joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10058630
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x400
push edi
mov edi, dword [esp + 0x40c]
test edi, edi
jne 0x1005864c
xor eax, eax
pop edi
add esp, 0x400
ret
push ebx
push esi
call fcn.10058460
mov ebx, dword [esp + 0x418]
or esi, 0xffffffff
test ebx, ebx
jne 0x1005869b
mov ecx, dword [0x1026e8ac]
mov eax, dword [esp + 0x410]
mov edi, edi
movzx ebx, byte [eax]
mov edx, esi
and edx, 0xff
xor edx, ebx
shr esi, 8
xor esi, dword [ecx + edx*4]
sub edi, 1
add eax, 1
test edi, edi
jne 0x10058670
mov eax, esi
pop esi
pop ebx
not eax
pop edi
add esp, 0x400
ret
push 0x400
lea eax, [esp + 0x10]
push 0
push eax
call fcn.1018fc10
mov edx, dword [0x1026e8ac]
mov ecx, dword [esp + 0x41c]
add esp, 0xc
push ebp
lea ecx, [ecx]
movzx eax, byte [ecx]
add dword [esp + eax*4 + 0x10], 1
mov ebp, esi
and ebp, 0xff
xor ebp, eax
shr esi, 8
xor esi, dword [edx + ebp*4]
sub edi, 1
add ecx, 1
test edi, edi
jne 0x100586c0
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
add eax, ecx
add eax, dword [esp + 0x18]
xor edx, edx
add eax, dword [esp + 0x1c]
mov ecx, 7
add eax, dword [esp + 0x20]
pop ebp
add eax, dword [esp + 0x20]
add eax, dword [esp + 0x24]
jmp 0x10058710
add edx, dword [esp + ecx*4 + 0xc]
add ecx, 1
cmp ecx, 0x80
jl 0x10058710
cmp ecx, 0x100
jge 0x1005873f
jmp 0x10058730
add eax, dword [esp + ecx*4 + 0xc]
add ecx, 1
cmp ecx, 0x100
jl 0x10058730
shr edx, 2
cmp edx, eax
sbb ecx, ecx
mov eax, esi
neg ecx
pop esi
mov word [ebx], cx
pop ebx
not eax
pop edi
add esp, 0x400
ret
Function at 0x1005c340
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x6c
mov eax, dword [0x1026d48c]
xor eax, esp
mov dword [esp + 0x68], eax
push ebx
mov ebx, dword [esp + 0x7c]
push esi
mov esi, dword [esp + 0x78]
xor eax, eax
cmp esi, eax
push edi
je 0x1005c5c8
mov edi, dword [esp + 0x80]
cmp edi, eax
je 0x1005c5c8
cmp edi, 2
mov word [esp + 0xc], 0x24
mov word [esp + 0xe], 0x25
mov word [esp + 0x10], ax
mov word [esp + 0x12], ax
mov word [esp + 0x14], 0x26
mov word [esp + 0x16], 0x27
mov word [esp + 0x18], 0x28
mov word [esp + 0x1a], 0x29
mov word [esp + 0x1c], ax
mov word [esp + 0x1e], 1
mov word [esp + 0x20], 2
mov word [esp + 0x22], 3
mov word [esp + 0x24], 4
mov word [esp + 0x26], 5
mov word [esp + 0x28], 6
mov word [esp + 0x2a], 7
mov word [esp + 0x2c], 8
mov word [esp + 0x2e], 9
mov word [esp + 0x30], ax
mov word [esp + 0x32], ax
mov word [esp + 0x34], ax
mov word [esp + 0x36], 0x2a
mov word [esp + 0x38], ax
mov word [esp + 0x3a], ax
mov word [esp + 0x3c], ax
mov word [esp + 0x3e], 0xa
mov word [esp + 0x40], 0xb
mov word [esp + 0x42], 0xc
mov word [esp + 0x44], 0xd
mov word [esp + 0x46], 0xe
mov word [esp + 0x48], 0xf
mov word [esp + 0x4a], 0x10
mov word [esp + 0x4c], 0x11
mov word [esp + 0x4e], 0x12
mov word [esp + 0x50], 0x13
mov word [esp + 0x52], 0x14
mov word [esp + 0x54], 0x15
mov word [esp + 0x56], 0x16
mov word [esp + 0x58], 0x17
mov word [esp + 0x5a], 0x18
mov word [esp + 0x5c], 0x19
mov word [esp + 0x5e], 0x1a
mov word [esp + 0x60], 0x1b
mov word [esp + 0x62], 0x1c
mov word [esp + 0x64], 0x1d
mov word [esp + 0x66], 0x1e
mov word [esp + 0x68], 0x1f
mov word [esp + 0x6a], 0x20
mov word [esp + 0x6c], 0x21
mov word [esp + 0x6e], 0x22
mov word [esp + 0x70], 0x23
jb 0x1005c5c8
mov edi, edi
cmp edi, 3
jb 0x1005c55f
movzx ax, byte [esi]
movzx eax, ax
cmp ax, 0x28
jb 0x1005c4ec
cmp ax, 0x5a
jbe 0x1005c4f1
mov eax, 0x28
movzx dx, byte [esi + 1]
add eax, 0xffffffd8
add esi, 1
movzx ecx, ax
movzx eax, word [esp + ecx*2 + 0xc]
movzx ecx, dx
cmp cx, 0x28
jb 0x1005c513
cmp cx, 0x5a
jbe 0x1005c518
mov ecx, 0x28
add ecx, 0xffffffd8
movzx ecx, cx
movzx edx, word [esp + ecx*2 + 0xc]
movzx cx, byte [esi + 1]
add esi, 1
movzx ecx, cx
cmp cx, 0x28
jb 0x1005c53a
cmp cx, 0x5a
jbe 0x1005c53f
mov ecx, 0x28
imul eax, eax, 0x2b
add eax, edx
imul eax, eax, 0x2b
add ecx, 0xffffffd8
movzx ecx, cx
add ax, word [esp + ecx*2 + 0xc]
mov ecx, ebx
add esi, 1
push eax
call fcn.1001cdf0
jmp 0x1005c5b7
movzx dx, byte [esi]
movzx eax, dx
cmp ax, 0x28
jb 0x1005c572
cmp ax, 0x5a
jbe 0x1005c577
mov eax, 0x28
movzx cx, byte [esi + 1]
add esi, 1
add eax, 0xffffffd8
movzx ecx, cx
cmp cx, 0x28
movzx eax, ax
movzx eax, word [esp + eax*2 + 0xc]
jb 0x1005c599
cmp cx, 0x5a
jbe 0x1005c59e
mov ecx, 0x28
add ecx, 0xffffffd8
movzx edx, cx
mov cl, 0x2b
imul cl
add al, byte [esp + edx*2 + 0xc]
mov ecx, ebx
add esi, 1
push eax
call fcn.10018f60
cmp edi, 3
jbe 0x1005c5c8
sub edi, 3
cmp edi, 2
jae 0x1005c4d0
mov ecx, dword [esp + 0x74]
pop edi
pop esi
pop ebx
xor ecx, esp
mov al, 1
call fcn.1018f87e
add esp, 0x6c
ret
Function at 0x1005d530
Capabilities:
Encode data using base64

Disassembly:
mov ecx, dword [esp + 0xc]
sub esp, 8
test ecx, ecx
jne 0x1005d543
xor eax, eax
add esp, 8
ret 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x18]
test ebp, ebp
mov dword [ecx], 0
je 0x1005d6e8
mov ebx, dword [esp + 0x14]
test ebx, ebx
je 0x1005d6e8
lea edx, [ebp + ebp*4]
mov eax, 0xaaaaaaab
mul edx
shr edx, 1
lea eax, [edx + 4]
push esi
push eax
mov dword [ecx], eax
call fcn.10017110
mov esi, eax
add esp, 4
test esi, esi
jne 0x1005d58e
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
mov eax, 0xaaaaaaab
mul ebp
push edi
xor edi, edi
xor ecx, ecx
shr edx, 1
mov dword [esp + 0x14], edx
je 0x1005d63d
mov dword [esp + 0x10], edx
lea ebx, [ebx]
movzx eax, byte [edi + ebx]
movzx ebp, byte [edi + ebx + 1]
add edi, 1
movzx edx, byte [edi + ebx + 1]
mov ebx, eax
add edi, 1
sar ebx, 2
and ebx, 0x3f
mov bl, byte [ebx + 0x101e89d0]
mov byte [ecx + esi], bl
and eax, 3
mov ebx, ebp
shl eax, 4
sar ebx, 4
and ebx, 0xf
or ebx, eax
movzx eax, byte [ebx + 0x101e89d0]
mov ebx, dword [esp + 0x1c]
mov byte [ecx + esi + 1], al
add ecx, 1
mov eax, edx
and ebp, 0xf
sar eax, 6
add ebp, ebp
and eax, 3
add ebp, ebp
or eax, ebp
movzx eax, byte [eax + 0x101e89d0]
add ecx, 1
mov byte [ecx + esi], al
and edx, 0x3f
mov dl, byte [edx + 0x101e89d0]
add ecx, 1
mov byte [ecx + esi], dl
add edi, 1
add ecx, 1
sub dword [esp + 0x10], 1
jne 0x1005d5b0
mov ebp, dword [esp + 0x20]
mov edx, dword [esp + 0x14]
lea eax, [edx + edx*2]
sub ebp, eax
sub ebp, 1
je 0x1005d69a
sub ebp, 1
jne 0x1005d6d2
movzx eax, byte [edi + ebx]
movzx edi, byte [edi + ebx + 1]
mov edx, eax
sar edx, 2
and edx, 0x3f
movzx edx, byte [edx + 0x101e89d0]
mov byte [ecx + esi], dl
mov edx, edi
sar edx, 4
and eax, 3
and edx, 0xf
shl eax, 4
or edx, eax
mov al, byte [edx + 0x101e89d0]
add ecx, 1
mov byte [ecx + esi], al
add ecx, 1
and edi, 0xf
movzx edx, byte [edi*4 + 0x101e89d0]
mov byte [ecx + esi], dl
jmp 0x1005d6c8
movzx eax, byte [edi + ebx]
mov edx, eax
sar edx, 2
and edx, 0x3f
mov dl, byte [edx + 0x101e89d0]
and eax, 3
mov byte [ecx + esi], dl
shl eax, 4
mov al, byte [eax + 0x101e89d0]
add ecx, 1
mov byte [ecx + esi], al
add ecx, 1
mov byte [ecx + esi], 0x3d
add ecx, 1
mov byte [ecx + esi], 0x3d
add ecx, 1
mov edx, dword [esp + 0x24]
pop edi
mov byte [ecx + esi], 0
mov eax, esi
pop esi
pop ebp
mov dword [edx], ecx
pop ebx
add esp, 8
ret 0xc
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 0xc

Function at 0x10064aa0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1019e8d8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
mov eax, dword [0x1026d48c]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
test esi, esi
je 0x10064acf
lea eax, [esi + 8]
jmp 0x10064ad1
xor eax, eax
push eax
lea ecx, [esp + 0xc]
call fcn.1005ff60
lea ecx, [esi + 0xa4]
mov dword [esp + 0x1c], 0
call fcn.100cb770
lea ecx, [esi + 0xb8]
call fcn.100cb770
lea ecx, [esi + 0x30]
call fcn.10010600
lea ecx, [esp + 8]
mov dword [esi + 0x2c], 0
mov dword [esp + 0x1c], 0xffffffff
call fcn.1005ff90
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x18
ret
Function at 0x10067680
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10197528
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
mov eax, dword [0x1026d48c]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
lea ecx, [esp + 8]
call fcn.100182e0
mov esi, dword [esp + 0x34]
lea eax, [esp + 8]
push eax
mov ecx, esi
mov dword [esp + 0x30], 0
call fcn.1008be90
push eax
call fcn.10067580
add esp, 8
push 0
lea ecx, [esp + 0xc]
call fcn.10018f60
lea ecx, [esp + 8]
push ecx
mov ecx, esi
call fcn.10012b40
lea ecx, [esp + 8]
mov dword [esp + 0x2c], 0xffffffff
call fcn.10018a90
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x28
ret

Function at 0x10067d00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10197528
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
mov eax, dword [0x1026d48c]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
lea ecx, [esp + 8]
call fcn.100182e0
mov esi, dword [esp + 0x34]
push esi
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0
call fcn.1001cca0
push esi
lea ecx, [esp + 0xc]
call fcn.100f6330
push eax
lea ecx, [esp + 0x10]
call fcn.1008bea0
push eax
call fcn.10067860
add esp, 0xc
lea ecx, [esp + 8]
mov dword [esp + 0x2c], 0xffffffff
call fcn.10018a90
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x28
ret

Function at 0x10068310
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
mov esi, dword [esp + 0x14]
test esi, esi
push edi
mov edi, dword [esp + 0x1c]
mov byte [ebp], 0
mov ebx, ecx
mov dword [edi], 0
je 0x100683ef
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x100683ef
mov eax, dword [ebx + 8]
cmp eax, 0xffffffff
je 0x10068390
push 0
push edi
push esi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1006837e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x26
je 0x10068383
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x10068403
push eax
call fcn.10061530
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 0x14
cmp dword [edi], 0
jne 0x10068387
mov byte [ebp], 1
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
ret 0x14
mov eax, dword [ebx + 4]
test eax, eax
je 0x100683d2
push eax
push esi
push 1
push ecx
call dword [sym.imp.MSVCR80.dll_fread]
add esp, 0x10
cmp eax, esi
mov dword [edi], eax
je 0x10068387
mov eax, dword [ebx + 4]
push eax
call dword [sym.imp.MSVCR80.dll_ferror]
add esp, 4
test eax, eax
je 0x10068383
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x10068403
call fcn.10061460
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 0x14
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x10068403
mov edx, dword [ecx]
mov eax, dword [edx + 0x14]
push str.No_file_is_open.
call eax
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 0x14
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x10068403
mov edx, dword [ecx]
mov eax, dword [edx + 0x14]
push str.NULL_buf_or_bufSize
call eax
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 0x14
Function at 0x10068410
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp dword [ecx + 8], 0xffffffff
mov dword [esp], ecx
jne 0x1006843a
cmp dword [ecx + 4], 0
jne 0x1006843a
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x10068434
mov eax, dword [ecx]
mov edx, dword [eax + 0x14]
push str.Failed_to_write_because_file_is_not_open.
call edx
xor al, al
pop ecx
ret 0x14
push ebx
mov ebx, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x1c]
test edi, edi
je 0x10068455
mov dword [edi], 0
mov dword [edi + 4], 0
push ebp
mov ebp, dword [esp + 0x18]
mov eax, ebp
or eax, dword [esp + 0x1c]
push esi
je 0x1006852e
mov edx, dword [esp + 0x18]
jmp 0x10068470
cmp dword [esp + 0x20], 0
jl 0x10068488
jg 0x10068481
cmp ebp, 0x989680
jbe 0x10068488
mov esi, 0x989680
jmp 0x1006848a
mov esi, ebp
mov eax, dword [ecx + 8]
cmp eax, 0xffffffff
je 0x100684e8
push 0
lea ecx, [esp + 0x1c]
push ecx
push esi
push ebx
push eax
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x100684b6
mov edx, dword [esp + 0x18]
cmp edx, esi
je 0x10068508
mov esi, dword [esp + 0x28]
test esi, esi
je 0x100684de
mov edx, dword [esi]
mov eax, dword [edx + 0x24]
push 1
push str.WriteFileError
mov ecx, esi
call eax
mov ecx, esi
call fcn.10061460
mov edx, dword [esi]
mov eax, dword [edx + 0x28]
mov ecx, esi
call eax
pop esi
pop ebp
pop edi
xor al, al
pop ebx
pop ecx
ret 0x14
mov eax, dword [ecx + 4]
test eax, eax
je 0x1006850c
push eax
push 1
push esi
push ebx
call dword [sym.imp.MSVCR80.dll_fwrite]
add esp, 0x10
cmp eax, 1
jne 0x10068538
mov edx, esi
mov dword [esp + 0x18], edx
mov ecx, dword [esp + 0x10]
add ebx, esi
sub ebp, esi
mov eax, 0
sbb dword [esp + 0x20], eax
cmp edi, eax
je 0x10068522
add dword [edi], edx
adc dword [edi + 4], eax
mov eax, ebp
or eax, dword [esp + 0x20]
jne 0x10068470
pop esi
pop ebp
pop edi
mov al, 1
pop ebx
pop ecx
ret 0x14
mov ecx, dword [esp + 0x28]
test ecx, ecx
je 0x1006854c
mov edx, dword [ecx]
mov eax, dword [edx + 0x14]
push str.fwrite_failed.
call eax
pop esi
pop ebp
pop edi
xor al, al
pop ebx
pop ecx
ret 0x14
Function at 0x10068560
Capabilities:
Get file size

Disassembly:
push 0xffffffffffffffff
push 0x1019184b
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x1026d48c]
xor eax, esp
mov dword [esp + 0x74], eax
push ebx
push esi
push edi
mov eax, dword [0x1026d48c]
xor eax, esp
push eax
lea eax, [esp + 0x88]
mov dword fs:[0], eax
mov eax, dword [ecx + 8]
cmp eax, 0xffffffff
mov esi, dword [esp + 0x98]
je 0x10068609
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x10068605
test esi, esi
je 0x10068605
lea ecx, [esp + 0x10]
call fcn.10010fb0
lea ecx, [esp + 0x10]
mov dword [esp + 0x90], 0
call fcn.10015b50
mov edi, dword [esi]
lea ecx, [esp + 0x10]
call fcn.1008be90
push eax
mov eax, dword [edi + 0x14]
mov ecx, esi
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0x14]
push str.Failed_to_get_file_size__32_
mov ecx, esi
call eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x90], ebx
call fcn.10011070
mov eax, ebx
jmp 0x10068626
mov ecx, dword [ecx + 4]
test ecx, ecx
je 0x10068623
push ecx
call dword [sym.imp.MSVCR80.dll__fileno]
push eax
call dword [sym.imp.MSVCR80.dll__filelength]
add esp, 8
jmp 0x10068626
or eax, 0xffffffff
mov ecx, dword [esp + 0x88]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x74]
xor ecx, esp
call fcn.1018f87e
add esp, 0x84
ret 4

Function at 0x10068650
Capabilities:
Get file size

Disassembly:
push 0xffffffffffffffff
push 0x1019f21b
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
mov eax, dword [0x1026d48c]
xor eax, esp
mov dword [esp + 0x78], eax
push esi
push edi
mov eax, dword [0x1026d48c]
xor eax, esp
push eax
lea eax, [esp + 0x88]
mov dword fs:[0], eax
mov esi, dword [esp + 0x98]
mov edi, ecx
mov eax, dword [edi + 8]
cmp eax, 0xffffffff
je 0x10068756
lea ecx, [esp + 0xc]
push ecx
push eax
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x10068746
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x10068746
test esi, esi
je 0x1006871b
lea ecx, [esp + 0x10]
call fcn.10010fb0
lea ecx, [esp + 0x10]
mov dword [esp + 0x90], 0
call fcn.10015b50
mov edi, dword [esi]
lea ecx, [esp + 0x10]
call fcn.1008be90
mov edx, dword [edi + 0x14]
push eax
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x14]
push str.Failed_to_get_file_size__64_
mov ecx, esi
call edx
lea ecx, [esp + 0x10]
mov dword [esp + 0x90], 0xffffffff
call fcn.10011070
or eax, 0xffffffff
or edx, 0xffffffff
mov ecx, dword [esp + 0x88]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x78]
xor ecx, esp
call fcn.1018f87e
add esp, 0x88
ret 4
mov eax, dword [esp + 0xc]
push eax
push edi
call fcn.10069f50
add esp, 8
jmp 0x10068721
mov eax, dword [edi + 4]
test eax, eax
je 0x1006871b
push eax
call dword [sym.imp.MSVCR80.dll_fflush]
mov edi, dword [edi + 4]
push edi
call dword [sym.imp.MSVCR80.dll__fileno]
push eax
call dword [sym.imp.MSVCR80.dll__filelengthi64]
add esp, 0xc
jmp 0x10068721
Function at 0x10069070
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 4], 0x67452301
mov dword [ecx + 8], 0xefcdab89
mov dword [ecx + 0xc], 0x98badcfe
mov dword [ecx + 0x10], 0x10325476
ret

Function at 0x100690a0
Capabilities:
Hash data with md5

Disassembly:
mov eax, ecx
xor ecx, ecx
mov dword [eax], vtable._ckMd5.0
mov dword [eax + 0x18], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 4], 0x67452301
mov dword [eax + 8], 0xefcdab89
mov dword [eax + 0xc], 0x98badcfe
mov dword [eax + 0x10], 0x10325476
ret

Function at 0x10069280
Capabilities:
Hash data with md5

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0xc]
xor eax, eax
mov ecx, edi
mov dword [esi + 0x18], eax
mov dword [esi + 0x14], eax
mov dword [esi + 4], 0x67452301
mov dword [esi + 8], 0xefcdab89
mov dword [esi + 0xc], 0x98badcfe
mov dword [esi + 0x10], 0x10325476
call fcn.1000f630
push eax
mov ecx, edi
call fcn.1008be90
push eax
mov ecx, esi
call fcn.100690e0
mov eax, dword [esp + 0x10]
push eax
mov ecx, esi
call fcn.100691b0
pop edi
pop esi
ret 8

Function at 0x100692e0
Capabilities:
Hash data with md5

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esp + 8]
xor eax, eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x14], eax
mov eax, dword [esp + 0xc]
push eax
push ecx
mov ecx, esi
mov dword [esi + 4], 0x67452301
mov dword [esi + 8], 0xefcdab89
mov dword [esi + 0xc], 0x98badcfe
mov dword [esi + 0x10], 0x10325476
call fcn.100690e0
mov edx, dword [esp + 0x10]
push edx
mov ecx, esi
call fcn.100691b0
pop esi
ret 0xc

Function at 0x10069330
Capabilities:
Hash data with md5

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
xor ebx, ebx
push esi
mov esi, ecx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 4], 0x67452301
mov dword [esi + 8], 0xefcdab89
mov dword [esi + 0xc], 0x98badcfe
mov dword [esi + 0x10], 0x10325476
cmp dword [ebp + 0x804], ebx
jbe 0x10069390
push edi
lea edi, [ebp + 4]
lea esp, [esp]
mov eax, dword [edi + 0x400]
mov ecx, dword [edi]
push eax
push ecx
mov ecx, esi
call fcn.100690e0
add ebx, 1
add edi, 4
cmp ebx, dword [ebp + 0x804]
jb 0x10069370
pop edi
mov edx, dword [esp + 0x14]
push edx
mov ecx, esi
call fcn.100691b0
pop esi
pop ebp
pop ebx
ret 8

Function at 0x100693b0
Capabilities:
Hash data with md5

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0xc]
xor eax, eax
mov ecx, edi
mov dword [esi + 0x18], eax
mov dword [esi + 0x14], eax
mov dword [esi + 4], 0x67452301
mov dword [esi + 8], 0xefcdab89
mov dword [esi + 0xc], 0x98badcfe
mov dword [esi + 0x10], 0x10325476
call fcn.100f6330
push eax
mov ecx, edi
call fcn.1008bea0
push eax
mov ecx, esi
call fcn.100690e0
mov eax, dword [esp + 0x10]
push eax
mov ecx, esi
call fcn.100691b0
pop edi
pop esi
ret 8
Function at 0x10069410
Capabilities:
Hash data with md5

Disassembly:
sub esp, 8
push ebx
mov ebx, ecx
push esi
push edi
xor esi, esi
push 0x4e28
mov dword [ebx + 0x18], esi
mov dword [ebx + 0x14], esi
mov dword [ebx + 4], 0x67452301
mov dword [ebx + 8], 0xefcdab89
mov dword [ebx + 0xc], 0x98badcfe
mov dword [ebx + 0x10], 0x10325476
call fcn.10017110
mov edi, eax
add esp, 4
cmp edi, esi
jne 0x1006945a
pop edi
pop esi
xor al, al
pop ebx
add esp, 8
ret 0x14
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x10], esi
mov byte [esp + 0xf], 1
call fcn.10082b40
test al, al
jne 0x100694fe
push ebp
mov ebp, dword [esp + 0x20]
lea esp, [esp]
mov eax, dword [esp + 0x24]
push eax
push ebp
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x28]
push 0x4e20
push edi
call fcn.10083620
test al, al
je 0x100694fd
mov esi, dword [esp + 0x14]
test esi, esi
je 0x100694d9
mov ecx, dword [esp + 0x2c]
test ecx, ecx
je 0x100694b9
push esi
push edi
call fcn.10019380
mov esi, dword [esp + 0x14]
push esi
push edi
mov ecx, ebx
call fcn.100690e0
test ebp, ebp
je 0x100694d9
mov edx, dword [esp + 0x24]
push edx
push 0
push esi
mov ecx, ebp
call fcn.1007ab10
test al, al
jne 0x100694e8
mov ecx, dword [esp + 0x1c]
call fcn.10082b40
test al, al
je 0x10069480
jmp 0x100694fd
mov ecx, dword [esp + 0x24]
mov eax, dword [ecx]
mov edx, dword [eax + 0x14]
push str.Digest_MD5_aborted_by_application
call edx
mov byte [esp + 0x13], 0
pop ebp
push edi
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
mov eax, dword [esp + 0x28]
add esp, 4
push eax
mov ecx, ebx
call fcn.100691b0
mov al, byte [esp + 0xf]
pop edi
pop esi
pop ebx
add esp, 8
ret 0x14

Function at 0x10069540
Capabilities:
Hash data using djb2

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 8], 0x6119a407
je 0x1006955c
push 0
call fcn.100c11a0
add esp, 4
xor eax, eax
pop esi
ret 4
mov ecx, dword [esp + 8]
call fcn.1008be90
mov edx, eax
movsx ecx, byte [edx]
test ecx, ecx
mov eax, 0x1505
je 0x10069588
push edi
mov edi, eax
shl edi, 5
add edx, 1
add edi, ecx
movsx ecx, byte [edx]
add eax, edi
test ecx, ecx
jne 0x10069574
pop edi
xor edx, edx
div dword [esi + 0xc]
pop esi
mov eax, edx
ret 4
Function at 0x10077980
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [esp + 8]
cmp dword [ecx + 0x10], 1
je 0x100779ad
mov eax, dword [ecx + 8]
test eax, eax
je 0x100779ad
jle 0x100779a4
mov eax, dword [ecx + 4]
test byte [eax], 1
je 0x100779a4
mov dword [esp + 8], ecx
jmp fcn.10075c20
mov dword [esp + 8], ecx
jmp fcn.10076fe0
mov eax, 0xfffffffd
ret

Function at 0x1007a4e0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x10197f33
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1026d48c]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
call fcn.10061940
lea edi, [esi + 8]
xor ebx, ebx
mov ecx, edi
mov dword [esp + 0x20], ebx
mov dword [esi], vtable.ProgressMonitor.0
call fcn.100c1410
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x28]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x88], eax
mov eax, dword [esp + 0x38]
cmp eax, ebx
mov byte [esp + 0x20], 1
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebp
mov byte [esi + 0x68], bl
mov byte [esi + 0x69], bl
mov dword [esi + 0x80], ebx
mov dword [esi + 0x84], ebx
mov dword [esi + 0x8c], ecx
mov dword [esi + 0x90], ebx
mov byte [esi + 0x94], bl
mov byte [esi + 0x95], bl
mov byte [esi + 0x96], bl
jg 0x1007a58b
jl 0x1007a585
mov ecx, dword [esp + 0x34]
cmp ecx, ebx
jae 0x1007a58f
xor ecx, ecx
xor eax, eax
jmp 0x1007a58f
mov ecx, dword [esp + 0x34]
mov dword [esi + 0x78], ebx
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x70], ecx
mov dword [esi + 0x74], eax
call sub.KERNEL32.dll_GetTickCount
mov dword [esi + 0x6c], eax
mov eax, dword [esi + 0x8c]
cmp eax, 0xa
jae 0x1007a5ba
mov dword [esi + 0x8c], 0x64
jmp 0x1007a5cb
cmp eax, 0x186a0
jbe 0x1007a5cb
mov dword [esi + 0x8c], 0x186a0
cmp ebp, ebx
jne 0x1007a5d2
mov dword [esi + 0x64], edi
mov ecx, dword [esi + 0x64]
cmp ecx, ebx
je 0x1007a5e1
call fcn.100c0f60
mov byte [esi + 0x68], al
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0x14