joyce8/EMBER2024-capa huggingface dataset:
Function at 0x453e40
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd0
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
test byte [esi + 0x236], 0x20
je 0x453e6f
push 0x100
lea eax, [ebp - 0x204]
push eax
push edi
call sub.USER32.DLL_GetClassNameA
jmp 0x453e81
push 0x100
lea edx, [ebp - 0x204]
push edx
push edi
call sub.USER32.DLL_GetWindowTextA
test byte [esi + 0x236], 2
je 0x453f44
xor ebx, ebx
lea eax, [ebp - 0x204]
jmp 0x453ea3
xor edx, edx
mov dl, byte [eax]
cmp edx, 0x2d
je 0x453eb0
inc ebx
inc eax
cmp ebx, 0x100
jge 0x453eb0
cmp byte [eax], 0
jne 0x453e98
lea eax, [ebp + ebx - 0x205]
jmp 0x453ebb
dec ebx
dec eax
test ebx, ebx
jle 0x453ecd
xor edx, edx
mov dl, byte [eax]
cmp edx, 0x2d
je 0x453eb9
cmp edx, 0x20
je 0x453eb9
mov byte [ebp + ebx - 0x204], 0
mov dword [ebp - 0x230], 0x2c
lea ecx, [ebp - 0x230]
push ecx
push edi
call sub.USER32.DLL_GetWindowPlacement
mov ecx, dword [ebp - 0x228]
push ecx
mov ecx, dword [ebp - 0x208]
mov edx, dword [ebp - 0x210]
sub ecx, edx
push ecx
mov ecx, dword [ebp - 0x20c]
mov eax, dword [ebp - 0x214]
sub ecx, eax
push ecx
push edx
push eax
push str._i__i__i__i__i
lea edx, [ebp - 0x104]
push edx
call fcn.004a6c2c
add esp, 0x1c
lea eax, [ebp - 0x104]
lea edx, [ebp - 0x204]
push 0x4d53a4
push eax
push edx
push str.Placement
call sub.KERNEL32.DLL_WritePrivateProfileStringA
test byte [esi + 0x236], 0x22
je 0x454013
movsx ecx, word [esi + 0x23f]
push ecx
movsx eax, word [esi + 0x231]
push eax
mov edx, dword [esi + 0x22d]
push edx
lea edx, [ebp - 0x104]
movsx ecx, word [esi + 0x23d]
push ecx
mov eax, dword [esi + 0x239]
push eax
push str._i__i__i__i__i
push edx
call fcn.004a6c2c
add esp, 0x1c
lea ecx, [ebp - 0x104]
lea eax, [ebp - 0x204]
push 0x4d53a4
push ecx
push eax
push 0x4bb43d
call sub.KERNEL32.DLL_WritePrivateProfileStringA
xor ebx, ebx
xor edi, edi
lea eax, [esi + 0x144]
mov dword [ebp - 4], eax
jmp 0x453fda
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x104]
add eax, edi
mov ecx, dword [edx]
push ecx
push 0x4bb540
push eax
call fcn.004a6c2c
add esp, 0xc
add edi, eax
inc ebx
add dword [ebp - 4], 4
cmp ebx, dword [esi + 0x13c]
jge 0x453fea
cmp edi, 0xf4
jl 0x453fb7
test edi, edi
jle 0x453ff6
mov byte [ebp + edi - 0x105], 0
push 0x4d53a4
lea edx, [ebp - 0x104]
push edx
lea ecx, [ebp - 0x204]
push ecx
push str.Columns
call sub.KERNEL32.DLL_WritePrivateProfileStringA
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45f1cc
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x45f1ea
cmp byte [ebx], 0
je 0x45f1ea
cmp dword [ebp + 0xc], 0
jne 0x45f1f1
xor eax, eax
jmp 0x45f336
mov edx, dword [ebp + 0xc]
lea ecx, [ebp - 0xc]
mov byte [edx], 0
push ecx
push ebx
call sub.VERSION.DLL_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
jne 0x45f20e
xor eax, eax
jmp 0x45f336
push esi
push 0
call sub.KERNEL32.DLL_GlobalAlloc
mov edi, eax
test edi, edi
jne 0x45f223
xor eax, eax
jmp 0x45f336
push edi
push esi
push 0
push ebx
call sub.VERSION.DLL_GetFileVersionInfoA
test eax, eax
jne 0x45f23e
push edi
call sub.KERNEL32.DLL_GlobalFree
xor eax, eax
jmp 0x45f336
xor esi, esi
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 0x14]
push edx
push str.VarFileInfoTranslation
push edi
call sub.VERSION.DLL_VerQueryValueA
test eax, eax
jne 0x45f25c
xor ecx, ecx
mov dword [ebp - 4], ecx
xor ebx, ebx
jmp 0x45f2a4
mov eax, dword [ebp - 0x14]
movzx edx, word [eax + ebx*4 + 2]
push edx
lea edx, [ebp - 0x114]
mov ecx, dword [ebp - 0x14]
movzx eax, word [ecx + ebx*4]
push eax
push str.StringFileInfo_04x_04xFileVersion
push edx
call fcn.004a6c2c
add esp, 0x10
lea ecx, [ebp - 8]
lea eax, [ebp - 0x10]
lea edx, [ebp - 0x114]
push ecx
push eax
push edx
push edi
call sub.VERSION.DLL_VerQueryValueA
test eax, eax
je 0x45f2a3
mov esi, dword [ebp - 8]
jmp 0x45f2ae
inc ebx
mov eax, dword [ebp - 4]
shr eax, 2
cmp ebx, eax
jb 0x45f260
test esi, esi
jne 0x45f2cc
lea edx, [ebp - 8]
push edx
lea ecx, [ebp - 0x10]
push ecx
push str.StringFileInfo040904E4FileVersion
push edi
call sub.VERSION.DLL_VerQueryValueA
test eax, eax
je 0x45f2cc
mov esi, dword [ebp - 8]
test esi, esi
jne 0x45f2ea
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 0x10]
push edx
push str.StringFileInfo040904B0FileVersion
push edi
call sub.VERSION.DLL_VerQueryValueA
test eax, eax
je 0x45f2ea
mov esi, dword [ebp - 8]
test esi, esi
jne 0x45f308
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 0x10]
push edx
push str.StringFileInfo00000000FileVersion
push edi
call sub.VERSION.DLL_VerQueryValueA
test eax, eax
je 0x45f308
mov esi, dword [ebp - 8]
cmp esi, 0x1f
jle 0x45f312
mov esi, 0x1f
test esi, esi
jle 0x45f327
push esi
mov eax, dword [ebp - 0x10]
push eax
mov edx, dword [ebp + 0xc]
push edx
call fcn.004a3530
add esp, 0xc
mov ecx, dword [ebp + 0xc]
mov byte [ecx + esi], 0
push edi
call sub.KERNEL32.DLL_GlobalFree
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46b258
Capabilities:
Read .ini file

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffcfc
mov edi, str.DATA
xor ebx, ebx
push ebx
lea eax, [edi + 0x4f8]
push eax
lea edx, [esp + 0x10c]
push edx
call fcn.004a6c2c
add esp, 0xc
push 0x4d53a4
push 0x104
lea ecx, [esp + 8]
push ecx
lea eax, [edi + 4]
push eax
lea edx, [esp + 0x114]
push edx
lea ecx, [edi + 0x503]
push ecx
call sub.KERNEL32.DLL_GetPrivateProfileStringA
cmp byte [esp], 0
je 0x46b2e6
mov eax, dword [0x4d54d8]
push eax
call sub.USER32.DLL_SetCursor
mov esi, eax
xor eax, eax
mov dword [0x4eae50], eax
push 0
lea edx, [esp + 0x208]
push edx
lea ecx, [esp + 8]
push ecx
call fcn.00469818
add esp, 0xc
call fcn.0046718c
cmp dword [0x4eae50], 0
jne 0x46b2f3
inc ebx
cmp ebx, 0xc8
jl 0x46b268
push esi
call sub.USER32.DLL_SetCursor
add esp, 0x304
pop edi
pop esi
pop ebx
ret
Function at 0x46ba50
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffadc
push ebx
push esi
push edi
mov edi, str.DATA
mov ebx, dword [ebp + 8]
push 0
push 1
push 0x20
lea eax, [edi + 0x54d]
push 0x21c
push eax
push 0x4eb0f4
call sym.Cari___.exe__Createsorteddata
add esp, 0x18
test eax, eax
je 0x46ba8f
or eax, 0xffffffff
jmp 0x46bca3
mov dword [0x4eb278], 0x18
lea edx, [edi + 0x319]
mov dword [0x4eb2bc], edx
mov byte [0x4eb300], 0x10
mov dword [0x4eb27c], 0x100
lea ecx, [edi + 0x55f]
mov dword [0x4eb2c0], ecx
mov byte [0x4eb301], 4
mov dword [0x4eb22c], 2
mov dword [0x4eb230], ebx
push 0x4eb22c
call sym.Cari___.exe__Defaultbar
xor eax, eax
pop ecx
mov dword [0x4eb311], eax
mov dword [0x4eb31d], 1
mov dx, word [0x4d54b4]
xor eax, eax
mov word [0x4eb321], dx
mov dword [0x4eb325], 0x12
mov dword [0x4eb329], ebx
xor edx, edx
mov cx, word [0x4d5394]
mov word [0x4eb32d], cx
xor ecx, ecx
mov dword [ebp - 0x524], 0xfffffffe
mov dword [ebp - 0x520], 1
mov dword [ebp - 0x51c], ecx
mov dword [0x4eb331], eax
mov byte [ebp - 0x518], 0
xor eax, eax
mov dword [0x4eb335], edx
mov dword [ebp - 0x414], eax
xor edx, edx
mov byte [ebp - 0x410], 0
mov dword [ebp - 0x30c], edx
xor ecx, ecx
mov dword [ebp - 0x310], ecx
lea eax, [ebp - 0x524]
push eax
push 0x4eb0f4
mov dword [0x4eb339], 0x46b304
call sym.Cari___.exe__Addsorteddata
add esp, 8
xor edx, edx
mov ebx, edx
mov esi, edx
cmp esi, 0xc8
jge 0x46bc00
push esi
lea eax, [edi + 0x4f8]
push eax
lea edx, [ebp - 0x104]
push edx
call fcn.004a6c2c
add esp, 0xc
lea ecx, [ebp - 0x308]
lea eax, [edi + 4]
lea edx, [ebp - 0x104]
push 0x4d53a4
push 0x204
push ecx
push eax
push edx
lea ecx, [edi + 0x503]
push ecx
call sub.KERNEL32.DLL_GetPrivateProfileStringA
cmp byte [ebp - 0x308], 0
je 0x46bbf7
push ebx
lea eax, [ebp - 0x308]
push eax
call fcn.00469db4
add esp, 8
inc ebx
inc esi
cmp esi, 0xc8
jl 0x46bb9e
xor edx, edx
mov dword [0x4eb200], edx
push 0
push 0x46b7b4
mov ecx, dword [0x4d3b80]
push ecx
lea eax, [edi + 0x568]
push eax
mov edx, dword [0x4d3b78]
push edx
call sub.USER32.DLL_DialogBoxParamA
mov esi, eax
push 0x4d53a4
push 0
push 0
lea eax, [edi + 0x503]
push eax
call sub.KERNEL32.DLL_WritePrivateProfileStringA
mov edx, dword [0x4eb210]
xor ebx, ebx
mov dword [ebp - 4], edx
jmp 0x46bc8b
push ebx
lea eax, [edi + 0x4f8]
push eax
lea edx, [ebp - 0x104]
push edx
call fcn.004a6c2c
add esp, 0xc
lea eax, [ebp - 0x104]
lea edx, [edi + 0x503]
push 0x4d53a4
mov ecx, dword [ebp - 4]
add ecx, 0xc
push ecx
push eax
push edx
call sub.KERNEL32.DLL_WritePrivateProfileStringA
inc ebx
add dword [ebp - 4], 0x21c
mov ecx, dword [0x4eb1f8]
dec ecx
cmp ebx, ecx
jl 0x46bc4d
push 0x4eb0f4
call sym.Cari___.exe__Destroysorteddata
pop ecx
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46bcac
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffddc
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov ecx, esi
mov eax, edi
shl eax, cl
mov dword [ebp - 4], eax
test esi, esi
je 0x46bcd4
cmp dword [ebp - 4], 0x200000
jae 0x46bcdb
mov eax, esi
jmp 0x46bd8d
mov dword [ebp - 0x224], 0x20
lea edx, [ebp - 0x224]
push edx
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov ecx, dword [ebp - 4]
add ecx, 0x400000
mov eax, dword [ebp - 0x210]
cmp ecx, eax
jbe 0x46bd8b
sub eax, 0x400000
cmp eax, 0x200000
jae 0x46bd19
mov eax, 0x200000
xor ebx, ebx
jmp 0x46bd1e
inc ebx
cmp esi, ebx
jbe 0x46bd32
mov ecx, ebx
mov edx, 2
shl edx, cl
imul edx, edi
cmp eax, edx
ja 0x46bd1d
mov ecx, ebx
mov eax, edi
shl eax, cl
shr eax, 0x14
lea ecx, [ebp - 0x204]
push eax
mov edx, dword [ebp - 0x210]
shr edx, 0x14
push edx
mov eax, dword [ebp + 0x10]
push eax
mov edx, dword [ebp - 4]
shr edx, 0x14
push edx
push 0x4c07e7
push ecx
call fcn.004a6c2c
add esp, 0x18
lea eax, [ebp - 0x204]
mov edx, dword [0x4d3b7c]
push 0x2024
push 0x4c0884
push eax
push edx
call sub.USER32.DLL_MessageBoxA
cmp eax, 6
jne 0x46bd8b
mov eax, ebx
jmp 0x46bd8d
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x477084
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
test ebx, ebx
je 0x47710a
sub eax, 0x7da
test eax, eax
jl 0x4770aa
cmp eax, 6
jl 0x4770af
mov byte [ebx], 0
jmp 0x47710a
push eax
push str.Executable__i_
lea eax, [ebp - 0x100]
push eax
call fcn.004a6c2c
add esp, 0xc
lea edx, [ebp - 0x100]
push 0x4d53a4
push 0x104
push ebx
push 0x4c1700
push edx
push str.History
call sub.KERNEL32.DLL_GetPrivateProfileStringA
test esi, esi
je 0x47710a
push 0x4d53a4
push 0x1000
push esi
lea ecx, [ebp - 0x100]
push 0x4c1700
push ecx
push str.Arguments
call sub.KERNEL32.DLL_GetPrivateProfileStringA
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x477110
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7bc
push ebx
push esi
push edi
push 0
push 0x7d9
mov eax, dword [ebp + 8]
push eax
call sub.USER32.DLL_RemoveMenu
xor ebx, ebx
push 0
lea eax, [ebx + 0x7da]
push eax
mov edx, dword [ebp + 8]
push edx
call sub.USER32.DLL_RemoveMenu
inc ebx
cmp ebx, 6
jl 0x47712e
xor ecx, ecx
mov ebx, ecx
mov edi, ecx
mov eax, ebx
shl eax, 6
add eax, ebx
cmp ebx, 6
lea edx, [ebp + eax*4 - 0x620]
mov dword [ebp - 4], edx
jge 0x477218
push ebx
push str.Executable__i_
lea ecx, [ebp - 0x720]
push ecx
call fcn.004a6c2c
mov eax, ebx
add esp, 0xc
shl eax, 6
lea edx, [ebp - 0x620]
add eax, ebx
push 0x4d53a4
shl eax, 2
push 0x104
add eax, edx
lea ecx, [ebp - 0x720]
push eax
push 0x4c1700
push ecx
push str.History
call sub.KERNEL32.DLL_GetPrivateProfileStringA
mov esi, eax
mov eax, 0x104
sub eax, esi
cmp eax, 8
jbe 0x477202
cmp dword [0x4d6d90], 0
je 0x477202
mov edx, ebx
dec eax
shl edx, 6
lea ecx, [ebp - 0x61f]
add edx, ebx
push 0x4d53a4
shl edx, 2
push eax
add edx, esi
lea eax, [ebp - 0x720]
add edx, ecx
push edx
push 0x4c1700
push eax
push str.Arguments
call sub.KERNEL32.DLL_GetPrivateProfileStringA
test eax, eax
je 0x477202
mov edx, dword [ebp - 4]
mov byte [edx + esi], 0x20
test esi, esi
jle 0x477207
inc edi
inc ebx
add dword [ebp - 4], 0x104
cmp ebx, 6
jl 0x477166
test edi, edi
je 0x477314
push 0x4c1700
push 0x7d9
push 0x800
mov ecx, dword [ebp + 8]
push ecx
call sub.USER32.DLL_AppendMenuA
xor eax, eax
mov ebx, eax
mov edi, eax
mov eax, ebx
shl eax, 6
add eax, ebx
cmp ebx, 6
lea edx, [ebp + eax*4 - 0x620]
mov dword [ebp - 8], edx
jge 0x477314
mov ecx, dword [ebp - 8]
cmp byte [ecx], 0
je 0x477303
inc edi
cmp edi, 9
jg 0x4772b1
mov eax, ebx
shl eax, 6
add eax, ebx
shl eax, 2
lea edx, [ebp - 0x620]
add eax, edx
push eax
push edi
push 0x4c1ddd
lea ecx, [ebp - 0x844]
push ecx
call fcn.004a6c2c
add esp, 0x10
mov esi, eax
cmp edi, 1
jne 0x4772ea
push str._tCtrlF2
lea eax, [ebp - 0x844]
add esi, eax
push esi
call fcn.004a6c2c
add esp, 8
jmp 0x4772ea
mov edx, ebx
lea ecx, [ebp - 0x620]
shl edx, 6
push edi
add edx, ebx
xor eax, eax
shl edx, 2
lea esi, [ebp - 0x844]
add edx, ecx
or ecx, 0xffffffff
mov edi, edx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
lea eax, [ebp - 0x844]
push eax
lea edx, [ebx + 0x7da]
push edx
push 0
mov ecx, dword [ebp + 8]
push ecx
call sub.USER32.DLL_AppendMenuA
inc ebx
add dword [ebp - 8], 0x104
cmp ebx, 6
jl 0x477258
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x478788
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, dword [0x4d7db0]
test ebx, ebx
jne 0x4787a2
xor eax, eax
jmp 0x47884a
xor esi, esi
xor eax, eax
mov dword [ebp - 4], eax
mov edx, dword [0x4d5a74]
mov dword [ebp - 8], edx
xor edi, edi
jmp 0x478814
mov eax, dword [ebx]
cmp eax, dword [ebp + 8]
jne 0x4787e4
mov edx, dword [ebx + 0xc]
push edx
call sub.KERNEL32.DLL_ResumeThread
test eax, eax
jg 0x4787d4
mov ecx, dword [ebx]
mov dword [ebp - 8], ecx
inc dword [ebp - 4]
jmp 0x47880d
dec dword [ebx + 0x620]
mov esi, 1
dec eax
je 0x47880d
jmp 0x4787bd
cmp dword [ebx + 0x620], 0
jg 0x47880d
mov eax, dword [ebx + 0xc]
push eax
call sub.KERNEL32.DLL_SuspendThread
test eax, eax
jne 0x478802
mov edx, dword [ebx]
mov dword [ebp - 8], edx
inc dword [ebp - 4]
inc dword [ebx + 0x620]
mov esi, 1
inc edi
add ebx, 0x66c
cmp edi, dword [0x4d7d98]
jl 0x4787b6
test esi, esi
je 0x478838
cmp dword [0x4d7c90], 0
je 0x478838
push 0
push 0
mov eax, dword [0x4d7c90]
push eax
call sub.USER32.DLL_InvalidateRect
cmp dword [ebp - 4], 1
jle 0x478847
mov edx, dword [0x4d5a74]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x478854
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov ebx, dword [0x4d7db0]
test ebx, ebx
je 0x478971
xor esi, esi
xor eax, eax
mov dword [esp], eax
xor ebp, ebp
jmp 0x4788f5
cmp dword [ebx + 0x620], 0
jge 0x47889f
jmp 0x478894
mov eax, dword [ebx + 0xc]
push eax
call sub.KERNEL32.DLL_SuspendThread
inc dword [ebx + 0x620]
mov esi, 1
cmp dword [ebx + 0x620], 0
jl 0x478880
jmp 0x4788ee
cmp dword [ebx + 0x620], 0
jle 0x4788d3
jmp 0x4788c0
mov eax, dword [ebx + 0xc]
push eax
call sub.KERNEL32.DLL_ResumeThread
mov edi, eax
dec dword [ebx + 0x620]
mov esi, 1
cmp dword [ebx + 0x620], 0
jg 0x4788aa
cmp edi, 1
jg 0x4788ee
inc dword [esp]
jmp 0x4788ee
mov eax, dword [ebx + 0xc]
push eax
call sub.KERNEL32.DLL_SuspendThread
mov edi, eax
mov eax, dword [ebx + 0xc]
push eax
call sub.KERNEL32.DLL_ResumeThread
test edi, edi
jne 0x4788ee
inc dword [esp]
inc ebp
add ebx, 0x66c
cmp ebp, dword [0x4d7d98]
jl 0x478875
test esi, esi
je 0x47891e
cmp dword [0x4d7c90], 0
je 0x47891e
push 0
push 0
mov edx, dword [0x4d7c90]
push edx
call sub.USER32.DLL_InvalidateRect
cmp dword [esp], 0
jne 0x478971
cmp dword [0x4d7d98], 1
jne 0x47894c
push 0x30
push 0x4c21f0
push 0x4c21ac
mov ecx, dword [0x4d3b7c]
push ecx
call sub.USER32.DLL_MessageBoxA
call sym.Cari___.exe__Createthreadwindow
jmp 0x478971
cmp dword [0x4d7d98], 1
jle 0x478971
push 0x30
push 0x4c21f0
push 0x4c2202
mov eax, dword [0x4d3b7c]
push eax
call sub.USER32.DLL_MessageBoxA
call sym.Cari___.exe__Createthreadwindow
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x496092
Capabilities:
Encode data using xor
Hash data using crc32b

Disassembly:
enter 0, 0
push ebx
push esi
mov ebx, 0x4c11db7
mov eax, 0xffffffff
mov ecx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
jecxz 0x4960c5
mov edx, 0xffffff00
xor ebx, ebx
rol eax, 8
xor al, byte [esi]
inc esi
mov bl, al
and eax, edx
xor eax, dword [ebx*4 + 0x4f06ac]
dec ecx
jne 0x4960b1
pop esi
pop ebx
leave
ret

Function at 0x496673
Capabilities:
Enumerate files on windows
Link many functions at runtime

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffff004
mov ebp, str..dll
push eax
add esp, 0xfffffbb0
push 0x4b00
push 0
push 0x4f0ab4
call fcn.004a35a0
xor eax, eax
add esp, 0xc
mov dword [0x4f55b4], eax
xor eax, eax
or ecx, 0xffffffff
mov edi, 0x4d3a70
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea esi, [esp + 0x110c]
xchg edi, esi
mov edx, ecx
mov eax, edi
shr ecx, 2
lea eax, [esp + 0x110c]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push eax
call fcn.004a36d4
pop ecx
mov edi, eax
test edi, edi
jle 0x4966dd
xor eax, eax
mov al, byte [esp + edi + 0x110b]
cmp eax, 0x5c
je 0x4966dd
mov byte [esp + edi + 0x110c], 0x5c
inc edi
lea edx, [esp + 0x110c]
mov esi, ebp
add edi, edx
push edi
mov eax, edi
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop edi
lea edx, [esp + 0x1310]
push edx
lea ecx, [esp + 0x1110]
push ecx
call sub.KERNEL32.DLL_FindFirstFileA
mov dword [esp + 4], eax
cmp dword [esp + 4], 0xffffffff
jmp section..pdata

Function at 0x497154
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x49716f
cmp dword [ebp + 0xc], 0
jne 0x497173
mov eax, esi
jmp 0x4971da
xor eax, eax
mov edx, 0x4f0ab4
jmp 0x4971c8
cmp ecx, dword [edx]
jne 0x4971c1
mov ecx, eax
lea eax, [ebp - 0x100]
shl ecx, 3
lea ecx, [ecx + ecx*2]
lea ecx, [ecx + ecx*4]
lea ecx, [ecx + ecx*4]
add ecx, 0x4f0bbc
push ecx
push str.Plugin__s
push eax
call fcn.004a6c2c
add esp, 0xc
push 0x4d53a4
push esi
mov edx, dword [ebp + 0xc]
push edx
lea ecx, [ebp - 0x100]
push ecx
call sub.KERNEL32.DLL_GetPrivateProfileIntA
jmp 0x4971da
inc eax
add edx, 0x258
mov ebx, dword [0x4f55b4]
inc ebx
cmp eax, ebx
jge 0x4971d8
cmp eax, 0x20
jl 0x49717c
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4971e0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
push edi
mov ebx, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x497201
test esi, esi
je 0x497201
test ebx, ebx
jne 0x49720f
test ebx, ebx
je 0x497208
mov byte [ebx], 0
xor eax, eax
jmp 0x49729a
xor eax, eax
mov edx, 0x4f0ab4
jmp 0x49726a
cmp ecx, dword [edx]
jne 0x497263
mov ecx, eax
lea eax, [ebp - 0x100]
shl ecx, 3
lea ecx, [ecx + ecx*2]
lea ecx, [ecx + ecx*4]
lea ecx, [ecx + ecx*4]
add ecx, 0x4f0bbc
push ecx
push str.Plugin__s
push eax
call fcn.004a6c2c
add esp, 0xc
lea ecx, [ebp - 0x100]
push 0x4d53a4
push 0x100
push ebx
mov edx, dword [ebp + 0x14]
push edx
push esi
push ecx
call sub.KERNEL32.DLL_GetPrivateProfileStringA
jmp 0x49729a
inc eax
add edx, 0x258
mov edi, dword [0x4f55b4]
inc edi
cmp eax, edi
jge 0x49727a
cmp eax, 0x20
jl 0x497218
push 0xff
mov eax, dword [ebp + 0x14]
push eax
push ebx
call fcn.004a3904
add esp, 0xc
mov byte [ebx + 0xff], 0
push ebx
call fcn.004a36d4
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a31fc
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
mov dword [esp], 0x20
push esp
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [esp + 0xc]
add esp, 0x20
ret

Function at 0x4a46a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x4a46bc
call fcn.004a5a98
pop ebx
pop ebp
ret
test byte [ebp + 0xc], 2
je 0x4a46d7
test bl, 1
je 0x4a46d7
mov dword [0x4cc6e4], 5
or eax, 0xffffffff
pop ebx
pop ebp
ret
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x4a4884
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
test byte [ebp + 0xd], 0xc0
jne 0x4a48a3
mov eax, dword [0x4cb484]
mov edx, dword [eax]
and edx, 0xc000
or dword [ebp + 0xc], edx
test byte [ebp + 0xd], 0x80
jne 0x4a48b0
or dword [ebp + 0xc], 0x4000
mov ecx, dword [ebp + 0xc]
and ecx, 0x700
cmp ecx, 0x500
jg 0x4a48dd
je 0x4a48ef
sub ecx, 0x100
je 0x4a48fd
sub ecx, 0x100
je 0x4a4904
sub ecx, 0x100
je 0x4a48f6
jmp 0x4a490b
sub ecx, 0x600
je 0x4a4904
sub ecx, 0x100
je 0x4a48ef
jmp 0x4a490b
mov edi, 1
jmp 0x4a4910
mov edi, 2
jmp 0x4a4910
mov edi, 4
jmp 0x4a4910
mov edi, 5
jmp 0x4a4910
mov edi, 3
test byte [ebp + 0xd], 1
je 0x4a4937
lea eax, [ebp + 0x10]
add eax, 4
mov eax, dword [eax - 4]
and eax, dword [0x4caefc]
test al, 0x80
je 0x4a4930
mov ebx, 0x80
jmp 0x4a4949
mov ebx, 1
jmp 0x4a4949
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x4a4949
xor ebx, ebx
mov eax, dword [ebp + 0xc]
and eax, 3
sub eax, 1
jb 0x4a495b
je 0x4a4964
dec eax
je 0x4a496d
jmp 0x4a4976
mov dword [ebp - 4], 0x80000000
jmp 0x4a4985
mov dword [ebp - 4], 0x40000000
jmp 0x4a4985
mov dword [ebp - 4], 0xc0000000
jmp 0x4a4985
push 1
call fcn.004a5a34
pop ecx
mov ebx, eax
jmp 0x4a4a71
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0x4a49a1
sub eax, 0x10
je 0x4a49a8
sub eax, 0x10
je 0x4a49b1
sub eax, 0x10
je 0x4a49ba
jmp 0x4a49ba
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x4a49c1
mov dword [ebp - 8], 1
jmp 0x4a49c1
mov dword [ebp - 8], 2
jmp 0x4a49c1
mov dword [ebp - 8], 3
mov dword [ebp - 0x14], 0xc
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
and eax, 0x80
cmp eax, 1
sbb edx, edx
neg edx
mov dword [ebp - 0xc], edx
push 0
push ebx
push edi
push ecx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
cmp eax, 0xffffffff
jne 0x4a4a2a
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
and ebx, 0xffff
cmp ebx, 0x6e
jne 0x4a4a1f
test byte [ebp + 0xd], 1
mov ebx, 0x50
jne 0x4a4a1f
add ebx, 0xffffffb2
push ebx
call fcn.004a5a34
pop ecx
mov ebx, eax
jmp 0x4a4a71
mov edi, esi
push edi
call fcn.004a47f4
pop ecx
test eax, eax
je 0x4a4a3e
or dword [ebp + 0xc], 0x2000
test bl, 1
jne 0x4a4a4a
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.004a5778
add esp, 8
mov ebx, eax
inc eax
jne 0x4a4a71
push 4
call fcn.004a5a34
pop ecx
push esi
call sub.KERNEL32.DLL_CloseHandle
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret