joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4383d4
Capabilities:
Hide graphical window

Disassembly:
pop ebp
ret 8
push ebp
mov ebp, esp
sub esp, 0xc
push 0
push 0
call sub.user32.dll_ShowWindow
or eax, eax
je 0x4383f2
leave
ret
mov esp, ebp
jmp 0x437e58
Function at 0x10004400
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x10004461
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x10004444
cmp edi, 2
jb 0x10004444
cmp byte [esi], cl
jne 0x10004444
cmp byte [esi + 1], cl
jne 0x10004444
mov eax, ebx
movzx ecx, cl
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10058738]
jmp 0x10004415
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10058738]
test edi, edi
jne 0x10004415
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x10004490
cmp cl, 0x23
jne 0x10004477
cmp byte [esi], cl
jne 0x10004477
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x10058738]
test cl, cl
jne 0x10004468
pop edi
pop esi
not eax
pop ebx
pop ebp
ret

Function at 0x10004630
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
jne 0x10004655
push 0x736
push str.D:MyFilesDLLDLL_WITH_HWID_MADNESS1ImGui_StandaloneImGuiimgui.cpp
push str.filename__mode
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
mov edi, dword [ebp + 8]
test edi, edi
je 0x10004662
mov dword [edi], 0
mov edx, 0x10061b78
mov ecx, esi
call fcn.100044a0
mov esi, eax
test esi, esi
je 0x10004752
mov ebx, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
push esi
call ebx
add esp, 4
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x10004748
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x10004748
push esi
call ebx
mov ebx, eax
add esp, 4
mov dword [ebp + 8], ebx
cmp ebx, 0xffffffff
je 0x10004748
push 0
push dword [ebp - 4]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x10004748
mov eax, dword [0x1007169c]
test eax, eax
je 0x100046dc
inc dword [eax + 0xb0]
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x10004748
push esi
push dword [ebp + 8]
push 1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
push esi
cmp eax, dword [ebp + 8]
je 0x1000472d
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, dword [0x1007169c]
add esp, 4
test eax, eax
je 0x1000471a
dec dword [eax + 0xb0]
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
test edi, edi
je 0x1000473f
mov eax, dword [ebp + 8]
mov dword [edi], eax
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10006c00
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1006b00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
push esi
push edi
mov edi, dword [ebp + 8]
cmp dword [ebx + 0xfc], 0
mov dword [ebp - 8], edi
jg 0x10006c3c
push 0x756
push str.D:MyFilesDLLDLL_WITH_HWID_MADNESS1ImGui_StandaloneImGuiimgui.h
push str.Size___0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
mov eax, dword [ebx + 0xfc]
lea edx, [ebp - 8]
mov ebx, dword [ebx + 0x104]
mov esi, 4
mov ebx, dword [ebx + eax*4 - 4]
not ebx
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x10058738]
sub esi, 1
jne 0x10006c56
mov eax, dword [0x1007169c]
not ebx
cmp dword [eax + 0x3f28], ebx
jne 0x10006c8e
push ecx
push edi
lea edx, [esi + 4]
mov ecx, ebx
call fcn.10029520
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10055554
mov esp, ebp
pop ebp
ret 4
Function at 0x1001b590
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
cmp dword [edi + 0x53b8], 0
lea esi, [edi + 0x53bc]
je 0x1001b612
mov ecx, dword [esi + 4]
test ecx, ecx
jns 0x1001b5cc
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, esi
call fcn.1002a840
push dword [ebp + 8]
mov ecx, esi
mov dword [esi], 0
push ebx
call fcn.10004ca0
mov edx, dword [esi]
mov ecx, 0x10071576
push dword [edi + 0x53b8]
lea eax, [edx - 1]
neg edx
sbb edx, edx
and edx, eax
mov eax, dword [edi + 0x53c4]
test eax, eax
push edx
cmovne ecx, eax
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 8]
mov ecx, esi
push ebx
call fcn.10004ca0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1001bae0
Capabilities:
Hash data with crc32

Disassembly:
push esi
push edi
mov edi, ecx
or ecx, 0xffffffff
mov al, byte [edi]
lea esi, [edi + 1]
test al, al
je 0x1001bb1c
push ebx
or ebx, 0xffffffff
cmp al, 0x23
jne 0x1001bb02
cmp byte [esi], al
jne 0x1001bb02
cmp byte [esi + 1], al
cmove ecx, ebx
movzx edx, cl
movzx eax, al
xor edx, eax
shr ecx, 8
mov al, byte [esi]
inc esi
xor ecx, dword [edx*4 + 0x10058738]
test al, al
jne 0x1001baf4
pop ebx
not ecx
call fcn.1001ba20
test eax, eax
jne 0x1001bb30
mov ecx, edi
pop edi
pop esi
jmp fcn.1001b940
pop edi
pop esi
ret

Function at 0x1001bb40
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x1007169c]
lea edx, [ecx + 1]
push ebx
mov dword [ebp - 4], eax
or ebx, 0xffffffff
mov al, byte [ecx]
push esi
push edi
test al, al
je 0x1001bb87
or esi, 0xffffffff
nop
cmp al, 0x23
jne 0x1001bb6e
cmp byte [edx], al
jne 0x1001bb6e
cmp byte [edx + 1], al
cmove ebx, esi
movzx ecx, bl
movzx eax, al
xor ecx, eax
shr ebx, 8
mov al, byte [edx]
inc edx
xor ebx, dword [ecx*4 + 0x10058738]
test al, al
jne 0x1001bb60
mov ecx, dword [ebp - 4]
xor esi, esi
not ebx
mov eax, dword [ecx + 0x537c]
test eax, eax
jle 0x1001bbdf
mov edx, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
xor edi, edi
test esi, esi
js 0x1001bba8
cmp esi, eax
jl 0x1001bbc5
push 0x74d
push str.D:MyFilesDLLDLL_WITH_HWID_MADNESS1ImGui_StandaloneImGuiimgui.h
push str.i___0__i___Size
call edx
mov ecx, dword [ebp - 4]
add esp, 0xc
mov edx, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov eax, dword [ecx + 0x5384]
cmp dword [eax + edi + 4], ebx
je 0x1001bbe8
mov eax, dword [ecx + 0x537c]
inc esi
add edi, 0x24
cmp esi, eax
jl 0x1001bba0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
js 0x1001bbf4
cmp esi, dword [ecx + 0x537c]
jl 0x1001bc08
push 0x74d
push str.D:MyFilesDLLDLL_WITH_HWID_MADNESS1ImGui_StandaloneImGuiimgui.h
push str.i___0__i___Size
call edx
add esp, 0xc
mov eax, dword [ebp - 4]
lea ecx, [esi + esi*8]
pop edi
pop esi
pop ebx
mov eax, dword [eax + 0x5384]
lea eax, [eax + ecx*4]
mov esp, ebp
pop ebp
ret
Function at 0x100274d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov ebx, edx
mov esi, ecx
push edi
mov dword [ebp - 4], ebx
push dword [ebx + 0x390]
lea ecx, [esi + 0x5340]
call fcn.10004a40
cmp dword [ebx + 0x388], 0
mov edi, eax
je 0x10027512
push 0x41bf
push str.D:MyFilesDLLDLL_WITH_HWID_MADNESS1ImGui_StandaloneImGuiimgui.cpp
push str.window__DockNode__0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
test edi, edi
je 0x10027531
cmp dword [edi + 0x1c], 0
je 0x10027562
push 1
mov edx, ebx
call fcn.10020550
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebx + 0x390]
mov ecx, esi
call fcn.1001f630
mov edi, eax
mov eax, dword [edi + 0x9c]
and eax, 0xfffffe92
or eax, 0x92
mov dword [edi + 0x9c], eax
mov eax, dword [esi + 0x3ea0]
mov dword [edi + 0x84], eax
test byte [edi + 0xa0], 1
jne 0x10027626
mov esi, edi
mov eax, dword [esi + 0x18]
test eax, eax
je 0x10027583
mov esi, eax
test byte [esi + 0xa0], 1
je 0x10027571
movss xmm0, dword [esi + 0x3c]
xorps xmm1, xmm1
comiss xmm0, xmm1
jbe 0x1002759a
movss xmm0, dword [esi + 0x40]
comiss xmm0, xmm1
ja 0x100275b2
push 0x41d9
push str.D:MyFilesDLLDLL_WITH_HWID_MADNESS1ImGui_StandaloneImGuiimgui.cpp
push str.ancestor_node__Size.x___0.0f__ancestor_node__Size.y___0.0f
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
mov eax, dword [esi + 0x18]
mov edx, esi
test eax, eax
je 0x100275c9
nop dword [eax + eax]
mov edx, eax
mov eax, dword [edx + 0x18]
test eax, eax
jne 0x100275c0
and byte [edx + 0xa0], 0xdf
mov ecx, dword [edx + 0x1c]
test ecx, ecx
je 0x100275dc
call fcn.100216b0
mov ecx, dword [edx + 0x20]
test ecx, ecx
je 0x100275e8
call fcn.100216b0
cmp dword [edx + 0x18], 0
jne 0x1002760e
mov eax, dword [edx + 0x78]
test eax, eax
je 0x1002760e
nop word [eax + eax]
or byte [eax + 0xa0], 0x20
mov eax, dword [eax + 0x18]
test eax, eax
jne 0x10027600
push dword [esi + 0x40]
mov edx, edi
mov ecx, esi
push dword [esi + 0x3c]
push dword [esi + 0x38]
push dword [esi + 0x34]
call fcn.10025a00
add esp, 0x10
mov esi, dword [ebp - 4]
mov ecx, edi
mov bl, byte [edi + 0xa0]
mov edx, esi
push 1
call fcn.10020bb0
mov al, byte [edi + 0xa0]
add esp, 4
xor al, bl
and al, 1
xor byte [edi + 0xa0], al
cmp edi, dword [esi + 0x388]
je 0x1002766d
push 0x41e2
push str.D:MyFilesDLLDLL_WITH_HWID_MADNESS1ImGui_StandaloneImGuiimgui.cpp
push str.node__window__DockNode
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10032e60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x10032e9a
mov eax, dword [0x1007169c]
mov dword [esi + 4], 0
mov dword [esi], 0
test eax, eax
je 0x10032e8d
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 8], 0
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x10032ecb
mov eax, dword [0x1007169c]
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
test eax, eax
je 0x10032ebe
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 0x14], 0
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x10032efc
mov eax, dword [0x1007169c]
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
test eax, eax
je 0x10032eef
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x10032f49
mov eax, dword [0x1007169c]
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
test eax, eax
je 0x10032f3c
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 0x44], 0
mov ecx, dword [esi + 0x50]
test ecx, ecx
je 0x10032f7a
mov eax, dword [0x1007169c]
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
test eax, eax
je 0x10032f6d
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 0x50], 0
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x10032fab
mov eax, dword [0x1007169c]
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
test eax, eax
je 0x10032f9e
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 0x5c], 0
pop edi
lea ecx, [esi + 0x78]
pop esi
jmp fcn.100358e0
Function at 0x10053670
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 1
jne 0x10053697
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
push 0
push 0
push 0
push 0x10053d40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
pop ebp
ret 0xc

Function at 0x100544f0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push esi
push 0
mov esi, ecx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x10054501
pop esi
ret
push ebx
push edi
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov eax, dword [esi + 0x10]
lea ebx, [esi + 0x10]
lea eax, [eax*2 + 2]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x10054539
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, eax
test ecx, ecx
jne 0x10054545
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop ebx
xor eax, eax
pop esi
ret
cmp dword [esi + 0x14], 8
jb 0x1005454d
mov esi, dword [esi]
mov eax, dword [ebx]
push esi
inc eax
push eax
push ecx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop ebx
mov eax, 1
pop esi
ret
Function at 0x401864
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4018a3
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4018a3
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4018a3
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4018a3
cmp dword [ecx + 0x74], 0xe
jbe 0x4018a3
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x401000
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x42d90b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [0x43af64]
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
lea ecx, [esi + 4]
mov dword [ecx], eax
xor edi, edi
push 0x43e5b0
mov dword [esp + 0x1c], edi
call fcn.00424bd5
lea ecx, [esp + 0xc]
or eax, 0xffffffff
mov dword [esi + 0x10], edi
push ecx
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], eax
mov dword [esi + 8], eax
mov dword [esi + 0x30], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x14], edi
mov dword [esi], edi
call fcn.004239c6
lea edx, [esp + 0xc]
push edx
call fcn.004239c6
lea eax, [esp + 0xc]
push eax
call fcn.004239c6
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x4010a0
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x42d930
push eax
mov dword fs:[0], esp
push ebx
push ebp
push esi
push edi
mov esi, ecx
mov edi, dword [esp + 0x20]
lea ecx, [esp + 0x24]
lea edx, [esp + 0x20]
xor ebx, ebx
lea eax, [edi + 0x2c]
mov dword [esp + 0x18], ebx
push eax
push ecx
push edx
call fcn.00424ce1
push eax
lea ecx, [esi + 4]
mov byte [esp + 0x1c], 1
call fcn.00424b85
lea ecx, [esp + 0x20]
mov byte [esp + 0x18], bl
call fcn.00424a98
mov eax, dword [edi]
push 1
mov dword [esi + 8], eax
mov ecx, dword [edi + 0x1c]
push ebx
push ebx
push ecx
call fcn.00415660
mov ecx, dword [edi + 0x20]
xor ebp, ebp
add eax, ecx
mov dword [esi + 0x30], ebx
adc edx, ebp
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
lea edx, [esi + 0x18]
lea eax, [edi + 4]
push edx
push eax
mov dword [esi + 0x2c], ebx
call fcn.00401170
lea ecx, [esi + 0x1c]
lea edx, [edi + 0xc]
push ecx
push edx
call fcn.00401170
lea eax, [esi + 0x20]
add edi, 0x14
push eax
push edi
call fcn.00401170
mov ecx, dword [esp + 0x40]
add esp, 0x18
mov dword [esi], ecx
lea ecx, [esp + 0x24]
mov dword [esp + 0x18], 0xffffffff
call fcn.00424a98
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret 0xc
Function at 0x402840
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x42dbb1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [0x43af64]
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
lea ebp, [esi + 4]
mov dword [ebp], eax
mov ecx, dword [0x43af64]
lea ebx, [esi + 0x2c]
xor edi, edi
mov dword [esp + 0x1c], edi
mov dword [ebx], ecx
lea ecx, [esi + 0x30]
mov byte [esp + 0x1c], 1
call fcn.00401330
mov ecx, ebp
mov byte [esp + 0x1c], 2
mov dword [esi], 0x4308cc
call fcn.00424a23
mov ebp, 1
mov ecx, ebx
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], ebp
mov dword [esi + 0x14], ebp
mov dword [esi + 0x1c], edi
mov dword [esi + 0x18], edi
call fcn.00424a23
mov ecx, dword [esp + 0x14]
mov dword [esi + 0x20], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x24], 0x32
mov dword [esi + 0x58], ebp
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x402cc0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x42dc68
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov eax, dword [0x43af64]
push ebp
push esi
push edi
mov esi, ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x24], 0
mov dword [esp + 0x10], eax
lea ebp, [esi + 0x30]
push 0xffffffffffffffff
push 0
mov ecx, ebp
mov byte [esp + 0x2c], 1
call fcn.004022b0
lea eax, [esp + 0x10]
lea ecx, [esp + 0xc]
push eax
push ecx
push ecx
lea edi, [esi + 4]
mov ecx, esp
mov dword [esp + 0x20], esp
push edi
call fcn.0042480d
mov ecx, esi
call fcn.00402e00
mov edx, dword [esp + 0xc]
mov eax, dword [edx - 8]
test eax, eax
je 0x402dc4
mov eax, dword [esp + 0x10]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x402dc4
push 0x4390c0
lea ecx, [esp + 0x10]
call fcn.00424e28
push 0x2a
mov ecx, edi
call fcn.00424f13
cmp eax, 0xffffffff
jne 0x402d86
push 0x3f
mov ecx, edi
call fcn.00424f13
cmp eax, 0xffffffff
jne 0x402d86
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push edi
call fcn.0042480d
mov ecx, ebp
call fcn.00401c60
jmp 0x402dc4
mov esi, dword [esi + 8]
push 0
push 0
push esi
push 0
push esi
push ecx
lea edx, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x2c], esp
push edx
call fcn.0042480d
push ecx
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x34], esp
push eax
mov byte [esp + 0x44], 2
call fcn.0042480d
mov ecx, ebp
mov byte [esp + 0x40], 1
call fcn.00401780
lea ecx, [esp + 0x10]
mov byte [esp + 0x24], 0
call fcn.00424a98
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xffffffff
call fcn.00424a98
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebp
add esp, 0x1c
ret
Function at 0x403510
Capabilities:
Delete directory

Disassembly:
push 0xffffffffffffffff
push 0x42dd28
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
mov eax, dword [0x43af64]
mov dword [esp + 0x18], 0
mov dword [esp + 4], eax
mov dword [esp + 8], eax
lea esi, [ecx + 4]
push 0x5c
mov ecx, esi
mov byte [esp + 0x1c], 2
call fcn.00423b86
cmp eax, 0xffffffff
je 0x40358c
push eax
lea eax, [esp + 0x10]
push eax
mov ecx, esi
call fcn.00423b0e
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x1c], 3
call fcn.00424b85
lea ecx, [esp + 0xc]
mov byte [esp + 0x18], 2
call fcn.00424a98
push 0x4390c0
lea ecx, [esp + 0xc]
call fcn.00423f41
push 0x5c
lea ecx, [esp + 0x24]
call fcn.00423b86
cmp eax, 0xffffffff
pop esi
je 0x4035fd
lea ecx, [esp + 8]
push eax
push ecx
lea ecx, [esp + 0x24]
call fcn.00423b0e
push eax
lea ecx, [esp + 4]
mov byte [esp + 0x18], 4
call fcn.00424b85
lea ecx, [esp + 8]
mov byte [esp + 0x14], 2
call fcn.00424a98
mov edx, dword [esp]
push 0
push edx
call fcn.00416013
add esp, 8
test eax, eax
jne 0x4035fd
mov eax, dword [esp]
mov ecx, dword [esp + 4]
push eax
push ecx
call fcn.00415e05
add esp, 8
test eax, eax
je 0x4035fd
mov edx, dword [esp]
push edx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
lea ecx, [esp + 4]
mov byte [esp + 0x14], 1
call fcn.00424a98
lea ecx, [esp]
mov byte [esp + 0x14], 0
call fcn.00424a98
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], 0xffffffff
call fcn.00424a98
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret 4
Function at 0x403640
Capabilities:
Delete directory

Disassembly:
push 0xffffffffffffffff
push 0x42dd68
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
mov eax, dword [0x43af64]
mov dword [esp + 0x1c], 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
lea esi, [ecx + 4]
mov bl, 2
push 0x5c
mov ecx, esi
mov byte [esp + 0x20], bl
call fcn.00423b86
cmp eax, 0xffffffff
je 0x4036af
push eax
lea eax, [esp + 0x14]
push eax
mov ecx, esi
call fcn.00423b0e
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], 3
call fcn.00424b85
lea ecx, [esp + 0x10]
mov byte [esp + 0x1c], bl
call fcn.00424a98
lea ecx, [esp + 0x24]
push ecx
lea ecx, [esp + 0xc]
call fcn.00424b85
mov edx, dword [esp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push edx
call esi
push 0x5c
lea ecx, [esp + 0xc]
call fcn.00423b86
cmp eax, 0xffffffff
je 0x403742
push edi
push eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x14]
call fcn.00423b0e
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x24], 4
call fcn.00424b85
lea ecx, [esp + 0x14]
mov byte [esp + 0x20], bl
call fcn.00424a98
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push ecx
push edx
call fcn.00415e05
add esp, 8
test eax, eax
je 0x403731
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov eax, dword [ecx - 8]
mov edi, dword [edx - 8]
cmp eax, edi
jle 0x403731
push ecx
call esi
push 0x5c
lea ecx, [esp + 0x10]
call fcn.00423b86
cmp eax, 0xffffffff
jne 0x4036db
pop edi
lea ecx, [esp + 0xc]
mov byte [esp + 0x1c], 1
call fcn.00424a98
lea ecx, [esp + 8]
mov byte [esp + 0x1c], 0
call fcn.00424a98
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], 0xffffffff
call fcn.00424a98
mov ecx, dword [esp + 0x14]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret 4
Function at 0x404730
Capabilities:
Extract resource via kernel32 functions

Disassembly:
jmp method.CDialog.virtual_184
mov eax, 0x42f4d0
call fcn.00417854
sub esp, 0x18
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], esi
mov eax, dword [esi + 0x48]
mov edi, dword [esi + 0x44]
mov dword [ebp - 0x18], eax
call fcn.0042c075
cmp dword [esi + 0x40], 0
mov ebx, dword [eax + 0xc]
je 0x426aea
call fcn.0042c075
mov ebx, dword [eax + 0xc]
push 5
push dword [esi + 0x40]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x426af8
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x426b06
or eax, 0xffffffff
jmp 0x426bee
mov ecx, esi
call fcn.00426a21
mov dword [ebp - 0x14], eax
call fcn.00427833
xor edi, edi
cmp dword [ebp - 0x14], edi
mov dword [ebp - 0x20], edi
je 0x426b3d
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x426b3d
push edi
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x20], 1
push esi
mov dword [ebp - 4], edi
call fcn.004277e7
push dword [ebp - 0x14]
call fcn.00427335
push ebx
push eax
push dword [ebp - 0x18]
mov ecx, esi
call fcn.004267b9
cmp eax, edi
je 0x426bb0
test byte [esi + 0x24], 0x10
je 0x426b7e
push 4
mov ecx, esi
pop ebx
call fcn.00425155
test ah, 1
je 0x426b76
push 5
pop ebx
push ebx
mov ecx, esi
call fcn.00429342
cmp dword [esi + 0x1c], edi
je 0x426bb0
push 0x97
push edi
push edi
push edi
push edi
push edi
mov ecx, esi
call fcn.004251b0
jmp 0x426bb0
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x20], edi
je 0x426bc4
push 1
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp dword [ebp - 0x14], edi
je 0x426bdd
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [esi + 0x1c]
jne 0x426bdd
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x58]
mov ecx, esi
call fcn.00426a5b
mov eax, dword [esi + 0x2c]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0x4058f0
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret