joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003fde0
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x108
mov eax, dword [0x100810f0]
xor eax, esp
mov dword [esp + 0x104], eax
mov eax, dword [esp + 0x10c]
push eax
call fcn.10053b82
add esp, 4
mov byte [esp], 0
test eax, eax
je 0x1003fe45
push 0x104
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_ExpandEnvironmentStringsA]
cmp byte [esp], 0
je 0x1003fe45
lea edx, [esp]
push edx
call dword [0x1008100c]
add esp, 4
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.1004ea1f
add esp, 0x108
ret
mov ecx, dword [esp + 0x104]
xor ecx, esp
xor eax, eax
call fcn.1004ea1f
add esp, 0x108
ret
jmp 0x1003fde0

Function at 0x1003fe60
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x108
mov eax, dword [0x100810f0]
xor eax, esp
mov dword [esp + 0x104], eax
mov eax, dword [esp + 0x10c]
push eax
call fcn.10053b82
add esp, 4
mov byte [esp], 0
test eax, eax
je 0x1003fe45
push 0x104
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_ExpandEnvironmentStringsA]
cmp byte [esp], 0
je 0x1003fe45
lea edx, [esp]
push edx
call dword [0x1008100c]
add esp, 4
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.1004ea1f
add esp, 0x108
ret
mov ecx, dword [esp + 0x104]
xor ecx, esp
xor eax, eax
call fcn.1004ea1f
add esp, 0x108
ret
jmp 0x1003fde0
Function at 0x10042ac0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, dword [esp + 4]
push ebx
mov ebx, dword [eax + 0x2c]
push esi
push edi
mov edi, dword [ebx]
mov esi, dword [edi + 0x1e0]
test esi, esi
jne 0x10042ad9
mov esi, dword [eax + 0x28]
mov ecx, dword [eax + 0x24]
mov edx, dword [eax + 0x20]
push ecx
push edx
call fcn.10029ee0
push edx
push eax
call fcn.10029f10
add esp, 0x10
sub esi, eax
cmp dword [edi + 0x1d4], 0
je 0x10042b26
mov eax, dword [ebx + 0x124]
mov ecx, dword [ebx + 0x120]
push eax
push ecx
call fcn.10029ee0
push edx
push eax
call fcn.10029f10
mov ecx, dword [edi + 0x1d4]
sub ecx, eax
add esp, 0x10
cmp esi, ecx
mov eax, ecx
jge 0x10042b28
mov eax, esi
pop edi
pop esi
pop ebx
ret

Function at 0x10043b10
Capabilities:
Get hostname

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push esi
mov byte [esi], 0
call dword [sym.imp.WS2_32.dll_gethostname]
mov byte [esi + edi - 1], 0
test eax, eax
jne 0x10043b42
push 0x2e
push esi
call fcn.10051840
add esp, 8
test eax, eax
je 0x10043b40
mov byte [eax], 0
xor eax, eax
pop edi
pop esi
ret

Function at 0x10043c10
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
sub esp, 8
push 0xf0000000
push 1
push 0
push 0
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x10043c45
mov edx, dword [esp]
lea ecx, [esp + 4]
push ecx
push 0
push 0
push 0x8003
push edx
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
push esi
mov esi, dword [esp + 0x14]
mov eax, esi
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10043c50
sub eax, edx
push eax
call fcn.10028eb0
add esp, 4
push 0
push eax
mov eax, dword [esp + 0x10]
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
mov edx, dword [esp + 0x10]
lea ecx, [esp + 4]
push ecx
push edx
call fcn.10043bb0
add esp, 8
pop esi
add esp, 8
ret

Function at 0x10045290
Capabilities:
Read file on windows

Disassembly:
push edi
mov edi, eax
mov eax, dword [esi]
cmp dword [eax + 4], 2
jne 0x100452b2
mov ecx, dword [esi + 0xc]
test ecx, ecx
jne 0x100452a6
xor eax, eax
pop edi
ret
mov eax, dword [eax + 8]
push eax
push edi
push 1
push ebx
call ecx
jmp 0x100452e2
cmp dword [esi + 8], 0
jne 0x100452d5
mov ecx, dword [eax + 8]
push 0x100752a4
push ecx
call fcn.100528a6
add esp, 8
mov dword [esi + 8], eax
test eax, eax
jne 0x100452d5
or eax, 0xffffffff
pop edi
ret
mov edx, dword [esi + 8]
push edx
push edi
push 1
push ebx
call fcn.10051b9e
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x10045304
mov eax, dword [esi + 8]
test eax, eax
je 0x100452fe
push eax
call fcn.1005015c
add esp, 4
mov dword [esi + 8], edi
mov eax, dword [esi]
mov ecx, dword [eax]
mov dword [esi], ecx
mov eax, edi
pop edi
ret
Function at 0x10046780
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x14]
lea eax, [ecx + eax*2 + 0xc]
push edi
push eax
call dword [section..data]
mov edi, eax
add esp, 4
test edi, edi
jne 0x100467a5
pop edi
pop esi
pop ecx
ret
lea eax, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], eax
mov edx, dword [esi + 0xc]
push ebx
add edx, eax
push ebp
mov ebp, dword [esp + 0x20]
mov dword [edi + 8], edx
cmp ebp, dword [esi + 0x10]
jbe 0x100467ec
push eax
mov eax, dword [esi]
call eax
mov ecx, dword [esp + 0x20]
mov edx, dword [edi + 4]
mov eax, dword [esi + 4]
push ebp
push ecx
push edx
call eax
mov ebx, dword [edi + 8]
mov ecx, dword [edi + 4]
add ebx, dword [esi + 0xc]
mov edx, dword [esi + 8]
push ecx
push ebx
call edx
mov ebp, dword [esi + 0x14]
add esp, 0x18
jmp 0x100467f0
mov ebx, dword [esp + 0x1c]
mov eax, dword [edi + 4]
mov ecx, dword [esi]
push eax
call ecx
mov edx, dword [edi + 8]
mov eax, dword [esi]
push edx
call eax
add esp, 8
mov dword [esp + 0x10], 0
test ebp, ebp
jbe 0x1004684e
mov dword [esp + 0x10], ebp
mov cl, byte [ebx]
xor cl, 0x36
mov byte [esp + 0x18], cl
mov eax, dword [edi + 4]
mov ecx, dword [esi + 4]
push 1
lea edx, [esp + 0x1c]
push edx
push eax
call ecx
mov dl, byte [ebx]
xor dl, 0x5c
mov byte [esp + 0x24], dl
mov ecx, dword [edi + 8]
mov edx, dword [esi + 4]
push 1
lea eax, [esp + 0x28]
push eax
push ecx
inc ebx
call edx
add esp, 0x18
sub ebp, 1
jne 0x10046813
mov eax, dword [esp + 0x10]
pop ebp
pop ebx
cmp eax, dword [esi + 0x10]
jae 0x10046891
lea esp, [esp]
mov ecx, dword [edi + 4]
mov edx, dword [esi + 4]
push 1
push 0x1007547c
push ecx
call edx
mov eax, dword [edi + 8]
mov ecx, dword [esi + 4]
push 1
push 0x1007547d
push eax
call ecx
mov eax, dword [esp + 0x20]
inc eax
add esp, 0x18
mov dword [esp + 8], eax
cmp eax, dword [esi + 0x10]
jb 0x10046860
mov eax, edi
pop edi
pop esi
pop ecx
ret
Function at 0x1004e370
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
mov edi, dword [esp + 0x14]
xor ebp, ebp
cmp edi, ebp
jne 0x1004e38f
mov eax, dword [esp + 0xc]
pop edi
mov dword [eax + 8], ebp
mov dword [eax + 4], ebp
mov dword [eax], 1
pop ebp
ret
push esi
lea eax, [esp + 0x18]
push eax
push edi
mov dword [esp + 0x20], ebp
call fcn.1004be80
mov esi, eax
add esp, 8
cmp esi, ebp
je 0x1004e3c1
push edi
call fcn.1005015c
mov eax, dword [esp + 0x14]
add esp, 4
mov dword [eax], esi
pop esi
pop edi
mov dword [eax + 8], ebp
mov dword [eax + 4], ebp
pop ebp
ret
push ebx
mov ebx, dword [esp + 0x1c]
mov eax, ebx
cmp ebx, ebp
ja 0x1004e3d1
mov eax, 1
push eax
call dword [0x10081044]
add esp, 4
mov esi, eax
push edi
cmp esi, ebp
jne 0x1004e3ff
call fcn.1005015c
mov eax, dword [esp + 0x18]
add esp, 4
pop ebx
pop esi
pop edi
mov dword [eax + 8], ebp
mov dword [eax + 4], ebp
mov dword [eax], 3
pop ebp
ret
push ebx
push 1
push esi
call fcn.10051b9e
push edi
mov ebp, eax
call fcn.1005015c
add esp, 0x14
cmp ebp, ebx
je 0x1004e438
push esi
call dword [0x10081048]
mov eax, dword [esp + 0x18]
add esp, 4
pop ebx
pop esi
xor ecx, ecx
pop edi
mov dword [eax + 8], ecx
mov dword [eax], 2
mov dword [eax + 4], ecx
pop ebp
ret
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x1c]
push edx
push ebx
push esi
mov esi, dword [esp + 0x24]
push esi
call fcn.1004e340
pop ebx
mov eax, esi
pop esi
pop edi
pop ebp
ret

Function at 0x1004ea1f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100810f0]
jne 0x1004ea29
repz ret
jmp fcn.10056af3
Function at 0x10065fa5
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.10056c6b
and dword [ebp - 4], 0
cmp dword [0x10083650], 0
mov ebx, eax
jne 0x10066056
push str.USER32.DLL
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x10066107
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x10066107
push eax
call fcn.10056bf9
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x10083650], eax
call esi
push eax
call fcn.10056bf9
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x10083654], eax
call esi
push eax
call fcn.10056bf9
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x10083658], eax
call esi
push eax
call fcn.10056bf9
pop ecx
mov dword [0x10083660], eax
test eax, eax
je 0x10066056
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.10056bf9
pop ecx
mov dword [0x1008365c], eax
mov eax, dword [0x1008365c]
cmp eax, ebx
je 0x100660ae
cmp dword [0x10083660], ebx
je 0x100660ae
push eax
call fcn.10056c74
push dword [0x10083660]
mov esi, eax
call fcn.10056c74
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x100660ae
test edi, edi
je 0x100660ae
call esi
test eax, eax
je 0x100660a5
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x100660a5
test byte [ebp - 0xc], 1
jne 0x100660ae
or dword [ebp + 0x10], 0x200000
jmp 0x100660e7
mov eax, dword [0x10083654]
cmp eax, ebx
je 0x100660e7
push eax
call fcn.10056c74
pop ecx
test eax, eax
je 0x100660e7
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x100660e7
mov eax, dword [0x10083658]
cmp eax, ebx
je 0x100660e7
push eax
call fcn.10056c74
pop ecx
test eax, eax
je 0x100660e7
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x10083650]
call fcn.10056c74
pop ecx
test eax, eax
je 0x10066107
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x10066109
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401120
Capabilities:
Check for time delay via gettickcount

Disassembly:
movsx ecx, byte [0x4274df]
mov al, byte [0x4274f8]
mov edx, dword [0x427510]
push ebx
push ebp
push edi
push ecx
dec al
push edx
mov dword [0x427520], 0x1149ffff
mov word [0x4274f4], 1
mov byte [0x4274da], al
call fcn.0040c6e0
movsx ecx, word [0x4274ec]
mov dword [0x427520], eax
mov eax, dword [0x427524]
push eax
push ecx
mov bl, 1
call fcn.0040c720
mov edi, dword [sym.imp.KERNEL32.DLL_GetTickCount]
add esp, 0x10
mov word [0x4274f4], ax
call edi
mov ebp, eax
call edi
sub eax, ebp
cmp eax, 0x535
jae 0x40129b
or ebx, 0xffffffff
push esi
jmp 0x4011a0
movsx edx, word [0x4274ec]
push 0x7a69ffff
push edx
mov word [0x4274f4], bx
mov byte [0x4274dc], 1
call fcn.0040c7b0
mov ecx, dword [0x427514]
mov dword [0x42751c], eax
movsx eax, byte [0x4274de]
push eax
push ecx
call fcn.0040c7f0
mov byte [0x4274d9], al
call fcn.004010b0
mov esi, eax
mov eax, dword [0x42752c]
mov edx, 0xd58bffff
sub edx, eax
movsx eax, byte [0x4274d9]
push 0x63f7ffff
push eax
mov dword [0x427518], edx
mov word [0x427500], bx
call fcn.0040c8a0
add esp, 0x18
cmp esi, 0xd0000000
mov byte [0x4274de], al
ja 0x401228
cmp esi, 0x80000000
jae 0x401294
movsx cx, byte [0x4274dd]
mov edx, dword [0x427520]
movsx eax, al
push edx
push eax
imul ecx, dword [0x42750c]
mov word [0x4274f4], cx
call fcn.0040c7b0
movsx edx, byte [0x4274df]
movsx ecx, ax
push edx
or ecx, 0x8e25ffff
push 0x8421ffff
mov word [0x4274f8], ax
mov dword [0x42752c], ecx
call fcn.0040c8a0
add esp, 0x10
mov word [0x4274ec], ax
call edi
sub eax, ebp
cmp eax, 0x535
jb 0x4011a0
pop esi
pop edi
pop ebp
mov al, 1
pop ebx
ret
pop esi
pop edi
pop ebp
xor al, al
pop ebx
ret
pop edi
pop ebp
mov al, bl
pop ebx
ret
Function at 0x403fe0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x41fae3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov eax, dword [esp + 0x34]
push esi
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 8], 0
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
mov ecx, dword [esp + 0x3c]
push ecx
mov ecx, eax
mov dword [esp + 0x30], 1
call dword [sym.imp.MSVCP71.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
mov esi, dword [esp + 0x34]
push eax
mov ecx, esi
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
lea ecx, [esp + 8]
mov dword [esp + 4], 1
mov byte [esp + 0x2c], 0
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov ecx, dword [esp + 0x24]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret

Function at 0x404060
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x41fae3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov eax, dword [esp + 0x34]
push esi
push eax
push 1
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], 0
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_unsigned_int__char_]
mov ecx, dword [esp + 0x3c]
push ecx
mov ecx, eax
mov dword [esp + 0x30], 1
call dword [sym.imp.MSVCP71.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
mov esi, dword [esp + 0x34]
push eax
mov ecx, esi
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
lea ecx, [esp + 8]
mov dword [esp + 4], 1
mov byte [esp + 0x2c], 0
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov ecx, dword [esp + 0x24]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret
Function at 0x4040e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x41fae3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov eax, dword [esp + 0x34]
push esi
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 8], 0
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
mov ecx, dword [esp + 0x3c]
push ecx
mov ecx, eax
mov dword [esp + 0x30], 1
call dword [sym.imp.MSVCP71.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_char_const__]
mov esi, dword [esp + 0x34]
push eax
mov ecx, esi
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
lea ecx, [esp + 8]
mov dword [esp + 4], 1
mov byte [esp + 0x2c], 0
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov ecx, dword [esp + 0x24]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret
Function at 0x404750
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x41fb59
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
movsx eax, byte [0x4274df]
mov ecx, dword [0x427518]
push esi
push eax
push ecx
call fcn.0040c6e0
movsx edx, word [0x4274e8]
push edx
push 0x6b55ffff
mov word [0x4274ec], ax
mov dword [0x42752c], 1
call fcn.0040c760
mov word [0x4274f4], ax
mov eax, dword [0x42752c]
push 0x4913ffff
push eax
xor esi, esi
call fcn.0040c7b0
push 0x1a5dffff
push 0x637bffff
mov dword [0x42750c], eax
call fcn.0040c8a0
add esp, 0x20
lea ecx, [esp + 4]
mov byte [0x4274d8], al
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_void_]
movsx ecx, word [0x4274f8]
push ecx
push 0x1243ffff
mov dword [esp + 0x30], esi
call fcn.0040c720
mov ecx, dword [esp + 0x3c]
xor edx, edx
cmp word [0x427500], dx
mov dword [0x427528], eax
setne dl
lea eax, [esp + 0xc]
push eax
push ecx
mov dword [0x427524], edx
mov edx, dword [esp + 0x40]
push edx
call fcn.00414000
add esp, 0x14
test eax, eax
je 0x404912
movsx eax, word [0x4274fc]
push edi
push 0x6bcdffff
push eax
call fcn.0040c720
movsx ecx, byte [0x4274de]
push 0x299dffff
push ecx
mov word [0x4274f0], ax
call fcn.0040c830
push 0xe489ffff
push 0x2103ffff
mov word [0x4274f4], ax
call fcn.0040c7b0
mov edi, dword [esp + 0x54]
push 0x4214f4
push edi
mov byte [0x4274d9], al
call fcn.0040f3e0
add esp, 0x20
test eax, eax
je 0x404911
mov eax, dword [0x42752c]
push eax
push eax
call fcn.0040c8e0
lea edx, [esp + 0x10]
push edx
push edi
mov byte [0x4274df], al
call fcn.0040eb50
add esp, 0x10
test eax, eax
je 0x404911
movsx eax, word [0x427500]
push 0x26a3ffff
push eax
call fcn.0040c720
movsx ecx, byte [0x4274de]
push ecx
push 0xd35bffff
mov dword [0x42751c], eax
call fcn.0040c8e0
push edi
mov byte [0x4274e0], al
mov word [0x4274fc], 0xfffe
call fcn.00404180
mov edx, dword [0x42751c]
push 0x8fbffff
push edx
mov esi, eax
mov byte [0x4274df], 0
call fcn.0040c6e0
add esp, 0x1c
mov dword [0x427510], eax
mov byte [0x4274e0], 0xff
pop edi
mov ecx, dword [0x42752c]
xor eax, eax
test ecx, ecx
setne al
push 0x6825ffff
push 0x72cbffff
mov word [0x4274f8], 0xffff
mov word [0x4274ec], ax
call fcn.0040c720
add esp, 8
lea ecx, [esp + 4]
mov word [0x4274e4], ax
mov dword [esp + 0x28], 0xffffffff
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov ecx, dword [esp + 0x20]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x28
ret
Function at 0x405260
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x41fc73
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push esi
push 0xb6a3ffff
mov dword [esp + 0xc], 0
push 0x9011ffff
mov byte [0x4274da], 1
call fcn.0040c720
mov dword [0x42752c], eax
mov eax, dword [0x42750c]
push eax
push 0x84cdffff
call fcn.0040c6e0
movsx ecx, word [0x4274f4]
push 0xdd79ffff
push ecx
mov byte [0x4274df], al
call fcn.0040c870
lea edx, [esp + 0x1c]
push edx
push 0
mov dword [0x427520], eax
call fcn.0040c920
mov eax, dword [0x42752c]
push 0x1059ffff
push eax
call fcn.0040c8a0
add esp, 0x28
lea ecx, [esp + 0xc]
mov dword [0x427520], eax
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_void_]
mov edx, dword [0x42752c]
movsx eax, word [0x4274e8]
mov cl, byte [0x4274dc]
push edx
push eax
mov dword [esp + 0x38], 1
mov byte [0x4274d9], cl
call fcn.0040c8e0
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x14]
push ecx
push edx
mov word [0x4274ec], ax
call fcn.0041c470
push 0xceb7ffff
push 0xd117ffff
call fcn.0040c6e0
mov esi, dword [esp + 0x50]
mov word [0x4274e4], ax
add esp, 0x18
lea eax, [esp + 0xc]
push eax
mov ecx, esi
mov dword [0x427514], 0xe8920000
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
lea ecx, [esp + 0xc]
mov dword [esp + 8], 1
mov byte [esp + 0x30], 0
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov ecx, dword [esp + 0x28]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x30
ret
Function at 0x407320
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x41fe41
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push esi
push edi
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_void_]
mov esi, dword [esp + 0x38]
test esi, esi
lea eax, [esp + 0xc]
push eax
push 0x4224f4
push ecx
mov eax, esp
mov byte [esp + 0x3c], 1
mov dword [esp + 0x14], esp
mov dword [eax], esi
je 0x407372
mov ecx, dword [esi]
push esi
call dword [ecx + 4]
call fcn.0041ee20
add esp, 0xc
test eax, eax
je 0x4073eb
movsx eax, byte [0x4274d9]
movsx edx, byte [0x4274dc]
mov edi, dword [esp + 0x3c]
and edx, eax
mov dword [0x427514], edx
mov eax, dword [edi + 0x14]
test eax, eax
jbe 0x4073ac
push 0x4224f0
mov ecx, edi
call dword [sym.imp.MSVCP71.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_char_const__]
movsx ecx, word [0x4274e8]
push 0xa689ffff
push ecx
call fcn.0040c720
movsx edx, byte [0x4274de]
push 0x3bcfffff
push edx
mov byte [0x4274dc], al
call fcn.0040c720
mov word [0x4274fc], ax
add esp, 0x10
lea eax, [esp + 0xc]
push eax
mov ecx, edi
call dword [sym.imp.MSVCP71.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], 0
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
test esi, esi
mov dword [esp + 0x30], 0xffffffff
je 0x40740c
mov ecx, dword [esi]
push esi
call dword [ecx + 8]
mov ecx, dword [esp + 0x28]
pop edi
mov dword fs:[0], ecx
pop esi
add esp, 0x2c
ret
Function at 0x412440
Capabilities:
Hash data with md5

Disassembly:
push esi
push 0x233fffff
push 0x57a1ffff
mov esi, ecx
mov word [0x4274e8], 0xffff
call fcn.0040c8a0
mov byte [0x4274da], al
xor eax, eax
lea ecx, [esi + 0x10]
mov dword [ecx], eax
mov dword [ecx + 4], eax
cmp word [0x427500], ax
push 0x65dbffff
setne dl
mov byte [0x4274dd], dl
mov dword [esi], 0x67452301
mov al, byte [0x427518]
dec al
push 0x27afffff
mov byte [0x4274df], al
call fcn.0040c8e0
mov word [0x4274f8], ax
mov dword [esi + 4], 0xefcdab89
mov cx, word [0x4274f0]
mov eax, dword [0x427528]
dec cx
xor edx, edx
test eax, eax
setne dl
mov word [0x4274ec], cx
xor ecx, ecx
mov dword [0x427524], edx
mov dword [esi + 8], 0x98badcfe
mov ax, word [0x427518]
sub ax, word [0x4274f0]
cmp word [0x4274e8], cx
mov edx, dword [0x42750c]
setne cl
mov word [0x427500], ax
movsx eax, byte [0x4274db]
push edx
push eax
mov word [0x4274f4], cx
call fcn.0040c870
movsx ecx, byte [0x4274de]
mov byte [0x4274dd], al
sub ecx, dword [0x427518]
mov dword [0x427510], ecx
mov dword [esi + 0xc], 0x10325476
movsx edx, word [0x4274f4]
push edx
push 0x43a9ffff
call fcn.0040c720
movsx ecx, word [0x4274fc]
mov byte [0x4274e0], al
movsx eax, byte [0x4274de]
push eax
push ecx
call fcn.0040c8e0
mov edx, dword [0x427520]
mov byte [0x4274dc], al
mov eax, dword [0x427518]
push edx
push eax
call fcn.0040c8e0
mov cl, byte [0x427524]
add esp, 0x30
neg cl
mov byte [0x4274d8], al
mov byte [0x4274da], cl
pop esi
ret