joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4339c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x5cc6c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
mov word [ebp - 8], ax
mov ecx, esi
push 0x1a
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 7
mov word [esi], ax
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x3c], 0x650072
mov dword [ebp - 0x38], 0x650063
mov dword [ebp - 0x34], 0x760069
mov dword [ebp - 0x30], 0x640065
mov dword [ebp - 0x2c], 0x710020
mov dword [ebp - 0x28], 0x690075
mov dword [ebp - 0x24], 0x2c0074
mov dword [ebp - 0x20], 0x650020
mov dword [ebp - 0x1c], 0x690078
mov dword [ebp - 0x18], 0x200074
mov dword [ebp - 0x14], 0x6f0063
mov dword [ebp - 0x10], 0x650064
mov dword [ebp - 0xc], 0x20003a
call fcn.00406a80
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004fa004
mov esp, ebp
pop ebp
ret 4

Function at 0x433a70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x64], 0x740068
push edi
mov dword [ebp - 0x60], 0x700074
mov dword [ebp - 0x5c], 0x2f003a
mov dword [ebp - 0x58], 0x61002f
mov dword [ebp - 0x54], 0x700070
mov dword [ebp - 0x50], 0x6c002e
mov dword [ebp - 0x4c], 0x640075
mov dword [ebp - 0x48], 0x730061
mov dword [ebp - 0x44], 0x690068
mov dword [ebp - 0x40], 0x63002e
mov dword [ebp - 0x3c], 0x6d006f
mov dword [ebp - 0x38], 0x61002f
mov dword [ebp - 0x34], 0x690070
mov dword [ebp - 0x30], 0x73002f
mov dword [ebp - 0x2c], 0x66006f
mov dword [ebp - 0x28], 0x770074
mov dword [ebp - 0x24], 0x720061
mov dword [ebp - 0x20], 0x2f0065
mov dword [ebp - 0x1c], 0x6f0063
mov dword [ebp - 0x18], 0x66006e
mov dword [ebp - 0x14], 0x670069
mov dword [ebp - 0x10], 0x70002f
mov dword [ebp - 0xc], 0x70006f
mov dword [ebp - 8], 0x320056
mov word [ebp - 4], ax
call fcn.004062e0
mov ecx, eax
test ecx, ecx
je 0x433b82
mov eax, dword [ecx]
push 2
push 0x30
call dword [eax]
test eax, eax
je 0x433b8c
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0x30
jl 0x433b78
mov dword [eax - 0xc], 0x30
xor eax, eax
mov ecx, dword [esi]
push 0x60
mov word [ecx + 0x60], ax
lea eax, [ebp - 0x64]
push eax
push 0x60
push dword [esi]
call fcn.00406ba0
add esp, 0x10
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.004061e0
push 0x80004005
call fcn.004061e0
call fcn.004069a0
int3
Function at 0x438840
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x5cc6c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
mov word [ebp - 8], ax
mov ecx, esi
push 0x2e
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 7
mov word [esi], ax
lea eax, [ebp - 0x64]
push eax
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x64], 0x6f006d
mov dword [ebp - 0x60], 0x730075
mov dword [ebp - 0x5c], 0x200065
mov dword [ebp - 0x58], 0x6f006e
mov dword [ebp - 0x54], 0x200074
mov dword [ebp - 0x50], 0x6e0069
mov dword [ebp - 0x4c], 0x630020
mov dword [ebp - 0x48], 0x720074
mov dword [ebp - 0x44], 0x2e006c
mov dword [ebp - 0x40], 0x690020
mov dword [ebp - 0x3c], 0x73006e
mov dword [ebp - 0x38], 0x610074
mov dword [ebp - 0x34], 0x6c006c
mov dword [ebp - 0x30], 0x6f0020
mov dword [ebp - 0x2c], 0x200072
mov dword [ebp - 0x28], 0x61006c
mov dword [ebp - 0x24], 0x75006e
mov dword [ebp - 0x20], 0x680063
mov dword [ebp - 0x1c], 0x700020
mov dword [ebp - 0x18], 0x730075
mov dword [ebp - 0x14], 0x200068
mov dword [ebp - 0x10], 0x700061
mov dword [ebp - 0xc], 0x2e0070
call fcn.00406a80
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004fa004
mov esp, ebp
pop ebp
ret 4

Function at 0x438930
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x5cc6c0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push 0xf
mov ecx, esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], 0x650072
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x20], 0x6f0063
mov dword [ebp - 0x1c], 0x70006d
mov dword [ebp - 0x18], 0x70006f
mov dword [ebp - 0x14], 0x6e0077
mov dword [ebp - 0x10], 0x2e0064
mov dword [ebp - 0xc], 0x6d0078
mov dword [ebp - 8], 0x6c
call fcn.00406a80
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004fa004
mov esp, ebp
pop ebp
ret 4
Function at 0x4391f0
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57021f
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x5cc6c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [ebp - 0x1c]
xorps xmm0, xmm0
push eax
movlpd qword [ebp - 0x1c], xmm0
call dword [sym.imp.USER32.dll_GetCursorPos]
push 0
push 0
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
call fcn.00482ae0
add esp, 8
lea ecx, [edi + 0x30]
push eax
call fcn.00488e00
mov ecx, edi
call fcn.00438dc0
push 0xffffffffffffffec
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
and eax, 0xfffbffff
or eax, 0x80
push eax
push 0xffffffffffffffec
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetWindowLongW]
lea eax, [ebp - 0x24]
mov ecx, edi
push eax
call fcn.00438bc0
movzx ecx, word [ebp - 0x20]
movzx eax, word [ebp - 0x24]
shl ecx, 0x10
or ecx, eax
push ecx
push 0
push 0x436
mov ecx, edi
call fcn.00494560
push 0
push 0xa4cb80
push 0x2716
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetTimer]
mov esi, dword [0x5d3cfc]
test esi, esi
jne 0x43931b
push 0x5cc04c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x5d3cfc], esi
jne 0x43930a
push 0x24
call fcn.004f9d2c
add esp, 4
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], esi
test eax, eax
je 0x4392f4
xorps xmm0, xmm0
mov ecx, eax
movups xmmword [eax], xmm0
movups xmmword [eax + 0x10], xmm0
mov dword [eax + 0x20], esi
call fcn.004213d0
jmp 0x4392f6
xor eax, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
xor edx, edx
lock or dword [ecx], edx
mov dword [0x5d3cfc], eax
push 0x5cc04c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [0x5d3cfc]
push 0
call fcn.005507b1
add esp, 4
mov ecx, esi
push eax
call fcn.00422490
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004fa004
mov esp, ebp
pop ebp
ret
Function at 0x43a740
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x570500
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x5cc6c0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, ecx
mov dword [ebp - 0x1c], eax
mov edi, dword [ebp + 0xc]
mov esi, edi
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
cmp dword [edi + 0x14], 8
mov ebx, dword [edi + 0x10]
mov dword [ebp - 4], 0
jb 0x43a793
mov esi, dword [edi]
lea eax, [ebx + ebx]
xor ecx, ecx
mov edx, 0x811c9dc5
test eax, eax
je 0x43a7b7
mov ebx, eax
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x43a7a3
mov ebx, dword [edi + 0x10]
mov ecx, dword [ebp - 0x1c]
mov esi, dword [ecx + 0x18]
mov eax, dword [ecx + 0xc]
and esi, edx
mov dword [ebp - 0x24], esi
lea edx, [eax + esi*8]
mov esi, dword [ecx + 4]
mov dword [ebp - 0x18], edx
cmp esi, dword [edx]
je 0x43a860
mov esi, dword [edx + 4]
mov esi, dword [esi]
nop dword [eax + eax]
cmp esi, dword [edx]
je 0x43a860
mov esi, dword [esi + 4]
cmp dword [esi + 0x1c], 8
lea eax, [esi + 8]
mov edx, dword [eax + 0x10]
jb 0x43a7f5
mov eax, dword [eax]
cmp dword [edi + 0x14], 8
mov ecx, edi
jb 0x43a7ff
mov ecx, dword [edi]
cmp ebx, edx
mov edx, dword [ebp - 0x18]
jne 0x43a7e0
push ebx
push eax
push ecx
call fcn.00440370
mov edx, dword [ebp - 0x18]
add esp, 0xc
test eax, eax
jne 0x43a7e0
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp - 0x1c]
push edi
mov ecx, dword [edi + 4]
mov eax, dword [edi]
mov dword [ecx], eax
mov edx, dword [edi]
mov ecx, dword [edi + 4]
mov dword [edx + 4], ecx
lea ecx, [ebx + 4]
dec dword [ebx + 8]
call fcn.00440150
mov eax, dword [ebp - 0x20]
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004fa004
mov esp, ebp
pop ebp
ret 0xc
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x18], edi
mov eax, dword [edi]
cmp esi, eax
je 0x43a88d
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
push dword [ebp - 0x24]
mov ebx, dword [ebp - 0x1c]
mov ecx, ebx
push esi
push edi
call fcn.00440270
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.00440000
mov eax, dword [ebp - 0x20]
mov dword [eax], edi
mov byte [eax + 4], 1
jmp 0x43a842
Function at 0x43a8e0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x570530
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x5cc6c0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, ecx
mov dword [ebp - 0x18], eax
mov edi, dword [ebp + 0xc]
mov esi, edi
mov dword [ebp - 4], 0
cmp dword [edi + 0x14], 8
mov ebx, dword [edi + 0x10]
jb 0x43a92a
mov esi, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
add ebx, ebx
je 0x43a949
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x43a935
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x18]
mov eax, dword [eax + 0xc]
and ecx, edx
mov esi, dword [ebp - 0x18]
mov dword [ebp - 0x24], ecx
lea edx, [eax + ecx*8]
mov esi, dword [esi + 4]
mov dword [ebp - 0x1c], edx
cmp dword [edx], esi
je 0x43a969
mov esi, dword [edx + 4]
mov esi, dword [esi]
mov ebx, dword [edi + 0x10]
nop dword [eax]
cmp esi, dword [edx]
je 0x43a9cf
mov esi, dword [esi + 4]
cmp dword [esi + 0x1c], 8
lea eax, [esi + 8]
mov edx, dword [eax + 0x10]
jb 0x43a985
mov eax, dword [eax]
cmp dword [edi + 0x14], 8
mov ecx, edi
jb 0x43a98f
mov ecx, dword [edi]
cmp ebx, edx
mov edx, dword [ebp - 0x1c]
jne 0x43a970
push ebx
push eax
push ecx
call fcn.00440370
mov edx, dword [ebp - 0x1c]
add esp, 0xc
test eax, eax
jne 0x43a970
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004fa004
mov esp, ebp
pop ebp
ret 0xc
mov ebx, dword [ebp - 0x18]
push edi
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
mov ecx, dword [eax + 4]
push ecx
mov dword [ebp - 0x20], ecx
lea ecx, [ebx + 4]
push eax
call fcn.0043a410
mov edx, eax
mov ecx, 0x71c71c6
mov eax, dword [ebx + 8]
sub ecx, eax
cmp ecx, 1
jb 0x43aa93
inc eax
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0x1c]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x20]
mov dword [eax], edx
mov edi, dword [ebx + 4]
mov edi, dword [edi]
mov dword [ebp - 0x20], edi
mov eax, dword [edi]
cmp esi, eax
je 0x43aa45
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
push dword [ebp - 0x24]
mov ecx, ebx
push esi
push edi
call fcn.00440270
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.00440000
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
jmp 0x43a9b1
push str.list_T__too_long
call fcn.00460650
int3
Function at 0x43afe0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x1c], 8
push ebx
mov ebx, dword [eax + 0x18]
push esi
lea esi, [eax + 8]
mov dword [ebp - 4], ecx
push edi
jb 0x43b003
mov esi, dword [esi]
xor edx, edx
mov edi, 0x811c9dc5
add ebx, ebx
je 0x43b021
nop
movzx ecx, byte [edx + esi]
inc edx
xor ecx, edi
imul edi, ecx, 0x1000193
cmp edx, ebx
jb 0x43b010
mov ebx, dword [ebp - 4]
mov ecx, dword [ebx + 0x18]
mov edx, dword [ebx + 0xc]
and ecx, edi
lea esi, [ecx*8]
mov ecx, dword [edx + esi]
add edx, esi
cmp dword [edx + 4], eax
jne 0x43b05a
cmp ecx, eax
jne 0x43b052
mov ecx, dword [ebx + 4]
mov dword [edx], ecx
mov edx, dword [ebx + 0xc]
mov ecx, dword [ebx + 4]
mov dword [esi + edx + 4], ecx
jmp 0x43b062
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
jmp 0x43b062
cmp ecx, eax
jne 0x43b062
mov ecx, dword [eax]
mov dword [edx], ecx
mov edx, dword [eax + 4]
lea ecx, [ebx + 4]
mov edi, dword [eax]
push eax
mov dword [edx], edi
mov esi, dword [eax]
mov edx, dword [eax + 4]
mov dword [esi + 4], edx
dec dword [ecx + 4]
call fcn.00440150
mov eax, dword [ebp - 8]
mov dword [eax], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x43e890
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x570d14
mov eax, dword fs:[0]
push eax
sub esp, 0x43c
mov eax, dword [0x5cc6c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x444], ecx
xorps xmm0, xmm0
mov dword [ebp - 0x438], 0
movq qword [ebp - 0x440], xmm0
mov dword [ebp - 0x440], 0
mov dword [ebp - 0x43c], 0
mov dword [ebp - 0x438], 0
push 0x20019
push str.ExtensionsContractIdWindows.ProtocolPackageId
push SysReAllocString
lea ecx, [ebp - 0x440]
mov dword [ebp - 4], 0
call fcn.00412e10
mov edi, dword [ebp - 0x440]
test eax, eax
jne 0x43eaac
push 0x2c
call fcn.004f9d2c
mov ebx, eax
add esp, 4
mov dword [ebp - 0x424], ebx
mov byte [ebp - 4], 1
test ebx, ebx
je 0x43e9b0
lea edi, [ebx + 0xc]
mov dword [ebx + 4], 1
mov dword [ebx + 8], 1
lea ecx, [edi + 4]
mov dword [ebx], 0x583b58
push 0
mov dword [edi], 0
push 0
mov dword [ebp - 0x448], edi
mov dword [edi + 4], 0
mov dword [edi + 8], 0
call fcn.0042b4a0
mov dword [edi + 4], eax
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
push 8
mov ecx, edi
mov byte [ebp - 4], 3
mov dword [edi], 0x3f800000
call fcn.00422610
mov edi, dword [ebp - 0x440]
jmp 0x43e9b2
xor ebx, ebx
xorps xmm0, xmm0
lea eax, [ebx + 0xc]
movlpd qword [ebp - 0x42c], xmm0
mov dword [ebp - 0x42c], eax
mov dword [ebp - 0x428], ebx
mov byte [ebp - 4], 4
xor esi, esi
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.0053efc0
add esp, 0xc
mov dword [ebp - 0x424], 0x104
lea eax, [ebp - 0x434]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x218]
push eax
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x43ea87
push 0x208
push eax
lea eax, [ebp - 0x420]
push eax
call fcn.0053efc0
lea eax, [ebp - 0x218]
push eax
push str.ExtensionsContractIdWindows.ProtocolPackageId
push str._s_sActivatableClassId
lea eax, [ebp - 0x420]
push 0x104
push eax
call fcn.004407c0
add esp, 0x18
mov eax, esp
mov dword [eax], 0
mov dword [eax + 4], 0
test ebx, ebx
je 0x43ea67
lock inc dword [ebx + 4]
lea ecx, [ebx + 0xc]
mov dword [eax + 4], ebx
mov dword [eax], ecx
lea eax, [ebp - 0x420]
mov ecx, dword [ebp - 0x444]
push eax
call fcn.0043da10
inc esi
jmp 0x43e9d2
test ebx, ebx
je 0x43eaac
or esi, 0xffffffff
mov eax, esi
lock xadd dword [ebx + 4], eax
jne 0x43eaac
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax]
lock xadd dword [ebx + 8], esi
dec esi
jne 0x43eaac
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 4]
test edi, edi
je 0x43eab7
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004fa004
mov esp, ebp
pop ebp
ret
Function at 0x440c50
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x10
movaps xmm0, xmmword [0x583e30]
push esi
push edi
push 0
sub esp, 0x10
mov edi, ecx
mov dword [edi + 0x318], eax
mov eax, esp
push 0
push 0x86000000
push 0x583dc4
push 0
movups xmmword [eax], xmm0
call fcn.00494080
push 0x6b
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.USER32.dll_LoadIconW]
mov esi, eax
test esi, esi
je 0x440cb6
push esi
push 1
push 0x80
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
push esi
call dword [sym.imp.USER32.dll_DestroyIcon]
push 1
push ecx
mov dword [esp], 0x3f800000
lea eax, [ebp - 0x10]
push 0x190
push 0x2d0
push eax
call fcn.0041a130
add esp, 0x14
movups xmm1, xmmword [eax]
push 0x15
push 0xffffffffffffffff
movaps xmm0, xmm1
psrldq xmm0, 4
push 0xffffffffffffffff
movd eax, xmm0
push eax
movd eax, xmm1
push eax
push 0
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetWindowPos]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x440d10
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x570fc0
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x5cc6c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebp + 8]
mov dword [ebx + 0x31c], eax
test eax, eax
je 0x440d5c
mov ecx, dword [ebx + 0x330]
push 0x64
call fcn.0049ca20
jmp 0x440ef2
mov ecx, dword [ebx + 0x328]
push 0x583dd8
mov eax, dword [ecx]
call dword [eax + 0x30]
mov ecx, dword [ebx + 0x328]
push 0xffef3737
call fcn.00497490
mov ecx, dword [ebx + 0x32c]
push 1
mov eax, dword [ecx]
call dword [eax + 0x114]
mov ecx, dword [ebx + 0x330]
call fcn.0049c5b0
mov ecx, dword [ebx + 0x330]
mov esi, eax
push str.loadingprogress_retry_down.png
call fcn.0049c9e0
mov ecx, dword [ebx + 0x330]
push esi
call fcn.0049ca20
mov ecx, dword [ebx + 0x334]
push 1
mov eax, dword [ecx]
call dword [eax + 0x114]
push 0x30
lea eax, [ebp - 0x58]
push 0
push eax
call fcn.0053efc0
add esp, 0xc
lea ecx, [ebp - 0x58]
call fcn.0046b380
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edx, eax
mov dword [ebp - 0x60], 0
mov ecx, edx
mov dword [ebp - 0x5c], 7
xor eax, eax
mov word [ebp - 0x70], ax
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x440e05
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x70]
call fcn.00406a80
lea eax, [ebp - 0x70]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x58]
call fcn.0046bc10
lea ecx, [ebp - 0x70]
call fcn.00406060
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
push 4
push str.show
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 2
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], 7
mov word [ebp - 0x70], ax
call fcn.00406a80
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x58]
call fcn.0046ba20
lea ecx, [ebp - 0x70]
call fcn.00406060
cmp dword [ebp - 0x14], 8
lea edi, [ebp - 0x28]
cmovae edi, dword [ebp - 0x28]
cmp dword [ebp - 0x18], 1
jne 0x440ee2
movzx ecx, word [edi]
mov esi, 0x32
mov edx, 1
mov eax, 0x583e28
cmp ecx, esi
jb 0x440ee2
sub edi, eax
cmp cx, si
ja 0x440ee2
cmp edx, 1
je 0x440ecd
movzx ecx, word [edi + eax + 2]
add eax, 2
dec edx
movzx esi, word [eax]
cmp cx, si
jae 0x440eb3
jmp 0x440ee2
push 0
push 0
push 0x42a
push dword [ebx + 0x318]
call dword [sym.imp.USER32.dll_PostMessageW]
lea ecx, [ebp - 0x28]
call fcn.00406060
lea ecx, [ebp - 0x58]
call fcn.0046b4f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004fa004
mov esp, ebp
pop ebp
ret 4
Function at 0x441c50
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, edi
mov dword [ebp - 4], ecx
cmp dword [edi + 0x14], 8
mov eax, dword [edi + 0x10]
jb 0x441c6c
mov esi, dword [edi]
lea ebx, [eax + eax]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x441c91
nop word [eax + eax]
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x441c80
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0xc]
and eax, edx
mov ebx, dword [ebx + 4]
mov edx, dword [ecx + eax*8]
lea eax, [eax*8 + 4]
add eax, ecx
mov dword [ebp - 8], edx
mov esi, edx
mov dword [ebp - 0xc], eax
cmp edx, ebx
jne 0x441cbb
mov eax, ebx
jmp 0x441cbf
mov eax, dword [eax]
mov eax, dword [eax]
cmp esi, eax
je 0x441d32
cmp dword [edi + 0x14], 8
lea eax, [esi + 8]
mov ecx, edi
jb 0x441cd0
mov ecx, dword [edi]
mov edi, dword [eax + 0x14]
cmp edi, 8
mov edx, dword [eax + 0x10]
mov dword [ebp - 0x10], edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x14], edx
jb 0x441ce6
mov eax, dword [eax]
push dword [edi + 0x10]
push ecx
push edx
push eax
call fcn.00441c00
add esp, 0x10
test al, al
jne 0x441d02
mov esi, dword [esi]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
jmp 0x441cb3
cmp dword [ebp - 0x10], 8
lea eax, [esi + 8]
jb 0x441d0d
mov eax, dword [eax]
cmp dword [edi + 0x14], 8
mov ecx, edi
jb 0x441d17
mov ecx, dword [edi]
push dword [ebp - 0x14]
push eax
push dword [edi + 0x10]
push ecx
call fcn.00441c00
add esp, 0x10
mov ecx, ebx
test al, al
cmovne ecx, esi
mov eax, ecx
jmp 0x441d36
mov ecx, ebx
mov eax, ebx
cmp eax, ebx
jne 0x441d96
mov esi, dword [ebx]
lea eax, [ebp + 0xf]
mov ebx, dword [ebp - 4]
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], edi
mov edi, dword [esi + 4]
push eax
push 0x580ff0
push edi
push esi
lea ecx, [ebx + 4]
call fcn.00441330
mov edx, eax
mov ecx, 0x38e38e2
mov eax, dword [ebx + 8]
sub ecx, eax
cmp ecx, 1
jb 0x441da8
inc eax
mov ecx, ebx
mov dword [ebx + 8], eax
mov dword [esi + 4], edx
mov esi, dword [ebp + 8]
mov dword [edi], edx
mov eax, dword [ebx + 4]
mov eax, dword [eax]
push eax
add eax, 8
push eax
push esi
call fcn.00441490
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [eax], ecx
mov byte [eax + 4], 0
mov esp, ebp
pop ebp
ret 8
push str.list_T__too_long
call fcn.00460650
int3
Function at 0x441dc0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
cmp dword [edi + 0x1c], 8
lea esi, [edi + 8]
mov ebx, dword [edi + 0x18]
jb 0x441de4
mov esi, dword [edi + 8]
xor ecx, ecx
mov edx, 0x811c9dc5
add ebx, ebx
je 0x441e01
nop
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x441df0
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0xc]
and eax, edx
lea edx, [eax*8]
mov eax, dword [ecx + edx]
add ecx, edx
cmp dword [ecx + 4], edi
jne 0x441e3a
cmp eax, edi
jne 0x441e32
mov eax, dword [ebx + 4]
mov dword [ecx], eax
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 4]
mov dword [edx + ecx + 4], eax
jmp 0x441e42
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x441e42
cmp eax, edi
jne 0x441e42
mov eax, dword [edi]
mov dword [ecx], eax
mov eax, dword [edi + 4]
lea ecx, [edi + 8]
mov esi, dword [edi]
mov dword [eax], esi
mov edx, dword [edi]
mov eax, dword [edi + 4]
mov dword [edx + 4], eax
dec dword [ebx + 8]
call fcn.00442270
push 0x48
push edi
call fcn.004f9d5c
mov eax, dword [ebp - 8]
add esp, 8
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8