joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402112
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
call fcn.004020c0
push 0x8800
push dword [ebp + 8]
call sub.MSVCRT.dll__open
add esp, 8
mov ebx, eax
test ebx, ebx
jne 0x402136
xor eax, eax
pop ebx
pop ebp
ret
push 2
push 0
push ebx
call sub.MSVCRT.dll__lseek
add esp, 0xc
mov dword [0x406250], eax
mov edx, dword [0x406250]
add edx, 9
push edx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov dword [0x40624c], eax
test eax, eax
jne 0x40216e
xor edx, edx
mov dword [0x406250], edx
xor eax, eax
pop ebx
pop ebp
ret
push 0
push 0
push ebx
call sub.MSVCRT.dll__lseek
add esp, 0xc
push dword [0x406250]
push dword [0x40624c]
push ebx
call sub.MSVCRT.dll__read
add esp, 0xc
test eax, eax
jne 0x40219e
call fcn.004020c0
xor eax, eax
pop ebx
pop ebp
ret
push ebx
call sub.MSVCRT.dll__close
pop ecx
mov al, 1
pop ebx
pop ebp
ret

Function at 0x4022c6
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov byte [0x406249], 0
push 0
push dword [0x40771c]
call sub.KERNEL32.dll_TerminateThread
lea eax, [ebp - 4]
push eax
push dword [0x40771c]
call sub.KERNEL32.dll_GetExitCodeThread
test eax, eax
setne al
and eax, 1
test al, al
je 0x402302
cmp dword [ebp - 4], 0x103
je 0x4022de
pop ecx
pop ebp
ret

Function at 0x402488
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, 0x4076d0
mov esi, 0x4076b8
call fcn.0040246f
call fcn.0040244a
call fcn.00402436
test al, al
jne 0x4024b1
xor eax, eax
jmp 0x402565
push 0x407718
push 0
push 0
push 0x40220c
push 0
push 0
call sub.KERNEL32.dll_CreateThread
mov dword [0x40771c], eax
cmp dword [0x40771c], 0
jne 0x4024dd
xor eax, eax
jmp 0x402565
push 2
push dword [0x40771c]
call sub.KERNEL32.dll_SetThreadPriority
mov word [ebx], 1
mov dx, word [esi + 8]
mov word [ebx + 2], dx
mov ecx, dword [esi + 4]
mov dword [ebx + 4], ecx
mov eax, dword [esi + 4]
imul dword [esi + 8]
mov edx, dword [esi + 0x10]
test edx, edx
jns 0x40250d
add edx, 7
sar edx, 3
imul edx
mov dword [ebx + 8], eax
mov ecx, dword [esi + 0x10]
test ecx, ecx
jns 0x40251f
add ecx, 7
sar ecx, 3
imul ecx, dword [esi + 8]
mov word [ebx + 0xc], cx
mov ax, word [esi + 0x10]
mov word [ebx + 0xe], ax
mov word [ebx + 0x10], 0
push 0x20000
push 0
push dword [0x407718]
push ebx
push 0xffffffffffffffff
push 0x4076cc
call sub.WINMM.dll_waveOutOpen
test eax, eax
sete dl
and edx, 1
mov byte [0x406248], dl
mov al, byte [0x406248]
pop esi
pop ebx
pop ebp
ret
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x427b30
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x427b36
ret
Function at 0x101ed92
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x28
push 0x1002ec8
call fcn.0101ef18
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp word [eax], 0x5a4d
jne 0x101edcd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x101edcd
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x101ede5
cmp eax, 0x20b
je 0x101edd2
mov dword [ebp - 0x1c], edi
jmp 0x101edf9
cmp dword [ecx + 0x84], 0xe
jbe 0x101edcd
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x101edf3
cmp dword [ecx + 0x74], 0xe
jbe 0x101edcd
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
push 1
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x1042bc8], 0xffffffff
or dword [0x1042bcc], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x1023760]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x102375c]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x1042bd0], eax
call fcn.0101f0b8
cmp dword [0x1020c20], edi
jne 0x101ee54
push fcn.0101f0b8
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.0101f0a6
push 0x10012e0
push 0x10012dc
call sub.msvcrt.dll__initterm
mov eax, dword [0x1023758]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push dword [0x1023754]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x30], eax
push 0x10012d8
push 0x10012d0
call sub.msvcrt.dll__initterm
mov eax, dword [ebp - 0x24]
mov ecx, dword [sym.imp.msvcrt.dll___initenv]
mov dword [ecx], eax
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call fcn.0100e1d4
add esp, 0x30
mov esi, eax
mov dword [ebp - 0x34], esi
cmp dword [ebp - 0x1c], edi
jne 0x101eecb
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x101ef00
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.0101ef51
ret
Function at 0x409470
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x44f848
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push esi
push edi
mov esi, ecx
mov edx, dword [esi + 0x9c]
mov edi, dword [esp + 0x50]
mov eax, dword [esp + 0x44]
lea ecx, [esp + 0xc]
xor ebx, ebx
push ecx
push ebx
push 0x1007
push edx
mov dword [esp + 0x4c], 2
mov dword [esp + 0x1c], 9
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], ebx
mov dword [esp + 0x30], eax
call dword [0x453860]
mov eax, dword [esp + 0x48]
add esi, 0x7c
push eax
push 1
push edi
mov ecx, esi
call fcn.0040f9f8
mov ecx, dword [esp + 0x4c]
push ecx
push 2
push edi
mov ecx, esi
call fcn.0040f9f8
lea ecx, [esp + 0x44]
mov byte [esp + 0x3c], 1
call fcn.0040f7be
lea ecx, [esp + 0x48]
mov byte [esp + 0x3c], bl
call fcn.0040f7be
lea ecx, [esp + 0x4c]
mov dword [esp + 0x3c], 0xffffffff
call fcn.0040f7be
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x34
ret 0x10
Function at 0x40b580
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x44fd20
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
mov esi, ecx
lea ecx, [esp + 8]
call fcn.0040f7ca
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0
call fcn.0040f7ca
push 0x45f2b0
lea eax, [esp + 0x14]
mov ebx, 1
push 0x462f44
push eax
mov byte [esp + 0x30], bl
call fcn.0040f824
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 2
call fcn.0040f806
lea ecx, [esp + 0x10]
mov byte [esp + 0x24], bl
call fcn.0040f7be
mov ecx, dword [esp + 0xc]
push 0x80
push ecx
call dword [0x4531cc]
mov edx, dword [esp + 0xc]
push edx
call dword [0x4531c0]
test eax, eax
jne 0x40b63f
lea ecx, [esp + 0xc]
mov byte [esp + 0x24], al
call fcn.0040f7be
lea ecx, [esp + 8]
mov dword [esp + 0x24], 0xffffffff
call fcn.0040f7be
xor eax, eax
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop esi
pop ebx
add esp, 0x20
ret
push 0x45f2c0
lea ecx, [esp + 0xc]
call fcn.0040f81e
lea eax, [esp + 8]
push 0x462f44
lea ecx, [esp + 0x14]
push eax
push ecx
call fcn.0040f8d2
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 3
call fcn.0040f806
lea ecx, [esp + 0x10]
mov byte [esp + 0x24], bl
call fcn.0040f7be
mov edx, dword [esp + 8]
push 0
push edx
call dword [0x4531bc]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push 0x45fa0c
call fcn.0040f7fa
push ecx
mov byte [esp + 0x2c], 4
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x462f44
call fcn.0040f7ee
mov byte [esp + 0x2c], bl
call fcn.0040e150
add esp, 4
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x45fa0c
call fcn.0040f7fa
push ecx
mov byte [esp + 0x2c], 5
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x462f44
call fcn.0040f7ee
mov ecx, esi
mov byte [esp + 0x2c], bl
call fcn.0040a260
lea ecx, [esi + 0x78]
call fcn.0040f830
lea ecx, [esi + 0xbc]
call fcn.0040f830
push 0
mov ecx, esi
mov dword [esi + 0x60], 0
call fcn.0040f8a8
lea ecx, [esp + 0xc]
mov byte [esp + 0x24], 0
call fcn.0040f7be
lea ecx, [esp + 8]
mov dword [esp + 0x24], 0xffffffff
call fcn.0040f7be
mov ecx, dword [esp + 0x1c]
mov eax, ebx
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x20
ret

Function at 0x40cdc0
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x412960
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x44ebb8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 0
call fcn.0041f7ca
lea ecx, [esp + 8]
mov byte [esp + 0x20], 1
call fcn.0041f7ca
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 2
call fcn.0041f7ca
mov ebx, 3
lea eax, [esp + 0x14]
push ebx
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0x28], bl
call fcn.0041f80c
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x24], 4
call fcn.0041f806
lea ecx, [esp + 0x14]
mov byte [esp + 0x20], bl
call fcn.0041f7be
lea ecx, [esp + 0x10]
push 0x45f420
lea edx, [esp + 0x18]
push ecx
push edx
call fcn.0041f824
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x24], 5
call fcn.0041f806
lea ecx, [esp + 0x14]
mov byte [esp + 0x20], bl
call fcn.0041f7be
lea eax, [esp + 8]
push 0x45f310
lea ecx, [esp + 0x18]
push eax
push ecx
call fcn.0041f824
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x24], 6
call fcn.0041f806
lea ecx, [esp + 0x14]
mov byte [esp + 0x20], bl
call fcn.0041f7be
push 0x462f40
lea ecx, [esp + 0x10]
call fcn.0041f83c
mov edx, dword [esp + 8]
push 0
push edx
call dword [0x4531c8]
mov esi, eax
test esi, esi
je 0x412a69
mov eax, dword [esp + 8]
push 2
push eax
call dword [0x4531cc]
mov ecx, dword [esp + 8]
mov edx, dword [0x462f44]
push ecx
push edx
call fcn.0041e670
mov ecx, dword [esp + 0x14]
add esp, 8
test eax, eax
mov eax, dword [0x462f3c]
push eax
push ecx
jne 0x412af3
call fcn.0041e670
add esp, 8
test esi, esi
je 0x412aa3
mov edx, dword [esp + 8]
push edx
call dword [0x4531b0]
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 2
call fcn.0041f7be
lea ecx, [esp + 8]
mov byte [esp + 0x20], 1
call fcn.0041f7be
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], 0
call fcn.0041f7be
lea ecx, [esp + 0x28]
mov dword [esp + 0x20], 0xffffffff
call fcn.0041f7be
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret 4
call fcn.0041e670
add esp, 8
test esi, esi
je 0x412b0a
mov edx, dword [esp + 8]
push edx
call dword [0x4531b0]
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 2
call fcn.0041f7be
lea ecx, [esp + 8]
mov byte [esp + 0x20], 1
call fcn.0041f7be
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], 0
call fcn.0041f7be
lea ecx, [esp + 0x28]
mov dword [esp + 0x20], 0xffffffff
call fcn.0041f7be
mov ecx, dword [esp + 0x18]
pop esi
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 4
Function at 0x419470
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x44f848
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push esi
push edi
mov esi, ecx
mov edx, dword [esi + 0x9c]
mov edi, dword [esp + 0x50]
mov eax, dword [esp + 0x44]
lea ecx, [esp + 0xc]
xor ebx, ebx
push ecx
push ebx
push 0x1007
push edx
mov dword [esp + 0x4c], 2
mov dword [esp + 0x1c], 9
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], ebx
mov dword [esp + 0x30], eax
call dword [0x453860]
mov eax, dword [esp + 0x48]
add esi, 0x7c
push eax
push 1
push edi
mov ecx, esi
call fcn.0041f9f8
mov ecx, dword [esp + 0x4c]
push ecx
push 2
push edi
mov ecx, esi
call fcn.0041f9f8
lea ecx, [esp + 0x44]
mov byte [esp + 0x3c], 1
call fcn.0041f7be
lea ecx, [esp + 0x48]
mov byte [esp + 0x3c], bl
call fcn.0041f7be
lea ecx, [esp + 0x4c]
mov dword [esp + 0x3c], 0xffffffff
call fcn.0041f7be
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x34
ret 0x10
Function at 0x41b580
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x44fd20
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
mov esi, ecx
lea ecx, [esp + 8]
call fcn.0041f7ca
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0
call fcn.0041f7ca
push 0x45f2b0
lea eax, [esp + 0x14]
mov ebx, 1
push 0x462f44
push eax
mov byte [esp + 0x30], bl
call fcn.0041f824
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 2
call fcn.0041f806
lea ecx, [esp + 0x10]
mov byte [esp + 0x24], bl
call fcn.0041f7be
mov ecx, dword [esp + 0xc]
push 0x80
push ecx
call dword [0x4531cc]
mov edx, dword [esp + 0xc]
push edx
call dword [0x4531c0]
test eax, eax
jne 0x41b63f
lea ecx, [esp + 0xc]
mov byte [esp + 0x24], al
call fcn.0041f7be
lea ecx, [esp + 8]
mov dword [esp + 0x24], 0xffffffff
call fcn.0041f7be
xor eax, eax
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop esi
pop ebx
add esp, 0x20
ret
push 0x45f2c0
lea ecx, [esp + 0xc]
call fcn.0041f81e
lea eax, [esp + 8]
push 0x462f44
lea ecx, [esp + 0x14]
push eax
push ecx
call fcn.0041f8d2
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 3
call fcn.0041f806
lea ecx, [esp + 0x10]
mov byte [esp + 0x24], bl
call fcn.0041f7be
mov edx, dword [esp + 8]
push 0
push edx
call dword [0x4531bc]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push 0x45fa0c
call fcn.0041f7fa
push ecx
mov byte [esp + 0x2c], 4
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x462f44
call fcn.0041f7ee
mov byte [esp + 0x2c], bl
call fcn.0041e150
add esp, 4
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x45fa0c
call fcn.0041f7fa
push ecx
mov byte [esp + 0x2c], 5
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x462f44
call fcn.0041f7ee
mov ecx, esi
mov byte [esp + 0x2c], bl
call fcn.0041a260
lea ecx, [esi + 0x78]
call fcn.0041f830
lea ecx, [esi + 0xbc]
call fcn.0041f830
push 0
mov ecx, esi
mov dword [esi + 0x60], 0
call fcn.0041f8a8
lea ecx, [esp + 0xc]
mov byte [esp + 0x24], 0
call fcn.0041f7be
lea ecx, [esp + 8]
mov dword [esp + 0x24], 0xffffffff
call fcn.0041f7be
mov ecx, dword [esp + 0x1c]
mov eax, ebx
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x20
ret

Function at 0x41cdc0
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x422960
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x44ebb8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 0
call fcn.0042f7ca
lea ecx, [esp + 8]
mov byte [esp + 0x20], 1
call fcn.0042f7ca
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 2
call fcn.0042f7ca
mov ebx, 3
lea eax, [esp + 0x14]
push ebx
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0x28], bl
call fcn.0042f80c
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x24], 4
call fcn.0042f806
lea ecx, [esp + 0x14]
mov byte [esp + 0x20], bl
call fcn.0042f7be
lea ecx, [esp + 0x10]
push 0x45f420
lea edx, [esp + 0x18]
push ecx
push edx
call fcn.0042f824
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x24], 5
call fcn.0042f806
lea ecx, [esp + 0x14]
mov byte [esp + 0x20], bl
call fcn.0042f7be
lea eax, [esp + 8]
push 0x45f310
lea ecx, [esp + 0x18]
push eax
push ecx
call fcn.0042f824
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x24], 6
call fcn.0042f806
lea ecx, [esp + 0x14]
mov byte [esp + 0x20], bl
call fcn.0042f7be
push 0x462f40
lea ecx, [esp + 0x10]
call fcn.0042f83c
mov edx, dword [esp + 8]
push 0
push edx
call dword [0x4531c8]
mov esi, eax
test esi, esi
je 0x422a69
mov eax, dword [esp + 8]
push 2
push eax
call dword [0x4531cc]
mov ecx, dword [esp + 8]
mov edx, dword [0x462f44]
push ecx
push edx
call fcn.0042e670
mov ecx, dword [esp + 0x14]
add esp, 8
test eax, eax
mov eax, dword [0x462f3c]
push eax
push ecx
jne 0x422af3
call fcn.0042e670
add esp, 8
test esi, esi
je 0x422aa3
mov edx, dword [esp + 8]
push edx
call dword [0x4531b0]
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 2
call fcn.0042f7be
lea ecx, [esp + 8]
mov byte [esp + 0x20], 1
call fcn.0042f7be
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], 0
call fcn.0042f7be
lea ecx, [esp + 0x28]
mov dword [esp + 0x20], 0xffffffff
call fcn.0042f7be
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret 4
call fcn.0042e670
add esp, 8
test esi, esi
je 0x422b0a
mov edx, dword [esp + 8]
push edx
call dword [0x4531b0]
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 2
call fcn.0042f7be
lea ecx, [esp + 8]
mov byte [esp + 0x20], 1
call fcn.0042f7be
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], 0
call fcn.0042f7be
lea ecx, [esp + 0x28]
mov dword [esp + 0x20], 0xffffffff
call fcn.0042f7be
mov ecx, dword [esp + 0x18]
pop esi
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 4
Function at 0x429470
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x44f848
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push esi
push edi
mov esi, ecx
mov edx, dword [esi + 0x9c]
mov edi, dword [esp + 0x50]
mov eax, dword [esp + 0x44]
lea ecx, [esp + 0xc]
xor ebx, ebx
push ecx
push ebx
push 0x1007
push edx
mov dword [esp + 0x4c], 2
mov dword [esp + 0x1c], 9
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], ebx
mov dword [esp + 0x30], eax
call dword [0x453860]
mov eax, dword [esp + 0x48]
add esi, 0x7c
push eax
push 1
push edi
mov ecx, esi
call fcn.0042f9f8
mov ecx, dword [esp + 0x4c]
push ecx
push 2
push edi
mov ecx, esi
call fcn.0042f9f8
lea ecx, [esp + 0x44]
mov byte [esp + 0x3c], 1
call fcn.0042f7be
lea ecx, [esp + 0x48]
mov byte [esp + 0x3c], bl
call fcn.0042f7be
lea ecx, [esp + 0x4c]
mov dword [esp + 0x3c], 0xffffffff
call fcn.0042f7be
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x34
ret 0x10
Function at 0x42b580
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x44fd20
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
mov esi, ecx
lea ecx, [esp + 8]
call fcn.0042f7ca
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0
call fcn.0042f7ca
push 0x45f2b0
lea eax, [esp + 0x14]
mov ebx, 1
push 0x462f44
push eax
mov byte [esp + 0x30], bl
call fcn.0042f824
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 2
call fcn.0042f806
lea ecx, [esp + 0x10]
mov byte [esp + 0x24], bl
call fcn.0042f7be
mov ecx, dword [esp + 0xc]
push 0x80
push ecx
call dword [0x4531cc]
mov edx, dword [esp + 0xc]
push edx
call dword [0x4531c0]
test eax, eax
jne 0x42b63f
lea ecx, [esp + 0xc]
mov byte [esp + 0x24], al
call fcn.0042f7be
lea ecx, [esp + 8]
mov dword [esp + 0x24], 0xffffffff
call fcn.0042f7be
xor eax, eax
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop esi
pop ebx
add esp, 0x20
ret
push 0x45f2c0
lea ecx, [esp + 0xc]
call fcn.0042f81e
lea eax, [esp + 8]
push 0x462f44
lea ecx, [esp + 0x14]
push eax
push ecx
call fcn.0042f8d2
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 3
call fcn.0042f806
lea ecx, [esp + 0x10]
mov byte [esp + 0x24], bl
call fcn.0042f7be
mov edx, dword [esp + 8]
push 0
push edx
call dword [0x4531bc]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push 0x45fa0c
call fcn.0042f7fa
push ecx
mov byte [esp + 0x2c], 4
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x462f44
call fcn.0042f7ee
mov byte [esp + 0x2c], bl
call fcn.0042e150
add esp, 4
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x45fa0c
call fcn.0042f7fa
push ecx
mov byte [esp + 0x2c], 5
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x462f44
call fcn.0042f7ee
mov ecx, esi
mov byte [esp + 0x2c], bl
call fcn.0042a260
lea ecx, [esi + 0x78]
call fcn.0042f830
lea ecx, [esi + 0xbc]
call fcn.0042f830
push 0
mov ecx, esi
mov dword [esi + 0x60], 0
call fcn.0042f8a8
lea ecx, [esp + 0xc]
mov byte [esp + 0x24], 0
call fcn.0042f7be
lea ecx, [esp + 8]
mov dword [esp + 0x24], 0xffffffff
call fcn.0042f7be
mov ecx, dword [esp + 0x1c]
mov eax, ebx
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x20
ret

Function at 0x42cdc0
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x432960
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x44ebb8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 0
call fcn.0043f7ca
lea ecx, [esp + 8]
mov byte [esp + 0x20], 1
call fcn.0043f7ca
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 2
call fcn.0043f7ca
mov ebx, 3
lea eax, [esp + 0x14]
push ebx
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0x28], bl
call fcn.0043f80c
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x24], 4
call fcn.0043f806
lea ecx, [esp + 0x14]
mov byte [esp + 0x20], bl
call fcn.0043f7be
lea ecx, [esp + 0x10]
push 0x45f420
lea edx, [esp + 0x18]
push ecx
push edx
call fcn.0043f824
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x24], 5
call fcn.0043f806
lea ecx, [esp + 0x14]
mov byte [esp + 0x20], bl
call fcn.0043f7be
lea eax, [esp + 8]
push 0x45f310
lea ecx, [esp + 0x18]
push eax
push ecx
call fcn.0043f824
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x24], 6
call fcn.0043f806
lea ecx, [esp + 0x14]
mov byte [esp + 0x20], bl
call fcn.0043f7be
push 0x462f40
lea ecx, [esp + 0x10]
call fcn.0043f83c
mov edx, dword [esp + 8]
push 0
push edx
call dword [0x4531c8]
mov esi, eax
test esi, esi
je 0x432a69
mov eax, dword [esp + 8]
push 2
push eax
call dword [0x4531cc]
mov ecx, dword [esp + 8]
mov edx, dword [0x462f44]
push ecx
push edx
call fcn.0043e670
mov ecx, dword [esp + 0x14]
add esp, 8
test eax, eax
mov eax, dword [0x462f3c]
push eax
push ecx
jne 0x432af3
call fcn.0043e670
add esp, 8
test esi, esi
je 0x432aa3
mov edx, dword [esp + 8]
push edx
call dword [0x4531b0]
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 2
call fcn.0043f7be
lea ecx, [esp + 8]
mov byte [esp + 0x20], 1
call fcn.0043f7be
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], 0
call fcn.0043f7be
lea ecx, [esp + 0x28]
mov dword [esp + 0x20], 0xffffffff
call fcn.0043f7be
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret 4
call fcn.0043e670
add esp, 8
test esi, esi
je 0x432b0a
mov edx, dword [esp + 8]
push edx
call dword [0x4531b0]
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 2
call fcn.0043f7be
lea ecx, [esp + 8]
mov byte [esp + 0x20], 1
call fcn.0043f7be
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], 0
call fcn.0043f7be
lea ecx, [esp + 0x28]
mov dword [esp + 0x20], 0xffffffff
call fcn.0043f7be
mov ecx, dword [esp + 0x18]
pop esi
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 4
Function at 0x43cdc0
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret