joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4dd1c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], edx
mov ecx, 0x54ac48
call fcn.004029a0
mov ebx, eax
mov byte [ebx + 0x38], 1
mov dword [ebx + 0x2c], 0xffffffff
mov dword [ebx + 0x30], 0xffffffff
mov byte [ebx + 0x39], 1
mov eax, 0x645700
mov dword [ebp - 0x28], eax
mov ecx, eax
mov edx, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], ecx
mov edi, edx
add edi, 1
mov esi, ecx
adc esi, 0
push esi
push edi
push ecx
push edx
mov ecx, eax
call fcn.00404e10
mov ecx, dword [ebp - 0x10]
xor ecx, eax
mov eax, dword [ebp - 0x14]
xor edx, eax
or edx, ecx
mov eax, dword [ebp - 0x28]
jne 0x4dd1f9
mov ecx, esi
mov edx, edi
lea eax, [ebx + 4]
mov dword [eax], edx
mov dword [eax + 4], ecx
mov esi, dword [ebp - 0x20]
lea edx, [esi + 4]
call fcn.00402c74
mov edi, dword [ebp - 0x24]
test edi, edi
je 0x4dd25a
lea edx, [esi + 8]
call fcn.00402cbe
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, 0x541d00
call fcn.0044ff60
int3

Function at 0x50c3e0
Capabilities:
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
xor eax, eax
mov esi, dword [edx + 4]
test esi, esi
jle 0x50c410
lea edi, [edx + eax*4 + 8]
mov edi, dword [edi]
test edi, edi
jne 0x50c3fd
xor ebx, ebx
jmp 0x50c400
mov ebx, dword [edi + 0x10]
mov edi, ecx
rol edi, 0xd
add edi, ecx
mov ecx, edi
xor ecx, ebx
inc eax
cmp esi, eax
jg 0x50c3ef
mov eax, ecx
rol eax, 0xf
add eax, ecx
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x50c420
Capabilities:
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
xor eax, eax
mov esi, dword [edx + 4]
test esi, esi
jle 0x50c450
lea edi, [edx + eax*4 + 8]
mov edi, dword [edi]
test edi, edi
jne 0x50c43d
xor ebx, ebx
jmp 0x50c440
mov ebx, dword [edi + 0x10]
mov edi, ecx
rol edi, 0xd
add edi, ecx
mov ecx, edi
xor ecx, ebx
inc eax
cmp esi, eax
jg 0x50c42f
mov eax, ecx
rol eax, 0xf
add eax, ecx
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x5196d0
Capabilities:
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 8
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], edx
mov esi, dword [ebp - 0x10]
mov edi, dword [ebp - 0x14]
mov ebx, 0x544d90
cmp dword [ebx - 4], 0
jne 0x519742
mov eax, dword [ebx]
imul edx, esi, 0xc2b2ae3d
lea eax, [eax + edx + 0x165667b9]
rol eax, 0x11
imul eax, eax, 0x27d4eb2f
imul edx, edi, 0xc2b2ae3d
add eax, edx
rol eax, 0x11
imul eax, eax, 0x27d4eb2f
mov edx, eax
shr edx, 0xf
xor edx, eax
imul eax, edx, 0x85ebca77
mov edx, eax
shr edx, 0xd
xor edx, eax
imul eax, edx, 0xc2b2ae3d
mov edx, eax
shr edx, 0x10
xor eax, edx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.0040102e
jmp 0x5196f0
Function at 0x519750
Capabilities:
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], edx
mov esi, dword [ebp - 0x10]
mov edi, dword [ebp - 0x14]
mov ebx, dword [ebp + 8]
mov edx, 0x544d90
mov dword [ebp - 0x18], edx
cmp dword [edx - 4], 0
jne 0x5197db
mov eax, dword [edx]
imul edx, esi, 0xc2b2ae3d
lea eax, [eax + edx + 0x165667bd]
rol eax, 0x11
imul eax, eax, 0x27d4eb2f
imul edx, edi, 0xc2b2ae3d
add eax, edx
rol eax, 0x11
imul eax, eax, 0x27d4eb2f
imul edx, ebx, 0xc2b2ae3d
add eax, edx
rol eax, 0x11
imul eax, eax, 0x27d4eb2f
mov edx, eax
shr edx, 0xf
xor edx, eax
imul eax, edx, 0x85ebca77
mov edx, eax
shr edx, 0xd
xor edx, eax
imul eax, edx, 0xc2b2ae3d
mov edx, eax
shr edx, 0x10
xor eax, edx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 4
call fcn.0040102e
mov edx, dword [ebp - 0x18]
jmp 0x519776

Function at 0x5197f0
Capabilities:
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], edx
mov esi, dword [ebp - 0x10]
mov edi, dword [ebp - 0x14]
mov ebx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [ebp - 0x18], edx
mov ecx, 0x544d90
mov dword [ebp - 0x1c], ecx
cmp dword [ecx - 4], 0
jne 0x5198b4
mov eax, dword [ecx]
imul ecx, esi, 0x85ebca77
lea ecx, [eax + ecx + 0x24234428]
rol ecx, 0xd
imul ecx, ecx, 0x9e3779b1
rol ecx, 1
imul esi, edi, 0x85ebca77
lea edi, [eax + esi - 0x7a143589]
rol edi, 0xd
imul esi, edi, 0x9e3779b1
rol esi, 7
add ecx, esi
imul ebx, ebx, 0x85ebca77
add ebx, eax
rol ebx, 0xd
imul esi, ebx, 0x9e3779b1
rol esi, 0xc
add ecx, esi
imul edx, edx, 0x85ebca77
lea eax, [eax + edx + 0x61c8864f]
rol eax, 0xd
imul eax, eax, 0x9e3779b1
rol eax, 0x12
add eax, ecx
add eax, 0x10
mov edx, eax
shr edx, 0xf
xor edx, eax
imul eax, edx, 0x85ebca77
mov edx, eax
shr edx, 0xd
xor edx, eax
imul eax, edx, 0xc2b2ae3d
mov edx, eax
shr edx, 0x10
xor eax, edx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 8
call fcn.0040102e
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
jmp 0x519820

Function at 0x521ee0
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
push eax
mov esi, edx
mov edi, ecx
xor ebx, ebx
mov eax, dword [esi + 4]
mov dword [ebp - 0x10], eax
test eax, eax
jle 0x521f13
mov ecx, dword [esi + ebx*4 + 8]
mov edx, dword [ecx]
call dword [edx + 0x1c]
mov edx, edi
rol edx, 0xd
add edx, edi
mov edi, eax
xor edi, edx
inc ebx
mov eax, dword [ebp - 0x10]
cmp eax, ebx
jg 0x521ef7
mov eax, edi
rol eax, 0xf
add eax, edi
pop ecx
pop ebx
pop esi
pop edi
pop ebp
ret 4
Function at 0x521f40
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
push eax
mov esi, edx
mov edi, ecx
xor ebx, ebx
mov eax, dword [esi + 4]
mov dword [ebp - 0x10], eax
test eax, eax
jle 0x521f73
mov ecx, dword [esi + ebx*4 + 8]
mov edx, dword [ecx]
call dword [edx + 0x1c]
mov edx, edi
rol edx, 0xd
add edx, edi
mov edi, eax
xor edi, edx
inc ebx
mov eax, dword [ebp - 0x10]
cmp eax, ebx
jg 0x521f57
mov eax, edi
rol eax, 0xf
add eax, edi
pop ecx
pop ebx
pop esi
pop edi
pop ebp
ret 4
Function at 0x4044e3
Capabilities:
Identify system language via api

Disassembly:
push ebp
push ebx
call fcn.00485db0
call fcn.004050c0
push 0x5a
call fcn.0047e5ad
push eax
mov eax, 0x54003e
push eax
push 0
push 0x53
call fcn.004661e0
push 0x17
call fcn.0047e5ad
push eax
mov eax, 0x54003e
push eax
push 1
push 0x53
call fcn.004661e0
push 8
call fcn.0047e5ad
push eax
mov eax, 0x54003e
push eax
push 2
push 0x53
call fcn.004661e0
call sub.KERNEL32.dll_GetUserDefaultLangID
mov ebx, eax
and ebx, 0x3ff
push ebx
mov ebx, 4
cmp ebx, dword [esp]
je 0x40457b
mov ebx, 4
cmp ebx, dword [esp]
je 0x40457b
mov ebx, 0x7c04
cmp ebx, dword [esp]
jne 0x4045bd
mov ebp, dword [0x628e04]
mov edx, 0x550fca
lea ecx, [ebp]
call fcn.0043c008
mov eax, 0x550fca
push eax
call fcn.0040c1b4
push 2
push 0x53
call fcn.00466245
mov eax, 0x550fca
push eax
push 0x53
call fcn.0046627d
jmp 0x404643
mov ebx, 9
cmp ebx, dword [esp]
jne 0x404606
mov ebp, dword [0x628e04]
mov edx, str.English
lea ecx, [ebp]
call fcn.0043c008
mov eax, str.English
push eax
call fcn.0040c1b4
push 1
push 0x53
call fcn.00466245
mov eax, str.English
push eax
push 0x53
call fcn.0046627d
jmp 0x404643
mov ebp, dword [0x628e04]
mov edx, 0x541270
lea ecx, [ebp]
call fcn.0043c008
mov eax, 0x541270
push eax
call fcn.0040c1b4
push 0
push 0x53
call fcn.00466245
mov eax, 0x541270
push eax
push 0x53
call fcn.0046627d
pop eax
call fcn.00404655
call fcn.004293b8
jmp 0x404649
Function at 0x40561c
Capabilities:
Delete registry value

Disassembly:
push ebp
push ebx
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.00485db0
mov edx, dword [esp + 0x24]
lea ecx, [esp]
call fcn.0043c000
mov edx, dword [esp + 0x28]
lea ecx, [esp + 4]
call fcn.0043c000
mov dword [esp + 0xc], 0x20006
cmp dword [esp + 0x2c], 0
je 0x405660
mov ebx, dword [esp + 0xc]
or ebx, 0x100
mov dword [esp + 0xc], ebx
push edx
call fcn.00485c40
pop edx
push eax
push edx
call fcn.00485c40
pop edx
push eax
push 1
push dword [esp + 0xc]
call fcn.00483710
call fcn.00485e10
mov edx, 0x542028
call fcn.0043c330
mov ecx, eax
call fcn.0043c340
je 0x4056c6
push edx
call fcn.00485c40
pop edx
push eax
push edx
call fcn.00485c40
pop edx
push eax
push dword [esp + 8]
call fcn.00483780
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0xc]
call fcn.004837b0
lea eax, [esp + 4]
push eax
call fcn.00485ce0
push edx
call fcn.00485c40
pop edx
push eax
push edx
call fcn.00485c40
pop edx
push eax
push 1
push dword [esp + 0xc]
call fcn.004837b0
call fcn.00485e10
mov edx, 0x542028
call fcn.0043c330
mov ecx, eax
call fcn.0043c340
je 0x40572c
push edx
call fcn.00485c40
pop edx
push eax
push edx
call fcn.00485c40
pop edx
push eax
push dword [esp + 8]
call fcn.00483780
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0xc]
call fcn.00483710
lea eax, [esp + 4]
push eax
call fcn.00485ce0
mov ebx, dword [esp + 0x30]
and ebx, ebx
je 0x405747
push 0x555b04
push 0x24
push dword [esp + 0x38]
call fcn.00484b00
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x10]
push 0
push dword [esp + 0xc]
push dword [esp + 0x30]
call sub.ADVAPI32.dll_RegOpenKeyExW
mov dword [esp + 8], eax
cmp dword [esp + 8], 0
je 0x4057b2
mov ebx, dword [esp + 0x30]
and ebx, ebx
je 0x40579e
push dword [esp + 8]
mov ebp, dword [esp + 0x34]
pop dword [ebp + 8]
push edx
call fcn.00485c40
pop edx
push eax
push dword [esp + 0xc]
call fcn.004069de
mov ebp, dword [esp + 0x34]
lea eax, [ebp + 0xc]
push eax
call fcn.00485ce0
cmp dword [esp + 0x10], 0
je 0x4057ae
push dword [esp + 0x10]
call sub.ADVAPI32.dll_RegCloseKey
xor eax, eax
jmp 0x405811
push dword [esp + 4]
push dword [esp + 0x14]
call sub.ADVAPI32.dll_RegDeleteValueW
mov dword [esp + 8], eax
push dword [esp + 0x10]
call sub.ADVAPI32.dll_RegCloseKey
cmp dword [esp + 8], 0
je 0x405808
mov ebx, dword [esp + 0x30]
and ebx, ebx
je 0x405804
push dword [esp + 8]
mov ebp, dword [esp + 0x34]
pop dword [ebp + 8]
push edx
call fcn.00485c40
pop edx
push eax
push dword [esp + 0xc]
call fcn.004069de
mov ebp, dword [esp + 0x34]
lea eax, [ebp + 0xc]
push eax
call fcn.00485ce0
xor eax, eax
jmp 0x405811
mov eax, 1
jmp 0x405811
push dword [esp]
call fcn.00485e40
push dword [esp + 4]
call fcn.00485e40
add esp, 0x14
pop ebx
pop ebp
ret 0x14
Function at 0x40bc43
Capabilities:
Identify system language via api

Disassembly:
push ebp
push ebx
call fcn.00485db0
call fcn.004091ea
push 0x2f
push 0
call fcn.0041c8f9
push 0xffffffec
push 0x2d
call fcn.0046911d
push eax
call sub.USER32.dll_GetWindowLongW
mov ebx, eax
or ebx, 0x20
push ebx
push 0xffffffec
push 0x2d
call fcn.0046911d
push eax
call sub.USER32.dll_SetWindowLongW
push 0x5a
call fcn.0047e5ad
push eax
mov eax, 0x54003e
push eax
push 0
push 5
call fcn.004661e0
push 0x17
call fcn.0047e5ad
push eax
mov eax, 0x54003e
push eax
push 1
push 5
call fcn.004661e0
push 8
call fcn.0047e5ad
push eax
mov eax, 0x54003e
push eax
push 2
push 5
call fcn.004661e0
mov ebp, dword [0x628e24]
mov ebx, dword [ebp + 0x1c]
cmp ebx, 1
jne 0x40bdaa
call sub.KERNEL32.dll_GetUserDefaultLangID
mov ebx, eax
and ebx, 0x3ff
push ebx
mov ebx, 4
cmp ebx, dword [esp]
jne 0x40bd44
mov eax, 0x550fca
push eax
call fcn.0040c1b4
push 2
push 5
call fcn.00466245
mov eax, 0x550fca
push eax
push 5
call fcn.0046627d
jmp 0x40bda4
mov ebx, 9
cmp ebx, dword [esp]
jne 0x40bd7a
mov eax, str.English
push eax
call fcn.0040c1b4
push 1
push 5
call fcn.00466245
mov eax, str.English
push eax
push 5
call fcn.0046627d
jmp 0x40bda4
mov eax, 0x541270
push eax
call fcn.0040c1b4
push 0
push 5
call fcn.00466245
mov eax, 0x541270
push eax
push 5
call fcn.0046627d
pop eax
jmp 0x40be54
mov ebp, dword [0x628e04]
push dword [ebp]
mov edx, 0x550fca
mov ecx, dword [esp]
call fcn.0043c340
je 0x40bdee
mov eax, 0x550fca
push eax
call fcn.0040c1b4
push 2
push 5
call fcn.00466245
mov eax, 0x550fca
push eax
push 5
call fcn.0046627d
jmp 0x40be53
mov edx, str.English
mov ecx, dword [esp]
call fcn.0043c340
je 0x40be29
mov eax, str.English
push eax
call fcn.0040c1b4
push 1
push 5
call fcn.00466245
mov eax, str.English
push eax
push 5
call fcn.0046627d
jmp 0x40be53
mov eax, 0x541270
push eax
call fcn.0040c1b4
push 0
push 5
call fcn.00466245
mov eax, 0x541270
push eax
push 5
call fcn.0046627d
pop eax
call fcn.0040a3fd
call fcn.00407054
call fcn.00437534
mov ebp, dword [0x628e24]
mov ebx, dword [ebp + 0x1c]
cmp ebx, 1
jne 0x40be78
call fcn.004293b8
jmp 0x40be71
xor eax, eax
pop ebx
pop ebp
ret

Function at 0x41cb22
Capabilities:
Get common file path

Disassembly:
xor eax, eax
push eax
push eax
call fcn.00485db0
push dword [esp + 0x14]
call fcn.0043c320
lea eax, [esp]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x18]
call sub.SHELL32.dll_SHGetKnownFolderPath
cmp dword [esp], 0
je 0x41cb7b
push edx
call fcn.00485c40
pop edx
push eax
push edx
call fcn.00485c40
pop edx
push eax
push dword [esp + 8]
call fcn.00484d90
lea eax, [esp + 8]
push eax
call fcn.00485ce0
push dword [esp]
call sub.ole32.dll_CoTaskMemFree
mov edx, dword [esp + 4]
push edx
call fcn.00485c40
pop edx
push eax
push edx
call fcn.00485c80
pop eax
push eax
call fcn.0043c2f0
pop edx
add eax, edx
jmp 0x41cba3
push dword [esp + 4]
call fcn.00485e40
add esp, 8
ret 8
Function at 0x41d144
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
push ebx
mov edx, 9
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x41d14b
call fcn.00485db0
mov edx, dword [esp + 0x30]
lea ecx, [esp]
call fcn.0043c000
mov edx, dword [esp + 0x34]
lea ecx, [esp + 4]
call fcn.0043c000
mov edx, dword [esp + 0x38]
lea ecx, [esp + 8]
call fcn.0043c000
mov edx, dword [esp + 0x3c]
lea ecx, [esp + 0xc]
call fcn.0043c000
mov edx, dword [esp + 0x40]
lea ecx, [esp + 0x10]
call fcn.0043c000
mov edx, dword [esp + 0x48]
lea ecx, [esp + 0x14]
call fcn.0043c000
push 0
call sub.ole32.dll_CoInitialize
lea eax, [esp + 0x18]
push eax
mov ebp, 0x624e90
push ebp
push 1
push 0
mov ebp, 0x624e70
push ebp
call sub.ole32.dll_CoCreateInstance
mov ebx, eax
and ebx, ebx
jne 0x41d2b8
sub esp, 4
push dword [esp + 4]
mov eax, dword [esp + 0x20]
push eax
mov eax, dword [eax]
call dword [eax + 0x50]
add esp, 4
sub esp, 4
push dword [esp + 0xc]
mov eax, dword [esp + 0x20]
push eax
mov eax, dword [eax]
call dword [eax + 0x2c]
add esp, 4
sub esp, 4
push dword [esp + 0x14]
mov eax, dword [esp + 0x20]
push eax
mov eax, dword [eax]
call dword [eax + 0x24]
add esp, 4
sub esp, 4
push dword [esp + 0x10]
mov eax, dword [esp + 0x20]
push eax
mov eax, dword [eax]
call dword [eax + 0x1c]
add esp, 4
push dword [esp + 0x44]
mov eax, dword [esp + 0x1c]
push eax
mov eax, dword [eax]
call dword [eax + 0x3c]
push 0
mov eax, dword [esp + 0x1c]
push eax
mov eax, dword [eax]
call dword [eax + 0x34]
sub esp, 4
push dword [esp + 0x50]
push dword [esp + 0x1c]
mov eax, dword [esp + 0x24]
push eax
mov eax, dword [eax]
call dword [eax + 0x44]
add esp, 4
lea eax, [esp + 0x1c]
push eax
mov ebp, 0x624e80
push ebp
mov eax, dword [esp + 0x20]
push eax
mov eax, dword [eax]
call dword [eax]
mov ebx, eax
and ebx, ebx
jne 0x41d2ae
sub esp, 4
push 1
push dword [esp + 0xc]
mov eax, dword [esp + 0x28]
push eax
mov eax, dword [eax]
call dword [eax + 0x18]
add esp, 4
mov ebx, eax
and ebx, ebx
jne 0x41d2a4
mov dword [esp + 0x20], 1
mov eax, dword [esp + 0x1c]
push eax
mov eax, dword [eax]
call dword [eax + 8]
mov eax, dword [esp + 0x18]
push eax
mov eax, dword [eax]
call dword [eax + 8]
call sub.ole32.dll_CoUninitialize
mov eax, dword [esp + 0x20]
jmp 0x41d2c5
push dword [esp + 8]
call fcn.00485e40
push dword [esp + 0xc]
call fcn.00485e40
push dword [esp]
call fcn.00485e40
push dword [esp + 4]
call fcn.00485e40
push dword [esp + 0x10]
call fcn.00485e40
push dword [esp + 0x14]
call fcn.00485e40
add esp, 0x24
pop ebx
pop ebp
ret 0x20
Function at 0x43d8b5
Capabilities:
Create thread

Disassembly:
push ecx
push ebp
push esi
lea eax, [esp + 8]
xor esi, esi
push eax
push esi
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push 0x1000
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebp, eax
test ebp, ebp
je 0x43d94d
push edi
push 0x6a3480
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0x629884]
test edi, edi
je 0x43d921
push ebx
push esi
lea ebx, [edi + 8]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x43d91a
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [edi]
push ebx
push 0x629884
call fcn.00485b51
pop ecx
pop ecx
jmp 0x43d91c
mov edi, dword [edi]
test edi, edi
jne 0x43d8f1
pop ebx
mov eax, dword [0x624ea0]
mov esi, eax
inc eax
push 0x10
push 0x629884
mov dword [0x624ea0], eax
call fcn.00485b91
pop ecx
pop ecx
push 0x6a3480
mov dword [eax], ebp
mov dword [eax + 4], esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov eax, esi
pop esi
pop ebp
pop ecx
ret 8

Function at 0x441691
Capabilities:
Enumerate gui resources

Disassembly:
cmp dword [esp + 4], 0
push ebx
push esi
push edi
je 0x4416e6
push dword [esp + 0x10]
push 0x441610
call dword [sym.imp.USER32.dll_EnumWindows]
mov esi, dword [0x629934]
test esi, esi
je 0x44173f
xor edi, edi
mov ebx, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esi + 8], eax
jne 0x4416de
cmp byte [esi + 0x10], 0
je 0x4416de
push 3
push edi
push edi
push edi
push edi
push 0xfffffffffffffffe
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov esi, ebx
test ebx, ebx
jne 0x4416ba
jmp 0x44173f
mov esi, dword [0x629934]
test esi, esi
je 0x44173f
xor edi, edi
push ebp
mov ebx, dword [esi]
lea ebp, [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp], eax
jne 0x441738
cmp byte [esi + 0x11], 0
je 0x441714
push 1
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp byte [esi + 0x10], 0
je 0x44172b
push 3
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_SetWindowPos]
push ebp
push 0x629934
call fcn.00485b51
pop ecx
pop ecx
mov esi, ebx
test ebx, ebx
jne 0x4416f3
pop ebp
pop edi
pop esi
pop ebx
ret 4
Function at 0x441f23
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, 0x1000
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebp, ebp
cmp dword [esp + 0x24], 0x18
mov ebx, eax
je 0x441fe2
cmp dword [esp + 0x24], 2
je 0x441fe2
push 0x2000
push ebp
push dword [0x628de4]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
jmp 0x441fb1
cmp dword [esp + 0x18], 2
jne 0x441fcd
cmp dword [esp + 0x28], 0xffffffff
je 0x441f75
cmp ebp, dword [esp + 0x28]
jae 0x441fcd
add ebp, 2
test ebx, ebx
jne 0x441f9a
lea eax, [edi*2 + 0x2000]
push eax
push esi
push 8
push dword [0x628de4]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov esi, eax
mov ebx, 0x1000
mov ax, word [esp + 0x14]
cmp ax, 0xa
je 0x441fcd
cmp ax, 0xd
je 0x441fb1
mov word [esi + edi*2], ax
inc edi
dec ebx
push 0
lea eax, [esp + 0x1c]
push eax
push 2
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x30]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x441f61
push dword [esp + 0x2c]
xor eax, eax
push esi
mov word [esi + edi*2], ax
call fcn.0051f2a0
jmp 0x442074
push eax
push 0
push dword [0x628de4]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
cmp dword [esp + 0x28], 0xffffffff
je 0x442000
cmp ebp, dword [esp + 0x28]
jae 0x442058
push 0
lea eax, [esp + 0x1c]
push eax
push 1
lea eax, [esp + 0x1f]
push eax
push dword [esp + 0x30]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x442058
cmp dword [esp + 0x18], 1
jne 0x442058
inc ebp
test ebx, ebx
jne 0x442045
lea eax, [edi + 0x1000]
push eax
push esi
push 8
push dword [0x628de4]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov esi, eax
mov ebx, 0x1000
mov al, byte [esp + 0x13]
cmp al, 0xa
je 0x442058
cmp al, 0xd
je 0x441ff3
mov byte [esi + edi], al
inc edi
dec ebx
jmp 0x441ff3
cmp dword [esp + 0x24], 0x18
push dword [esp + 0x2c]
mov byte [esi + edi], 0
push esi
jne 0x44206f
call fcn.0051f2f0
jmp 0x442074
call fcn.0051f4a0
push esi
push 0
push dword [0x628de4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x10
Function at 0x443091
Capabilities:
Delete file

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
xor edi, edi
test esi, esi
je 0x4430f3
cmp word [esi], di
je 0x4430f3
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.004ace50
push dword [esp + 0x1c]
mov ebx, eax
push ebx
call dword [esp + 0x20]
push esi
push ebx
call fcn.004ad060
add esp, 0x10
test eax, eax
jne 0x4430f2
push 0x24
push 8
push dword [0x628de4]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
mov eax, dword [esp + 0x10]
mov dword [ecx + 0x14], edi
mov edi, ecx
mov dword [ecx], ebx
mov dword [ecx + 8], 1
mov dword [ecx + 0x20], eax
mov dword [eax + 4], ecx
pop ebx
mov eax, edi
pop edi
pop esi
ret 0x10
Function at 0x463d90
Capabilities:
Get thread local storage value

Disassembly:
cmp dword [0x6a1c68], 0
jne 0x463d9e
call fcn.00463c10
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push dword [0x6a1c6c]
call esi
test eax, eax
jne 0x463dc1
call fcn.00463c10
push dword [0x6a1c6c]
call esi
mov edx, dword [esp + 0x14]
lea esi, [eax + 8]
mov edi, 0x11
lea ecx, [ecx]
imul ecx, edx, 0x53a9b4fb
lea esi, [esi + 4]
mov edx, 1
sub edx, ecx
imul ecx, edx, 0x53a9b4fb
mov dword [esi + 0x40], edx
mov edx, 1
sub edx, ecx
mov dword [esi - 4], edx
dec edi
jne 0x463dd0
mov dword [eax], edi
lea ebp, [edi + 0x1f]
mov dword [eax + 4], 0xa
mov ebx, dword [eax]
mov edi, dword [eax + 4]
mov edx, dword [eax + ebx*4 + 8]
mov ecx, dword [eax + ebx*4 + 0x4c]
mov esi, dword [eax + edi*4 + 8]
ror ecx, 0xd
add ecx, dword [eax + edi*4 + 0x4c]
dec edi
ror edx, 5
add edx, esi
mov dword [eax + ebx*4 + 8], ecx
mov dword [eax + ebx*4 + 0x4c], edx
dec ebx
jns 0x463e30
mov ebx, 0x10
test edi, edi
jns 0x463e39
mov edi, 0x10
mov dword [eax], ebx
mov dword [eax + 4], edi
dec ebp
jne 0x463e02
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x463e50
Capabilities:
Get thread local storage value

Disassembly:
cmp dword [0x6a1c68], 0
jne 0x463e5e
call fcn.00463c10
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push dword [0x6a1c6c]
call esi
mov edx, eax
test edx, edx
jne 0x463e85
call fcn.00463c10
push dword [0x6a1c6c]
call esi
mov edx, eax
mov ebx, dword [edx]
mov esi, dword [edx + 4]
mov ebp, dword [esp + 0x14]
inc ebp
mov edi, dword [edx + ebx*4 + 0x4c]
mov eax, dword [edx + ebx*4 + 8]
mov ecx, dword [edx + esi*4 + 8]
ror edi, 0xd
add edi, dword [edx + esi*4 + 0x4c]
dec esi
ror eax, 5
add eax, ecx
mov dword [edx + ebx*4 + 8], edi
mov dword [edx + ebx*4 + 0x4c], eax
dec ebx
jns 0x463eb8
mov ebx, 0x10
test esi, esi
jns 0x463ec1
mov esi, 0x10
mov dword [edx], ebx
mov eax, edi
mov dword [edx + 4], esi
test ebp, ebp
je 0x463ed0
mul ebp
mov eax, edx
pop edi
pop esi
pop ebp
pop ebx
ret 4