joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4115a3
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48f783
mov eax, dword fs:[0]
push eax
mov eax, 0x1040
call fcn.004285b0
mov eax, dword [0x4bd034]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
call fcn.004111fc
mov ebx, 0x800
mov esi, eax
push ebx
lea eax, [ebp - 0x1010]
push 0
push eax
call fcn.00429240
xor eax, eax
push ebx
push eax
mov dword [ebp - 0x1044], eax
mov dword [ebp - 0x104c], eax
mov dword [ebp - 0x1048], eax
lea eax, [ebp - 0x810]
push eax
call fcn.00429240
add esp, 0x18
lea ecx, [ebp - 0x1040]
mov edx, str.3eoB
call fcn.0040c7ae
and dword [ebp - 4], 0
lea ecx, [ebp - 0x1028]
mov edx, eax
call fcn.0040a523
lea ecx, [ebp - 0x1040]
call fcn.00405c7c
cmp dword [ebp - 0x1014], 8
lea ecx, [ebp - 0x810]
mov edx, 0x400
lea eax, [ebp - 0x1028]
cmovae eax, dword [ebp - 0x1028]
push edx
push ecx
lea ecx, [ebp - 0x1048]
push ecx
lea ecx, [ebp - 0x104c]
push ecx
lea ecx, [ebp - 0x1044]
push ecx
push edx
lea ecx, [ebp - 0x1010]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov ecx, dword [ebp - 0x1044]
mov edx, esi
push edi
call fcn.00411503
pop ecx
lea ecx, [ebp - 0x1028]
call fcn.0040172c
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004272e5
leave
ret

Function at 0x4116be
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48f7c8
mov eax, dword fs:[0]
push eax
mov eax, 0x1054
call fcn.004285b0
mov eax, dword [0x4bd034]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
call fcn.004111fc
mov edi, 0x800
mov esi, eax
push edi
lea eax, [ebp - 0x1020]
push 0
push eax
call fcn.00429240
add esp, 0xc
xor eax, eax
mov dword [ebp - 0x1054], eax
mov dword [ebp - 0x105c], eax
mov dword [ebp - 0x1058], eax
push edi
push eax
lea eax, [ebp - 0x820]
push eax
call fcn.00429240
add esp, 0xc
lea ecx, [ebp - 0x1050]
mov edx, str.3eoB
call fcn.0040c7ae
and dword [ebp - 4], 0
lea ecx, [ebp - 0x1038]
mov edx, eax
call fcn.0040a523
lea ecx, [ebp - 0x1050]
mov byte [ebp - 4], 2
call fcn.00405c7c
cmp dword [ebp - 0x1024], 8
lea ecx, [ebp - 0x820]
mov edx, 0x400
lea eax, [ebp - 0x1038]
cmovae eax, dword [ebp - 0x1038]
push edx
push ecx
lea ecx, [ebp - 0x1058]
push ecx
lea ecx, [ebp - 0x105c]
push ecx
lea ecx, [ebp - 0x1054]
push ecx
push edx
lea ecx, [ebp - 0x1020]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov ecx, dword [ebp - 0x1054]
lea edi, [ebp - 0x1c]
xor eax, eax
mov edx, esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00411503
pop ecx
push ebx
push 0xc
pop edx
lea ecx, [ebp - 0x1c]
call fcn.0040cf75
pop ecx
lea ecx, [ebp - 0x1038]
call fcn.0040172c
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004272e5
leave
ret
Function at 0x420060
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edi
mov ebx, dword [edi + 0x2c]
mov ecx, dword [edi + 0x74]
mov dword [ebp - 0x10], ebx
mov eax, dword [edi + 0x2c]
mov esi, dword [edi + 0x3c]
add eax, 0xfffffefa
sub esi, dword [edi + 0x6c]
add eax, ebx
sub esi, ecx
mov dword [ebp - 0xc], esi
cmp dword [edi + 0x6c], eax
jb 0x42010b
mov ecx, dword [edi + 0x38]
push ebx
lea eax, [ecx + ebx]
push eax
push ecx
call fcn.00428cc0
mov ecx, dword [edi + 0x4c]
add esp, 0xc
mov eax, dword [edi + 0x44]
mov esi, ecx
sub dword [edi + 0x70], ebx
sub dword [edi + 0x6c], ebx
sub dword [edi + 0x5c], ebx
mov dword [ebp - 8], ecx
lea edi, [eax + ecx*2]
lea edi, [edi - 2]
movzx ecx, bx
movzx eax, word [edi]
mov edx, eax
mov dword [ebp - 8], ecx
sub eax, ecx
xor ecx, ecx
cmp edx, ebx
movzx eax, ax
cmovae ecx, eax
mov word [edi], cx
sub esi, 1
jne 0x4200b9
mov edi, dword [ebp - 4]
mov esi, ebx
mov eax, dword [edi + 0x40]
lea edi, [eax + ebx*2]
lea edi, [edi - 2]
xor ecx, ecx
movzx eax, word [edi]
mov edx, eax
sub eax, dword [ebp - 8]
cmp edx, ebx
movzx eax, ax
cmovae ecx, eax
mov word [edi], cx
sub esi, 1
jne 0x4200e6
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 4]
add esi, ebx
mov ebx, dword [edi]
mov eax, dword [ebx + 4]
test eax, eax
je 0x4201c5
mov edx, dword [edi + 0x6c]
mov ecx, dword [edi + 0x74]
add edx, ecx
add edx, dword [edi + 0x38]
cmp eax, esi
mov dword [ebp - 0xc], edx
cmovbe esi, eax
test esi, esi
je 0x42017e
sub eax, esi
mov dword [ebx + 4], eax
mov eax, dword [ebx + 0x1c]
mov eax, dword [eax + 0x18]
cmp eax, 1
jne 0x42014c
mov edx, dword [ebx]
mov ecx, dword [ebx + 0x30]
push esi
call fcn.00420a0c
jmp 0x420164
cmp eax, 2
jne 0x420168
mov edx, dword [ebx]
test edx, edx
jne 0x42015b
xor eax, eax
jmp 0x420165
mov ecx, dword [ebx + 0x30]
push esi
call fcn.0041dbcd
pop ecx
mov dword [ebx + 0x30], eax
push esi
push dword [ebx]
push dword [ebp - 0xc]
call fcn.00428cc0
add dword [ebx], esi
add esp, 0xc
add dword [ebx + 8], esi
mov ecx, dword [edi + 0x74]
add ecx, esi
mov dword [ebp - 0xc], ecx
mov dword [edi + 0x74], ecx
cmp ecx, 3
jb 0x4201ad
mov edx, dword [edi + 0x6c]
mov eax, dword [edi + 0x38]
mov ecx, dword [edi + 0x58]
movzx esi, byte [edx + eax]
mov dword [edi + 0x48], esi
movzx eax, byte [edx + eax + 1]
shl esi, cl
mov ecx, dword [ebp - 0xc]
xor esi, eax
and esi, dword [edi + 0x54]
mov dword [edi + 0x48], esi
cmp ecx, 0x106
jae 0x4201c5
mov eax, dword [edi]
cmp dword [eax + 4], 0
je 0x4201c5
mov ebx, dword [ebp - 0x10]
jmp 0x420077
pop edi
pop esi
pop ebx
leave
ret
Function at 0x423bcb
Capabilities:
Write file on windows

Disassembly:
push 0x40
mov eax, 0x490c63
call fcn.00427e31
mov edi, ecx
mov eax, dword [ebp + 8]
xor ecx, ecx
test eax, eax
je 0x423be7
cmp word [eax], cx
jne 0x423bf2
lea eax, [edi + 0x1c]
cmp dword [eax + 0x14], 8
jb 0x423bf2
mov eax, dword [eax]
push 0x4ab84c
push eax
call fcn.00437e2b
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x423d17
mov esi, dword [edi + 0x4c]
xor edx, edx
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], 0xf
mov byte [ebp - 0x44], dl
mov dword [ebp - 4], edx
cmp esi, dword [edi + 0x50]
je 0x423c47
mov ecx, dword [esi]
mov eax, dword [ecx]
cmp dword [edi + 0x44], edx
jne 0x423c35
push ebx
call dword [eax + 0x18]
jmp 0x423c3c
lea edx, [ebp - 0x44]
push edx
call dword [eax + 0x14]
add esi, 4
push 0
pop edx
cmp esi, dword [edi + 0x50]
jne 0x423c26
mov esi, 0x1000
cmp dword [edi + 0x44], edx
je 0x423cdc
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], dl
sub esp, 0x18
mov byte [ebp - 4], 1
mov ecx, esp
lea eax, [ebp - 0x44]
push eax
mov dword [ecx], edx
mov dword [ecx + 0x10], edx
mov dword [ecx + 0x14], edx
call fcn.00408237
lea eax, [ebp - 0x2c]
mov ecx, edi
push eax
call fcn.00423e24
test eax, eax
je 0x423ca8
cmp dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x2c]
push ebx
cmovae eax, dword [ebp - 0x2c]
push 1
push dword [ebp - 0x1c]
push eax
call fcn.00437a87
add esp, 0x10
mov eax, dword [ebp - 0x18]
cmp eax, 0x10
jb 0x423cdc
mov ecx, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], ecx
cmp eax, esi
jb 0x423cd3
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.004016dc
mov eax, dword [ebp - 0x4c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x48]
push eax
push ecx
call fcn.004272f3
pop ecx
pop ecx
push ebx
call fcn.0043751a
mov eax, dword [ebp - 0x30]
pop ecx
cmp eax, 0x10
jb 0x423d17
mov ecx, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x4c], ecx
cmp eax, esi
jb 0x423d0e
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x4c]
push eax
call fcn.004016dc
mov eax, dword [ebp - 0x48]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x4c]
push eax
push ecx
call fcn.004272f3
pop ecx
pop ecx
call fcn.00427de0
ret 4

Function at 0x423f7d
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
sub esp, 0x14
push esi
push edi
call fcn.00408a6e
push 0x14
pop esi
cmp eax, esi
jb 0x423feb
push ebx
xor ebx, ebx
push ebx
push ebx
push dword [ebp + 8]
call fcn.00438ecd
push dword [ebp + 8]
xor eax, eax
mov word [ebp - 0x10], si
inc eax
mov byte [ebp - 0xc], bl
push eax
mov word [ebp - 0xe], ax
mov edi, 0x58453144
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], edi
push esi
push eax
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call fcn.00438514
add esp, 0x1c
pop ebx
test eax, eax
je 0x423feb
cmp dword [ebp - 0x14], edi
jne 0x423feb
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x423fe7
push 5
pop ecx
lea esi, [ebp - 0x14]
rep movsd dword es:[edi], dword [esi]
mov al, 1
jmp 0x423fed
xor al, al
pop edi
pop esi
leave
ret 8
Function at 0x42462e
Capabilities:
Connect socket
Resolve dns
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x4bd034]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x18], esi
test edi, edi
je 0x42469e
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x424654
sub ecx, edx
sar ecx, 1
lea eax, [ecx + 1]
mov dword [ebp - 0x1c], eax
cmp eax, 0x3fffffff
jg 0x42469e
add eax, eax
call fcn.00427da0
mov esi, esp
test esi, esi
je 0x42469b
mov ecx, dword [ebp - 0x1c]
push ebx
push ebx
mov byte [esi], bl
lea eax, [ecx + ecx]
push eax
push esi
push 0xffffffffffffffff
push edi
push ebx
push 3
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
neg eax
sbb ebx, ebx
and ebx, esi
mov esi, dword [ebp - 0x18]
xor eax, eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
push 2
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop eax
push 0x7b
mov word [ebp - 0x14], ax
call dword [sym.imp.WSOCK32.dll_htons]
push ebx
mov word [ebp - 0x12], ax
call dword [sym.imp.WSOCK32.dll_inet_addr]
mov dword [ebp - 0x10], eax
cmp eax, 0xffffffff
jne 0x4246de
push ebx
call dword [sym.imp.WSOCK32.dll_gethostbyname]
test eax, eax
je 0x424705
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
push 0x10
lea eax, [ebp - 0x14]
push eax
push dword [esi]
call dword [sym.imp.WSOCK32.dll_connect]
neg eax
sbb eax, eax
inc eax
lea esp, [ebp - 0x28]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004272e5
leave
ret 8
xor eax, eax
jmp 0x4246f1

Function at 0x424709
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x4bd034]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
xor edx, edx
push esi
push edi
mov edi, 0x3e8
mov esi, dword [ebp + 8]
div edi
xor edi, edi
mov dword [ebp - 0x110], eax
inc edi
mov eax, dword [ecx]
xor ecx, ecx
mov dword [ebp - 0x104], eax
lea eax, [ebp - 0x110]
push eax
push ecx
push ecx
lea eax, [ebp - 0x108]
mov dword [ebp - 0x10c], edx
push eax
push ecx
mov dword [ebp - 0x108], edi
call dword [sym.imp.WSOCK32.dll_select]
cmp eax, 0xffffffff
jne 0x42476c
xor eax, eax
jmp 0x424777
xor ecx, ecx
test eax, eax
mov eax, edi
setne cl
mov dword [esi], ecx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004272e5
leave
ret 8
Function at 0x424a18
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14
mov eax, 0x490d1a
call fcn.00427e67
mov ebx, edx
push 0x801
call fcn.004275aa
xor esi, esi
mov edi, eax
mov dword [ebp - 4], esi
mov dword [esp], 0x801
push esi
push edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], 0x800
call fcn.00429240
add esp, 0xc
mov dword [ebp - 0x14], esi
lea eax, [ebp - 0x14]
push eax
push 0x20019
push esi
push ebx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp dword [ebp - 0x14], esi
je 0x424aa2
lea eax, [ebp - 0x1c]
push eax
push edi
lea eax, [ebp - 0x18]
push eax
push esi
push dword [ebp + 8]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp dword [ebp - 0x18], 1
jne 0x424a99
mov ecx, dword [ebp + 0xc]
push edi
call fcn.00405b67
inc esi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
call fcn.004275a5
pop ecx
mov eax, esi
call fcn.00427dcc
ret

Function at 0x4435c7
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0044343d

Function at 0x4499cd
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00449520

Function at 0x451d70
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4912a8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4bd034]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi]
call dword [eax + 0x24]
mov esi, eax
mov dword [ebp - 0x10], esi
push dword [ebp + 0x14]
mov eax, dword [edi]
mov ecx, edi
push dword [ebp + 0x10]
mov dword [ebp - 4], 0
push esi
call dword [eax + 0x28]
push dword [ebp + 0xc]
mov eax, dword [esi]
mov ecx, esi
push dword [ebp + 8]
call dword [eax + 0xc]
mov eax, dword [edi]
mov ecx, edi
push esi
mov eax, dword [eax + 0x30]
call eax
mov edx, dword [esi]
mov ecx, esi
push 1
mov bl, al
call dword [edx]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x46e470
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
xor edx, edx
push ebx
push ebp
mov ebp, dword [esp + 0x14]
xor ebx, ebx
push esi
mov esi, dword [esp + 0x20]
mov ecx, esi
shr ecx, 2
push edi
test ecx, ecx
je 0x46e535
mov edi, dword [esp + 0x20]
cmp ecx, 8
jb 0x46e510
mov ebx, ecx
lea eax, [edi + 0x10]
mov esi, ebp
and ebx, 0xfffffff8
sub esi, edi
xorps xmm3, xmm3
mov dword [esp + 0x10], esi
movaps xmm2, xmm3
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x10]
nop word [eax + eax]
movups xmm0, xmmword [eax - 0x10]
lea eax, [eax + 0x20]
movups xmm1, xmmword [ebp + edx*4]
add edx, 8
pxor xmm1, xmm0
por xmm3, xmm1
movups xmm1, xmmword [edi + eax - 0x20]
movups xmm0, xmmword [eax - 0x20]
pxor xmm1, xmm0
por xmm2, xmm1
cmp edx, ebx
jb 0x46e4c0
mov edi, dword [esp + 0x20]
por xmm2, xmm3
movaps xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movaps xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movd ebx, xmm2
cmp edx, ecx
jae 0x46e535
mov esi, ebp
lea edi, [edi + edx*4]
sub esi, dword [esp + 0x20]
sub ecx, edx
add edx, ecx
mov eax, dword [edi + esi]
lea edi, [edi + 4]
xor eax, dword [edi - 4]
or ebx, eax
sub ecx, 1
jne 0x46e521
mov esi, dword [esp + 0x24]
shl edx, 2
sub esi, edx
jne 0x46e54b
pop edi
xor eax, eax
test ebx, ebx
pop esi
pop ebp
sete al
pop ebx
add esp, 8
ret
mov ecx, dword [esp + 0x20]
add ebp, edx
add ecx, edx
mov eax, ebx
shr eax, 0x10
mov edx, ebx
shr edx, 0x18
xor edi, edi
or dl, al
mov dword [esp + 0x20], ecx
mov eax, ebx
shr eax, 8
or dl, al
or dl, bl
mov dword [esp + 0x10], edx
test esi, esi
je 0x46e625
cmp esi, 0x20
jb 0x46e609
mov ebx, esi
mov edx, ebp
and ebx, 0xffffffe0
xorps xmm3, xmm3
sub edx, ecx
mov eax, ecx
mov dword [esp + 0x14], edx
movaps xmm2, xmm3
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
movups xmm0, xmmword [eax]
lea eax, [eax + 0x20]
movups xmm1, xmmword [eax + ecx - 0x20]
pxor xmm1, xmm0
movups xmm0, xmmword [eax - 0x10]
por xmm3, xmm1
movups xmm1, xmmword [edi + ebp + 0x10]
add edi, 0x20
pxor xmm1, xmm0
por xmm2, xmm1
cmp edi, ebx
jb 0x46e5a0
por xmm2, xmm3
mov ecx, dword [esp + 0x20]
movaps xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movaps xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movaps xmm0, xmm2
psrldq xmm0, 2
por xmm2, xmm0
movaps xmm0, xmm2
psrldq xmm0, 1
por xmm2, xmm0
movd eax, xmm2
or dl, al
cmp edi, esi
jae 0x46e625
sub ebp, dword [esp + 0x20]
add ecx, edi
sub esi, edi
mov al, byte [ecx + ebp]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
or dl, al
sub esi, 1
jne 0x46e615
pop edi
pop esi
test dl, dl
pop ebp
sete al
pop ebx
add esp, 8
ret
Function at 0x46e640
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov edx, dword [esp + 0x10]
push ebx
push ebp
mov ebp, dword [esp + 0x10]
xor ebx, ebx
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, edx
shr edi, 2
test edi, edi
je 0x46e6e7
cmp edi, 8
jb 0x46e6c0
lea eax, [esi - 4]
lea eax, [eax + edi*4]
lea ecx, [ebp - 4]
lea ecx, [ecx + edi*4]
cmp ebp, eax
ja 0x46e679
cmp ecx, esi
jae 0x46e6c0
mov ecx, edi
lea eax, [ebp + 0x10]
mov edx, esi
and ecx, 0xfffffff8
sub edx, ebp
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x20]
mov ebp, dword [esp + 0x10]
movups xmm0, xmmword [eax - 0x10]
lea eax, [eax + 0x20]
movups xmm1, xmmword [esi + ebx*4]
add ebx, 8
pxor xmm1, xmm0
movups xmmword [eax - 0x30], xmm1
movups xmm1, xmmword [eax + ebp - 0x20]
movups xmm0, xmmword [eax - 0x20]
pxor xmm1, xmm0
movups xmmword [eax - 0x20], xmm1
cmp ebx, ecx
jb 0x46e691
mov ebp, dword [esp + 0x18]
cmp ebx, edi
jae 0x46e6e7
lea ecx, [ebx*4]
mov edx, esi
sub edi, ebx
add ecx, ebp
sub edx, ebp
add ebx, edi
mov eax, dword [ecx + edx]
lea ecx, [ecx + 4]
xor dword [ecx - 4], eax
sub edi, 1
jne 0x46e6d5
mov edx, dword [esp + 0x20]
shl ebx, 2
sub edx, ebx
je 0x46e764
add ebp, ebx
add esi, ebx
xor edi, edi
test edx, edx
je 0x46e764
cmp edx, 0x20
jb 0x46e74b
lea eax, [esi - 1]
lea ecx, [ebp - 1]
add eax, edx
add ecx, edx
cmp ebp, eax
ja 0x46e70f
cmp ecx, esi
jae 0x46e74b
mov ecx, edx
mov ebx, esi
and ecx, 0xffffffe0
mov eax, ebp
sub ebx, ebp
nop word [eax + eax]
movups xmm0, xmmword [eax]
lea eax, [eax + 0x20]
movups xmm1, xmmword [eax + ebx - 0x20]
pxor xmm1, xmm0
movups xmmword [eax - 0x20], xmm1
movups xmm1, xmmword [esi + edi + 0x10]
add edi, 0x20
movups xmm0, xmmword [eax - 0x10]
pxor xmm1, xmm0
movups xmmword [eax - 0x10], xmm1
cmp edi, ecx
jb 0x46e720
cmp edi, edx
jae 0x46e764
sub esi, ebp
lea ecx, [edi + ebp]
sub edx, edi
mov al, byte [ecx + esi]
lea ecx, [ecx + 1]
xor byte [ecx - 1], al
sub edx, 1
jne 0x46e756
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x479ea4
Capabilities:
Enumerate gui resources
Get graphical window text

Disassembly:
push 0x464
mov eax, 0x4942e4
call fcn.00427e31
mov esi, ecx
mov ecx, dword [esi]
call fcn.0047d7b0
mov edx, dword [esi]
lea ecx, [ebp - 0x448]
mov edi, eax
call fcn.0047d7ce
lea eax, [ebp - 0x470]
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
push edi
mov dword [ebp - 0x470], ebx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [ebp - 0x46c], ebx
mov dword [ebp - 0x468], ebx
mov dword [ebp - 0x464], ebx
push 0x1c
lea eax, [ebp - 0x460]
mov byte [ebp - 4], 1
push eax
mov ecx, 0x4c0fec
call fcn.00408313
mov ecx, eax
cmp dword [ecx + 0x14], 8
jb 0x479f17
mov ecx, dword [ecx]
mov eax, dword [ebp - 0x46c]
mov dword [ebp - 0x468], eax
mov eax, dword [ebp - 0x470]
mov dword [ebp - 0x430], eax
xor eax, eax
mov dword [ebp - 0x42c], ebx
mov dword [ebp - 0x41c], ebx
mov dword [ebp - 0x418], 7
mov word [ebp - 0x42c], ax
mov byte [ebp - 4], 3
lea eax, [ebp - 0x46c]
mov dword [ebp - 0x414], eax
test ecx, ecx
je 0x479f6e
push ecx
lea ecx, [ebp - 0x42c]
call fcn.00402048
lea eax, [ebp - 0x430]
push eax
push 0x411a95
call dword [sym.imp.USER32.dll_EnumWindows]
mov esi, dword [ebp - 0x468]
lea ecx, [ebp - 0x42c]
sub esi, dword [ebp - 0x46c]
sar esi, 2
call fcn.0040172c
lea ecx, [ebp - 0x460]
call fcn.0040172c
cmp esi, 1
jle 0x47a049
push 0x400
lea eax, [ebp - 0x410]
push ebx
push eax
call fcn.00429240
mov esi, dword [ebp - 0x46c]
add esp, 0xc
cmp esi, dword [ebp - 0x468]
je 0x47a060
push 0x200
lea eax, [ebp - 0x410]
push eax
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp dword [ebp - 0x434], 8
lea eax, [ebp - 0x448]
lea ecx, [ebp - 0x410]
cmovae eax, dword [ebp - 0x448]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x47a029
test dx, dx
je 0x47a025
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x47a029
add ecx, 4
add eax, 4
test dx, dx
jne 0x47a003
mov eax, ebx
jmp 0x47a02e
sbb eax, eax
or eax, 1
test eax, eax
je 0x47a03f
add esi, 4
cmp esi, dword [ebp - 0x468]
jne 0x479fd5
jmp 0x47a041
mov edi, dword [esi]
mov esi, dword [ebp - 0x46c]
jmp 0x47a060
mov eax, dword [ebp - 0x468]
mov esi, dword [ebp - 0x46c]
sub eax, esi
sar eax, 2
test eax, eax
je 0x47a060
mov edi, dword [esi]
test esi, esi
je 0x47a08a
mov eax, dword [ebp - 0x464]
sub eax, esi
and eax, 0xfffffffc
push eax
push esi
call fcn.00401700
pop ecx
pop ecx
mov dword [ebp - 0x46c], ebx
mov dword [ebp - 0x468], ebx
mov dword [ebp - 0x464], ebx
lea ecx, [ebp - 0x448]
call fcn.0040172c
mov eax, edi
call fcn.00427de0
ret
Function at 0x47a7d2
Capabilities:
Create thread

Disassembly:
push 0x5c
mov eax, 0x49444a
call fcn.00427e9d
cmp byte [0x4e7a8d], 0
jne 0x47a84f
xor esi, esi
lea eax, [ebp - 0x48]
push eax
push esi
push 0x4e7680
push 0x402cf1
push esi
push esi
mov dword [0x4e79f8], esi
mov dword [ebp - 0x48], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], esi
call fcn.004823d0
or dword [ebp - 4], 0xffffffff
mov dword [0x4e79f8], eax
jmp 0x47a828
cmp dword [ebp - 0x48], 0
je 0x47a846
push esi
push esi
push 0x502
push dword [ebp - 0x48]
call dword [sym.imp.USER32.dll_PostThreadMessageW]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x4e79f8], 0
je 0x47a855
call fcn.00427def
ret
lea ecx, [ebp - 0x2c]
call fcn.004079c4
mov dword [ebp - 4], 2
call fcn.004076fa
test al, al
lea eax, [ebp - 0x44]
je 0x47a895
push 0x2b
push 0x13
push eax
call fcn.00479c27
push eax
lea ecx, [ebp - 0x2c]
call fcn.00406f3f
lea ecx, [ebp - 0x44]
call fcn.00405ca2
lea ecx, [ebp - 0x2c]
call fcn.00480d51
jmp 0x47a8b0
push 0x29
push 0x11
push eax
call fcn.00479c27
push eax
lea ecx, [ebp - 0x2c]
call fcn.00406f3f
lea ecx, [ebp - 0x44]
call fcn.00405ca2
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x58]
call fcn.00405c31
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x68]
call fcn.00405055
push 0x4b8c3c
lea eax, [ebp - 0x68]
push eax
call fcn.0042a85e
int3

Function at 0x47a8db
Capabilities:
Create thread

Disassembly:
push esi
call fcn.00433759
cmp byte [0x4e7a8d], 0
mov esi, eax
jne 0x47a938
cmp dword [0x4e79f4], 0
jne 0x47a938
cmp word [0x4e7b0e], 3
push edi
mov edi, 0x4e7b08
jne 0x47a91c
mov ecx, edi
call fcn.0040201c
test al, 1
je 0x47a91c
mov eax, dword [0x4e77a8]
shr eax, 9
test al, 1
je 0x47a937
push 0x4e79fc
xor eax, eax
push eax
push edi
push 0x405f67
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x4e7a00], eax
pop edi
mov eax, esi
pop esi
ret