joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4133e0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
mov esi, eax
test edi, edi
je 0x413597
test esi, esi
je 0x413597
cmp dword [ebp + 0xc], 0
je 0x413597
mov ebx, dword [ebp + 8]
mov eax, ebx
call fcn.004135c0
mov ecx, dword [ebp + 0xc]
cmp dword [ecx], eax
jl 0x413597
mov eax, 0x55555556
imul ebx
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
lea edx, [ecx*4]
mov eax, 0x6bca1af3
imul edx
sar edx, 5
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
mov eax, 0x13
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
js 0x413508
cmp dword [ebp - 8], ebx
jne 0x413480
mov edx, ebx
imul edx, edx, 0x4c
lea eax, [ecx*4]
sub eax, edx
cdq
and edx, 3
add eax, edx
sar eax, 2
mov dword [ebp - 0xc], eax
test eax, eax
jle 0x4134f0
mov edx, eax
movzx ecx, byte [edi]
movzx eax, byte [edi + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi + 2]
shl ecx, 8
or ecx, eax
shl ecx, 8
mov eax, ecx
shr eax, 0x1a
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_r]
mov byte [esi], al
shl ecx, 6
mov eax, ecx
shr eax, 0x1a
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_r]
shl ecx, 6
mov byte [esi + 1], al
mov eax, ecx
shr eax, 0x1a
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_r]
shr ecx, 0x14
and ecx, 0x3f
mov byte [esi + 2], al
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_r]
mov byte [esi + 3], cl
add edi, 3
add esi, 4
sub edx, 1
jne 0x413486
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
lea edx, [edx + eax*4]
mov dword [ebp - 4], edx
mov edx, dword [ebp - 8]
inc edx
cmp edx, ebx
mov dword [ebp - 8], edx
jle 0x413461
lea eax, [ecx + ecx*2]
mov ecx, dword [ebp + 8]
sub ecx, eax
je 0x413583
lea edx, [ecx + 1]
test edx, edx
je 0x413583
xor eax, eax
test ecx, ecx
jle 0x413523
movzx eax, byte [edi]
inc edi
shl eax, 8
cmp ecx, 1
jle 0x413531
movzx ebx, byte [edi]
or eax, ebx
inc edi
shl eax, 8
cmp ecx, 2
jle 0x41353e
movzx ecx, byte [edi]
or eax, ecx
shl eax, 8
test edx, edx
jle 0x413566
mov ecx, edx
jmp 0x413550
mov edi, eax
shr edi, 0x1a
mov bl, byte [edi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_r]
mov byte [esi], bl
inc esi
shl eax, 6
sub ecx, 1
jne 0x413550
add dword [ebp - 4], edx
mov edi, 4
sub edi, edx
test edi, edi
jle 0x413580
push edi
push 0x3d
push esi
call fcn.00427b00
add esp, 0xc
add dword [ebp - 4], edi
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4137c0
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49e328
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x4ce540]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
xor esi, esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
cmp edi, esi
je 0x413816
mov eax, edi
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x413800
sub eax, edx
sar eax, 1
je 0x413816
cmp dword [ebp + 8], esi
jne 0x41382c
mov eax, 0x80070057
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp ebx, esi
je 0x413816
lea eax, [ebp - 0x10]
push eax
push 0x4a2974
push 1
push esi
push 0x4a2a44
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, esi
jl 0x413912
cmp dword [ebp - 0x10], esi
je 0x413908
lea ecx, [ebp - 0x18]
push ecx
call fcn.004136d0
mov dword [ebp - 4], esi
mov eax, dword [eax]
cmp eax, esi
je 0x41386e
mov ecx, dword [eax]
jmp 0x413870
xor ecx, ecx
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
lea edi, [ebp - 0x14]
push edi
push esi
push esi
push esi
push esi
push esi
push esi
push ecx
push eax
mov eax, dword [edx + 0xc]
call eax
lea edi, [ebp - 0x18]
mov esi, eax
mov dword [ebp - 4], 0xffffffff
call fcn.00413770
mov eax, dword [ebp - 0x14]
test esi, esi
jl 0x4138e1
test eax, eax
je 0x4138dd
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push eax
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
mov esi, eax
test esi, esi
jl 0x41392f
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x14]
mov dword [edx], ecx
mov dword [ebx], eax
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x4138e5
mov eax, esi
jmp 0x4138eb
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, 0x20000000
je 0x413902
test eax, eax
jle 0x41392d
and eax, 0xffff
or eax, 0xa0070000
jmp 0x41392d
test eax, eax
jg 0x413923
jmp 0x41392d
cmp eax, esi
jne 0x413912
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, 0x20000000
je 0x41391f
cmp eax, esi
jg 0x4138f6
jmp 0x41392d
cmp eax, esi
jle 0x41392d
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x413945
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x413954
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x415100
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
movzx eax, al
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 1
push edi
and eax, 1
push 0x14
mov dword [ebp - 4], eax
call esi
movzx edi, ax
push 0x11
and edi, 1
call esi
test al, al
js 0x415144
push 0xa2
call esi
test al, al
js 0x415144
push 0xa3
call esi
test al, al
js 0x415144
xor ebx, ebx
jmp 0x415149
mov ebx, 1
push 0x90
call esi
and eax, 1
cmp ebx, 1
je 0x4151ec
movzx esi, byte [ebp + 8]
xor edx, edx
xor ecx, ecx
movsx ebx, byte [ecx + str.S....O1111P2222Q3333K4444L5555M6666G7777H8888I9999R0000]
cmp esi, ebx
je 0x4151a9
add ecx, 5
inc edx
cmp ecx, 0x37
jb 0x415164
xor edx, edx
xor eax, eax
lea esp, [esp]
movsx ecx, byte [eax + 0x4c7378]
cmp esi, ecx
jne 0x4151e1
mov ecx, dword [ebp - 4]
test ecx, ecx
jne 0x4151c5
test edi, edi
je 0x4151f5
cmp edi, 1
jne 0x4151e1
mov al, byte [edx + edx*4 + 0x4c737b]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test eax, eax
je 0x4151ec
cmp eax, 1
jne 0x4151b7
cmp dword [ebp - 4], eax
je 0x4151ec
mov al, byte [edx + edx*4 + 0x4c7489]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp ecx, 1
jne 0x4151e1
test edi, edi
jne 0x4151dc
mov al, byte [edx + edx*4 + 0x4c737a]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp edi, 1
je 0x415203
add eax, 5
inc edx
cmp eax, 0x10e
jb 0x415180
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
mov al, byte [edx + edx*4 + str.aAAa0bBBb.cCCc_dDDd]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, byte [edx + edx*4 + 0x4c737c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x415220
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 2
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
mov byte [ebp - 1], al
call edi
test al, al
js 0x41525b
push 0xa0
call edi
test al, al
js 0x41525b
push 0xa1
call edi
test al, al
js 0x41525b
xor al, al
jmp 0x41525d
mov al, 1
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x10
movzx ebx, al
call esi
mov ecx, 0x8000
test cx, ax
jne 0x41529a
push 0xa0
call esi
mov edx, 0x8000
test dx, ax
jne 0x41529a
push 0xa1
call esi
mov ecx, 0x8000
mov byte [ebp - 2], 0
test cx, ax
je 0x41529e
mov byte [ebp - 2], 1
push 0x14
call edi
pop edi
pop esi
and eax, 1
test ebx, ebx
pop ebx
jne 0x4152d4
cmp byte [ebp - 2], 0
jne 0x4152d4
mov cl, byte [ebp - 1]
mov dl, cl
sub dl, 0x41
cmp dl, 0x19
ja 0x41537f
test eax, eax
jne 0x41537f
movsx eax, cl
or al, 0x20
mov esp, ebp
pop ebp
ret
movsx edx, byte [ebp - 1]
lea ecx, [edx - 0x27]
cmp ecx, 0x39
ja case.0x4152eb.40
movzx ecx, byte [ecx + 0x4153e0]
jmp dword [ecx*4 + 0x415388]
mov al, 0x21
mov esp, ebp
pop ebp
ret
mov al, 0x40
mov esp, ebp
pop ebp
ret
mov al, 0x23
mov esp, ebp
pop ebp
ret
mov al, 0x24
mov esp, ebp
pop ebp
ret
mov al, 0x25
mov esp, ebp
pop ebp
ret
mov al, 0x5e
mov esp, ebp
pop ebp
ret
mov al, 0x26
mov esp, ebp
pop ebp
ret
mov al, 0x2a
mov esp, ebp
pop ebp
ret
mov al, 0x28
mov esp, ebp
pop ebp
ret
mov al, 0x29
mov esp, ebp
pop ebp
ret
mov al, 0x7e
mov esp, ebp
pop ebp
ret
mov al, 0x5f
mov esp, ebp
pop ebp
ret
mov al, 0x2b
mov esp, ebp
pop ebp
ret
mov al, 0x7b
mov esp, ebp
pop ebp
ret
mov al, 0x7d
mov esp, ebp
pop ebp
ret
mov al, 0x7c
mov esp, ebp
pop ebp
ret
mov al, 0x3a
mov esp, ebp
pop ebp
ret
mov al, 0x22
mov esp, ebp
pop ebp
ret
mov al, 0x3c
mov esp, ebp
pop ebp
ret
mov al, 0x3e
mov esp, ebp
pop ebp
ret
mov al, 0x3f
mov esp, ebp
pop ebp
ret
test eax, eax
je 0x41537c
mov eax, edx
or al, 0x20
mov esp, ebp
pop ebp
ret
mov cl, byte [ebp - 1]
mov al, cl
mov esp, ebp
pop ebp
ret
Function at 0x415bf0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push edi
mov edi, eax
xor eax, eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
cmp dword [esi + 8], eax
jne 0x415c1e
test edi, edi
jne 0x415c1e
mov eax, 0x80070057
pop edi
mov esp, ebp
pop ebp
ret
push 0x10c
call fcn.00427859
add esp, 4
mov dword [esi + 0x5f0], eax
test eax, eax
jne 0x415c3f
mov eax, 0x8007000e
pop edi
mov esp, ebp
pop ebp
ret
push 0x10c
push 0
push eax
call fcn.00427b00
add esp, 0xc
test edi, edi
je 0x415c56
mov dword [esi + 8], edi
mov ecx, dword [esi + 8]
lea eax, [ebp - 0x10]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
push 0
push 0x8f
push 0x1b8
push edx
push eax
push 0x90000000
push 0x4c664c
push str.BUTTON
call fcn.00412880
mov dword [esi], eax
test eax, eax
jne 0x415ccd
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, 0x20000000
je 0x415cb6
test eax, eax
jle 0x415d4a
and eax, 0xffff
or eax, 0xa0070000
pop edi
mov esp, ebp
pop ebp
ret
test eax, eax
jle 0x415d4a
and eax, 0xffff
or eax, 0x80070000
pop edi
mov esp, ebp
pop ebp
ret
mov dword [esi + 0x5b8], 0xffffffff
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
xor edi, edi
jmp 0x415cf0
movsx ecx, byte [edi + str.0123456789abcdefghijklmnopqrstuvwxyz____________:___.___ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_abcdefghi]
push ecx
call fcn.0042ac60
add esp, 4
test eax, eax
je 0x415d1a
movsx edx, byte [edi + str.0123456789abcdefghijklmnopqrstuvwxyz____________:___.___ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_abcdefghi]
push edx
call fcn.0043a161
add esp, 4
mov byte [edi + str.0123456789abcdefghijklmnopqrstuvwxyz____________:___.___ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_abcdefghi], al
inc edi
cmp edi, 0x44
jb 0x415cf0
mov eax, dword [esi]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esi]
mov edi, dword [sym.imp.USER32.dll_SetWindowLongW]
push esi
push 0xffffffffffffffeb
push ecx
call edi
mov eax, dword [esi]
push 0x415e00
push 0xfffffffffffffffc
push eax
call edi
mov dword [esi + 4], eax
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x416310
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, eax
mov eax, dword [edi]
push eax
call dword [sym.imp.USER32.dll_GetDC]
mov edx, dword [edi]
lea ecx, [ebp - 0x18]
push ecx
push edx
mov ebx, eax
call dword [sym.imp.USER32.dll_GetClientRect]
push ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x18]
mov esi, eax
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
push eax
push ecx
push ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
push esi
mov dword [ebp - 8], eax
call dword [sym.imp.GDI32.dll_SelectObject]
push 1
push esi
call dword [sym.imp.GDI32.dll_SetBkMode]
mov edx, dword [edi + 0x18]
push edx
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x18]
push eax
push esi
call dword [sym.imp.USER32.dll_FillRect]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.GDI32.dll_DeleteObject]
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
add edx, 5
push edx
add ecx, 5
push esi
call fcn.004163f0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
push 0xcc0020
push 0
push 0
push esi
sub ecx, eax
push ecx
mov ecx, dword [ebp - 0x18]
sub edx, ecx
push edx
push eax
push ecx
push ebx
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
push esi
call dword [sym.imp.GDI32.dll_DeleteDC]
mov ecx, dword [edi]
push ebx
push ecx
call dword [sym.imp.USER32.dll_ReleaseDC]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4175b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x4175c2
mov eax, 0x80070057
pop ebp
ret 0xc
cmp dword [ebp + 0x10], 0
je 0x4175b9
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
push esi
test eax, eax
je 0x417635
mov esi, dword [ecx + 4]
test esi, esi
jle 0x417635
push ebx
mov bl, byte [eax + 0x1f]
or bl, byte [eax]
push edi
and bl, byte [eax + 0x10]
push esi
call fcn.004261ca
mov edi, eax
add esp, 4
test edi, edi
jne 0x4175fe
pop edi
pop ebx
mov eax, 0x8007000e
pop esi
pop ebp
ret 0xc
push esi
push 0
push edi
call fcn.00427b00
add esp, 0xc
xor eax, eax
test esi, esi
jle 0x417622
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov cl, byte [edx + eax]
xor cl, bl
mov byte [eax + edi], cl
inc eax
cmp eax, esi
jl 0x417610
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov dword [edx], edi
pop edi
mov dword [eax], esi
pop ebx
xor eax, eax
pop esi
pop ebp
ret 0xc
or eax, 0xffffffff
pop esi
pop ebp
ret 0xc
Function at 0x418b70
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov edx, 0x5a4d
cmp word [ecx], dx
jne 0x418b86
cmp dword [ecx + 0x3c], 0x200
jl 0x418b8d
mov eax, 0x8007000d
pop ebp
ret
mov edx, dword [ecx + 0x3c]
cmp dword [ecx + edx], 0x4550
push esi
lea esi, [ecx + edx]
jne 0x418ba3
test byte [esi + 0x16], 2
jne 0x418bab
mov eax, 0x8007000d
pop esi
pop ebp
ret
movzx edx, word [esi + 0x18]
push edi
mov edi, 0x10b
cmp dx, di
jne 0x418bc2
lea edi, [esi + 0x98]
jmp 0x418bd2
mov edi, 0x20b
cmp dx, di
jne 0x418c19
lea edi, [esi + 0xa8]
lea edx, [esi + 0x58]
mov esi, dword [edi]
add esi, ecx
cmp esi, ecx
jne 0x418be6
pop edi
mov eax, 0x800b0100
pop esi
pop ebp
ret
sub esi, ecx
cmp esi, dword [ebp + 8]
jae 0x418c19
sub edx, ecx
mov dword [eax + 4], edx
add edx, 4
mov dword [eax + 8], edx
mov edx, edi
sub edx, ecx
mov dword [eax + 0xc], edx
add edx, 8
mov dword [eax + 0x14], esi
mov dword [eax], 0
mov dword [eax + 0x10], edx
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
pop edi
xor eax, eax
pop esi
pop ebp
ret
pop edi
mov eax, 0x8007000d
pop esi
pop ebp
ret
Function at 0x41aab0
Capabilities:
Hash data using sha1

Disassembly:
xor ecx, ecx
cmp eax, ecx
jne 0x41aabc
mov eax, 1
ret
xor edx, edx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov word [eax + 0x1c], dx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x60], ecx
mov dword [eax + 0x64], ecx
xor eax, eax
ret

Function at 0x41ab80
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x4ce540]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, ecx
xor ecx, ecx
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp + 0xc]
xor edx, edx
push ecx
lea esi, [ebp - 0x70]
mov word [ebp - 0x54], dx
mov dword [ebp - 0x70], 0x67452301
mov dword [ebp - 0x6c], 0xefcdab89
mov dword [ebp - 0x68], 0x98badcfe
mov dword [ebp - 0x64], 0x10325476
mov dword [ebp - 0x60], 0xc3d2e1f0
call fcn.0041ac00
add esp, 4
mov eax, esi
call fcn.0041ab00
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.004265ea
mov esp, ebp
pop ebp
ret
Function at 0x41b2e0
Capabilities:
Hash data using sha224

Disassembly:
push 0x70
push 0
push esi
call fcn.00427b00
add esp, 0xc
mov dword [esi], 0xc1059ed8
mov dword [esi + 4], 0x367cd507
mov dword [esi + 8], 0x3070dd17
mov dword [esi + 0xc], 0xf70e5939
mov dword [esi + 0x10], 0xffc00b31
mov dword [esi + 0x14], 0x68581511
mov dword [esi + 0x18], 0x64f98fa7
mov dword [esi + 0x1c], 0xbefa4fa4
mov dword [esi + 0x6c], 0x1c
mov eax, 1
ret

Function at 0x41b340
Capabilities:
Hash data using sha224

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
push ebx
push esi
mov esi, eax
push edi
test esi, esi
jne 0x41b354
mov esi, 0x4d43cc
push 0x70
lea eax, [ebp - 0x70]
push 0
push eax
call fcn.00427b00
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x70], 0xc1059ed8
mov dword [ebp - 0x6c], 0x367cd507
mov dword [ebp - 0x68], 0x3070dd17
mov dword [ebp - 0x64], 0xf70e5939
mov dword [ebp - 0x60], 0xffc00b31
mov dword [ebp - 0x5c], 0x68581511
mov dword [ebp - 0x58], 0x64f98fa7
mov dword [ebp - 0x54], 0xbefa4fa4
mov dword [ebp - 4], 0x1c
call fcn.0041c500
add esp, 0x10
mov eax, esi
lea edi, [ebp - 0x70]
call fcn.0041c5f0
movzx ebx, byte [0x4d4344]
mov eax, edi
mov ecx, 0x70
lea ebx, [ebx]
mov byte [eax], bl
inc eax
mov edx, eax
dec ecx
and edx, 0xf
lea ebx, [ebx + edx + 0x11]
test ecx, ecx
jne 0x41b3d0
movzx eax, bl
push 0x70
push eax
lea ecx, [ebp - 0x70]
push ecx
call fcn.00494af0
add esp, 0xc
test eax, eax
je 0x41b409
lea eax, [ebx + eax + 0x3f]
mov byte [0x4d4344], al
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov eax, esi
pop esi
mov byte [0x4d4344], bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41b420
Capabilities:
Hash data using sha256

Disassembly:
push 0x70
push 0
push esi
call fcn.00427b00
add esp, 0xc
mov dword [esi], 0x6a09e667
mov dword [esi + 4], 0xbb67ae85
mov dword [esi + 8], 0x3c6ef372
mov dword [esi + 0xc], 0xa54ff53a
mov dword [esi + 0x10], 0x510e527f
mov dword [esi + 0x14], 0x9b05688c
mov dword [esi + 0x18], 0x1f83d9ab
mov dword [esi + 0x1c], 0x5be0cd19
mov dword [esi + 0x6c], 0x20
mov eax, 1
ret
Function at 0x41b480
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
push ebx
push esi
mov esi, eax
push edi
test esi, esi
jne 0x41b494
mov esi, 0x4d43ac
push 0x70
lea eax, [ebp - 0x70]
push 0
push eax
call fcn.00427b00
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x70], 0x6a09e667
mov dword [ebp - 0x6c], 0xbb67ae85
mov dword [ebp - 0x68], 0x3c6ef372
mov dword [ebp - 0x64], 0xa54ff53a
mov dword [ebp - 0x60], 0x510e527f
mov dword [ebp - 0x5c], 0x9b05688c
mov dword [ebp - 0x58], 0x1f83d9ab
mov dword [ebp - 0x54], 0x5be0cd19
mov dword [ebp - 4], 0x20
call fcn.0041c500
add esp, 0x10
mov eax, esi
lea edi, [ebp - 0x70]
call fcn.0041c5f0
movzx ebx, byte [0x4d4344]
mov eax, edi
mov ecx, 0x70
lea ebx, [ebx]
mov byte [eax], bl
inc eax
mov edx, eax
dec ecx
and edx, 0xf
lea ebx, [ebx + edx + 0x11]
test ecx, ecx
jne 0x41b510
movzx eax, bl
push 0x70
push eax
lea ecx, [ebp - 0x70]
push ecx
call fcn.00494af0
add esp, 0xc
test eax, eax
je 0x41b549
lea eax, [ebx + eax + 0x3f]
mov byte [0x4d4344], al
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov eax, esi
pop esi
mov byte [0x4d4344], bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41c950
Capabilities:
Hash data using sha224

Disassembly:
xor ecx, ecx
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0xcbbb9d5d
mov dword [eax + 8], 0x367cd507
mov dword [eax + 0xc], 0x629a292a
mov dword [eax + 0x10], 0x3070dd17
mov dword [eax + 0x14], 0x9159015a
mov dword [eax + 0x18], 0xf70e5939
mov dword [eax + 0x1c], 0x152fecd8
mov dword [eax + 0x20], 0xffc00b31
mov dword [eax + 0x24], 0x67332667
mov dword [eax + 0x28], 0x68581511
mov dword [eax + 0x2c], 0x8eb44a87
mov dword [eax + 0x30], 0x64f98fa7
mov dword [eax + 0x34], 0xdb0c2e0d
mov dword [eax + 0x38], 0xbefa4fa4
mov dword [eax + 0x3c], 0x47b5481d
mov dword [eax + 0x40], ecx
mov dword [eax + 0x44], ecx
mov dword [eax + 0x48], ecx
mov dword [eax + 0x4c], ecx
mov dword [eax + 0xd0], ecx
mov dword [eax + 0xd4], 0x30
lea eax, [ecx + 1]
ret

Function at 0x41c9f0
Capabilities:
Hash data using sha256

Disassembly:
xor ecx, ecx
mov dword [eax], 0xf3bcc908
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x3c], 0x5be0cd19
mov dword [eax + 0x40], ecx
mov dword [eax + 0x44], ecx
mov dword [eax + 0x48], ecx
mov dword [eax + 0x4c], ecx
mov dword [eax + 0xd0], ecx
mov dword [eax + 0xd4], 0x40
lea eax, [ecx + 1]
ret
Function at 0x421a20
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa28
mov eax, dword [0x4ce540]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x206
xor edi, edi
lea edx, [ebp - 0x212]
xor ecx, ecx
push edi
push edx
mov dword [ebp - 0xa28], eax
mov word [ebp - 0x214], cx
call fcn.00427b00
add esp, 0xc
push 0x7fe
lea ecx, [ebp - 0xa12]
xor eax, eax
push edi
push ecx
mov dword [ebp - 0xa18], edi
mov dword [ebp - 0xa1c], edi
mov word [ebp - 0xa14], ax
call fcn.00427b00
add esp, 0xc
push 0x104
lea edx, [ebp - 0x214]
push edx
push edi
mov dword [ebp - 0xa24], edi
mov dword [ebp - 0xa20], edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x421ac5
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004265ea
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x214]
push 0x4c8d30
push eax
call fcn.00494b9d
add esp, 8
test eax, eax
jne 0x421aac
lea esi, [ebp - 0x214]
call fcn.00412b60
mov ecx, esi
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x421aac
mov edx, esi
push 0x5c
push edx
call fcn.0049497a
mov esi, eax
add esp, 8
add esi, 2
mov eax, esi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x421b10
sub eax, edx
sar eax, 1
inc eax
push eax
push esi
call fcn.00494dc3
lea ebx, [ebp - 0xa18]
lea edi, [ebp - 0x214]
call fcn.00412c40
lea eax, [ebp - 0xa1c]
push eax
mov eax, edi
call fcn.004213f0
mov edi, dword [ebp - 0xa18]
add esp, 0xc
push 0x4c8794
push edi
call fcn.00494b9d
add esp, 8
test eax, eax
je 0x421b7b
add eax, 2
push 0x4c8794
push eax
call fcn.00494b9d
add esp, 8
test eax, eax
je 0x421b7b
xor ecx, ecx
mov word [eax], cx
mov ecx, dword [ebp - 0xa1c]
test ecx, ecx
jne 0x421b8a
mov ecx, 0x4c8d70
mov eax, edi
test edi, edi
jne 0x421b95
mov eax, 0x4c8d70
test esi, esi
jne 0x421b9e
mov esi, 0x4c8d70
push ecx
push eax
push 0x1e
push esi
push 0x4c8d74
lea edx, [ebp - 0xa14]
push 0x400
push edx
call fcn.004266d6
add esp, 0x1c
lea eax, [ebp - 0xa20]
push eax
lea ecx, [ebp - 0xa24]
push ecx
lea edx, [ebp - 0xa14]
push edx
call fcn.00412e80
mov ebx, dword [ebp - 0xa24]
add esp, 0xc
test eax, eax
jl 0x421c1e
mov edi, dword [ebp - 0xa20]
inc edi
push edi
call fcn.004261ca
mov esi, eax
add esp, 4
test esi, esi
je 0x421c18
push edi
push 0
push esi
call fcn.00427b00
add esp, 0xc
push ebx
push edi
push esi
call fcn.0042e825
mov eax, dword [ebp - 0xa28]
add esp, 0xc
mov dword [eax], esi
mov edi, dword [ebp - 0xa18]
test ebx, ebx
je 0x421c2b
push ebx
call fcn.00427598
add esp, 4
test edi, edi
je 0x421c38
push edi
call fcn.00427598
add esp, 4
mov eax, dword [ebp - 0xa1c]
test eax, eax
je 0x421c4b
push eax
call fcn.00427598
add esp, 4
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.004265ea
mov esp, ebp
pop ebp
ret