joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ae7d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
lea esp, [esp - 0x10]
mov edi, eax
mov eax, dword [edi + 0x20]
mov dword [esp + 4], eax
mov edx, edi
mov eax, dword [edx + 0x30]
mov ecx, dword [edx + 0x68]
sub eax, ecx
sub eax, dword [edx + 0x60]
mov dword [esp], eax
test eax, eax
jne 0x4ae80e
mov eax, edi
cmp dword [eax + 0x60], 0
jne 0x4ae80e
cmp dword [eax + 0x68], 0
jne 0x4ae80e
mov eax, dword [esp + 4]
mov dword [esp], eax
jmp 0x4ae914
cmp dword [esp], 0xffffffff
jne 0x4ae81d
sub dword [esp], 1
jmp 0x4ae914
mov eax, dword [esp + 4]
xor edx, edx
mov ecx, eax
mov eax, edx
mov edx, ecx
mov esi, eax
sub edx, 0x106
sbb esi, 0
add edx, ecx
adc esi, eax
mov eax, dword [edi + 0x60]
xor ecx, ecx
cmp esi, ecx
jl 0x4ae84f
jg 0x4ae914
cmp edx, eax
ja 0x4ae914
mov eax, dword [edi + 0x2c]
add eax, dword [esp + 4]
mov edx, dword [edi + 0x2c]
mov ecx, dword [esp + 4]
call fcn.004037b0
mov eax, dword [esp + 4]
sub dword [edi + 0x64], eax
mov eax, dword [esp + 4]
sub dword [edi + 0x60], eax
mov eax, dword [esp + 4]
sub dword [edi + 0x50], eax
mov ebx, dword [edi + 0x40]
mov eax, dword [edi + 0x38]
lea eax, [eax + ebx*2]
mov dword [esp + 0xc], eax
lea esi, [esi]
sub dword [esp + 0xc], 2
mov eax, dword [esp + 0xc]
movzx edx, word [eax]
mov dword [esp + 8], edx
mov eax, dword [esp + 4]
cmp eax, dword [esp + 8]
ja 0x4ae8b3
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
mov edx, dword [esp + 0xc]
mov word [edx], ax
jmp 0x4ae8bc
mov eax, dword [esp + 0xc]
mov word [eax], 0
sub ebx, 1
jne 0x4ae888
mov ebx, dword [esp + 4]
mov eax, dword [edi + 0x34]
lea eax, [eax + ebx*2]
mov dword [esp + 0xc], eax
nop
sub dword [esp + 0xc], 2
mov eax, dword [esp + 0xc]
movzx edx, word [eax]
mov dword [esp + 8], edx
mov eax, dword [esp + 4]
cmp eax, dword [esp + 8]
ja 0x4ae8fb
mov edx, dword [esp + 8]
sub edx, dword [esp + 4]
mov eax, dword [esp + 0xc]
mov word [eax], dx
jmp 0x4ae904
mov eax, dword [esp + 0xc]
mov word [eax], 0
sub ebx, 1
jne 0x4ae8d0
mov eax, dword [esp]
add eax, dword [esp + 4]
mov dword [esp], eax
nop
mov eax, dword [edi]
cmp dword [eax + 4], 0
je 0x4ae983
mov eax, edi
mov edx, dword [eax + 0x2c]
mov ecx, dword [eax + 0x60]
mov eax, dword [eax + 0x68]
add eax, ecx
add edx, eax
mov eax, dword [edi]
mov ecx, dword [esp]
call fcn.004ae3f0
mov ebx, eax
add dword [edi + 0x68], ebx
cmp dword [edi + 0x68], 3
jb 0x4ae96c
mov eax, edi
mov edx, dword [eax + 0x2c]
mov eax, dword [eax + 0x60]
movzx eax, byte [edx + eax]
mov dword [edi + 0x3c], eax
mov eax, edi
mov edx, dword [eax + 0x2c]
mov ecx, dword [eax + 0x60]
movzx edx, byte [edx + ecx + 1]
mov esi, dword [eax + 0x3c]
mov ecx, dword [eax + 0x4c]
shl esi, cl
xor edx, esi
and edx, dword [eax + 0x48]
mov dword [edi + 0x3c], edx
mov eax, edi
cmp dword [eax + 0x68], 0x106
jae 0x4ae983
mov eax, dword [eax]
cmp dword [eax + 4], 0
jne 0x4ae7e0
lea esp, [esp + 0x10]
pop edi
pop esi
pop ebx
ret
Function at 0x4ca750
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
mov edx, eax
xor eax, eax
lea ebx, [edx + 1]
movzx ecx, byte [edx]
add ecx, 1
and ecx, 0xff
add edx, ecx
jmp 0x4ca781
mov ecx, eax
shl ecx, 5
sub ecx, eax
movzx esi, byte [ebx]
xor ecx, esi
mov eax, ecx
add ebx, 1
cmp edx, ebx
ja 0x4ca770
pop esi
pop ebx
ret

Function at 0x4cbf60
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xc]
push ebx
push esi
push edi
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
cmp edx, 1
jne 0x4cbf84
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
call dword [edx + 0x34]
mov dword [ebp - 8], eax
lea esi, [esi]
cmp dword [ebp - 8], 0
je 0x4cc04a
mov esi, esi
xor eax, eax
push 0x4cc02b
push ebp
push 0x414de0
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 0xffffffff
mov eax, dword [ebp - 8]
xor edx, edx
call fcn.0040d7c0
mov eax, dword [ebp - 8]
mov byte [eax + 0xc], 0
mov eax, dword [ebp - 8]
mov byte [eax + 0xe], 0
mov edx, 1
mov eax, 0x754e18
call fcn.00456a00
mov edx, dword [ebp - 8]
mov dword [edx + 0x10], eax
mov eax, dword [ebp - 8]
call fcn.004cc1e0
mov edx, dword [ebp - 8]
mov dword [edx + 0x28], eax
mov eax, dword [ebp - 8]
call fcn.004cc250
mov edx, dword [ebp - 8]
mov dword [edx + 0x38], eax
mov eax, dword [ebp - 8]
call fcn.004cc2c0
mov edx, dword [ebp - 8]
mov dword [edx + 0x30], eax
mov dword [ebp - 0xc], 1
cmp dword [ebp - 8], 0
je 0x4cc020
cmp dword [ebp - 4], 0
je 0x4cc020
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call dword [edx + 0x44]
nop
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
jmp 0x4cc04a
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4d49b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x10]
push ebx
push esi
push edi
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
mov dword [ebp - 4], ecx
cmp dword [ebp - 8], 1
jne 0x4d49d8
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
call dword [edx + 0x34]
mov dword [ebp - 0xc], eax
lea esi, [esi]
cmp dword [ebp - 0xc], 0
je 0x4d4a86
mov esi, esi
xor eax, eax
push 0x4d4a67
push ebp
push 0x414de0
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x10], 0xffffffff
push dword [ebp + 8]
push dword [ebp - 4]
call sub.kernel32.dll_LoadResource
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x14], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x14], 0
je 0x4d4a3c
push dword [ebp + 8]
push dword [ebp - 4]
call sub.kernel32.dll_SizeofResource
mov ebx, eax
mov eax, dword [ebp - 0xc]
push dword [eax + 0x14]
call sub.kernel32.dll_LockResource
mov edx, eax
mov eax, dword [ebp - 0xc]
mov ecx, ebx
call fcn.00454a70
mov dword [ebp - 0x10], 1
cmp dword [ebp - 0xc], 0
je 0x4d4a5c
cmp dword [ebp - 8], 0
je 0x4d4a5c
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
mov edx, dword [edx]
call dword [edx + 0x44]
mov esi, esi
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
jmp 0x4d4a86
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4d66f0
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
push edi
mov esi, eax
cmp dword [esi + 0x14], 0xca
jne 0x4d6724
mov eax, esi
call fcn.004dac70
cmp byte [esi + 0x40], 0
je 0x4d671c
mov dword [esi + 0x14], 0xcf
mov bl, 1
jmp 0x4d67d5
mov dword [esi + 0x14], 0xcb
nop
cmp dword [esi + 0x14], 0xcb
jne 0x4d67b4
mov eax, dword [esi + 0x184]
cmp byte [eax + 0x10], 0
je 0x4d67ac
lea esi, [esi]
cmp dword [esi + 8], 0
je 0x4d6758
mov eax, esi
mov edx, dword [esi + 8]
call dword [edx]
lea esi, [esi]
mov eax, esi
mov edx, dword [esi + 0x184]
call dword [edx]
mov edi, eax
test edi, edi
jne 0x4d6770
xor bl, bl
jmp 0x4d67d5
cmp edi, 2
je 0x4d67aa
lea esi, [esi]
cmp dword [esi + 8], 0
je 0x4d6748
cmp edi, 3
je 0x4d6788
cmp edi, 1
jne 0x4d6748
mov eax, dword [esi + 8]
add dword [eax + 4], 1
mov eax, dword [esi + 8]
mov edx, dword [eax + 4]
cmp edx, dword [eax + 8]
jl 0x4d6748
mov edx, dword [esi + 8]
mov eax, dword [esi + 0x110]
add dword [edx + 8], eax
mov esi, esi
jmp 0x4d6748
mov esi, esi
mov eax, dword [esi + 0x70]
mov dword [esi + 0x78], eax
jmp 0x4d67cc
cmp dword [esi + 0x14], 0xcc
je 0x4d67cc
mov ecx, dword [esi + 0x14]
mov eax, esi
mov dl, 0x14
call fcn.004d6b10
lea esi, [esi]
mov eax, esi
call fcn.004d67e0
mov bl, al
mov al, bl
pop edi
pop esi
pop ebx
ret
Function at 0x4f3250
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 4]
push ebx
mov dword [ebp - 4], eax
cmp dword [eax + 0x24], 0
je 0x4f3298
mov eax, dword [0x5870f0]
mov edx, dword [ebp - 4]
mov eax, dword [eax + 0x170]
cmp eax, dword [edx + 0x24]
jne 0x4f3298
mov eax, dword [0x5870f0]
cmp byte [eax + 0x11c], 0
jne 0x4f3298
mov eax, dword [0x725620]
mov edx, dword [0x725620]
mov edx, dword [edx]
call dword [edx + 0x6c]
mov edx, dword [ebp - 4]
mov dword [edx], eax
nop
mov ebx, dword [ebp - 4]
mov eax, dword [0x725620]
mov edx, dword [0x725620]
mov edx, dword [edx]
call dword [edx + 0x6c]
cmp eax, dword [ebx]
jne 0x4f338e
mov eax, dword [0x5870f0]
cmp byte [eax + 0x11c], 0
jne 0x4f338e
mov eax, dword [0x725620]
mov edx, dword [0x725620]
mov edx, dword [edx]
call dword [edx + 0x6c]
call fcn.00562080
mov eax, dword [0x5870f0]
cmp dword [eax + 0x170], 0
je 0x4f3354
push 0x10
push 0
mov eax, dword [0x5870f0]
mov eax, dword [eax + 0x170]
push dword [eax + 0x254]
mov eax, dword [0x5870f0]
mov eax, dword [eax + 0x170]
push dword [eax + 0x248]
mov eax, dword [0x5870f0]
mov eax, dword [eax + 0x170]
push dword [eax + 0x12c]
push 0
mov eax, dword [ebp - 4]
push dword [eax]
call sub.user32.dll_SetWindowPos
mov eax, dword [0x5870f0]
mov eax, dword [eax + 0x170]
call fcn.00512780
test al, al
je 0x4f3354
push 0
mov eax, dword [0x5870f0]
call fcn.00420fe0
push eax
call sub.user32.dll_ShowWindow
lea esi, [esi]
mov eax, dword [ebp - 4]
push dword [eax + 0xc]
mov eax, dword [ebp - 4]
push dword [eax + 8]
push 0x112
mov eax, dword [ebp - 4]
push dword [eax]
call sub.user32.dll_DefWindowProcA
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x20]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0x28], 0
mov eax, dword [0x5870f0]
call fcn.004243d0
jmp 0x4f3424
mov eax, dword [ebp - 4]
cmp dword [eax + 0x24], 0
je 0x4f33e2
mov eax, dword [ebp - 4]
mov edx, dword [0x5870f0]
mov eax, dword [eax + 0x24]
cmp eax, dword [edx + 0x170]
jne 0x4f33e2
mov eax, dword [ebp - 4]
push dword [eax + 0xc]
mov eax, dword [ebp - 4]
push dword [eax + 8]
push 0x112
mov eax, dword [ebp - 4]
push dword [eax]
call sub.user32.dll_DefWindowProcA
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x20]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0x28], 0
mov eax, dword [0x5870f0]
call fcn.004243d0
jmp 0x4f3424
mov eax, dword [ebp - 4]
cmp dword [eax + 0x24], 0
je 0x4f3424
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x24]
test dword [eax + 0x48c], 8
je 0x4f3424
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x20]
mov dword [eax + 0xc], 1
mov eax, dword [ebp - 4]
mov byte [eax + 0x28], 0
mov eax, dword [0x725620]
mov edx, dword [0x725620]
mov edx, dword [edx]
call dword [edx + 0x8c]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4f3430
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 4]
push ebx
mov dword [ebp - 4], eax
mov ebx, eax
mov eax, dword [0x725620]
mov edx, dword [0x725620]
mov edx, dword [edx]
call dword [edx + 0x6c]
cmp eax, dword [ebx]
jne 0x4f3500
mov eax, dword [0x5870f0]
cmp byte [eax + 0x11c], 0
jne 0x4f3500
mov eax, dword [ebp - 4]
push dword [eax + 0xc]
mov eax, dword [ebp - 4]
push dword [eax + 8]
push 0x112
mov eax, dword [ebp - 4]
push dword [eax]
call sub.user32.dll_DefWindowProcA
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x20]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0x28], 0
mov eax, dword [0x5870f0]
cmp dword [eax + 0x170], 0
je 0x4f34f4
mov eax, dword [0x5870f0]
mov eax, dword [eax + 0x170]
call fcn.00512780
test al, al
je 0x4f34f4
mov eax, dword [0x5870f0]
mov eax, dword [eax + 0x170]
mov edx, dword [0x5870f0]
mov edx, dword [edx + 0x170]
mov edx, dword [edx]
call dword [edx + 0x344]
test al, al
je 0x4f34ec
push 8
mov eax, dword [0x5870f0]
call fcn.00420fe0
push eax
call sub.user32.dll_ShowWindow
lea esi, [esi]
call fcn.00562150
lea esi, [esi]
mov eax, dword [0x5870f0]
call fcn.00424410
jmp 0x4f3564
mov eax, dword [ebp - 4]
cmp dword [eax + 0x24], 0
je 0x4f3529
mov eax, dword [ebp - 4]
mov edx, dword [0x5870f0]
mov eax, dword [eax + 0x24]
cmp eax, dword [edx + 0x170]
jne 0x4f3529
mov eax, dword [0x5870f0]
call fcn.00424410
jmp 0x4f3564
mov eax, dword [ebp - 4]
cmp dword [eax + 0x24], 0
je 0x4f3564
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x24]
test dword [eax + 0x48c], 8
je 0x4f3564
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x20]
mov dword [eax + 0xc], 1
mov eax, dword [0x725620]
mov edx, dword [0x725620]
mov edx, dword [edx]
call dword [edx + 0x90]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4f8b20
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x30]
mov dword [ebp - 4], eax
mov dword [ebp - 0x30], 8
mov eax, fcn.004f72c0
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
call fcn.00413960
mov dword [ebp - 0x20], eax
mov eax, str.MAINICON
push eax
push dword [0x7a22d0]
call sub.user32.dll_LoadIconA
mov dword [ebp - 0x1c], eax
test eax, eax
jne 0x4f8b78
push 0x7f00
push 0
call sub.user32.dll_LoadIconA
mov dword [ebp - 0x1c], eax
mov esi, esi
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov eax, str.Window
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x30]
push eax
call sub.user32.dll_RegisterClassW
test ax, ax
setne byte [ebp - 8]
cmp byte [ebp - 8], 0
je 0x4f8bf4
or dword [ebp - 0x30], 0x800
cmp dword [0x73e660], 6
jb 0x4f8bcc
or dword [ebp - 0x30], 0x20000
mov esi, esi
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x14], 0
mov eax, str.HintWindow
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x30]
push eax
call sub.user32.dll_RegisterClassW
test ax, ax
setne byte [ebp - 8]
mov esi, esi
mov al, byte [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x4f9c90
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xc]
push ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov byte [ebp - 0xc], 0
mov eax, dword [ebp - 8]
push dword [eax - 8]
call sub.user32.dll_GetClipboardData
mov edx, dword [ebp - 8]
mov dword [edx - 0x14], eax
mov eax, dword [ebp - 8]
cmp dword [eax - 0x14], 0
je 0x4f9d28
mov eax, dword [ebp - 8]
push dword [eax - 0x14]
call sub.kernel32.dll_GlobalSize
mov edx, dword [ebp - 8]
mov dword [edx - 0x1c], eax
mov eax, dword [ebp - 8]
cmp dword [eax - 0x1c], 0
jle 0x4f9d28
mov eax, dword [ebp - 8]
push dword [eax - 0x14]
call sub.kernel32.dll_GlobalLock
mov edx, dword [ebp - 8]
mov dword [edx - 0x18], eax
xor eax, eax
push fcn.004f9c70
push ebp
push 0x414a60
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [eax - 0x18]
mov eax, dword [ebp - 8]
mov ecx, dword [eax - 0x1c]
mov eax, dword [ebp - 4]
mov ebx, dword [ebp - 4]
mov ebx, dword [ebx]
call dword [ebx + 0x84]
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.004f9c70
mov byte [ebp - 0xc], 1
mov al, byte [ebp - 0xc]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4fa3d0
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x2c]
push ebx
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], edx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x1c], 0
xor eax, eax
push fcn.004fa3b0
push ebp
push 0x414a60
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call dword [edx + 0x70]
push eax
push 2
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x4fa49c
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call dword [edx + 0x70]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
push dword [ebp - 0x24]
push dword [ebp - 0x28]
lea eax, [ebp - 0x1c]
call fcn.00487660
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0x2c]
call fcn.004875b0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x24], eax
call fcn.00487d70
mov ebx, eax
mov eax, str._DataSize
push eax
push dword [ebp - 0x18]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [ebp - 0x24]
mov edx, str.TWin32WidgetSet.ClipboardGetOwnerShip_DataHandle
mov eax, ebx
call fcn.00489220
mov eax, dword [ebp - 0xc]
mov byte [eax - 0x10], 0
jmp 0x4fa4f3
push dword [ebp - 0x10]
call sub.kernel32.dll_GlobalLock
mov dword [ebp - 0x14], eax
xor eax, eax
push fcn.004fa390
push ebp
push 0x414a60
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call dword [edx + 0x70]
mov ecx, eax
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
mov ebx, dword [ebp - 8]
mov ebx, dword [ebx]
call dword [ebx + pe_nt_image_headers32]
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.004fa390
push dword [ebp - 0x10]
push dword [ebp - 4]
call sub.user32.dll_SetClipboardData
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.004fa3b0
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x522c10
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x10]
push ebx
push esi
push edi
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
mov dword [ebp - 4], ecx
cmp dword [ebp - 8], 1
jne 0x522c38
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
call dword [edx + 0x34]
mov dword [ebp - 0xc], eax
lea esi, [esi]
cmp dword [ebp - 0xc], 0
je 0x522cee
mov esi, esi
xor eax, eax
push 0x522ccf
push ebp
push 0x414de0
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x10], 0xffffffff
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.0040d7c0
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x20], 0
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x14], 0
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x18], 0
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x30], 0
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x34], 0
mov dword [ebp - 0x10], 1
cmp dword [ebp - 0xc], 0
je 0x522cc4
cmp dword [ebp - 8], 0
je 0x522cc4
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
mov edx, dword [edx]
call dword [edx + 0x44]
lea esi, [esi]
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
jmp 0x522cee
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5624a0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x18]
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x18], 0
xor eax, eax
push fcn.00562480
push ebp
push 0x414a60
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [ebp - 4]
call sub.user32.dll_GetWindowTextLengthW
mov dword [ebp - 0xc], eax
mov edx, eax
lea eax, [ebp - 0x10]
call fcn.0040aaa0
cmp dword [ebp - 0xc], 0
jle 0x562508
mov eax, dword [ebp - 0xc]
add eax, 1
push eax
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x5624fc
mov eax, 0x7a22f0
push eax
push dword [ebp - 4]
call sub.user32.dll_GetWindowTextW
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 0x10]
call fcn.0040aaa0
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0x18]
call fcn.0040b3a0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x14]
test edx, edx
je 0x562531
mov edx, dword [edx - 4]
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x56253d
mov eax, 0x7a22f0
call fcn.0044d130
mov eax, dword [ebp - 8]
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00562480
mov esp, ebp
pop ebp
ret
Function at 0x5638d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x10]
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], ecx
mov eax, ecx
mov edx, 0x796688
call fcn.0040eef0
mov dword [ebp - 0x10], 0
xor eax, eax
push fcn.005638c0
push ebp
push 0x414a60
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
mov dword [eax + 8], 0
mov eax, dword [ebp - 0xc]
mov dword [eax], 0
mov eax, dword [ebp - 0xc]
add eax, 0x34
xor edx, edx
call fcn.00408bc0
mov eax, dword [ebp - 0xc]
mov edx, fcn.004f72c0
mov dword [eax + 0x2c], edx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
mov dword [edx + 0x24], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 8]
mov dword [edx + 0x28], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
mov dword [edx + 4], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
lea ecx, [ebp - 0x10]
xor dx, dx
call fcn.00409510
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
add eax, 0x30
call fcn.00408bc0
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [edx + 0xc], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x10]
mov dword [edx + 0x10], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x14]
mov dword [edx + 0x18], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x18]
mov dword [edx + 0x14], eax
mov eax, dword [ebp - 0xc]
lea ecx, [eax + 0x10]
mov eax, dword [ebp - 0xc]
lea edx, [eax + 0xc]
mov eax, dword [ebp - 4]
call fcn.00561bb0
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00563f40
mov eax, dword [ebp - 4]
test dword [eax + 0x28], 0x10
jne 0x5639ec
mov eax, dword [ebp - 4]
call fcn.00517270
test al, al
jne 0x5639ec
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x24]
or eax, 0x8000000
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x24], eax
nop
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.005638c0
mov esp, ebp
pop ebp
ret
Function at 0x5795a0
Capabilities:
Hash data using sha1

Disassembly:
push ebx
mov ebx, eax
xor cl, cl
mov edx, 0x60
call fcn.004037f0
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
mov dword [ebx + 0x10], 0xc3d2e1f0
pop ebx
ret

Function at 0x582250
Capabilities:
Hash data using murmur3

Disassembly:
xchg ecx, edx
push ebp
push edi
lea ebp, [ecx + edx]
push esi
push ebx
sub esp, 8
cmp edx, 0xf
mov ebx, eax
mov dword [esp], edx
lea eax, [ebx + 0x165667b1]
jbe 0x5822f8
lea eax, [ebp - 0x10]
lea edi, [ebx + 0x24234428]
lea esi, [ebx - 0x7a143589]
mov dword [esp + 4], ebp
mov edx, eax
lea eax, [ebx + 0x61c8864f]
mov ebp, edx
mov edx, dword [ecx]
imul edx, edx, 0x85ebca77
add edi, edx
rol edi, 0xd
imul edi, edi, 0x9e3779b1
mov edx, dword [ecx + 4]
imul edx, edx, 0x85ebca77
add esi, edx
rol esi, 0xd
imul esi, esi, 0x9e3779b1
mov edx, dword [ecx + 8]
imul edx, edx, 0x85ebca77
add ebx, edx
rol ebx, 0xd
imul ebx, ebx, 0x9e3779b1
mov edx, dword [ecx + 0xc]
lea ecx, [ecx + 0x10]
imul edx, edx, 0x85ebca77
add eax, edx
rol eax, 0xd
imul eax, eax, 0x9e3779b1
cmp ebp, ecx
jae 0x58228d
rol edi, 1
rol esi, 7
rol ebx, 0xc
add esi, edi
mov ebp, dword [esp + 4]
ror eax, 0xe
add ebx, esi
add eax, ebx
lea esi, [ecx + 4]
add eax, dword [esp]
cmp ebp, esi
jb 0x58232a
mov ebx, esi
nop
imul edx, dword [ebx - 4], 0xc2b2ae3d
add ebx, 4
add eax, edx
ror eax, 0xf
imul eax, eax, 0x27d4eb2f
cmp ebp, ebx
jae 0x582305
lea edx, [ebp - 4]
sub edx, ecx
mov ecx, edx
and ecx, 0xfffffffc
add ecx, esi
cmp ebp, ecx
jbe 0x58234a
movzx edx, byte [ecx]
add ecx, 1
imul edx, edx, 0x165667b1
add eax, edx
rol eax, 0xb
imul eax, eax, 0x9e3779b1
cmp ebp, ecx
jne 0x58232e
nop
mov edx, eax
add esp, 8
shr edx, 0xf
xor eax, edx
imul eax, eax, 0x85ebca77
pop ebx
pop esi
mov edx, eax
shr edx, 0xd
xor eax, edx
imul eax, eax, 0xc2b2ae3d
pop edi
pop ebp
mov edx, eax
shr edx, 0x10
xor eax, edx
ret