using xor
Hash data using sha1

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push edi
mov edi, eax
mov eax, dword [edi + 0x9c]
cmp eax, 0xffffffff
je 0x43cf88
cmp eax, 0x40
jbe 0x43cf14
push esi
lea esi, [edi + 0x40]
push edi
call fcn.0043af70
add esp, 4
mov dword [edi + 0x9c], 0x14
pop esi
mov eax, dword [edi + 0x9c]
mov ecx, 0x40
sub ecx, eax
push ecx
add eax, edi
push 0
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
xor eax, eax
xor dword [edi + eax*4], 0x36363636
inc eax
cmp eax, 0x10
jb 0x43cf31
lea eax, [edi + 0x40]
push eax
push 0x40
mov ecx, edi
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
mov dword [eax + 0x18], 0xc3d2e1f0
call fcn.0043b080
add esp, 8
mov dword [edi + 0x9c], 0xffffffff
test ebx, ebx
je 0x43cf9d
mov ecx, dword [esp + 0xc]
add edi, 0x40
push edi
push ebx
call fcn.0043b080
add esp, 8
pop edi
pop ebx
ret

Function at 0x43cfa0
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esi + 0x9c]
push ebx
mov ebx, dword [esp + 8]
cmp eax, 0xffffffff
jne 0x43cfb4
or eax, eax
pop ebx
ret
lea ecx, [eax + edi]
cmp ecx, 0x40
jbe 0x43d01f
cmp eax, 0x40
ja 0x43d006
lea eax, [esi + 0x40]
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
mov dword [eax + 0x18], 0xc3d2e1f0
mov edx, dword [esi + 0x9c]
push eax
push edx
mov ecx, esi
call fcn.0043b080
add esp, 8
lea eax, [esi + 0x40]
push eax
push edi
mov ecx, ebx
call fcn.0043b080
add dword [esi + 0x9c], edi
add esp, 8
xor eax, eax
pop ebx
ret
push edi
add eax, esi
push ebx
push eax
call sub.MSVCR90.dll_memcpy
add dword [esi + 0x9c], edi
add esp, 0xc
xor eax, eax
pop ebx
ret

Function at 0x43d040
Capabilities:
Encode data using xor
Hash data using sha1

Disassembly:
sub esp, 0x18
mov eax, dword [0x490018]
xor eax, esp
mov dword [esp + 0x14], eax
cmp dword [edi + 0x9c], 0xffffffff
push ebx
mov ebx, dword [esp + 0x24]
push ebp
mov ebp, dword [esp + 0x24]
je 0x43d06f
push 0
push 0
mov eax, edi
call fcn.0043cee0
add esp, 8
push esi
lea eax, [esp + 0xc]
lea esi, [edi + 0x40]
push eax
call fcn.0043af70
add esp, 4
xor eax, eax
xor dword [edi + eax*4], 0x6a6a6a6a
inc eax
cmp eax, 0x10
jb 0x43d082
push esi
push 0x40
mov ecx, edi
mov dword [esi + 4], 0
mov dword [esi], 0
mov dword [esi + 8], 0x67452301
mov dword [esi + 0xc], 0xefcdab89
mov dword [esi + 0x10], 0x98badcfe
mov dword [esi + 0x14], 0x10325476
mov dword [esi + 0x18], 0xc3d2e1f0
call fcn.0043b080
push esi
push 0x14
lea ecx, [esp + 0x1c]
call fcn.0043b080
lea ecx, [esp + 0x1c]
push ecx
call fcn.0043af70
add esp, 0x14
pop esi
test ebx, ebx
jbe 0x43d0f6
push ebx
lea edx, [esp + 0xc]
push edx
push ebp
call sub.MSVCR90.dll_memcpy
add esp, 0xc
mov ecx, dword [esp + 0x1c]
pop ebp
pop ebx
xor ecx, esp
call fcn.00428cb4
add esp, 0x18
ret
Function at 0x43daf0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
push edi
lea edi, [ebx + 0x104]
mov ecx, 0x41
mov esi, ebx
mov dword [esp + 0x14], edi
xor ebp, ebp
rep movsd dword es:[edi], dword [esi]
lea ecx, [ecx]
mov edx, dword [ebx + 0x20c]
mov eax, 0x104
sub eax, ebp
push eax
lea ecx, [ebx + ebp]
push ecx
call edx
add ebp, eax
add esp, 8
cmp ebp, 0x104
jb 0x43db10
xor eax, eax
jmp 0x43db40
mov ecx, dword [esp + 0x14]
movzx edx, byte [ecx + eax]
movzx ecx, byte [eax + ebx + 0x105]
not dl
xor byte [eax + ebx], dl
movzx edx, byte [eax + ebx + 0x106]
not cl
xor byte [eax + ebx + 1], cl
movzx ecx, byte [eax + ebx + 0x107]
not dl
xor byte [eax + ebx + 2], dl
movzx edx, byte [eax + ebx + 0x108]
not cl
xor byte [eax + ebx + 3], cl
not dl
xor byte [eax + ebx + 4], dl
add eax, 5
cmp eax, 0x104
jb 0x43db40
mov edi, ebx
call fcn.0043da30
mov edi, dword [esp + 0x14]
call fcn.0043da30
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x441a80
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x46d11e
mov eax, dword fs:[0]
push eax
sub esp, 0x70
mov eax, dword [0x490018]
xor eax, esp
mov dword [esp + 0x68], eax
push esi
mov eax, dword [0x490018]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [esp + 0xc]
push eax
call fcn.00409040
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov dword [esp + 0x80], 0
mov dword [esp + 0x2c], ecx
mov ecx, dword [esi + 0xc]
mov esi, dword [esi + 8]
mov dword [esp + 0xc], 0x10
mov dword [esp + 0x30], edx
mov eax, dword [esi + 0x2c]
test eax, eax
je 0x441b01
lea edx, [esp + 0xc]
push edx
push ecx
mov ecx, dword [esi + 0x30]
push ecx
call eax
add esp, 0xc
jmp 0x441b06
mov eax, 0x400
and al, 1
movsx esi, al
neg esi
sbb esi, esi
lea edx, [esp + 0xc]
and esi, 0x7fffbffb
push edx
add esi, 0x80004005
mov dword [esp + 0x84], 0xffffffff
call fcn.00408700
mov eax, esi
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x68]
xor ecx, esp
call fcn.00428cb4
mov esp, ebp
pop ebp
ret 0xc
Function at 0x442ec0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x46c04f
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x490018]
xor eax, esp
mov dword [esp + 0x224], eax
push esi
push edi
mov eax, dword [0x490018]
xor eax, esp
push eax
lea eax, [esp + 0x234]
mov dword fs:[0], eax
push 0x208
lea eax, [esp + 0x2c]
push 0
push eax
mov esi, ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
lea ecx, [esp + 0xc]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_void_]
mov ecx, dword [esp + 0x244]
mov edi, dword [esp + 0x248]
push ecx
lea eax, [esp + 0x10]
mov dword [esp + 0x240], 0
call fcn.0042abc0
mov edi, dword [esp + 0x24]
mov eax, dword [esp + 0x14]
add esp, 4
cmp dword [esp + 0x24], 0x10
jae 0x442f52
lea eax, [esp + 0x10]
push eax
lea edx, [esp + 0x2c]
push 0x208
push edx
call dword [sym.imp.MSVCR90.dll_strcpy_s]
mov ecx, dword [esp + 0x258]
mov eax, dword [esi]
mov eax, dword [eax + 0x18]
add esp, 0xc
push ecx
push edi
lea edx, [esp + 0x30]
push edx
mov ecx, esi
call eax
lea ecx, [esp + 0xc]
mov esi, eax
mov dword [esp + 0x23c], 0xffffffff
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov eax, esi
mov ecx, dword [esp + 0x234]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x224]
xor ecx, esp
call fcn.00428cb4
add esp, 0x234
ret 0xc
Function at 0x447ce0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x46f457
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
mov eax, dword [0x490018]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
mov dword [esp + 0x1c], vtable.Common::Variant::ObjectBase.0
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1c], vtable.Common::Variant::Property.0
mov dword [esp + 0x30], ebx
cmp dword [esp + 0x20], ebx
jne 0x447d59
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x20]
push eax
mov eax, dword [edx + 4]
lea ecx, [esp + 0x20]
call eax
mov edx, dword [esp + 0x1c]
mov eax, dword [edx + 0xc]
lea ecx, [esp + 0x1c]
call eax
mov edx, dword [esp + 0x1c]
mov eax, dword [edx + 0x14]
lea ecx, [esp + 0x1c]
call eax
lea ecx, [esp + 0x1c]
push ecx
push 0x15
push esi
call fcn.00423f30
mov dword [esp + 0x14], vtable.Common::Variant::ObjectBase.0
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], vtable.Common::Variant::PropertyArray.0
mov byte [esp + 0x30], 1
cmp dword [esp + 0x18], ebx
je 0x447d9f
mov edx, dword [esp + 0x14]
mov eax, dword [edx + 0x10]
lea ecx, [esp + 0x14]
call eax
mov edx, dword [esp + 0x14]
mov eax, dword [edx + 0x18]
lea ecx, [esp + 0x14]
call eax
mov edx, dword [esp + 0x14]
mov eax, dword [edx + 4]
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x18]
mov dword [esp + 0x1c], ebx
call eax
mov edx, dword [esp + 0x14]
mov eax, dword [edx + 0xc]
lea ecx, [esp + 0x14]
call eax
mov edx, dword [esp + 0x14]
mov eax, dword [edx + 0x14]
lea ecx, [esp + 0x14]
call eax
lea ecx, [esp + 0x14]
push ecx
push 0x14
push esi
call fcn.00423fb0
mov dword [esp + 0xc], vtable.Common::Variant::ObjectBase.0
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], vtable.Common::Variant::PropertyArray.0
mov byte [esp + 0x30], 2
cmp dword [esp + 0x10], ebx
je 0x447e15
mov edx, dword [esp + 0xc]
mov eax, dword [edx + 0x10]
lea ecx, [esp + 0xc]
call eax
mov edx, dword [esp + 0xc]
mov eax, dword [edx + 0x18]
lea ecx, [esp + 0xc]
call eax
mov edx, dword [esp + 0xc]
mov eax, dword [edx + 4]
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x10]
mov dword [esp + 0x14], ebx
call eax
mov edx, dword [esp + 0xc]
mov eax, dword [edx + 0xc]
lea ecx, [esp + 0xc]
call eax
mov edx, dword [esp + 0xc]
mov eax, dword [edx + 0x14]
lea ecx, [esp + 0xc]
call eax
lea ecx, [esp + 0xc]
push ecx
push 0x13
push esi
call fcn.00423fb0
mov ecx, esi
call fcn.00424b50
push 0xffffffffffffffff
push 8
mov ecx, esi
call fcn.00423c10
push 0xffffffffffffffff
push 0x16
mov ecx, esi
call fcn.00423c10
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], 1
call fcn.0043f890
lea ecx, [esp + 0x14]
mov byte [esp + 0x30], bl
call fcn.0043f890
lea ecx, [esp + 0x1c]
mov dword [esp + 0x30], 0xffffffff
call fcn.004409d0
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4497b0
Capabilities:
Hash data with crc32

Disassembly:
push 0xffffffffffffffff
push 0x46e35e
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebp
push esi
push edi
mov eax, dword [0x490018]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
lea eax, [esp + 0x18]
push eax
xor edi, edi
xor esi, esi
call fcn.004494a0
mov dword [esp + 0x30], edi
mov eax, dword [esp + 0x1c]
cmp eax, edi
je 0x4497f5
lea ecx, [eax - 8]
jmp 0x4497f7
xor ecx, ecx
mov eax, dword [ecx + 0x18]
sub eax, dword [ecx + 0x14]
mov ecx, 1
sar eax, 2
cmp ecx, eax
sbb ebp, ebp
lea eax, [esp + 0x18]
neg ebp
call fcn.00413bf0
test eax, eax
jbe 0x4498d5
lea esp, [esp]
push edi
lea edx, [esp + 0x24]
push edx
lea edx, [esp + 0x20]
call fcn.00460e30
push 4
xor edx, edx
lea ecx, [esp + 0x24]
mov byte [esp + 0x34], 1
call fcn.00423940
mov dword [esp + 0x14], eax
test ebp, ebp
je 0x4498b3
mov ecx, esi
not ecx
mov edx, ecx
and edx, 0xff
movzx esi, al
xor edx, esi
shr ecx, 8
xor ecx, dword [edx*4 + 0x476610]
movzx eax, ah
mov edx, ecx
and edx, 0xff
xor edx, eax
movzx eax, byte [esp + 0x16]
shr ecx, 8
xor ecx, dword [edx*4 + 0x476610]
mov edx, ecx
and edx, 0xff
xor edx, eax
movzx eax, byte [esp + 0x17]
shr ecx, 8
xor ecx, dword [edx*4 + 0x476610]
mov edx, ecx
and edx, 0xff
shr ecx, 8
xor edx, eax
xor ecx, dword [edx*4 + 0x476610]
not ecx
mov esi, ecx
jmp 0x4498b5
mov esi, eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x30], 0
call fcn.00460ac0
lea eax, [esp + 0x18]
inc edi
call fcn.00413bf0
cmp edi, eax
jb 0x449820
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], 0xffffffff
call fcn.00460ce0
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x24
ret