joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414ed0
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4150e4
sub esp, 0x18
mov eax, dword [0x87ba14]
test eax, eax
jne 0x4150cd
nop
lea eax, [0x87b9fc]
mov dword [esp], eax
call fcn.00409780
mov eax, dword [0x87ba00]
test eax, eax
je 0x414f19
cmp dword [eax + 8], 0xcc
jne 0x414f8f
mov edx, dword [0x87b9f4]
test edx, edx
jne 0x414f71
mov dword [esp], 0x1000
mov dword [esp + 4], 0
lea eax, [0x880450]
mov dword [esp + 8], eax
call fcn.0040bb10
mov eax, dword [esp + 0xc]
mov dword [0x87b9f4], eax
mov ecx, dword [0x87b9b8]
mov dword [eax], ecx
mov eax, dword [0x87b9f4]
mov dword [0x87b9b8], eax
movzx eax, byte [0x87c040]
test al, al
jne 0x414f71
xor eax, eax
jmp 0x415079
mov edx, dword [0x87b9f4]
mov ebx, dword [edx + 4]
mov dword [0x87b9f4], ebx
mov ebx, dword [0x87ba00]
mov dword [edx + 4], ebx
mov dword [0x87ba00], edx
mov edx, dword [0x87ba00]
mov eax, dword [edx + 8]
cmp eax, 0xcc
jae 0x415061
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
lea eax, [edx + 8]
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.004020d0
mov eax, dword [esp + 0x10]
lea eax, [eax + eax*4]
mov ecx, dword [esp + 0x14]
lea edi, [ecx + eax*4 + 0x10]
mov edx, dword [0x87bd00]
lea ebx, [ecx + eax*4 + 0x1c]
lea ebp, [ecx + eax*4 + 0x20]
lea esi, [ecx + eax*4 + 0x14]
test edx, edx
jne 0x414fed
mov edx, dword [esp + 0x20]
mov dword [ecx + eax*4 + 0x10], edx
jmp 0x414ffa
mov edx, eax
mov eax, dword [esp + 0x20]
call fcn.004626c0
mov eax, edx
mov edx, dword [esp + 0x24]
mov dword [ecx + eax*4 + 0x18], edx
mov edx, dword [0x87bd00]
test edx, edx
jne 0x415026
mov edx, dword [esp + 0x28]
mov dword [ecx + eax*4 + 0x1c], edx
mov edx, dword [esp + 0x2c]
mov dword [ecx + eax*4 + 0x20], edx
mov edx, dword [esp + 0x1c]
mov dword [ecx + eax*4 + 0x14], edx
jmp 0x415047
mov edi, ebx
mov eax, dword [esp + 0x28]
call fcn.004626c0
mov edi, ebp
mov eax, dword [esp + 0x2c]
call fcn.004626c0
mov edi, esi
mov eax, dword [esp + 0x1c]
call fcn.004626c0
mov byte [0x87b953], 1
nop
lea eax, [0x87b9fc]
mov dword [esp], eax
call fcn.00409980
add esp, 0x18
ret
mov ecx, 0xcc
call fcn.00462750
lea esi, [0x87c040]
xchg ebp, eax
mov byte [esi + ebx], al
xchg ebp, eax
lea eax, [ebx + 1]
cmp eax, 0x80
jge 0x414f71
mov ecx, eax
mov eax, 0xcccccccd
imul ecx
add edx, ecx
sar edx, 2
mov eax, ecx
sar ecx, 0x1f
sub edx, ecx
lea edx, [edx + edx*4]
mov ebx, eax
sub eax, edx
cmp eax, 5
jae 0x4150c3
lea edx, [0x81f7c4]
movzx ebp, byte [edx + eax]
cmp ebx, 0x80
jb 0x41506b
mov eax, ebx
mov ecx, pe_nt_image_headers32
call fcn.00462740
mov ecx, 5
call fcn.00462740
lea eax, [0x6631fa]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call fcn.004370f0
nop
call fcn.004612b0
jmp fcn.00414ed0
Function at 0x4288c0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x428a30
sub esp, 0x1c
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call fcn.00426680
mov eax, dword [esp + 4]
test eax, eax
je 0x428a19
mov dword [esp + 0xc], eax
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov edx, dword [ecx + 0x18]
nop
inc dword [edx + 0x7c]
mov ecx, dword [ecx + 0x18]
mov dword [esp + 0x14], ecx
mov dword [esp], eax
call fcn.00424640
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0xc]
sub eax, dword [ecx + 0xc]
mov dword [esp + 0x10], eax
mov edx, dword [esp + 0x24]
movzx ebx, byte [edx + 6]
mov byte [esp + 0xb], bl
lea ebp, [ecx + 0x48]
mov dword [esp + 0x18], ebp
nop
mov dword [esp], ebp
call fcn.00409780
mov eax, dword [esp + 0xc]
lea ecx, [eax + 0x4c]
movzx edx, byte [esp + 0xb]
mov ebx, dword [esp + 0x10]
jmp 0x428957
mov ecx, ebp
mov ebp, dword [ecx]
test ebp, ebp
je 0x4289bd
movzx esi, word [ebp + 4]
cmp esi, ebx
jne 0x42896c
cmp byte [ebp + 6], dl
je 0x428977
cmp esi, ebx
ja 0x4289bd
jne 0x428955
cmp byte [ebp + 6], dl
jbe 0x428955
jmp 0x4289bd
nop
nop
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00409980
nop
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx + 0x7c]
lea ebx, [edx - 1]
mov dword [ecx + 0x7c], ebx
cmp edx, 1
jne 0x4289b4
movzx ecx, byte [eax + 0x65]
test cl, cl
je 0x4289b4
mov dword [eax + 8], 0xfffffade
mov byte [esp + 0x28], 0
add esp, 0x1c
ret
mov edx, dword [esp + 0x24]
mov word [edx + 4], bx
mov ebx, dword [ecx]
mov dword [edx], ebx
mov dword [ecx], edx
mov dword [esp], eax
call fcn.004287c0
nop
nop
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00409980
nop
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx + 0x7c]
lea ebx, [edx - 1]
mov dword [ecx + 0x7c], ebx
cmp edx, 1
jne 0x428a10
movzx ecx, byte [eax + 0x65]
test cl, cl
je 0x428a10
mov dword [eax + 8], 0xfffffade
mov byte [esp + 0x28], 1
add esp, 0x1c
ret
lea eax, [0x6656d1]
mov dword [esp], eax
mov dword [esp + 4], 0x1d
call fcn.004370f0
nop
call fcn.004612b0
jmp fcn.004288c0
Function at 0x428ea0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x428fbc
sub esp, 0x14
mov eax, dword [esp + 0x18]
movzx ecx, byte [eax + 6]
cmp cl, 1
je 0x428f35
cmp cl, 2
je 0x428edd
cmp cl, 3
jne 0x428fa5
mov byte [eax + 8], 1
jmp 0x428fa1
mov ecx, dword [eax + 8]
mov dword [esp], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.0042e630
nop
lea eax, [0x85ffa4]
mov dword [esp], eax
call fcn.00409780
nop
mov eax, dword [0x85ff70]
sub eax, dword [0x85ff54]
mov dword [0x85ff70], eax
mov eax, dword [0x85ff60]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x85ff60], ecx
nop
lea eax, [0x85ffa4]
mov dword [esp], eax
call fcn.00409980
jmp 0x428fa1
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov ebx, dword [eax + 0x10]
mov ebp, dword [eax + 0x14]
mov esi, dword [esp + 0x1c]
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebp
call fcn.00414ed0
nop
lea eax, [0x85ffa4]
mov dword [esp], eax
call fcn.00409780
nop
mov eax, dword [0x85ff48]
sub eax, dword [0x85ff2c]
mov dword [0x85ff48], eax
mov eax, dword [0x85ff38]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x85ff38], ecx
nop
nop
lea eax, [0x85ffa4]
mov dword [esp], eax
call fcn.00409980
add esp, 0x14
ret
lea eax, [0x65e9f8]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call fcn.004370f0
nop
call fcn.004612b0
jmp fcn.00428ea0
Function at 0x4522a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x452427
sub esp, 0x10
mov ecx, dword [esp + 0x18]
test ecx, ecx
jbe 0x45241d
mov edx, dword [esp + 0x14]
movzx ebx, byte [edx]
test ebx, ebx
jne 0x4522fc
movzx ebp, byte [esp + 0x28]
xchg ebp, eax
test al, al
xchg ebp, eax
jne 0x4522fc
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov byte [esp + 0x38], 0
add esp, 0x10
ret
test ebx, 0x80
je 0x45230f
xor eax, eax
xor ebx, ebx
xor ebp, ebp
jmp 0x4523f2
mov eax, 1
mov ebp, ebx
and ebx, 1
neg ebx
shr ebp, 1
xor ebx, ebp
mov ebp, dword [esp + 0x24]
add dword [ebp], ebx
cmp ecx, eax
jb 0x4523e4
sub ecx, eax
mov ebx, dword [esp + 0x1c]
sub ebx, eax
mov ebp, ebx
neg ebx
sar ebx, 0x1f
and eax, ebx
lea ebx, [edx + eax]
test ecx, ecx
jbe 0x4523db
movzx edx, byte [edx + eax]
test edx, 0x80
je 0x452366
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ebp
xor eax, eax
xor edx, edx
xor esi, esi
jmp 0x4523af
mov eax, 1
cmp eax, ecx
ja 0x45239d
mov esi, dword [esp + 0x20]
add dword [esi], edx
sub ebp, eax
mov edx, ebp
xchg ebp, ebx
neg ebx
xchg ebp, ebx
sar ebp, 0x1f
and ebp, eax
add ebx, ebp
mov dword [esp + 0x2c], ebx
sub ecx, eax
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], edx
mov byte [esp + 0x38], 1
add esp, 0x10
ret
call fcn.004627b0
lea esi, [ecx + 7]
mov ecx, dword [esp + 8]
mov eax, ebp
mov ebp, dword [esp + 0xc]
cmp eax, ecx
jae 0x4523d6
movzx edi, byte [eax + ebx]
lea ebp, [eax + 1]
mov eax, edi
and edi, 0x7f
mov ecx, esi
shl edi, cl
or edx, edi
test al, 0x80
jne 0x4523a2
mov ecx, dword [esp + 8]
mov eax, ebp
mov ebp, dword [esp + 0xc]
jmp 0x45236b
call fcn.00462750
xor eax, eax
mov ecx, eax
call fcn.00462740
call fcn.004627b0
lea ebp, [ecx + 7]
mov ecx, dword [esp + 0x18]
mov eax, edi
cmp ecx, eax
jbe 0x452418
movzx esi, byte [eax + edx]
lea edi, [eax + 1]
mov eax, esi
and esi, 0x7f
mov ecx, ebp
shl esi, cl
or ebx, esi
test al, 0x80
jne 0x4523e9
mov ecx, dword [esp + 0x18]
mov eax, edi
jmp 0x452314
call fcn.00462750
xor eax, eax
mov ecx, eax
call fcn.00462740
nop
call fcn.004612b0
jmp fcn.004522a0
Function at 0x459e40
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x459edf
sub esp, 0x30
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
lea edi, [esp + 0xc]
xor eax, eax
call fcn.00462937
lea ecx, [0x459ef0]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x34]
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 8]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x28], ecx
lea ecx, [esp + 4]
mov dword [esp + 0x2c], ecx
lea ecx, [esp + 0xc]
mov dword [esp], ecx
call fcn.004611a0
mov ecx, dword [esp + 4]
mov dword [esp + 0x44], ecx
add esp, 0x30
ret
call fcn.004612b0
jmp fcn.00459e40
Function at 0x462570
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0x87be20]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x460d3b
je 0x460d8e
cmp ebx, 0x20
jbe 0x460d94
cmp ebx, 0x40
jbe 0x460dda
jmp 0x460e7b
test ebx, ebx
je 0x460d84
add eax, 0x10
test ax, 0xff0
je 0x460d70
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0x6c4ee0]
pxor xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0x6c50e0]
jmp 0x460d58
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x460d58
pxor xmm1, xmmword [0x87be30]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
pxor xmm2, xmm0
pxor xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x87be30]
pxor xmm2, xmmword [0x87be40]
pxor xmm3, xmmword [0x87be50]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
pxor xmm4, xmm0
pxor xmm5, xmm1
pxor xmm6, xmm2
pxor xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x87be30]
pxor xmm2, xmmword [0x87be40]
pxor xmm3, xmmword [0x87be50]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x460eda
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
cmp byte [0x87b95b], 0
je 0x46258a
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x460d00
jmp fcn.00408140
Function at 0x462590
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x402b3e
sub esp, 0x10
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp], ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.00408140
mov eax, dword [esp + 0xc]
mov dword [esp + 0x1c], eax
add esp, 0x10
ret
call fcn.004612b0
jmp 0x402b00
cmp byte [0x87b95b], 0
je 0x4625ab
mov eax, dword [esp + 4]
mov ebx, dword [eax + 4]
mov eax, dword [eax]
lea edx, [esp + 0xc]
jmp 0x460d00
jmp 0x402b00
Function at 0x4bfb60
Capabilities:
Hash data with md5

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
lea eax, [esp - 8]
cmp eax, dword [ecx + 8]
jbe 0x4bfc53
sub esp, 0x88
mov dword [esp + 0x98], 0
mov dword [esp + 0x9c], 0
mov dword [esp + 0xa0], 0
mov dword [esp + 0xa4], 0
lea edi, [esp + 0x2c]
xor eax, eax
call fcn.00462929
nop
mov dword [esp + 0x2c], 0x67452301
mov dword [esp + 0x30], 0xefcdab89
mov dword [esp + 0x34], 0x98badcfe
mov dword [esp + 0x38], 0x10325476
mov dword [esp + 0x7c], 0
mov dword [esp + 0x80], 0
mov dword [esp + 0x84], 0
lea ecx, [esp + 0x2c]
mov dword [esp], ecx
mov edx, dword [esp + 0x8c]
mov dword [esp + 4], edx
mov edx, dword [esp + 0x90]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x94]
mov dword [esp + 0xc], edx
call fcn.004bf670
lea ecx, [esp + 0x2c]
mov dword [esp], ecx
call fcn.004bf950
lea edi, [esp + 0x1c]
lea esi, [esp + 4]
call fcn.00462e28
lea edi, [esp + 0x98]
lea esi, [esp + 0x1c]
call fcn.00462e28
add esp, 0x88
ret
call fcn.004612b0
jmp fcn.004bfb60
Function at 0x4e0910
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4e0aae
sub esp, 0x5c
lea edi, [esp + 0x78]
xor eax, eax
call fcn.00462937
mov ecx, dword [esp + 0x60]
test ecx, ecx
je 0x4e094a
mov ecx, dword [esp + 0x64]
mov edx, dword [esp + 0x68]
mov eax, dword [esp + 0x60]
jmp 0x4e0973
lea eax, [0x628460]
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x200
call fcn.0044b0b0
mov eax, dword [esp + 0xc]
xor ecx, ecx
mov edx, 0x200
mov dword [esp + 0x24], ecx
lea edi, [esp + 0x38]
mov ebx, eax
xor eax, eax
call fcn.00462937
mov dword [esp + 0x38], ebx
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], edx
mov dword [esp + 0x54], ecx
movzx ecx, word [esp + 0x6c]
movzx edx, word [esp + 0x70]
shl edx, 0xb
movzx ebx, word [esp + 0x76]
or ebx, edx
movzx edx, byte [esp + 0x75]
test dl, dl
je 0x4e09bb
or ebx, 0x80
movzx eax, byte [esp + 0x74]
test al, al
je 0x4e09ca
or ebx, 0x100
movzx eax, byte [esp + 0x73]
test al, al
je 0x4e09d9
or ebx, 0x200
movzx eax, byte [esp + 0x72]
test al, al
je 0x4e09e8
or ebx, 0x400
movzx eax, byte [esp + 0x6e]
test al, al
je 0x4e09f7
or ebx, 0xffff8000
mov word [esp + 0x46], cx
mov word [esp + 0x48], bx
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov eax, dword [esp + 0x3c]
lea ecx, [eax + 0xc]
mov dword [esp + 0x24], ecx
mov edx, dword [esp + 0x40]
mov ebx, dword [esp + 0x38]
cmp edx, ecx
jae 0x4e0a5e
mov dword [esp + 0x20], eax
lea ebp, [0x628460]
mov dword [esp], ebp
mov dword [esp + 4], ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
call fcn.0044b2b0
mov ebx, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
mov dword [esp + 0x20], edx
mov dword [esp + 0x34], ebx
add eax, ebx
mov dword [esp], eax
lea eax, [esp + 0x28]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xc
call fcn.00463030
mov eax, dword [esp + 0x34]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x40], eax
mov byte [esp + 0x44], 1
lea edi, [esp + 0x78]
lea esi, [esp + 0x38]
call fcn.00462df6
add esp, 0x5c
ret
call fcn.004612b0
jmp fcn.004e0910
Function at 0x4f65d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4f6731
sub esp, 0x48
mov eax, dword [esp + 0x78]
cmp eax, 4
jne 0x4f6657
mov ecx, dword [esp + 0x74]
cmp dword [ecx], 0x6c616964
jne 0x4f665b
mov eax, dword [esp + 0x64]
mov ecx, dword [eax + 0x1c]
mov edx, dword [esp + 0x68]
mov dword [esp], edx
call ecx
movzx eax, byte [esp + 4]
test al, al
jne 0x4f6621
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x74]
jmp 0x4f665b
mov eax, dword [esp + 0x64]
mov eax, dword [eax + 0x24]
mov ecx, dword [esp + 0x68]
mov dword [esp], ecx
mov ecx, dword [esp + 0x54]
mov dword [esp + 4], ecx
mov edx, dword [esp + 0x58]
mov dword [esp + 8], edx
call eax
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov edx, eax
mov ebx, ecx
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x74]
jmp 0x4f6663
mov ecx, dword [esp + 0x74]
mov edx, dword [esp + 0x64]
mov ebx, dword [esp + 0x68]
mov dword [esp + 0x44], ebx
mov dword [esp + 0x40], edx
mov ebp, dword [esp + 0x54]
mov dword [esp], ebp
mov esi, dword [esp + 0x58]
mov dword [esp + 4], esi
mov edi, dword [esp + 0x5c]
mov dword [esp + 8], edi
mov edi, dword [esp + 0x60]
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], eax
call fcn.004f63b0
mov eax, dword [esp + 0x20]
movzx ecx, byte [esp + 0x24]
mov edx, dword [esp + 0x4c]
mov dword [esp], edx
mov edx, dword [esp + 0x50]
mov dword [esp + 4], edx
mov edx, dword [esp + 0x54]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x58]
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 0x18], eax
mov byte [esp + 0x1c], cl
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x30], eax
call fcn.004fbff0
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x34]
mov dword [esp + 0x80], edx
mov dword [esp + 0x84], eax
mov dword [esp + 0x88], ecx
add esp, 0x48
ret
call fcn.004612b0
jmp fcn.004f65d0
Function at 0x513130
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5131d8
mov eax, dword [esp + 4]
movzx ecx, byte [eax + 0x6c]
test cl, cl
je 0x51318b
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0x367cd507
mov dword [eax + 8], 0x3070dd17
mov dword [eax + 0xc], 0xf70e5939
mov dword [eax + 0x10], 0xffc00b31
mov dword [eax + 0x14], 0x68581511
mov dword [eax + 0x18], 0x64f98fa7
mov dword [eax + 0x1c], 0xbefa4fa4
jmp 0x5131c2
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
mov dword [eax + 0x60], 0
mov dword [eax + 0x64], 0
mov dword [eax + 0x68], 0
ret
call fcn.004612b0
jmp fcn.00513130
Function at 0x57fb20
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x57fd36
mov eax, dword [esp + 4]
mov ecx, dword [eax + 0xcc]
cmp ecx, 6
jne 0x57fbb9
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0xcbbb9d5d
mov dword [eax + 8], 0x367cd507
mov dword [eax + 0xc], 0x629a292a
mov dword [eax + 0x10], 0x3070dd17
mov dword [eax + 0x14], 0x9159015a
mov dword [eax + 0x18], 0xf70e5939
mov dword [eax + 0x1c], 0x152fecd8
mov dword [eax + 0x20], 0xffc00b31
mov dword [eax + 0x24], 0x67332667
mov dword [eax + 0x28], 0x68581511
mov dword [eax + 0x2c], 0x8eb44a87
mov dword [eax + 0x30], 0x64f98fa7
mov dword [eax + 0x34], 0xdb0c2e0d
mov dword [eax + 0x38], 0xbefa4fa4
mov dword [eax + 0x3c], 0x47b5481d
jmp 0x57fd17
cmp ecx, 0xe
jne 0x57fc32
mov dword [eax], 0x19544da2
mov dword [eax + 4], 0x8c3d37c8
mov dword [eax + 8], 0x89dcd4d6
mov dword [eax + 0xc], 0x73e19966
mov dword [eax + 0x10], 0x32ff9c82
mov dword [eax + 0x14], 0x1dfab7ae
mov dword [eax + 0x18], 0x582f9fcf
mov dword [eax + 0x1c], 0x679dd514
mov dword [eax + 0x20], 0x7bd44da8
mov dword [eax + 0x24], 0xf6d2b69
mov dword [eax + 0x28], 0x4c48942
mov dword [eax + 0x2c], 0x77e36f73
mov dword [eax + 0x30], 0x6a1d36c8
mov dword [eax + 0x34], 0x3f9d85a8
mov dword [eax + 0x38], 0x91d692a1
mov dword [eax + 0x3c], 0x1112e6ad
jmp 0x57fd17
cmp ecx, 0xf
jne 0x57fca8
mov dword [eax], 0xfc2bf72c
mov dword [eax + 4], 0x22312194
mov dword [eax + 8], 0xc84c64c2
mov dword [eax + 0xc], 0x9f555fa3
mov dword [eax + 0x10], 0x6f53b151
mov dword [eax + 0x14], 0x2393b86b
mov dword [eax + 0x18], 0x5940eabd
mov dword [eax + 0x1c], 0x96387719
mov dword [eax + 0x20], 0xa88effe3
mov dword [eax + 0x24], 0x96283ee2
mov dword [eax + 0x28], 0x53863992
mov dword [eax + 0x2c], 0xbe5e1e25
mov dword [eax + 0x30], 0x2c85b8aa
mov dword [eax + 0x34], 0x2b0199fc
mov dword [eax + 0x38], 0x81c52ca2
mov dword [eax + 0x3c], 0xeb72ddc
jmp 0x57fd17
mov dword [eax], 0xf3bcc908
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x3c], 0x5be0cd19
mov dword [eax + 0xc0], 0
mov dword [eax + 0xc4], 0
mov dword [eax + 0xc8], 0
ret
call fcn.004612b0
jmp fcn.0057fb20