joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416390
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x4befcb
mov eax, dword fs:[0]
push eax
sub esp, 0x13c
mov eax, dword [0x4f00a8]
xor eax, esp
mov dword [esp + 0x138], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4f00a8]
xor eax, esp
push eax
lea eax, [esp + 0x150]
mov dword fs:[0], eax
mov edi, dword [esp + 0x160]
push edi
mov ecx, 0x4f1e68
call fcn.00435cf0
lea ecx, [esp + 0x20]
mov esi, eax
call fcn.0042e460
lea eax, [esi + 0x48]
xor ebx, ebx
push eax
lea ecx, [esp + 0x24]
mov dword [esp + 0x15c], ebx
call fcn.0042e5d0
test al, al
je 0x416565
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x24]
push edx
mov ecx, 0x4f1e60
mov dword [esp + 0x20], ebx
call fcn.0042c400
test al, al
je 0x416565
mov al, byte [0x4eeb4c]
mov cl, byte [0x4eeb4d]
mov dl, byte [0x4eeb4e]
mov ebp, dword [0x4eeb48]
push 0xa3
mov byte [esp + 0x1a], al
mov byte [esp + 0x19], cl
mov byte [esp + 0x1b], dl
mov dword [0x4eeb48], 3
mov byte [0x4eeb4c], 1
mov byte [0x4eeb4d], bl
mov byte [0x4eeb4e], bl
mov dword [0x4eeb50], edi
mov dword [0x4eeb54], 0xffffffff
call fcn.00443150
add esp, 4
push eax
mov eax, dword [0x5391d4]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
push 0x8a
call fcn.00443150
push eax
push 0x5391f0
call fcn.00456c60
add esp, 0xc
lea ecx, [esp + 0x4c]
push ecx
push esi
mov ecx, 0x4f1e68
call fcn.00435db0
lea edx, [esp + 0x4c]
push edx
mov ecx, 0x5391d0
call fcn.00456fb0
push 1
mov dword [esp + 0x20], ebx
call fcn.004919dd
add esp, 4
cmp eax, ebx
je 0x4164dd
mov byte [eax], bl
jmp 0x4164df
xor eax, eax
lea ecx, [esp + 0x1c]
push ecx
push ebx
push eax
push 0x416060
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, eax
push 0x64
push esi
call edi
cmp eax, 0x102
jne 0x416525
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ecx]
call fcn.0043ec30
push 0x64
call ebx
push 0x64
push esi
call edi
cmp eax, 0x102
je 0x416510
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x5391d0
call fcn.00456d40
push 1
mov ecx, 0x5391f0
call fcn.00457190
mov dl, byte [esp + 0x16]
mov al, byte [esp + 0x15]
mov cl, byte [esp + 0x17]
mov dword [0x4eeb48], ebp
mov byte [0x4eeb4c], dl
mov byte [0x4eeb4d], al
mov byte [0x4eeb4e], cl
lea ecx, [esp + 0x20]
mov dword [esp + 0x158], 0xffffffff
call fcn.0042e550
mov ecx, dword [esp + 0x150]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x138]
xor ecx, esp
call fcn.004911aa
add esp, 0x148
ret 4
Function at 0x4172d0
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x4bf126
mov eax, dword fs:[0]
push eax
sub esp, 0x1a8
mov eax, dword [0x4f00a8]
xor eax, esp
mov dword [esp + 0x1a4], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4f00a8]
xor eax, esp
push eax
lea eax, [esp + 0x1bc]
mov dword fs:[0], eax
mov eax, dword [esp + 0x1d0]
mov esi, dword [esp + 0x1cc]
push eax
lea ecx, [esp + 0x54]
call fcn.0043b560
xor ebx, ebx
push ebx
mov dword [esp + 0x1c8], ebx
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea ecx, [esp + 0x58]
call fcn.00416830
mov ebp, eax
cmp ebp, 1
jne 0x4174ef
mov ecx, dword [0x4eeb50]
push ecx
mov ecx, 0x4f1e68
call fcn.00435cf0
mov edx, dword [0x4eeb50]
push edx
mov ecx, 0x4f1e68
mov edi, eax
call fcn.00435d30
cmp esi, ebx
je 0x417378
push ebx
push esi
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [esp + 0x18], vtable.WTL::CMessageLoop.0
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov byte [esp + 0x1c4], 1
cmp byte [esp + 0x1d0], bl
je 0x4173b8
lea eax, [esp + 0x18]
push eax
mov ecx, 0x537f08
call fcn.004165b0
mov ecx, dword [esp + 0x1d0]
push ecx
mov ecx, 0x5391d0
call fcn.00456c40
mov edx, dword [0x5391d4]
push edx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x4173e7
push ebx
push esi
mov ecx, 0x5391d0
call fcn.00416950
mov eax, dword [0x5391d4]
push 1
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0xa3
call fcn.00443150
mov ecx, dword [0x5391d4]
add esp, 4
push eax
push ecx
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov ecx, 0x5391d0
call fcn.00456d40
push 0x4f19d0
mov ecx, 0x5391d0
call fcn.00456c20
push esi
mov ecx, 0x5391d0
call fcn.00456c30
call fcn.0043ec30
lea edx, [esp + 0xb8]
push edx
push edi
mov ecx, 0x4f1e68
call fcn.00435db0
lea eax, [esp + 0xb8]
push eax
mov ecx, 0x5391d0
call fcn.00456fb0
push 0x8a
call fcn.00443150
push eax
push 0x5391f0
call fcn.00456c60
push 1
mov dword [esp + 0x24], ebx
call fcn.004919dd
add esp, 0x10
cmp eax, ebx
je 0x41748a
mov byte [eax], 1
jmp 0x41748c
xor eax, eax
lea ecx, [esp + 0x14]
push ecx
push ebx
push eax
push 0x416060
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp byte [esp + 0x1d0], bl
je 0x4174df
lea ecx, [esp + 0x18]
call fcn.00415ef0
mov ecx, 0x537f08
mov esi, eax
call fcn.00416a70
lea ecx, [esp + 0x18]
call fcn.00448580
lea ecx, [esp + 0x50]
mov dword [esp + 0x1c4], 0xffffffff
call fcn.0043b4c0
mov eax, esi
jmp 0x417505
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x18]
call fcn.00448580
lea ecx, [esp + 0x50]
mov dword [esp + 0x1c4], 0xffffffff
call fcn.0043b4c0
mov eax, ebp
mov ecx, dword [esp + 0x1bc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1a4]
xor ecx, esp
call fcn.004911aa
add esp, 0x1b4
ret 8
Function at 0x4180e0
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x4bf2e1
mov eax, dword fs:[0]
push eax
sub esp, 0x23c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4f00a8]
xor eax, esp
push eax
lea eax, [esp + 0x250]
mov dword fs:[0], eax
mov eax, dword [esp + 0x264]
push eax
lea ecx, [esp + 0x80]
call fcn.00423ad0
xor ebx, ebx
mov dword [esp + 0x258], ebx
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea ecx, [esp + 0x80]
call fcn.00449e80
mov ebp, eax
cmp ebp, 1
jne 0x418340
mov eax, dword [0x4ef440]
mov esi, dword [esp + 0x260]
cmp eax, dword [0x4ef444]
jne 0x41821c
push eax
mov ecx, 0x4f1e68
call fcn.00435cf0
lea ecx, [esp + 0x50]
mov edi, eax
call fcn.0042e460
add edi, 0x48
push edi
lea ecx, [esp + 0x54]
mov byte [esp + 0x25c], 1
call fcn.0042e5d0
lea ecx, [esp + 0x50]
test al, al
jne 0x4181ba
mov byte [esp + 0x258], bl
call fcn.0042e550
lea ecx, [esp + 0x7c]
mov dword [esp + 0x258], 0xffffffff
call fcn.00423820
xor eax, eax
jmp 0x418356
push 1
push 2
push ecx
mov ecx, 0x4f1e60
call fcn.0042c110
lea ecx, [esp + 0x50]
call fcn.0042e4c0
push 0x41
push 2
push 0x12e
push esi
call fcn.004431e0
add esp, 0x10
mov byte [esp + 0x258], bl
lea ecx, [esp + 0x50]
cmp eax, 2
jne 0x418217
call fcn.0042e550
lea ecx, [esp + 0x7c]
mov dword [esp + 0x258], 0xffffffff
call fcn.00423820
mov eax, 2
jmp 0x418356
call fcn.0042e550
cmp esi, ebx
je 0x418228
push ebx
push esi
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [esp + 0x18], vtable.WTL::CMessageLoop.0
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov byte [esp + 0x258], 2
cmp byte [esp + 0x264], bl
je 0x418268
lea edx, [esp + 0x18]
push edx
mov ecx, 0x537f08
call fcn.004165b0
mov eax, dword [esp + 0x264]
push eax
mov ecx, 0x5391d0
call fcn.00456c40
mov ecx, dword [0x5391d4]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x418297
push ebx
push esi
mov ecx, 0x5391d0
call fcn.00416950
mov edx, dword [0x5391d4]
push 1
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, 0x5391d0
call fcn.00456d40
push 0x4f19d0
mov ecx, 0x5391d0
call fcn.00456c20
push esi
mov ecx, 0x5391d0
call fcn.00456c30
call fcn.0043ec30
mov dword [esp + 0x14], ebx
mov eax, 0x415db0
cmp byte [0x4ef43c], bl
jne 0x4182e5
mov eax, 0x417a80
lea ecx, [esp + 0x14]
push ecx
push ebx
push ebx
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x18]
cmp byte [esp + 0x264], bl
je 0x41833b
call fcn.00415ef0
mov ecx, 0x537f08
mov esi, eax
call fcn.00416a70
lea ecx, [esp + 0x18]
call fcn.00448580
lea ecx, [esp + 0x7c]
mov dword [esp + 0x258], 0xffffffff
call fcn.00423820
mov eax, esi
jmp 0x418356
call fcn.00448580
lea ecx, [esp + 0x7c]
mov dword [esp + 0x258], 0xffffffff
call fcn.00423820
mov eax, ebp
mov ecx, dword [esp + 0x250]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x248
ret 8
Function at 0x41a190
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x4bf476
mov eax, dword fs:[0]
push eax
sub esp, 0x1a0
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4f00a8]
xor eax, esp
push eax
lea eax, [esp + 0x1b4]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, 0x4ede74
call fcn.004595d0
mov ecx, dword [esp + 0x1c8]
cmp eax, 1
sete al
xor ebx, ebx
cmp al, bl
sete al
push ecx
push eax
push eax
push ebx
push 0x39
call fcn.00443150
add esp, 4
push eax
lea ecx, [esp + 0x68]
call fcn.0041bad0
mov dword [esp + 0x1bc], ebx
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea ecx, [esp + 0x58]
call fcn.00449e80
mov ebp, eax
cmp ebp, 1
jne 0x41a35a
mov esi, dword [esp + 0x1c4]
mov edx, dword [0x4eeb70]
push esi
push edx
mov ecx, edi
call fcn.00415aa0
mov byte [esp + 0x17], al
cmp esi, ebx
je 0x41a23d
push ebx
push esi
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [esp + 0x1c], vtable.WTL::CMessageLoop.0
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
mov byte [esp + 0x1bc], 1
cmp byte [esp + 0x1c8], bl
je 0x41a27d
lea eax, [esp + 0x1c]
push eax
mov ecx, 0x537f08
invalid
invalid
Function at 0x41a390
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x4bf4b6
mov eax, dword fs:[0]
push eax
sub esp, 0x4c4
mov eax, dword [0x4f00a8]
xor eax, esp
mov dword [esp + 0x4c0], eax
push ebx
push esi
push edi
mov eax, dword [0x4f00a8]
xor eax, esp
push eax
lea eax, [esp + 0x4d4]
mov dword fs:[0], eax
mov esi, dword [esp + 0x4e4]
push esi
push str.Disc_Images__.iso_
push 0x80002
push str.Untitled
push 0x4c4958
xor ebx, ebx
push ebx
lea ecx, [esp + 0x64]
call fcn.00416af0
mov dword [esp + 0x4c], vtable.WTL::CFileDialog.0
mov dword [esp + 0x4dc], ebx
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea ecx, [esp + 0x50]
call fcn.00416740
mov edi, eax
cmp edi, 1
jne 0x41a554
cmp esi, ebx
je 0x41a428
push ebx
push esi
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [esp + 0x14], vtable.WTL::CMessageLoop.0
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x4dc], 1
cmp byte [esp + 0x4e8], bl
je 0x41a468
lea eax, [esp + 0x14]
push eax
mov ecx, 0x537f08
call fcn.004165b0
mov ecx, dword [esp + 0x4e8]
push ecx
mov ecx, 0x5391d0
call fcn.00456c40
mov edx, dword [0x5391d4]
push edx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x41a497
push ebx
push esi
mov ecx, 0x5391d0
call fcn.00416950
mov eax, dword [0x5391d4]
push 1
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, 0x5391d0
call fcn.00456d40
push 0x4f19d0
mov ecx, 0x5391d0
call fcn.00456c20
push esi
mov ecx, 0x5391d0
call fcn.00456c30
call fcn.0043ec30
push 0x208
call fcn.00490ef9
add esp, 4
lea ecx, [esp + 0x2c8]
mov esi, eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea edx, [esp + 0x10]
push edx
push ebx
push esi
push 0x419f50
push ebx
push ebx
mov dword [esp + 0x28], ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x14]
cmp byte [esp + 0x4e8], bl
je 0x41a54f
call fcn.00415ef0
mov ecx, 0x537f08
mov esi, eax
call fcn.00416a70
lea ecx, [esp + 0x14]
call fcn.00448580
mov eax, dword [esp + 0x60]
mov dword [esp + 0x4dc], 0xffffffff
cmp eax, ebx
je 0x41a54b
push eax
call fcn.00490c3a
mov eax, esi
jmp 0x41a56f
call fcn.00448580
mov eax, dword [esp + 0x60]
mov dword [esp + 0x4dc], 0xffffffff
cmp eax, ebx
je 0x41a56d
push eax
call fcn.00490c3a
mov eax, edi
mov ecx, dword [esp + 0x4d4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x4c0]
xor ecx, esp
call fcn.004911aa
add esp, 0x4d0
ret 8
Function at 0x41d5c0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov eax, dword [0x4f00a8]
xor eax, esp
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x28]
mov dl, byte [esp + 0x30]
push ebx
push ebp
push esi
mov esi, ecx
mov cl, byte [esp + 0x38]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x40]
push edi
mov dword [esp + 0x10], eax
mov byte [esp + 0x1c], cl
mov byte [esp + 0x1d], dl
xor ebx, ebx
lea edi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41d600
sub eax, edi
lea ebp, [eax + 1]
mov eax, dword [esi + 0x2a0]
mov dword [esp + 0x14], ebp
test eax, eax
jbe 0x41d639
mov cl, byte [esi + 0x2a8]
push eax
lea edx, [esi + 0x200]
push edx
lea eax, [esp + 0x28]
push eax
mov byte [esp + 0x29], cl
call fcn.00492030
add esp, 0xc
test ebp, ebp
jbe 0x41d789
jmp 0x41d647
mov ebp, dword [esp + 0x14]
mov edi, dword [esi + 0x2a0]
mov eax, ebp
sub eax, edi
mov ecx, 0xc
sub eax, ebx
sub ecx, edi
cmp ecx, eax
jae 0x41d667
mov ebp, 0xc
sub ebp, edi
jmp 0x41d669
mov ebp, eax
mov edx, dword [esp + 0x10]
push ebp
add edx, ebx
push edx
lea eax, [esp + edi + 0x28]
push eax
call fcn.00492030
add edi, ebp
add esp, 0xc
cmp edi, 0xc
jne 0x41d765
mov cl, byte [esi + 0x2a4]
mov dl, byte [esp + 0x48]
inc dword [esi + 0x2a4]
add dl, bl
mov byte [esp + 0x1e], cl
xor eax, eax
mov byte [esp + 0x1f], dl
xor ecx, ecx
jmp 0x41d6b0
movzx edx, byte [esp + ecx + 0x1c]
movzx edi, ax
shl eax, 8
shr edi, 8
xor edx, edi
xor ax, word [esi + edx*2]
movzx edi, byte [esp + ecx + 0x1d]
movzx eax, ax
movzx edx, ax
shl eax, 8
shr edx, 8
xor edx, edi
xor ax, word [esi + edx*2]
movzx edx, byte [esp + ecx + 0x1e]
movzx eax, ax
movzx edi, ax
shr edi, 8
xor edx, edi
shl eax, 8
xor ax, word [esi + edx*2]
movzx edx, byte [esp + ecx + 0x1f]
movzx eax, ax
movzx edi, ax
shr edi, 8
shl eax, 8
xor edx, edi
xor ax, word [esi + edx*2]
add ecx, 4
cmp ecx, 0x10
movzx eax, ax
jl 0x41d6b0
not eax
movzx eax, ax
mov ecx, eax
shr ecx, 8
push 0x12
lea edx, [esp + 0x20]
mov byte [esp + 0x30], cl
mov ecx, dword [esp + 0x1c]
push edx
mov byte [esp + 0x35], al
call fcn.004bdd40
movzx ecx, byte [esp + 0x1d]
xor eax, eax
add ebx, ebp
mov dword [esi + 0x2a0], eax
cmp ecx, dword [esi + 0x2a8]
jne 0x41d759
mov dl, byte [esp + 0x40]
mov byte [esp + 0x1d], dl
mov dword [esp + 0x48], eax
cmp ebx, dword [esp + 0x14]
jb 0x41d643
jmp 0x41d789
mov eax, dword [esp + 0x10]
mov ecx, dword [esi + 0x2a0]
push ebp
add eax, ebx
push eax
lea edx, [ecx + esi + 0x200]
push edx
call fcn.00492030
add esp, 0xc
add dword [esi + 0x2a0], ebp
mov ecx, dword [esp + 0x30]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.004911aa
add esp, 0x24
ret 0x14
Function at 0x41d7a0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x18
mov eax, dword [0x4f00a8]
xor eax, esp
mov dword [esp + 0x14], eax
push ebx
mov ebx, dword [esp + 0x20]
push esi
mov esi, ecx
push edi
mov edi, dword [esi + 0x2a0]
test edi, edi
jbe 0x41d8ae
mov cl, byte [esi + 0x2a8]
mov dl, byte [esi + 0x2a4]
mov al, byte [esp + 0x2c]
inc dword [esi + 0x2a4]
mov byte [esp + 0xd], cl
push edi
lea ecx, [esi + 0x200]
mov byte [esp + 0x12], dl
mov byte [esp + 0x10], al
mov al, byte [esp + 0x34]
push ecx
lea edx, [esp + 0x18]
push edx
mov byte [esp + 0x1b], al
call fcn.00492030
mov eax, 0xc
sub eax, edi
push eax
lea ecx, [esp + edi + 0x20]
push 0
push ecx
call fcn.004911c0
add esp, 0x18
xor eax, eax
xor ecx, ecx
lea esp, [esp]
movzx edx, byte [esp + ecx + 0xc]
movzx edi, ax
shl eax, 8
shr edi, 8
xor edx, edi
xor ax, word [esi + edx*2]
movzx edi, byte [esp + ecx + 0xd]
movzx eax, ax
movzx edx, ax
shl eax, 8
shr edx, 8
xor edx, edi
xor ax, word [esi + edx*2]
movzx edx, byte [esp + ecx + 0xe]
movzx eax, ax
movzx edi, ax
shr edi, 8
xor edx, edi
shl eax, 8
xor ax, word [esi + edx*2]
movzx edx, byte [esp + ecx + 0xf]
movzx eax, ax
movzx edi, ax
shr edi, 8
shl eax, 8
xor edx, edi
xor ax, word [esi + edx*2]
add ecx, 4
cmp ecx, 0x10
movzx eax, ax
jl 0x41d820
not eax
movzx eax, ax
mov ecx, eax
shr ecx, 8
push 0x12
lea edx, [esp + 0x10]
mov byte [esp + 0x20], cl
push edx
mov ecx, ebx
mov byte [esp + 0x25], al
call fcn.004bdd40
mov dword [esi + 0x2a0], 0
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004911aa
add esp, 0x18
ret 0xc
Function at 0x420b80
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x87c
mov eax, dword [0x4f00a8]
xor eax, esp
mov dword [esp + 0x878], eax
push ebx
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push ebp
push esi
push edi
push str.English__default_
push 0
mov esi, ecx
mov eax, dword [esi + 0x50]
push 0x143
push eax
call ebx
mov ecx, dword [esi + 0x50]
push 0
push 0
push 0x14e
push ecx
call ebx
push 0x103
lea edx, [esp + 0x684]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x680]
push eax
call fcn.00477110
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
add esp, 4
push str.Languages_
lea ecx, [esp + 0x684]
push ecx
call edi
lea edx, [esp + 0x680]
push edx
lea eax, [esp + 0x47c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x4c4dd0
lea ecx, [esp + 0x47c]
push ecx
call edi
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x47c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebp, dword [esi + 0x64]
lea edi, [esi + 0x54]
mov dword [esp + 0x10], eax
cmp dword [edi + 0xc], ebp
jbe 0x420c47
call fcn.0049118f
mov ecx, dword [edi]
mov dword [esp + 0x18], ecx
mov ecx, dword [edi + 0xc]
mov dword [esp + 0x14], ecx
cmp ecx, dword [edi + 0x10]
jbe 0x420c62
call fcn.0049118f
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov eax, dword [edi]
push ebp
push edx
push ecx
push eax
lea eax, [esp + 0x28]
push eax
mov ecx, edi
call fcn.00420460
cmp dword [esp + 0x10], 0xffffffff
je 0x420d6e
jmp 0x420c90
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcmpW]
push 0x4c4dcc
lea ecx, [esp + 0x50]
push ecx
call ebp
test eax, eax
je 0x420d4b
push 0x4c4dc4
lea edx, [esp + 0x50]
push edx
call ebp
test eax, eax
je 0x420d4b
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [esp + 0x4c]
push eax
lea ecx, [esp + 0x274]
push ecx
call ebp
lea edx, [esp + 0x270]
push edx
mov ecx, edi
call fcn.00420ad0
lea eax, [esp + 0x4c]
push eax
lea ecx, [esp + 0x47c]
push ecx
call ebp
lea edx, [esp + 0x478]
push 0x4c49ac
push edx
call fcn.00477260
mov ecx, dword [esi + 0x50]
add esp, 8
lea eax, [esp + 0x478]
push eax
push 0
push 0x143
push ecx
call ebx
push 0x4ee70c
lea edx, [esp + 0x50]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x420d4b
push eax
push eax
mov eax, dword [esi + 0x50]
push 0x146
push eax
call ebx
mov ecx, dword [esi + 0x50]
push 0
dec eax
push eax
push 0x14e
push ecx
call ebx
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x20]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x420c90
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x888]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004911aa
add esp, 0x87c
ret
Function at 0x423100
Capabilities:
Create a process with modified i/o handles and window
Create process on windows

Disassembly:
sub esp, 0x54
push esi
push edi
push str.CConsolePipe::CreateProcess
push 0x537f80
mov edi, ecx
call fcn.00444320
mov esi, dword [esp + 0x68]
push esi
push str.__Command_line___s.
push 0x537f80
call fcn.00444320
push 0x44
lea eax, [esp + 0x30]
push 0
push eax
call fcn.004911c0
mov edx, dword [esp + 0x88]
mov eax, dword [esp + 0x8c]
mov ecx, dword [esp + 0x84]
add esp, 0x20
mov dword [esp + 0x54], edx
lea edx, [esp + 8]
push edx
mov dword [esp + 0x5c], eax
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x58], ecx
xor ecx, ecx
push ecx
push ecx
push 0x10
push 1
push ecx
push ecx
push esi
push ecx
mov dword [esp + 0x40], 0x44
mov dword [esp + 0x6c], 0x101
mov word [esp + 0x70], cx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x4231b4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4c4ef0
push 0x537f80
call fcn.00444320
add esp, 0xc
pop edi
xor al, al
pop esi
add esp, 0x54
ret 0x10
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 8]
push edx
mov dword [edi + 4], ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov al, 1
pop esi
add esp, 0x54
ret 0x10

Function at 0x4231d0
Capabilities:
Terminate thread

Disassembly:
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esi + 0xc], ebx
je 0x423222
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp eax, dword [esi + 0x10]
je 0x423219
mov eax, dword [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [esi + 0xc]
push 0x1388
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x423219
mov edx, dword [esi + 0xc]
push 0xfffffffffffffffe
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [esi + 0xc]
push eax
call edi
mov dword [esi + 0xc], ebx
mov eax, dword [esi + 8]
cmp eax, ebx
je 0x42322f
push eax
call edi
mov dword [esi + 8], ebx
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x42323c
push eax
call edi
mov dword [esi + 4], ebx
mov eax, dword [esi + 0x14]
cmp eax, ebx
je 0x423249
push eax
call edi
mov dword [esi + 0x14], ebx
mov eax, dword [esi + 0x18]
cmp eax, ebx
je 0x423256
push eax
call edi
mov dword [esi + 0x18], ebx
mov eax, dword [0x4f19c8]
cmp eax, ebx
je 0x423268
push eax
call edi
mov dword [0x4f19c8], ebx
pop edi
mov dword [esi + 0x10], ebx
mov byte [esi + 0x420], bl
pop esi
mov al, 1
pop ebx
ret