joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1372437
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x1372405
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
add byte [eax], al
pushal
jmp 0x1372423
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
mov ch, 0x54
invalid
invalid
invalid
cmp eax, dword [ebp - 0x44]
ja 0x1372481
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x1372468
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x1372471
or byte [eax + ecx], 2
or al, 8
add bh, byte [ecx]
pop ebp
adc byte [ebp + eax + 3], dh
enter 0x980, 4
cmp dword [ebp + 0x10], ebx
je 0x137247b
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x137245d
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x13723e7
mov dword [ebp + 8], esi
xor edi, edi

Function at 0x137246e
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x1372405
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
add byte [eax], al
pushal
jmp 0x1372423
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
mov ch, 0x54
invalid
invalid
invalid
cmp eax, dword [ebp - 0x44]
ja 0x1372481
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x1372468
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x1372471
or byte [eax + ecx], 2
or al, 8
add bh, byte [ecx]
pop ebp
adc byte [ebp + eax + 3], dh
enter 0x980, 4
cmp dword [ebp + 0x10], ebx
je 0x137247b
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x137245d
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x13723e7
mov dword [ebp + 8], esi
xor edi, edi
Function at 0x137f736
Capabilities:
Delete registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ecx + 0xc], esi
jne 0x137f74a
mov esi, 0x8007000d
jmp 0x137f771
push dword [ecx + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jle 0x137f764
and eax, 0xffff
or eax, 0x80070000
cmp eax, 0x80070002
je 0x137f796
mov esi, eax
test eax, eax
jge 0x137f796
mov eax, dword [0x1426c54]
cmp eax, 0x1426c54
je 0x137f796
test byte [eax + 0x1c], 2
je 0x137f796
push esi
push 0x102fad4
push 0xe
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01043c41
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x13807a3
Capabilities:
Delete registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
push 0
mov esi, ecx
call fcn.0135e32f
push dword [esi + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea ecx, [ebp - 4]
call fcn.01045411
xor eax, eax
pop esi
leave
ret 4
Function at 0x13c0ec0
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], edi
cmp dword [ebp + 8], edi
jne 0x13c0ed9
mov esi, 0x80070057
jmp 0x13c0f0e
cmp dword [ebp + 0xc], edi
je 0x13c0ed2
cmp dword [ebp + 0x10], edi
je 0x13c0ed2
cmp dword [ebp + 0x14], edi
je 0x13c0ed2
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 3
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push eax
call fcn.01044c5f
mov esi, dword [ebp - 4]
cmp esi, edi
jge 0x13c0f33
mov eax, dword [0x1426c54]
cmp eax, 0x1426c54
je 0x13c0f33
test byte [eax + 0x1c], 2
je 0x13c0f33
push esi
push 0x103a09c
push 0x13
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01043c41
pop edi
mov eax, esi
pop esi
leave
ret 0x10

Function at 0x13c0fad
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
lea eax, [ebp - 0xc]
push eax
xor edi, edi
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp - 0x10]
push eax
push edi
push dword [ebp + 0xc]
mov dword [ebp - 0xc], edi
push dword [ebp + 8]
mov dword [ebp - 4], edi
call esi
push eax
call fcn.01044c5f
test eax, eax
je 0x13c1046
cmp dword [ebp - 0x10], 3
je 0x13c0ff3
mov esi, 0x8000ffff
jmp 0x13c104d
push dword [ebp - 8]
call fcn.0104309c
lea ecx, [ebp - 4]
mov ebx, eax
call fcn.0104572b
cmp ebx, edi
jne 0x13c1013
mov dword [ebp - 4], edi
mov esi, 0x8007000e
jmp 0x13c104d
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push ebx
lea eax, [ebp - 0x10]
push eax
push edi
push dword [ebp + 0xc]
mov dword [ebp - 4], ebx
push dword [ebp + 8]
call esi
push eax
call fcn.01044c5f
test eax, eax
je 0x13c1046
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 8]
mov dword [eax], ebx
mov eax, dword [ebp + 0x14]
mov dword [ebp - 4], edi
mov dword [eax], ecx
mov esi, dword [ebp - 0xc]
cmp esi, edi
jge 0x13c1072
mov eax, dword [0x1426c54]
cmp eax, 0x1426c54
je 0x13c1072
test byte [eax + 0x1c], 2
je 0x13c1072
push esi
push 0x103a0ac
push 0xd
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01043c41
lea ecx, [ebp - 4]
call fcn.0104572b
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x10
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
nop
pop eax
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x5dcbd3
Capabilities:
Encode data using xor

Disassembly:
nop
adc esp, ecx
rcl byte [edx]
mov edx, 0xe01ae265
fmul qword [ebx + ebx]
sti
in eax, 0xfe
lodsd eax, dword [esi]
xor eax, 0x7f9c07de
into
sbb ch, dh
test esi, edx
pop ds
or byte [eax - 0x53], 0x44
call 0x1b6f788f
enter 0xfffffffffffff25b, 0xffffffffffffff95
pop ebx
xchg ebp, eax
mov al, byte [0x2303b2dd]
cmovge ebx, dword [ecx]
jg 0x5dcbae
pop ss
sbb edi, ebx
nop
shl dword [esi - 0xb53c4e2], cl
pop edx
rcr byte [eax + edi*2 - 0x5b], cl
xor al, 0xa7
xor eax, 0x7e1b17e6
and eax, 0xecec9411
cmpsd dword ss:[esi], dword es:[edi]
stc
in eax, 0x17
sbb esi, dword [esi - 0x13]
or bl, byte [eax]
js 0x5dcbd4
pop ss
sbb edi, ebx
pop edx
ror byte [eax + 0x7e], cl
and eax, 0xddb4c239
mov edx, dword [eax]
sti
in eax, 0x17
rcl byte [edx - 0x6d14cade]
sbb byte [edx - 0x5923c3d0], al
ret 0xddb4
Function at 0x401300
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], ecx
xor eax, eax
jne 0x401309
mov dword [ebp - 4], 0
push 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x40133e
call fcn.00406ae0
jmp 0x401354
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0xc]
je 0x401352
push 0x26
call fcn.00406aa0
add esp, 4
jmp 0x401354
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x404da0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x404dc4
xor eax, eax
jmp 0x404e44
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x404ddb
xor eax, eax
jmp 0x404e44
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 0x10]
and eax, 0xf
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x404e27
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jae 0x404e27
mov edx, dword [ebp - 4]
movzx eax, word [edx]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax*2 + 2]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
jmp 0x404dfe
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jb 0x404e33
xor eax, eax
jmp 0x404e44
mov edx, dword [ebp - 4]
movzx eax, word [edx]
test eax, eax
jne 0x404e41
xor eax, eax
jmp 0x404e44
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x405540
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
xor eax, eax
jne 0x405549
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
shl edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40558c
mov eax, dword [ebp - 8]
jmp 0x4055f2
cmp dword [ebp - 0xc], 1
je 0x40559f
cmp dword [ebp - 0xc], 2
je 0x40559f
mov eax, 0xd
jmp 0x4055f2
cmp dword [ebp + 0xc], 0
je 0x4055e6
cmp dword [ebp - 4], 0
je 0x4055d5
mov eax, dword [ebp - 4]
xor edx, edx
mov ecx, 2
div ecx
test edx, edx
jne 0x4055cc
mov edx, dword [ebp - 4]
shr edx, 1
mov eax, dword [ebp + 0xc]
movzx ecx, word [eax + edx*2 - 2]
test ecx, ecx
je 0x4055d3
mov eax, 0xd
jmp 0x4055f2
jmp 0x4055e6
mov edx, 2
imul eax, edx, 0
xor ecx, ecx
mov edx, dword [ebp + 0xc]
mov word [edx + eax], cx
mov eax, dword [ebp - 4]
shr eax, 1
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
Function at 0x407340
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2ef4
call fcn.004d2a50
mov eax, dword [0x550070]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x2eec], 1
mov eax, dword [ebp + 8]
push eax
push str.SYSTEMCurrentControlSetControlNetwork4D36E972_E325_11CE_BFC1_08002BE10318_sConnection
push 0x7d0
lea ecx, [ebp - 0x7d4]
push ecx
call fcn.00408000
add esp, 0x10
lea edx, [ebp - 0x2ee8]
push edx
push 0x20119
push 0
lea eax, [ebp - 0x7d4]
push eax
push reloc.upgrade.dll_Ordinal_2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4073a9
mov eax, 2
jmp 0x407417
mov dword [ebp - 0x2ef0], 0x2710
lea ecx, [ebp - 0x2ef0]
push ecx
lea edx, [ebp - 0x2ee4]
push edx
lea eax, [ebp - 0x2ef4]
push eax
push 0
push str.PnpInstanceID
mov ecx, dword [ebp - 0x2ee8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x407404
push 4
push str.pci_
lea edx, [ebp - 0x2ee4]
push edx
call fcn.004e97a6
add esp, 0xc
test eax, eax
jne 0x407404
mov dword [ebp - 0x2eec], 0
mov eax, dword [ebp - 0x2ee8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x2eec]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d181f
mov esp, ebp
pop ebp
ret
Function at 0x407c50
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push 0
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
cmp eax, 0x6f
je 0x407c7c
mov al, 1
jmp 0x407ce8
mov ecx, dword [ebp - 8]
push ecx
call fcn.004dbe8c
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x407c95
mov al, 3
jmp 0x407ce8
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
je 0x407cb7
mov ecx, dword [ebp - 4]
push ecx
call fcn.004d72c8
add esp, 4
mov al, 4
jmp 0x407ce8
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x190]
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x194
push ecx
mov edx, dword [ebp - 0xc]
add edx, 0x18
push edx
call fcn.00409230
add esp, 0xc
mov eax, dword [ebp - 4]
push eax
call fcn.004d72c8
add esp, 4
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x4080b0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax + 0x40], 0
mov dword [eax + 0x44], 0
mov ecx, 4
imul edx, ecx, 0
mov eax, dword [ebp + 8]
mov dword [eax + edx + 0x48], 0x67452301
mov ecx, 4
shl ecx, 0
mov edx, dword [ebp + 8]
mov dword [edx + ecx + 0x48], 0xefcdab89
mov eax, 4
shl eax, 1
mov ecx, dword [ebp + 8]
mov dword [ecx + eax + 0x48], 0x98badcfe
mov edx, 4
imul eax, edx, 3
mov ecx, dword [ebp + 8]
mov dword [ecx + eax + 0x48], 0x10325476
pop ebp
ret
Function at 0x40af80
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x40afb4
mov dword [ebp - 4], 0
jmp 0x40afcd
cmp dword [ebp - 8], 0xea
jne 0x40afc6
mov dword [ebp - 4], 0xffffffe4
jmp 0x40afcd
mov dword [ebp - 4], 0xfffffff2
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x40d360
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x14]
push ecx
push 0x20119
push 0
mov edx, dword [ebp + 8]
push edx
push reloc.upgrade.dll_Ordinal_2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40d397
mov eax, dword [ebp - 8]
jmp 0x40d46a
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0x1c]
push edx
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x40d45d
cmp dword [ebp - 0x1c], 1
je 0x40d3cd
mov dword [ebp - 8], 0xd
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
add eax, 2
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0xc]
mov dx, word [ecx]
mov word [ebp - 2], dx
add dword [ebp - 0xc], 2
cmp word [ebp - 2], 0
jne 0x40d3dc
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x20]
sar eax, 1
mov dword [ebp - 0x24], eax
jne 0x40d407
mov dword [ebp - 8], 0xd
jmp 0x40d45d
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
add edx, 2
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x10]
mov cx, word [eax]
mov word [ebp - 4], cx
add dword [ebp - 0x10], 2
cmp word [ebp - 4], 0
jne 0x40d416
mov edx, dword [ebp - 0x10]
sub edx, dword [ebp - 0x28]
sar edx, 1
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp + 0x10]
movzx edx, word [ecx + eax*2 - 2]
cmp edx, 0x5c
je 0x40d45d
push 0x526678
mov eax, dword [ebp + 0x14]
shr eax, 1
push eax
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.004dcbf6
add esp, 0xc
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x430e40
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0
je 0x430e5c
mov eax, dword [ebp - 4]
sub eax, 0x380
mov dword [ebp - 0x18], eax
jmp 0x430e63
mov dword [ebp - 0x18], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0xc], ecx
push 4
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.USER32.dll_GetWindow]
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x10], 0
push 1
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x430fc7
cmp dword [ebp - 0x14], 0
je 0x430f0a
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
add eax, 0x1c
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x430f0a
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp - 4]
mov edx, dword [eax]
mov ecx, dword [ebp - 4]
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x24], 0
jne 0x430f08
mov dword [ebp - 0x14], 0
jmp 0x430eb9
push 0
push 0
push 0
mov edx, dword [ebp - 4]
add edx, 0x1c
push edx
call dword [sym.imp.USER32.dll_GetMessageW]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffff
jne 0x430f2d
jmp 0x430ea4
cmp dword [ebp - 0x1c], 0
jne 0x430f38
jmp 0x430fc7
mov eax, dword [ebp - 4]
cmp dword [eax + 0x20], 0x10
jne 0x430f65
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov eax, dword [ecx + 0x1c]
cmp eax, dword [edx + 4]
jne 0x430f65
push 1
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.USER32.dll_EnableWindow]
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [ebp - 4]
add eax, 0x1c
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov ecx, dword [ebp - 4]
mov eax, dword [edx]
call eax
test eax, eax
jne 0x430f96
mov ecx, dword [ebp - 4]
add ecx, 0x1c
push ecx
call dword [sym.imp.USER32.dll_TranslateMessage]
mov edx, dword [ebp - 4]
add edx, 0x1c
push edx
call dword [sym.imp.USER32.dll_DispatchMessageW]
mov eax, dword [ebp - 4]
cmp dword [eax + 0x20], 0x12
jne 0x430fa1
jmp 0x430fc7
mov ecx, dword [ebp - 4]
add ecx, 0x1c
push ecx
call fcn.00432cd0
add esp, 4
test eax, eax
je 0x430fc2
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x10], 0
jmp 0x430ea4
push 1
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.USER32.dll_EnableWindow]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x20], 0x12
jne 0x430ff3
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x24]
push eax
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x435390
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], ecx
push 0
mov ecx, dword [ebp - 4]
call fcn.00438110
push 1
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x3b4]
call dword [sym.imp.DuiLib.dll_public:_class_DuiLib::CListHeaderUI____thiscall_DuiLib::CVListUI::GetHeader_void_const]
mov ecx, eax
call dword [sym.imp.DuiLib.dll_public:_int___thiscall_DuiLib::CListHeaderUI::SetSortColumn_int_]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x3a8]
or edx, 1
mov eax, dword [ebp - 4]
mov dword [eax + 0x3a8], edx
mov ecx, dword [ebp - 4]
call fcn.00436840
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x3d0]
call fcn.00433bb0
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0x3b4]
call dword [sym.imp.DuiLib.dll_public:_class_DuiLib::CListHeaderUI____thiscall_DuiLib::CVListUI::GetHeader_void_const]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x435423
mov ecx, dword [ebp - 8]
call dword [sym.imp.DuiLib.dll_public:_int___thiscall_DuiLib::CListHeaderUI::GetSortColumn_void_]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x3d8], eax
mov ecx, dword [ebp - 8]
call dword [sym.imp.DuiLib.dll_public:_int___thiscall_DuiLib::CListHeaderUI::IsSortAsc_void_]
mov edx, dword [ebp - 4]
mov dword [edx + 0x3dc], eax
push 0
push 0
mov eax, dword [ebp - 4]
push eax
push 0x435360
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x43544d
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret 4
Function at 0x438ca0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov eax, dword [ebp + 0xc]
push eax
push 0x516600
mov ecx, dword [ebp + 0x10]
push ecx
push 0x516608
mov edx, dword [ebp + 0x14]
push edx
push 0x51660c
push 0x516610
call dword [sym.imp.jansson.dll_json_pack]
add esp, 0x1c
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x438cf4
xor eax, eax
jmp 0x438e61
push 0x24
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.jansson.dll_json_dumps]
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x438d1f
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00419ed0
add esp, 4
xor eax, eax
jmp 0x438e61
push 0x516620
mov edx, dword [ebp + 8]
push edx
call fcn.004dd95f
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x438d59
mov eax, dword [ebp - 0xc]
push eax
call fcn.00419ed0
add esp, 4
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.jansson.dll_json_dumps_free]
add esp, 4
xor eax, eax
jmp 0x438e61
mov edx, dword [ebp - 0x10]
push edx
push 3
push 1
push 0x516628
call fcn.004ddbae
add esp, 0x10
cmp eax, 3
je 0x438d9f
mov eax, dword [ebp - 0xc]
push eax
call fcn.00419ed0
add esp, 4
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.jansson.dll_json_dumps_free]
add esp, 4
mov edx, dword [ebp - 0x10]
push edx
call fcn.004ddc7c
add esp, 4
xor eax, eax
jmp 0x438e61
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x14]
mov al, byte [edx]
mov byte [ebp - 1], al
add dword [ebp - 0x14], 1
cmp byte [ebp - 1], 0
jne 0x438dae
mov ecx, dword [ebp - 0x14]
sub ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 8]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
add eax, 1
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x18]
mov dl, byte [ecx]
mov byte [ebp - 2], dl
add dword [ebp - 0x18], 1
cmp byte [ebp - 2], 0
jne 0x438dd8
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x24]
push edx
push 1
mov eax, dword [ebp - 8]
push eax
call fcn.004ddbae
add esp, 0x10
cmp eax, dword [ebp - 0x28]
je 0x438e37
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00419ed0
add esp, 4
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.jansson.dll_json_dumps_free]
add esp, 4
mov eax, dword [ebp - 0x10]
push eax
call fcn.004ddc7c
add esp, 4
xor eax, eax
jmp 0x438e61
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00419ed0
add esp, 4
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.jansson.dll_json_dumps_free]
add esp, 4
mov eax, dword [ebp - 0x10]
push eax
call fcn.004ddc7c
add esp, 4
mov eax, 1
mov esp, ebp
pop ebp
ret