joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4168c0
Capabilities:
Write file on windows

Disassembly:
push ecx
push edi
mov edi, dword [esp + 0x10]
xor eax, eax
mov dword [esp + 4], eax
test edi, edi
je 0x416919
push esi
mov esi, dword [esp + 0x18]
test esi, esi
je 0x416918
mov eax, dword [esp + 0x10]
mov ecx, dword [0x43fe44]
push eax
push ecx
call fcn.0041c573
test eax, eax
je 0x416914
cmp dword [eax + 4], 0
je 0x416902
push esi
push edi
push eax
call fcn.00417050
pop esi
pop edi
pop ecx
ret 0xc
mov eax, dword [eax]
push 0
lea edx, [esp + 0xc]
push edx
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop esi
pop edi
pop ecx
ret 0xc

Function at 0x416920
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x14]
push ebx
push ebp
push edi
push eax
push 0x1000
mov dword [esp + 0x1c], 0x1000
call fcn.0041d340
mov ecx, dword [esp + 0x1c]
mov edx, dword [0x43fe44]
push ecx
mov edi, eax
push edx
mov ebp, edi
call fcn.0041c573
mov ebx, eax
test ebx, ebx
je 0x416a39
push esi
lea ecx, [ecx]
mov byte [esp + 0x13], 0
cmp dword [ebx + 4], 0
je 0x41697e
push 1
lea eax, [esp + 0x17]
push eax
push ebx
call fcn.00416f30
mov dword [esp + 0x14], eax
jmp 0x416995
mov eax, dword [ebx]
push 0
lea ecx, [esp + 0x18]
push ecx
push 1
lea edx, [esp + 0x1f]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov al, byte [esp + 0x13]
test al, al
je 0x4169a5
mov byte [ebp], al
mov al, byte [esp + 0x13]
inc ebp
mov ecx, dword [esp + 0x18]
mov esi, ebp
sub esi, edi
cmp esi, ecx
jl 0x4169cf
mov edx, dword [esp + 0x24]
add ecx, 0x1000
push edx
push ecx
mov dword [esp + 0x20], ecx
call fcn.0041d340
mov edi, eax
mov al, byte [esp + 0x13]
lea ebp, [esi + edi]
test al, al
je 0x416a38
cmp dword [esp + 0x14], 0
je 0x4169e6
cmp al, 0xd
je 0x4169e6
cmp al, 0xa
jne 0x416960
dec ebp
cmp al, 0xd
jne 0x416a38
cmp dword [ebx + 4], 0
je 0x416a00
push 1
lea eax, [esp + 0x17]
push eax
push ebx
call fcn.00416f30
jmp 0x416a17
mov eax, dword [ebx]
push 0
lea ecx, [esp + 0x18]
push ecx
push 1
lea edx, [esp + 0x1f]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp byte [esp + 0x13], 0xa
je 0x416a38
cmp dword [ebx + 4], 0
je 0x416a29
inc dword [ebx + 0xc]
jmp 0x416a38
mov ecx, dword [ebx]
push 1
push 0
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
pop esi
sub edi, ebp
add edi, dword [esp + 0x14]
mov byte [ebp], 0
push edi
call fcn.0041d430
pop edi
pop ebp
pop ebx
add esp, 0xc
ret 8
Function at 0x416a60
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
mov ecx, dword [0x43fe44]
push esi
push eax
push ecx
mov dword [esp + 0xc], 0
call fcn.0041c573
mov esi, eax
test esi, esi
je 0x416ae3
cmp dword [esi + 4], 0
je 0x416ab2
push 1
lea edx, [esp + 8]
push edx
push esi
call fcn.00416f30
test eax, eax
je 0x416aa6
inc dword [esi + 0xc]
xor eax, eax
pop esi
add esp, 8
ret 4
mov eax, 1
pop esi
add esp, 8
ret 4
mov edx, dword [esi]
push 0
lea eax, [esp + 0xc]
push eax
push 1
lea ecx, [esp + 0x1c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x416aee
cmp dword [esp + 8], 0
je 0x416aee
mov eax, dword [esi]
push 1
push 0
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 4]
pop esi
add esp, 8
ret 4
or eax, 0xffffffff
pop esi
add esp, 8
ret 4

Function at 0x416b00
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
mov ecx, dword [0x43fe44]
push esi
push eax
push ecx
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call fcn.0041c573
mov esi, eax
test esi, esi
je 0x416bc7
mov ecx, dword [esp + 0x14]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
test ecx, ecx
je 0x416b7f
cmp byte [ecx], 0
je 0x416b7f
cmp dword [esi + 4], 0
mov eax, ecx
push edi
lea edi, [eax + 1]
je 0x416b67
nop
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x416b50
sub eax, edi
push eax
push ecx
push esi
call fcn.00417050
mov dword [esp + 0xc], eax
jmp 0x416b7e
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x416b67
push 0
lea edx, [esp + 0x10]
push edx
sub eax, edi
push eax
mov eax, dword [esi]
push ecx
push eax
call ebp
pop edi
cmp dword [esi + 4], 0
je 0x416ba2
push 2
push 0x4350dc
push esi
call fcn.00417050
mov ecx, eax
mov eax, dword [esp + 8]
pop ebp
add eax, ecx
pop esi
add esp, 8
ret 8
mov edx, dword [esi]
push 0
lea ecx, [esp + 0x10]
push ecx
push 2
push 0x4350dc
push edx
call ebp
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 8]
pop ebp
add eax, ecx
pop esi
add esp, 8
ret 8
mov eax, dword [esp + 4]
pop esi
add esp, 8
ret 8

Function at 0x416be0
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0x10]
xor eax, eax
mov dword [esp + 4], eax
test esi, esi
je 0x416c27
cmp byte [esi], al
je 0x416c27
mov eax, dword [esp + 0xc]
mov ecx, dword [0x43fe44]
push eax
push ecx
call fcn.0041c573
test eax, eax
je 0x416c55
cmp dword [eax + 4], 0
mov ecx, esi
push edi
lea edi, [ecx + 1]
je 0x416c30
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x416c15
sub ecx, edi
push ecx
push esi
push eax
call fcn.00417050
pop edi
pop esi
pop ecx
ret 8
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x416c30
mov eax, dword [eax]
push 0
lea edx, [esp + 0xc]
push edx
sub ecx, edi
push ecx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 8
mov eax, dword [esp + 4]
pop esi
pop ecx
ret 8
Function at 0x416c60
Capabilities:
Write file on windows

Disassembly:
push ecx
mov eax, dword [esp + 8]
mov ecx, dword [0x43fe44]
push eax
push ecx
mov dword [esp + 8], 0
call fcn.0041c573
test eax, eax
je 0x416ca8
cmp dword [eax + 4], 0
lea edx, [esp + 0xc]
je 0x416c95
push 4
push edx
push eax
call fcn.00417050
pop ecx
ret 8
mov eax, dword [eax]
push 0
lea ecx, [esp + 4]
push ecx
push 4
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp]
pop ecx
ret 8

Function at 0x416d10
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 8]
mov ecx, dword [0x43fe44]
push eax
push ecx
mov dword [esp + 8], 0
call fcn.0041c573
test eax, eax
je 0x416d5a
cmp dword [eax + 4], 0
lea edx, [esp]
je 0x416d47
push 4
push edx
push eax
call fcn.00416f30
mov eax, dword [esp]
pop ecx
ret 4
mov eax, dword [eax]
push 0
lea ecx, [esp + 0xc]
push ecx
push 4
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp]
pop ecx
ret 4

Function at 0x416e90
Capabilities:
Write file on windows

Disassembly:
push ecx
mov eax, dword [esp + 8]
mov ecx, dword [0x43fe44]
push eax
push ecx
mov dword [esp + 8], 0
call fcn.0041c573
test eax, eax
je 0x416ed8
cmp dword [eax + 4], 0
lea edx, [esp + 0xc]
je 0x416ec5
push 1
push edx
push eax
call fcn.00417050
pop ecx
ret 8
mov eax, dword [eax]
push 0
lea ecx, [esp + 4]
push ecx
push 1
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp]
pop ecx
ret 8

Function at 0x416ee0
Capabilities:
Write file on windows

Disassembly:
push ecx
mov eax, dword [esp + 8]
mov ecx, dword [0x43fe44]
push eax
push ecx
mov dword [esp + 8], 0
call fcn.0041c573
test eax, eax
je 0x416f28
cmp dword [eax + 4], 0
lea edx, [esp + 0xc]
je 0x416f15
push 2
push edx
push eax
call fcn.00417050
pop ecx
ret 8
mov eax, dword [eax]
push 0
lea ecx, [esp + 4]
push ecx
push 2
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp]
pop ecx
ret 8
Function at 0x416f30
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
cmp dword [esi + 0x14], 0
push edi
jne 0x416f51
push esi
call fcn.00416370
mov dword [esi + 0x14], 1
mov dword [esi + 0xc], 0
mov ebx, dword [esi + 0xc]
mov edi, dword [esp + 0x18]
cmp ebx, edi
jl 0x416fc6
mov eax, dword [esi + 0x10]
add eax, dword [esi + 4]
mov ecx, edi
sub eax, ebx
dec ecx
je 0x416fb3
dec ecx
je 0x416f9e
sub ecx, 2
je 0x416f8b
push edi
push eax
mov eax, dword [esp + 0x1c]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ebx
ret 0xc
mov ecx, dword [eax]
mov edx, dword [esp + 0x14]
mov dword [edx], ecx
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ebx
ret 0xc
mov ax, word [eax]
mov ecx, dword [esp + 0x14]
mov word [ecx], ax
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ebx
ret 0xc
mov dl, byte [eax]
mov eax, dword [esp + 0x14]
mov byte [eax], dl
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ebx
ret 0xc
mov ecx, dword [esi + 0x10]
push ebp
mov ebp, dword [esp + 0x18]
sub ecx, ebx
add ecx, dword [esi + 4]
push ebx
push ecx
push ebp
call sub.MSVCRT.dll_memcpy
mov eax, dword [esi + 8]
add esp, 0xc
sub edi, ebx
add ebp, ebx
push 0
cmp edi, eax
jl 0x41700f
mov eax, dword [esi]
lea edx, [esp + 0x18]
push edx
push edi
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x14]
pop ebp
pop edi
mov dword [esi + 0xc], 0
pop esi
add eax, ebx
pop ebx
ret 0xc
mov edx, dword [esi + 4]
lea ecx, [esp + 0x18]
push ecx
push eax
mov eax, dword [esi]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x14]
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
cmp edi, eax
jle 0x417032
mov edi, eax
mov ecx, dword [esi + 4]
push edi
push ecx
push ebp
call sub.MSVCRT.dll_memcpy
sub dword [esi + 0xc], edi
add esp, 0xc
pop ebp
lea eax, [ebx + edi]
pop edi
pop esi
pop ebx
ret 0xc
Function at 0x417050
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
cmp dword [esi + 0x14], 1
push edi
mov dword [esp + 8], 0
jne 0x417085
mov eax, dword [esi + 0xc]
mov ecx, dword [esi]
push 1
push 0
neg eax
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edx, dword [esi + 8]
mov dword [esi + 0x14], 0
mov dword [esi + 0xc], edx
mov ecx, dword [esi + 0xc]
mov edi, dword [esp + 0x18]
cmp ecx, edi
jle 0x4170fa
mov eax, dword [esi + 8]
add eax, dword [esi + 4]
sub eax, ecx
mov ecx, edi
dec ecx
je 0x4170e7
dec ecx
je 0x4170d2
sub ecx, 2
je 0x4170bf
mov ecx, dword [esp + 0x14]
push edi
push ecx
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
mov edx, dword [esp + 0x14]
mov ecx, dword [edx]
mov dword [eax], ecx
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
mov edx, dword [esp + 0x14]
mov cx, word [edx]
mov word [eax], cx
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
mov edx, dword [esp + 0x14]
mov cl, byte [edx]
mov byte [eax], cl
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
push esi
call fcn.00416370
mov eax, dword [esi + 8]
cmp edi, eax
jl 0x417127
mov eax, dword [esp + 0x14]
mov ecx, dword [esi]
push 0
lea edx, [esp + 0xc]
push edx
push edi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
mov ecx, dword [esi + 4]
sub ecx, dword [esi + 0xc]
mov edx, dword [esp + 0x14]
push edi
push edx
add ecx, eax
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc

Function at 0x417c28
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor edi, edi
push edi
xor esi, esi
call dword [sym.imp.USER32.DLL_OpenClipboard]
test eax, eax
je 0x417c69
push 1
call dword [sym.imp.USER32.DLL_GetClipboardData]
mov ebx, eax
test ebx, ebx
je 0x417c61
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
test esi, esi
je 0x417c61
push esi
call sub.MSVCRT.dll_strlen
pop ecx
mov edi, eax
call dword [sym.imp.USER32.DLL_CloseClipboard]
jmp 0x417c6c
mov ebx, dword [ebp + 8]
push dword [ebp + 8]
push edi
call fcn.0041d340
test esi, esi
je 0x417c8e
inc edi
push edi
push esi
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x417c91
mov byte [eax], 0
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x417c98
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
xor ebp, ebp
push ebp
call dword [sym.imp.USER32.DLL_OpenClipboard]
test eax, eax
je 0x417d09
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
cmp ebx, ebp
jne 0x417cb6
mov ebx, 0x43500f
push ebx
call sub.MSVCRT.dll_strlen
pop ecx
lea edi, [eax + 1]
push edi
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
cmp esi, ebp
je 0x417d00
call dword [sym.imp.USER32.DLL_EmptyClipboard]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x417d00
push edi
push ebx
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
push 1
call dword [sym.imp.USER32.DLL_SetClipboardData]
mov ebp, eax
call dword [sym.imp.USER32.DLL_CloseClipboard]
pop edi
pop esi
pop ebx
mov eax, ebp
pop ebp
ret 4
Function at 0x4183d0
Capabilities:
Encode data using xor
Hash data with crc32
Read file on windows

Disassembly:
sub esp, 0x14
mov eax, dword [esp + 0x18]
push ebx
push esi
or esi, 0xffffffff
xor ebx, ebx
mov dword [esp + 8], 0x80000
test eax, eax
je 0x4185de
push edi
push ebx
push pe_nt_image_headers32
push 3
push ebx
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
mov dword [esp + 0x1c], edi
cmp edi, 0xffffffff
je 0x4185dd
mov eax, dword [0x43f0b0]
push ebp
push 0x80000
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebp, eax
test ebp, ebp
je 0x4185d5
cmp dword [esp + 0x30], ebx
jl 0x418451
mov eax, dword [esp + 0x2c]
jg 0x418442
test eax, eax
je 0x418451
push 0
lea ecx, [esp + 0x34]
push ecx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edx, dword [esp + 0x34]
add edx, 0x80000
mov dword [esp + 0x28], edx
jmp 0x418465
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
sub dword [esp + 0x28], 0x80000
add ebx, 0x80000
and eax, ecx
mov dword [esp + 0x14], ebx
cmp eax, 0xffffffff
je 0x41849d
mov eax, ebx
cdq
cmp edx, ecx
jl 0x41849d
jg 0x418495
cmp eax, dword [esp + 0x34]
jbe 0x41849d
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x10], ecx
mov eax, dword [esp + 0x10]
push 0
lea edx, [esp + 0x1c]
push edx
push eax
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ebx, dword [esp + 0x18]
mov eax, ebp
mov edx, ebx
cmp ebx, 8
jb 0x41859c
mov edi, ebx
shr edi, 3
jmp 0x4184d0
movzx ecx, byte [eax]
xor ecx, esi
and ecx, 0xff
mov dword [esp + 0x1c], ecx
mov ecx, esi
mov esi, dword [esp + 0x1c]
shr ecx, 8
xor ecx, dword [esi*4 + 0x437c28]
movzx esi, byte [eax + 1]
xor esi, ecx
and esi, 0xff
shr ecx, 8
xor ecx, dword [esi*4 + 0x437c28]
movzx esi, byte [eax + 2]
xor esi, ecx
and esi, 0xff
shr ecx, 8
xor ecx, dword [esi*4 + 0x437c28]
movzx esi, byte [eax + 3]
xor esi, ecx
and esi, 0xff
shr ecx, 8
xor ecx, dword [esi*4 + 0x437c28]
movzx esi, byte [eax + 4]
xor esi, ecx
and esi, 0xff
shr ecx, 8
xor ecx, dword [esi*4 + 0x437c28]
movzx esi, byte [eax + 5]
xor esi, ecx
and esi, 0xff
shr ecx, 8
xor ecx, dword [esi*4 + 0x437c28]
movzx esi, byte [eax + 6]
xor esi, ecx
and esi, 0xff
shr ecx, 8
xor ecx, dword [esi*4 + 0x437c28]
movzx esi, byte [eax + 7]
xor esi, ecx
and esi, 0xff
shr ecx, 8
xor ecx, dword [esi*4 + 0x437c28]
add eax, 8
sub edx, 8
dec edi
mov esi, ecx
jne 0x4184d0
mov edi, dword [esp + 0x20]
test edx, edx
je 0x4185b9
movzx ecx, byte [eax]
xor ecx, esi
and ecx, 0xff
shr esi, 8
xor esi, dword [ecx*4 + 0x437c28]
inc eax
dec edx
jne 0x4185a0
cmp ebx, 0x80000
je 0x418461
mov edx, dword [0x43f0b0]
push ebp
push 0
push edx
call dword [sym.imp.KERNEL32.dll_HeapFree]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebp
pop edi
mov eax, esi
pop esi
not eax
pop ebx
add esp, 0x14
ret 0x14
Function at 0x418610
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x78
mov eax, dword [esp + 0x7c]
push ebx
push esi
xor ebx, ebx
push edi
xor edi, edi
mov dword [esp + 0x18], ebx
mov esi, 0x100000
cmp eax, ebx
je 0x418745
push ebx
push pe_nt_image_headers32
push 3
push ebx
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esp + 0xc], eax
cmp eax, 0xffffffff
je 0x418745
mov eax, dword [0x43f0b0]
push ebp
push esi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebp, eax
cmp ebp, ebx
je 0x418739
lea ecx, [esp + 0x30]
push ecx
call fcn.00418ad0
add esp, 4
cmp dword [esp + 0x94], ebx
jl 0x4186a4
mov eax, dword [esp + 0x90]
jg 0x41868f
cmp eax, ebx
jbe 0x4186a4
push ebx
lea edx, [esp + 0x98]
push edx
push eax
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edi, dword [esp + 0x98]
jmp 0x4186b0
mov eax, dword [esp + 0x9c]
add ebx, 0x100000
adc dword [esp + 0x1c], 0
mov ecx, edi
and ecx, eax
cmp ecx, 0xffffffff
je 0x4186e1
cmp dword [esp + 0x1c], eax
jl 0x4186e1
jg 0x4186d7
cmp ebx, edi
jbe 0x4186e1
mov esi, edi
sub esi, ebx
add esi, 0x100000
mov eax, dword [esp + 0x10]
push 0
lea edx, [esp + 0x18]
push edx
push esi
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x14]
push ecx
lea edx, [esp + 0x34]
push ebp
push edx
call fcn.004192a0
add esp, 0xc
cmp dword [esp + 0x14], 0x100000
je 0x4186b0
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x24]
push ecx
call fcn.00419360
mov edx, dword [0x43f0b0]
add esp, 8
push ebp
push 0
push edx
mov edi, 0x20
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebp
mov ecx, dword [esp + 0x9c]
push ecx
push edi
call fcn.0041d340
test edi, edi
pop edi
pop esi
pop ebx
je 0x4187fe
xor ecx, ecx
movzx edx, byte [esp + ecx + 0x10]
shr edx, 4
movzx edx, byte [edx + 0x4353e0]
mov byte [eax], dl
movzx edx, byte [esp + ecx + 0x10]
and edx, 0xf
movzx edx, byte [edx + 0x4353e0]
mov byte [eax + 1], dl
movzx edx, byte [esp + ecx + 0x11]
shr edx, 4
movzx edx, byte [edx + 0x4353e0]
mov byte [eax + 2], dl
movzx edx, byte [esp + ecx + 0x11]
and edx, 0xf
movzx edx, byte [edx + 0x4353e0]
mov byte [eax + 3], dl
movzx edx, byte [esp + ecx + 0x12]
shr edx, 4
movzx edx, byte [edx + 0x4353e0]
mov byte [eax + 4], dl
movzx edx, byte [esp + ecx + 0x12]
and edx, 0xf
movzx edx, byte [edx + 0x4353e0]
mov byte [eax + 5], dl
movzx edx, byte [esp + ecx + 0x13]
shr edx, 4
movzx edx, byte [edx + 0x4353e0]
mov byte [eax + 6], dl
movzx edx, byte [esp + ecx + 0x13]
and edx, 0xf
movzx edx, byte [edx + 0x4353e0]
mov byte [eax + 7], dl
add ecx, 4
add eax, 8
cmp ecx, 0x10
jl 0x418760
mov byte [eax], 0
add esp, 0x78
ret 0x18
Function at 0x418830
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc4
mov eax, dword [esp + 0xc8]
push ebx
push esi
xor ebx, ebx
push edi
xor edi, edi
mov dword [esp + 0x2c], ebx
mov esi, 0x80000
cmp eax, ebx
je 0x418967
push ebx
push pe_nt_image_headers32
push 3
push ebx
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esp + 0xc], eax
cmp eax, 0xffffffff
je 0x418967
mov eax, dword [0x43f0b0]
push ebp
push esi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebp, eax
cmp ebp, ebx
je 0x41895b
lea ecx, [esp + 0x34]
push ebx
push ecx
call fcn.0041c240
add esp, 8
cmp dword [esp + 0xe0], ebx
jl 0x4188cb
mov eax, dword [esp + 0xdc]
jg 0x4188b6
cmp eax, ebx
jbe 0x4188cb
push ebx
lea edx, [esp + 0xe4]
push edx
push eax
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edi, dword [esp + 0xe4]
mov eax, dword [esp + 0xe8]
add ebx, 0x80000
adc dword [esp + 0x30], 0
mov ecx, edi
and ecx, eax
cmp ecx, 0xffffffff
je 0x418903
cmp dword [esp + 0x30], eax
jl 0x418903
jg 0x4188f9
cmp ebx, edi
jbe 0x418903
mov esi, edi
sub esi, ebx
add esi, 0x80000
mov eax, dword [esp + 0x10]
push 0
lea edx, [esp + 0x18]
push edx
push esi
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x14]
push ecx
lea edx, [esp + 0x38]
push ebp
push edx
call fcn.0041c280
add esp, 0xc
cmp dword [esp + 0x14], 0x80000
je 0x4188d2
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x1c]
push ecx
call fcn.0041c340
mov edx, dword [0x43f0b0]
add esp, 8
push ebp
push 0
push edx
mov edi, 0x28
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebp
mov ecx, dword [esp + 0xe8]
push ecx
push edi
call fcn.0041d340
test edi, edi
pop edi
pop esi
pop ebx
je 0x418a52
xor ecx, ecx
jmp 0x418990
movzx edx, byte [esp + ecx + 8]
shr edx, 4
movzx edx, byte [edx + 0x4353f0]
mov byte [eax], dl
movzx edx, byte [esp + ecx + 8]
and edx, 0xf
movzx edx, byte [edx + 0x4353f0]
mov byte [eax + 1], dl
movzx edx, byte [esp + ecx + 9]
shr edx, 4
movzx edx, byte [edx + 0x4353f0]
mov byte [eax + 2], dl
movzx edx, byte [esp + ecx + 9]
and edx, 0xf
movzx edx, byte [edx + 0x4353f0]
mov byte [eax + 3], dl
movzx edx, byte [esp + ecx + 0xa]
shr edx, 4
movzx edx, byte [edx + 0x4353f0]
mov byte [eax + 4], dl
movzx edx, byte [esp + ecx + 0xa]
and edx, 0xf
movzx edx, byte [edx + 0x4353f0]
mov byte [eax + 5], dl
movzx edx, byte [esp + ecx + 0xb]
shr edx, 4
movzx edx, byte [edx + 0x4353f0]
mov byte [eax + 6], dl
movzx edx, byte [esp + ecx + 0xb]
and edx, 0xf
movzx edx, byte [edx + 0x4353f0]
mov byte [eax + 7], dl
movzx edx, byte [esp + ecx + 0xc]
shr edx, 4
movzx edx, byte [edx + 0x4353f0]
mov byte [eax + 8], dl
movzx edx, byte [esp + ecx + 0xc]
and edx, 0xf
movzx edx, byte [edx + 0x4353f0]
mov byte [eax + 9], dl
add ecx, 5
add eax, 0xa
cmp ecx, 0x14
jl 0x418990
mov byte [eax], 0
add esp, 0xc4
ret 0x18
Function at 0x418ad0
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret