joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416d50
Capabilities:
Parse credit card information

Disassembly:
push esi
mov esi, ecx
xor cl, cl
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x416f65
push ebx
push edi
cmp eax, 0x7c
je 0x416f63
cmp eax, 0x29
jne 0x416d91
cmp dword [esi + 0x10], 0
jne 0x416f63
cmp eax, eax
jne 0x416d91
test dword [esi + 0x50], 0x10000000
je 0x416f72
jmp 0x416f1c
cmp eax, 0x2e
jne 0x416deb
push 5
lea ecx, [esi + 0x24]
call fcn.00419bf0
mov eax, dword [esi]
mov edx, dword [esi + 8]
cmp eax, edx
je 0x416ddf
cmp byte [eax], 0x5c
jne 0x416ddc
lea ecx, [eax + 1]
cmp ecx, edx
je 0x416ddc
mov edx, dword [esi + 0x50]
test dl, 8
jne 0x416dc9
mov bl, byte [ecx]
cmp bl, 0x28
je 0x416dda
cmp bl, 0x29
je 0x416dda
test dl, 0x10
jne 0x416ddc
mov dl, byte [ecx]
cmp dl, 0x7b
je 0x416dda
cmp dl, 0x7d
jne 0x416ddc
mov eax, ecx
inc eax
mov dword [esi], eax
mov ecx, esi
call fcn.0041a840
jmp 0x416f4e
cmp eax, 0x5c
jne 0x416e47
mov ecx, esi
call fcn.00419c60
test byte [esi + 0x50], 0x80
je 0x416e3b
mov al, byte [esi + 0x48]
cmp al, 0x62
jne 0x416e1a
push 4
lea ecx, [esi + 0x24]
call fcn.00419bf0
mov ecx, esi
call fcn.00419c60
jmp 0x416f55
cmp al, 0x42
jne 0x416e3b
push 4
lea ecx, [esi + 0x24]
call fcn.00419bf0
mov eax, dword [esi + 0x28]
mov ecx, esi
xor dword [eax + 8], 1
call fcn.00419c60
jmp 0x416f55
mov ecx, esi
call fcn.00416f90
jmp 0x416f4e
cmp eax, 0x5b
jne 0x416ea8
mov ecx, esi
call fcn.00419c60
lea ecx, [esi + 0x24]
call fcn.004160e0
mov eax, dword [esi + 0x4c]
cmp eax, 0x5e
jne 0x416e74
mov eax, dword [esi + 0x28]
mov ecx, esi
xor dword [eax + 8], 1
call fcn.00419c60
mov eax, dword [esi + 0x4c]
test dword [esi + 0x50], 0x20000000
je 0x416e92
cmp eax, 0x5d
jne 0x416e92
push eax
lea ecx, [esi + 0x24]
call fcn.00416070
mov ecx, esi
call fcn.00419c60
mov ecx, esi
call fcn.004179f0
cmp dword [esi + 0x4c], 0x5d
jne 0x416f7b
jmp 0x416f47
cmp eax, 0x28
jne 0x416ed8
mov ecx, esi
call fcn.00419c60
mov ecx, esi
call fcn.0041ab20
cmp dword [esi + 0x4c], 0x29
mov bl, al
jne 0x416f72
mov ecx, esi
call fcn.00419c60
test bl, bl
je 0x416f55
jmp 0x416f4e
cmp eax, 0x5e
jne 0x416ef0
push 2
lea ecx, [esi + 0x24]
call fcn.00419bf0
mov ecx, esi
call fcn.00419c60
jmp 0x416f55
cmp eax, 0x24
jne 0x416f08
push 3
lea ecx, [esi + 0x24]
call fcn.00419bf0
mov ecx, esi
call fcn.00419c60
jmp 0x416f55
cmp eax, 0x2a
je 0x416f69
cmp eax, 0x2b
je 0x416f69
cmp eax, 0x3f
je 0x416f69
cmp eax, 0x7b
je 0x416f69
cmp eax, 0x7d
jne 0x416f2c
test dword [esi + 0x50], 0x10000000
je 0x416f84
jmp 0x416f3a
cmp eax, 0x5d
jne 0x416f3a
test dword [esi + 0x50], 0x10000000
je 0x416f7b
movzx eax, byte [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.00415f70
mov ecx, esi
call fcn.00419c60
mov ecx, esi
call fcn.0041a080
mov eax, dword [esi + 0x4c]
mov cl, 1
cmp eax, 0xffffffff
jne 0x416d63
pop edi
pop ebx
mov al, cl
pop esi
push 0xa
mov ecx, esi
call fcn.00418f40
push 5
mov ecx, esi
call fcn.00418f40
push 4
mov ecx, esi
call fcn.00418f40
push 6
mov ecx, esi
call fcn.00418f40
int3
Function at 0x418e80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x59c388]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x418f23
cmp byte [esi + 0x3d], 0
je 0x418f23
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x418ed9
mov ecx, dword [esi + 0x38]
mov eax, dword [ecx]
mov edx, dword [eax + 0x20]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call edx
sub eax, 0
je 0x418eeb
sub eax, 1
je 0x418eef
sub eax, 2
je 0x418f23
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004f3d68
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x418f0c
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0051be7d
add esp, 0x10
cmp edi, eax
jne 0x418ed9
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004f3d68
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.004f3d68
mov esp, ebp
pop ebp
ret

Function at 0x41b780
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x41b7b1
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x41b7a0
pop edi
mov eax, edx
pop esi
pop ebp
ret 8
Function at 0x41da60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x59c388]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x41da90
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004f3d68
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x41dacc
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x41dacc
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004f3d68
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x41dbb3
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x41daf4
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x41db27
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.0051b5a9
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004f3d68
mov esp, ebp
pop ebp
ret 4
mov byte [ebp - 0x28], bl
mov eax, dword [ecx]
mov edx, dword [eax + 0x1c]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call edx
test eax, eax
js 0x41dbb3
cmp eax, 1
jle 0x41db86
cmp eax, 3
jne 0x41dbb3
push dword [esi + 0x4c]
push dword [ebp - 0x28]
call fcn.00412310
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004f3d68
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x41dba3
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0051be7d
add esp, 0x10
cmp edi, eax
jne 0x41dbb3
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
jne 0x41dab7
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004f3d68
mov esp, ebp
pop ebp
ret 4
Function at 0x41f750
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ecx + 0x38], 0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
je 0x41f824
mov esi, dword [ebp + 0x10]
mov ebx, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
test esi, esi
jl 0x41f813
jg 0x41f788
test edx, edx
je 0x41f813
call fcn.00419220
mov esi, eax
mov eax, edx
mov dword [ebp - 8], eax
test eax, eax
jl 0x41f7d8
jg 0x41f79e
test esi, esi
je 0x41f7d8
cmp ebx, eax
jg 0x41f7ad
jl 0x41f7a8
cmp edi, esi
jae 0x41f7ad
mov esi, edi
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
push esi
mov eax, dword [eax + 0x1c]
push dword [eax]
push dword [ebp + 8]
call fcn.0050b2a0
mov ecx, dword [ebp - 4]
add esp, 0xc
sub edi, esi
sbb ebx, dword [ebp - 8]
mov eax, dword [ecx + 0x2c]
sub dword [eax], esi
mov eax, dword [ecx + 0x1c]
add dword [eax], esi
mov eax, dword [ebp + 8]
jmp 0x41f7fa
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
call dword [eax + 0x1c]
mov ecx, eax
cmp ecx, 0xffffffff
je 0x41f80d
mov eax, dword [ebp + 8]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
mov byte [eax], cl
mov ecx, dword [ebp - 4]
add eax, esi
mov dword [ebp + 8], eax
test ebx, ebx
jg 0x41f788
jl 0x41f80d
test edi, edi
jne 0x41f788
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
sub edx, edi
pop edi
sbb esi, ebx
mov eax, edx
mov edx, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x1c]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0xc], esi
mov eax, dword [eax]
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], eax
test eax, eax
je 0x41f843
mov eax, dword [ecx + 0x2c]
mov eax, dword [eax]
jmp 0x41f845
xor eax, eax
cdq
mov ebx, eax
mov eax, edx
mov dword [ebp + 0x10], eax
test edi, edi
jl 0x41f8ed
jg 0x41f85f
test esi, esi
je 0x41f8ed
test eax, eax
jl 0x41f89e
jg 0x41f869
test ebx, ebx
je 0x41f89e
cmp edi, eax
jg 0x41f878
jl 0x41f873
cmp esi, ebx
jae 0x41f878
mov ebx, esi
mov dword [ebp + 0x10], edi
push ebx
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.0050b2a0
mov ecx, dword [ebp - 4]
add esp, 0xc
add dword [ebp + 8], ebx
sub esi, ebx
sbb edi, dword [ebp + 0x10]
mov eax, dword [ecx + 0x2c]
sub dword [eax], ebx
mov eax, dword [ecx + 0x1c]
add dword [eax], ebx
jmp 0x41f8a4
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
test edi, edi
jl 0x41f8ed
jg 0x41f8ae
test esi, esi
je 0x41f8ed
mov edx, dword [ecx + 0x4c]
test edx, edx
je 0x41f8ed
mov ebx, dword [ecx + 0xc]
lea eax, [ecx + 0x3c]
cmp dword [ebx], eax
jne 0x41f8d9
mov edx, dword [ecx + 0x54]
mov ecx, dword [ecx + 0x50]
sub edx, ecx
mov dword [ebx], ecx
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebx + 0x2c]
mov dword [eax], edx
mov edx, dword [ebx + 0x4c]
push edx
push esi
push 1
push dword [ebp + 8]
call fcn.0051b891
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x41f9d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ecx + 0x38], 0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
je 0x41fa9e
mov esi, dword [ebp + 0x10]
mov ebx, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
test esi, esi
jl 0x41fa8d
jg 0x41fa08
test edx, edx
je 0x41fa8d
call fcn.00419de0
mov esi, eax
mov eax, edx
mov dword [ebp - 8], eax
test eax, eax
jl 0x41fa56
jg 0x41fa1e
test esi, esi
je 0x41fa56
cmp ebx, eax
jg 0x41fa2d
jl 0x41fa28
cmp edi, esi
jae 0x41fa2d
mov esi, edi
mov dword [ebp - 8], ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 8]
push esi
push eax
mov eax, dword [ecx + 0x20]
push dword [eax]
call fcn.0050b2a0
mov ecx, dword [ebp - 4]
add esp, 0xc
sub edi, esi
sbb ebx, dword [ebp - 8]
mov eax, dword [ecx + 0x30]
sub dword [eax], esi
mov eax, dword [ecx + 0x20]
add dword [eax], esi
jmp 0x41fa7a
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
push eax
call edx
cmp eax, 0xffffffff
je 0x41fa87
mov ecx, dword [ebp - 4]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
add dword [ebp + 8], esi
test ebx, ebx
jg 0x41fa08
jl 0x41fa87
test edi, edi
jne 0x41fa08
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
sub edx, edi
pop edi
sbb esi, ebx
mov eax, edx
mov edx, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0xc], esi
mov eax, dword [eax]
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], eax
test eax, eax
je 0x41fabd
mov eax, dword [ecx + 0x30]
mov eax, dword [eax]
jmp 0x41fabf
xor eax, eax
cdq
mov ebx, eax
mov eax, edx
mov dword [ebp + 0x10], eax
test edi, edi
jl 0x41fb38
jg 0x41fad1
test esi, esi
je 0x41fb38
test eax, eax
jl 0x41fb12
jg 0x41fadb
test ebx, ebx
je 0x41fb12
cmp edi, eax
jg 0x41faea
jl 0x41fae5
cmp esi, ebx
jae 0x41faea
mov ebx, esi
mov dword [ebp + 0x10], edi
push ebx
push dword [ebp + 8]
push dword [ebp - 8]
call fcn.0050b2a0
mov ecx, dword [ebp - 4]
add esp, 0xc
mov edx, dword [ebp + 8]
add edx, ebx
sub esi, ebx
mov eax, dword [ecx + 0x30]
sbb edi, dword [ebp + 0x10]
sub dword [eax], ebx
mov eax, dword [ecx + 0x20]
add dword [eax], ebx
jmp 0x41fb15
mov edx, dword [ebp + 8]
test edi, edi
jl 0x41fb38
jg 0x41fb1f
test esi, esi
je 0x41fb38
mov eax, dword [ecx + 0x4c]
test eax, eax
je 0x41fb38
push eax
push esi
push 1
push edx
call fcn.0051be7d
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x422290
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x35c
mov eax, dword [0x59c388]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0
push 2
xor bl, bl
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [ebp - 0x35c], 0x22c
lea eax, [ebp - 0x35c]
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x4222df
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004f3d68
mov esp, ebp
pop ebp
ret
push edi
lea eax, [ebp - 0x338]
push eax
lea eax, [ebp - 0x130]
push 0x545448
push eax
call fcn.00411630
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x130]
add esp, 0xc
mov ecx, edi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x422326
test dl, dl
je 0x422322
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x422326
add eax, 2
add ecx, 2
test dl, dl
jne 0x422306
xor eax, eax
jmp 0x42232b
sbb eax, eax
or eax, 1
test eax, eax
je 0x422399
nop
lea eax, [ebp - 0x35c]
mov dword [ebp - 0x35c], 0x22c
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x42239b
lea eax, [ebp - 0x338]
push eax
lea eax, [ebp - 0x130]
push 0x545448
push eax
call fcn.00411630
add esp, 0xc
lea ecx, [ebp - 0x130]
mov eax, edi
nop
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x422390
test dl, dl
je 0x42238c
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x422390
add ecx, 2
add eax, 2
test dl, dl
jne 0x422370
xor eax, eax
jmp 0x422395
sbb eax, eax
or eax, 1
test eax, eax
jne 0x422330
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004f3d68
mov esp, ebp
pop ebp
ret
Function at 0x422440
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x59c388]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0x1c], 8
push ebx
push esi
push edi
lea esi, [ebp + 8]
jb 0x422463
mov esi, dword [ebp + 8]
test esi, esi
je 0x4224b9
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x422470
sub ecx, edx
sar ecx, 1
lea edi, [ecx + 1]
cmp edi, 0x3fffffff
jg 0x4224b9
add edi, edi
mov eax, edi
call fcn.004f45f0
mov ebx, esp
test ebx, ebx
je 0x4224b9
push 0
push 0
push edi
push ebx
push 0xffffffffffffffff
push esi
push 0
push 3
mov byte [ebx], 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
neg edi
sbb edi, edi
and edi, ebx
jmp 0x4224bb
xor edi, edi
cmp dword [ebp + 0x34], 8
lea esi, [ebp + 0x20]
jb 0x4224cb
mov esi, dword [ebp + 0x20]
test esi, esi
je 0x42251f
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4224d0
sub ecx, edx
sar ecx, 1
lea eax, [ecx + 1]
mov dword [ebp - 8], eax
cmp eax, 0x3fffffff
jg 0x42251f
add eax, eax
call fcn.004f45f0
mov ebx, esp
test ebx, ebx
je 0x42251f
mov ecx, dword [ebp - 8]
push 0
push 0
mov byte [ebx], 0
lea eax, [ecx + ecx]
push eax
push ebx
push 0xffffffffffffffff
push esi
push 0
push 3
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, eax
neg esi
sbb esi, esi
and esi, ebx
jmp 0x422521
xor esi, esi
push 0x545204
push edi
call fcn.0051c610
mov edi, eax
add esp, 8
test edi, edi
jne 0x42253a
or esi, 0xffffffff
jmp 0x42255e
mov ecx, esi
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x422540
push edi
sub ecx, edx
push ecx
push 1
push esi
call fcn.0051be7d
push edi
mov esi, eax
call fcn.0051b038
add esp, 0x14
mov edx, dword [ebp + 0x1c]
cmp edx, 8
jb 0x422594
mov ecx, dword [ebp + 8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x42258a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4225f4
push edx
push ecx
call fcn.004f3ad4
add esp, 8
mov edx, dword [ebp + 0x34]
xor eax, eax
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 7
mov word [ebp + 8], ax
cmp edx, 8
jb 0x4225de
mov ecx, dword [ebp + 0x20]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4225d4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4225f4
push edx
push ecx
call fcn.004f3ad4
add esp, 8
mov eax, esi
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004f3d68
mov esp, ebp
pop ebp
ret
call fcn.0050f89c
int3
Function at 0x42aa40
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53a161
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x59c388]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov edx, dword [ebp + 8]
lea ecx, [esi + 0x14]
mov dword [esi], vtable.DuiLib::CWindowWnd.0
mov eax, dword [edx + 4]
mov dword [esi + 4], eax
mov eax, dword [edx + 8]
mov dword [esi + 8], eax
mov al, byte [edx + 0xc]
mov byte [esi + 0xc], al
mov eax, dword [edx + 0x10]
mov dword [esi + 0x10], eax
mov dword [ebp + 8], ecx
mov dword [ecx], vtable.DuiLib::CNotifyPump.0
movq xmm0, qword [edx + 0x18]
movq qword [ecx + 4], xmm0
mov eax, dword [edx + 0x20]
mov dword [ecx + 0xc], eax
mov dword [ebp - 4], 1
lea eax, [edx + 0x30]
mov dword [esi + 0x24], vtable.DuiLib::INotifyUI.0
mov dword [esi + 0x28], vtable.DuiLib::IMessageFilterUI.0
mov dword [esi + 0x2c], vtable.DuiLib::IDialogBuilderCallback.0
mov dword [ecx], vtable.DuiLib::WindowImplBase.1.0
lea ecx, [esi + 0x30]
push eax
mov dword [esi], vtable.DuiLib::WindowImplBase.0
mov dword [esi + 0x24], vtable.DuiLib::WindowImplBase.2.0
mov dword [esi + 0x28], vtable.DuiLib::WindowImplBase.3.0
mov dword [esi + 0x2c], vtable.DuiLib::WindowImplBase.4.0
call sym.uninstaller.exe_public:_void___thiscall_DuiLib::CPaintManagerUI::constructor_class_DuiLib::CPaintManagerUI_const__
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x4342f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53b9a2
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x59c388]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x21c]
push 0x20a
push 0
mov dword [ebp - 0x224], esi
push eax
mov dword [ebp - 0x220], 0
call fcn.0050bda0
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0xffffffffffffffff
lea eax, [ebp - 0x21c]
mov ecx, esi
push eax
call sym.uninstaller.exe_public:_void___thiscall_DuiLib::CDuiString::constructor_wchar_t_const___int_
mov dword [ebp - 4], 0
mov dword [ebp - 0x220], 1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f3d68
mov esp, ebp
pop ebp
ret

Function at 0x435a50
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
xor esi, esi
push 0x11
call edi
test ax, ax
mov ecx, 8
push 2
cmovs esi, ecx
call edi
test ax, ax
jns 0x435a75
or esi, 2
push 1
call edi
test ax, ax
jns 0x435a81
or esi, 1
push 0x10
call edi
test ax, ax
jns 0x435a8d
or esi, 4
push 0x12
call edi
test ax, ax
jns 0x435a99
or esi, 0x20
pop edi
mov eax, esi
pop esi
ret
Function at 0x438800
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov edi, ecx
xor esi, esi
lea ecx, [edi + 0x2e0]
call sym.uninstaller.exe_public:_struct_HWND______thiscall_DuiLib::CWindowWnd::operator_struct_HWND____void_const
mov ebx, dword [ebp + 8]
test eax, eax
jle 0x43885b
nop
push esi
lea ecx, [edi + 0x2e0]
mov byte [ebp + 0xb], 0
call sym.uninstaller.exe_public:_void____thiscall_DuiLib::CDuiPtrArray::operator___int_const
lea ecx, [ebp + 0xb]
push ecx
push dword [ebp + 0x10]
mov edx, dword [eax]
mov ecx, eax
push dword [ebp + 0xc]
push ebx
call dword [edx]
cmp byte [ebp + 0xb], 0
jne 0x4389bd
lea ecx, [edi + 0x2e0]
inc esi
call sym.uninstaller.exe_public:_struct_HWND______thiscall_DuiLib::CWindowWnd::operator_struct_HWND____void_const
cmp esi, eax
jl 0x438820
sub ebx, 0x100
je 0x438946
sub ebx, 4
je 0x4388d5
sub ebx, 2
jne 0x43893b
cmp dword [edi + 0xe4], ebx
je 0x43893b
push dword [ebp + 0xc]
mov dword [ebp + 8], ebx
call fcn.0051adff
mov ecx, dword [edi + 0xe4]
lea edx, [ebp + 8]
add esp, 4
mov word [ebp + 8], ax
mov eax, dword [ecx]
push reloc.WS2_32.dll_select
push edx
push sym.uninstaller.exe_private:_static_class_DuiLib::CControlUI____stdcall_DuiLib::CPaintManagerUI::__FindControlFromShortcut_class_DuiLib::CControlUI___void__
call dword [eax + 0x110]
mov esi, eax
test esi, esi
je 0x43893b
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x104]
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x20]
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [edi + 0xe8]
test eax, eax
je 0x43893b
mov dword [ebp - 0x1c], eax
xorps xmm0, xmm0
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov word [ebp - 0xc], ax
mov eax, dword [edi + 0xfc]
mov dword [ebp - 0x14], eax
mov eax, dword [edi + 0x100]
mov dword [ebp - 0x18], 0
movlpd qword [ebp - 0xa], xmm0
mov word [ebp - 2], cx
mov dword [ebp - 0x20], 6
mov dword [ebp - 0x10], eax
call fcn.00435a50
mov word [ebp - 0xa], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [edi + 0xe8]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x11c]
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp dword [ebp + 0xc], 9
jne 0x43893b
mov ecx, dword [edi + 0xe8]
test ecx, ecx
je 0x4389a4
mov eax, dword [ecx]
mov eax, dword [eax + 0xdc]
call eax
test al, al
je 0x4389a4
mov ecx, dword [edi + 0xe8]
mov eax, dword [ecx]
mov eax, dword [eax + 0xe8]
call eax
test al, al
je 0x4389a4
mov ecx, dword [edi + 0xe8]
push str.RichEdit
mov eax, dword [ecx]
call dword [eax + 0x10]
push eax
call fcn.0050c366
add esp, 8
test eax, eax
je 0x4389a4
mov ecx, dword [edi + 0xe8]
call sym.uninstaller.exe_public:_bool___thiscall_DuiLib::CRichEditUI::IsWantTab_void_
test al, al
jne 0x43893b
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
mov ecx, edi
setns al
movzx eax, al
push eax
call sym.uninstaller.exe_public:_bool___thiscall_DuiLib::CPaintManagerUI::SetNextTabControl_bool_
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x10