joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42ff40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x5cc6c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
mov word [ebp - 8], ax
mov ecx, esi
push 0x1a
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 7
mov word [esi], ax
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x3c], 0x650072
mov dword [ebp - 0x38], 0x650063
mov dword [ebp - 0x34], 0x760069
mov dword [ebp - 0x30], 0x640065
mov dword [ebp - 0x2c], 0x710020
mov dword [ebp - 0x28], 0x690075
mov dword [ebp - 0x24], 0x2c0074
mov dword [ebp - 0x20], 0x650020
mov dword [ebp - 0x1c], 0x690078
mov dword [ebp - 0x18], 0x200074
mov dword [ebp - 0x14], 0x6f0063
mov dword [ebp - 0x10], 0x650064
mov dword [ebp - 0xc], 0x20003a
call fcn.00406a80
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004fa0d4
mov esp, ebp
pop ebp
ret 4
Function at 0x433d60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x60], 0x740068
push edi
mov dword [ebp - 0x5c], 0x700074
mov dword [ebp - 0x58], 0x2f003a
mov dword [ebp - 0x54], 0x61002f
mov dword [ebp - 0x50], 0x700070
mov dword [ebp - 0x4c], 0x6c002e
mov dword [ebp - 0x48], 0x640075
mov dword [ebp - 0x44], 0x730061
mov dword [ebp - 0x40], 0x690068
mov dword [ebp - 0x3c], 0x63002e
mov dword [ebp - 0x38], 0x6d006f
mov dword [ebp - 0x34], 0x61002f
mov dword [ebp - 0x30], 0x690070
mov dword [ebp - 0x2c], 0x73002f
mov dword [ebp - 0x28], 0x66006f
mov dword [ebp - 0x24], 0x770074
mov dword [ebp - 0x20], 0x720061
mov dword [ebp - 0x1c], 0x2f0065
mov dword [ebp - 0x18], 0x6f0063
mov dword [ebp - 0x14], 0x66006e
mov dword [ebp - 0x10], 0x670069
mov dword [ebp - 0xc], 0x70002f
mov dword [ebp - 8], 0x70006f
mov word [ebp - 4], ax
call fcn.004062e0
mov ecx, eax
test ecx, ecx
je 0x433e6b
mov eax, dword [ecx]
push 2
push 0x2e
call dword [eax]
test eax, eax
je 0x433e75
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0x2e
jl 0x433e61
mov dword [eax - 0xc], 0x2e
xor eax, eax
mov ecx, dword [esi]
push 0x5c
mov word [ecx + 0x5c], ax
lea eax, [ebp - 0x60]
push eax
push 0x5c
push dword [esi]
call fcn.00406ba0
add esp, 0x10
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.004061e0
push 0x80004005
call fcn.004061e0
call fcn.004069a0
int3
Function at 0x438930
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x5cc6c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
mov word [ebp - 8], ax
mov ecx, esi
push 0x2e
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 7
mov word [esi], ax
lea eax, [ebp - 0x64]
push eax
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x64], 0x6f006d
mov dword [ebp - 0x60], 0x730075
mov dword [ebp - 0x5c], 0x200065
mov dword [ebp - 0x58], 0x6f006e
mov dword [ebp - 0x54], 0x200074
mov dword [ebp - 0x50], 0x6e0069
mov dword [ebp - 0x4c], 0x630020
mov dword [ebp - 0x48], 0x720074
mov dword [ebp - 0x44], 0x2e006c
mov dword [ebp - 0x40], 0x690020
mov dword [ebp - 0x3c], 0x73006e
mov dword [ebp - 0x38], 0x610074
mov dword [ebp - 0x34], 0x6c006c
mov dword [ebp - 0x30], 0x6f0020
mov dword [ebp - 0x2c], 0x200072
mov dword [ebp - 0x28], 0x61006c
mov dword [ebp - 0x24], 0x75006e
mov dword [ebp - 0x20], 0x680063
mov dword [ebp - 0x1c], 0x700020
mov dword [ebp - 0x18], 0x730075
mov dword [ebp - 0x14], 0x200068
mov dword [ebp - 0x10], 0x700061
mov dword [ebp - 0xc], 0x2e0070
call fcn.00406a80
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004fa0d4
mov esp, ebp
pop ebp
ret 4

Function at 0x438a20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x5cc6c0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push 0xf
mov ecx, esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], 0x650072
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x20], 0x6f0063
mov dword [ebp - 0x1c], 0x70006d
mov dword [ebp - 0x18], 0x70006f
mov dword [ebp - 0x14], 0x6e0077
mov dword [ebp - 0x10], 0x2e0064
mov dword [ebp - 0xc], 0x6d0078
mov dword [ebp - 8], 0x6c
call fcn.00406a80
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004fa0d4
mov esp, ebp
pop ebp
ret 4
Function at 0x4392e0
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57030f
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x5cc6c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [ebp - 0x1c]
xorps xmm0, xmm0
push eax
movlpd qword [ebp - 0x1c], xmm0
call dword [sym.imp.USER32.dll_GetCursorPos]
push 0
push 0
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
call fcn.00482bc0
add esp, 8
lea ecx, [edi + 0x30]
push eax
call fcn.00488ed0
mov ecx, edi
call fcn.00438eb0
push 0xffffffffffffffec
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
and eax, 0xfffbffff
or eax, 0x80
push eax
push 0xffffffffffffffec
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetWindowLongW]
lea eax, [ebp - 0x24]
mov ecx, edi
push eax
call fcn.00438cb0
movzx ecx, word [ebp - 0x20]
movzx eax, word [ebp - 0x24]
shl ecx, 0x10
or ecx, eax
push ecx
push 0
push 0x436
mov ecx, edi
call fcn.00494630
push 0
push 0xa4cb80
push 0x2716
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetTimer]
mov esi, dword [0x5d3cfc]
test esi, esi
jne 0x43940b
push 0x5cc04c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x5d3cfc], esi
jne 0x4393fa
push 0x24
call fcn.004f9dfc
add esp, 4
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], esi
test eax, eax
je 0x4393e4
xorps xmm0, xmm0
mov ecx, eax
movups xmmword [eax], xmm0
movups xmmword [eax + 0x10], xmm0
mov dword [eax + 0x20], esi
call fcn.004213d0
jmp 0x4393e6
xor eax, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
xor edx, edx
lock or dword [ecx], edx
mov dword [0x5d3cfc], eax
push 0x5cc04c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [0x5d3cfc]
push 0
call fcn.00550891
add esp, 4
mov ecx, esi
push eax
call fcn.00422490
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004fa0d4
mov esp, ebp
pop ebp
ret
Function at 0x43a830
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5705f0
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x5cc6c0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, ecx
mov dword [ebp - 0x1c], eax
mov edi, dword [ebp + 0xc]
mov esi, edi
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
cmp dword [edi + 0x14], 8
mov ebx, dword [edi + 0x10]
mov dword [ebp - 4], 0
jb 0x43a883
mov esi, dword [edi]
lea eax, [ebx + ebx]
xor ecx, ecx
mov edx, 0x811c9dc5
test eax, eax
je 0x43a8a7
mov ebx, eax
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x43a893
mov ebx, dword [edi + 0x10]
mov ecx, dword [ebp - 0x1c]
mov esi, dword [ecx + 0x18]
mov eax, dword [ecx + 0xc]
and esi, edx
mov dword [ebp - 0x24], esi
lea edx, [eax + esi*8]
mov esi, dword [ecx + 4]
mov dword [ebp - 0x18], edx
cmp esi, dword [edx]
je 0x43a950
mov esi, dword [edx + 4]
mov esi, dword [esi]
nop dword [eax + eax]
cmp esi, dword [edx]
je 0x43a950
mov esi, dword [esi + 4]
cmp dword [esi + 0x1c], 8
lea eax, [esi + 8]
mov edx, dword [eax + 0x10]
jb 0x43a8e5
mov eax, dword [eax]
cmp dword [edi + 0x14], 8
mov ecx, edi
jb 0x43a8ef
mov ecx, dword [edi]
cmp ebx, edx
mov edx, dword [ebp - 0x18]
jne 0x43a8d0
push ebx
push eax
push ecx
call fcn.00440460
mov edx, dword [ebp - 0x18]
add esp, 0xc
test eax, eax
jne 0x43a8d0
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp - 0x1c]
push edi
mov ecx, dword [edi + 4]
mov eax, dword [edi]
mov dword [ecx], eax
mov edx, dword [edi]
mov ecx, dword [edi + 4]
mov dword [edx + 4], ecx
lea ecx, [ebx + 4]
dec dword [ebx + 8]
call fcn.00440240
mov eax, dword [ebp - 0x20]
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004fa0d4
mov esp, ebp
pop ebp
ret 0xc
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x18], edi
mov eax, dword [edi]
cmp esi, eax
je 0x43a97d
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
push dword [ebp - 0x24]
mov ebx, dword [ebp - 0x1c]
mov ecx, ebx
push esi
push edi
call fcn.00440360
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.004400f0
mov eax, dword [ebp - 0x20]
mov dword [eax], edi
mov byte [eax + 4], 1
jmp 0x43a932
Function at 0x43a9d0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x570620
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x5cc6c0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, ecx
mov dword [ebp - 0x18], eax
mov edi, dword [ebp + 0xc]
mov esi, edi
mov dword [ebp - 4], 0
cmp dword [edi + 0x14], 8
mov ebx, dword [edi + 0x10]
jb 0x43aa1a
mov esi, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
add ebx, ebx
je 0x43aa39
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x43aa25
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x18]
mov eax, dword [eax + 0xc]
and ecx, edx
mov esi, dword [ebp - 0x18]
mov dword [ebp - 0x24], ecx
lea edx, [eax + ecx*8]
mov esi, dword [esi + 4]
mov dword [ebp - 0x1c], edx
cmp dword [edx], esi
je 0x43aa59
mov esi, dword [edx + 4]
mov esi, dword [esi]
mov ebx, dword [edi + 0x10]
nop dword [eax]
cmp esi, dword [edx]
je 0x43aabf
mov esi, dword [esi + 4]
cmp dword [esi + 0x1c], 8
lea eax, [esi + 8]
mov edx, dword [eax + 0x10]
jb 0x43aa75
mov eax, dword [eax]
cmp dword [edi + 0x14], 8
mov ecx, edi
jb 0x43aa7f
mov ecx, dword [edi]
cmp ebx, edx
mov edx, dword [ebp - 0x1c]
jne 0x43aa60
push ebx
push eax
push ecx
call fcn.00440460
mov edx, dword [ebp - 0x1c]
add esp, 0xc
test eax, eax
jne 0x43aa60
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004fa0d4
mov esp, ebp
pop ebp
ret 0xc
mov ebx, dword [ebp - 0x18]
push edi
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
mov ecx, dword [eax + 4]
push ecx
mov dword [ebp - 0x20], ecx
lea ecx, [ebx + 4]
push eax
call fcn.0043a500
mov edx, eax
mov ecx, 0x71c71c6
mov eax, dword [ebx + 8]
sub ecx, eax
cmp ecx, 1
jb 0x43ab83
inc eax
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0x1c]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x20]
mov dword [eax], edx
mov edi, dword [ebx + 4]
mov edi, dword [edi]
mov dword [ebp - 0x20], edi
mov eax, dword [edi]
cmp esi, eax
je 0x43ab35
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
push dword [ebp - 0x24]
mov ecx, ebx
push esi
push edi
call fcn.00440360
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.004400f0
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
jmp 0x43aaa1
push str.list_T__too_long
call fcn.00460730
int3
Function at 0x43b0d0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x1c], 8
push ebx
mov ebx, dword [eax + 0x18]
push esi
lea esi, [eax + 8]
mov dword [ebp - 4], ecx
push edi
jb 0x43b0f3
mov esi, dword [esi]
xor edx, edx
mov edi, 0x811c9dc5
add ebx, ebx
je 0x43b111
nop
movzx ecx, byte [edx + esi]
inc edx
xor ecx, edi
imul edi, ecx, 0x1000193
cmp edx, ebx
jb 0x43b100
mov ebx, dword [ebp - 4]
mov ecx, dword [ebx + 0x18]
mov edx, dword [ebx + 0xc]
and ecx, edi
lea esi, [ecx*8]
mov ecx, dword [edx + esi]
add edx, esi
cmp dword [edx + 4], eax
jne 0x43b14a
cmp ecx, eax
jne 0x43b142
mov ecx, dword [ebx + 4]
mov dword [edx], ecx
mov edx, dword [ebx + 0xc]
mov ecx, dword [ebx + 4]
mov dword [esi + edx + 4], ecx
jmp 0x43b152
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
jmp 0x43b152
cmp ecx, eax
jne 0x43b152
mov ecx, dword [eax]
mov dword [edx], ecx
mov edx, dword [eax + 4]
lea ecx, [ebx + 4]
mov edi, dword [eax]
push eax
mov dword [edx], edi
mov esi, dword [eax]
mov edx, dword [eax + 4]
mov dword [esi + 4], edx
dec dword [ecx + 4]
call fcn.00440240
mov eax, dword [ebp - 8]
mov dword [eax], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x43e980
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x570e04
mov eax, dword fs:[0]
push eax
sub esp, 0x43c
mov eax, dword [0x5cc6c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x444], ecx
xorps xmm0, xmm0
mov dword [ebp - 0x438], 0
movq qword [ebp - 0x440], xmm0
mov dword [ebp - 0x440], 0
mov dword [ebp - 0x43c], 0
mov dword [ebp - 0x438], 0
push 0x20019
push str.ExtensionsContractIdWindows.ProtocolPackageId
push SysReAllocString
lea ecx, [ebp - 0x440]
mov dword [ebp - 4], 0
call fcn.00412e10
mov edi, dword [ebp - 0x440]
test eax, eax
jne 0x43eb9c
push 0x2c
call fcn.004f9dfc
mov ebx, eax
add esp, 4
mov dword [ebp - 0x424], ebx
mov byte [ebp - 4], 1
test ebx, ebx
je 0x43eaa0
lea edi, [ebx + 0xc]
mov dword [ebx + 4], 1
mov dword [ebx + 8], 1
lea ecx, [edi + 4]
mov dword [ebx], 0x583bc8
push 0
mov dword [edi], 0
push 0
mov dword [ebp - 0x448], edi
mov dword [edi + 4], 0
mov dword [edi + 8], 0
call fcn.0042b4a0
mov dword [edi + 4], eax
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
push 8
mov ecx, edi
mov byte [ebp - 4], 3
mov dword [edi], 0x3f800000
call fcn.00422610
mov edi, dword [ebp - 0x440]
jmp 0x43eaa2
xor ebx, ebx
xorps xmm0, xmm0
lea eax, [ebx + 0xc]
movlpd qword [ebp - 0x42c], xmm0
mov dword [ebp - 0x42c], eax
mov dword [ebp - 0x428], ebx
mov byte [ebp - 4], 4
xor esi, esi
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.0053f0a0
add esp, 0xc
mov dword [ebp - 0x424], 0x104
lea eax, [ebp - 0x434]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x218]
push eax
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x43eb77
push 0x208
push eax
lea eax, [ebp - 0x420]
push eax
call fcn.0053f0a0
lea eax, [ebp - 0x218]
push eax
push str.ExtensionsContractIdWindows.ProtocolPackageId
push str._s_sActivatableClassId
lea eax, [ebp - 0x420]
push 0x104
push eax
call fcn.004408b0
add esp, 0x18
mov eax, esp
mov dword [eax], 0
mov dword [eax + 4], 0
test ebx, ebx
je 0x43eb57
lock inc dword [ebx + 4]
lea ecx, [ebx + 0xc]
mov dword [eax + 4], ebx
mov dword [eax], ecx
lea eax, [ebp - 0x420]
mov ecx, dword [ebp - 0x444]
push eax
call fcn.0043db00
inc esi
jmp 0x43eac2
test ebx, ebx
je 0x43eb9c
or esi, 0xffffffff
mov eax, esi
lock xadd dword [ebx + 4], eax
jne 0x43eb9c
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax]
lock xadd dword [ebx + 8], esi
dec esi
jne 0x43eb9c
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 4]
test edi, edi
je 0x43eba7
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004fa0d4
mov esp, ebp
pop ebp
ret
Function at 0x440d40
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x10
movaps xmm0, xmmword [0x583ea0]
push esi
push edi
push 0
sub esp, 0x10
mov edi, ecx
mov dword [edi + 0x318], eax
mov eax, esp
push 0
push 0x86000000
push 0x583e30
push 0
movups xmmword [eax], xmm0
call fcn.00494150
push 0x6b
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.USER32.dll_LoadIconW]
mov esi, eax
test esi, esi
je 0x440da6
push esi
push 1
push 0x80
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
push esi
call dword [sym.imp.USER32.dll_DestroyIcon]
push 1
push ecx
mov dword [esp], 0x3f800000
lea eax, [ebp - 0x10]
push 0x190
push 0x2d0
push eax
call fcn.0041a130
add esp, 0x14
movups xmm1, xmmword [eax]
push 0x15
push 0xffffffffffffffff
movaps xmm0, xmm1
psrldq xmm0, 4
push 0xffffffffffffffff
movd eax, xmm0
push eax
movd eax, xmm1
push eax
push 0
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetWindowPos]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x440e00
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5710b0
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x5cc6c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebp + 8]
mov dword [ebx + 0x31c], eax
test eax, eax
je 0x440e4c
mov ecx, dword [ebx + 0x330]
push 0x64
call fcn.0049caf0
jmp 0x440fe2
mov ecx, dword [ebx + 0x328]
push 0x583e44
mov eax, dword [ecx]
call dword [eax + 0x30]
mov ecx, dword [ebx + 0x328]
push 0xffef3737
call fcn.00497560
mov ecx, dword [ebx + 0x32c]
push 1
mov eax, dword [ecx]
call dword [eax + 0x114]
mov ecx, dword [ebx + 0x330]
call fcn.0049c680
mov ecx, dword [ebx + 0x330]
mov esi, eax
push str.loadingprogress_retry_down.png
call fcn.0049cab0
mov ecx, dword [ebx + 0x330]
push esi
call fcn.0049caf0
mov ecx, dword [ebx + 0x334]
push 1
mov eax, dword [ecx]
call dword [eax + 0x114]
push 0x30
lea eax, [ebp - 0x58]
push 0
push eax
call fcn.0053f0a0
add esp, 0xc
lea ecx, [ebp - 0x58]
call fcn.0046b460
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edx, eax
mov dword [ebp - 0x60], 0
mov ecx, edx
mov dword [ebp - 0x5c], 7
xor eax, eax
mov word [ebp - 0x70], ax
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x440ef5
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x70]
call fcn.00406a80
lea eax, [ebp - 0x70]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x58]
call fcn.0046bcf0
lea ecx, [ebp - 0x70]
call fcn.00406060
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
push 4
push str.show
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 2
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], 7
mov word [ebp - 0x70], ax
call fcn.00406a80
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x58]
call fcn.0046bb00
lea ecx, [ebp - 0x70]
call fcn.00406060
cmp dword [ebp - 0x14], 8
lea edi, [ebp - 0x28]
cmovae edi, dword [ebp - 0x28]
cmp dword [ebp - 0x18], 1
jne 0x440fd2
movzx ecx, word [edi]
mov esi, 0x32
mov edx, 1
mov eax, 0x583e98
cmp ecx, esi
jb 0x440fd2
sub edi, eax
cmp cx, si
ja 0x440fd2
cmp edx, 1
je 0x440fbd
movzx ecx, word [edi + eax + 2]
add eax, 2
dec edx
movzx esi, word [eax]
cmp cx, si
jae 0x440fa3
jmp 0x440fd2
push 0
push 0
push 0x42a
push dword [ebx + 0x318]
call dword [sym.imp.USER32.dll_PostMessageW]
lea ecx, [ebp - 0x28]
call fcn.00406060
lea ecx, [ebp - 0x58]
call fcn.0046b5d0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004fa0d4
mov esp, ebp
pop ebp
ret 4
Function at 0x441d40
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, edi
mov dword [ebp - 4], ecx
cmp dword [edi + 0x14], 8
mov eax, dword [edi + 0x10]
jb 0x441d5c
mov esi, dword [edi]
lea ebx, [eax + eax]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x441d81
nop word [eax + eax]
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x441d70
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0xc]
and eax, edx
mov ebx, dword [ebx + 4]
mov edx, dword [ecx + eax*8]
lea eax, [eax*8 + 4]
add eax, ecx
mov dword [ebp - 8], edx
mov esi, edx
mov dword [ebp - 0xc], eax
cmp edx, ebx
jne 0x441dab
mov eax, ebx
jmp 0x441daf
mov eax, dword [eax]
mov eax, dword [eax]
cmp esi, eax
je 0x441e22
cmp dword [edi + 0x14], 8
lea eax, [esi + 8]
mov ecx, edi
jb 0x441dc0
mov ecx, dword [edi]
mov edi, dword [eax + 0x14]
cmp edi, 8
mov edx, dword [eax + 0x10]
mov dword [ebp - 0x10], edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x14], edx
jb 0x441dd6
mov eax, dword [eax]
push dword [edi + 0x10]
push ecx
push edx
push eax
call fcn.00441cf0
add esp, 0x10
test al, al
jne 0x441df2
mov esi, dword [esi]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
jmp 0x441da3
cmp dword [ebp - 0x10], 8
lea eax, [esi + 8]
jb 0x441dfd
mov eax, dword [eax]
cmp dword [edi + 0x14], 8
mov ecx, edi
jb 0x441e07
mov ecx, dword [edi]
push dword [ebp - 0x14]
push eax
push dword [edi + 0x10]
push ecx
call fcn.00441cf0
add esp, 0x10
mov ecx, ebx
test al, al
cmovne ecx, esi
mov eax, ecx
jmp 0x441e26
mov ecx, ebx
mov eax, ebx
cmp eax, ebx
jne 0x441e86
mov esi, dword [ebx]
lea eax, [ebp + 0xf]
mov ebx, dword [ebp - 4]
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], edi
mov edi, dword [esi + 4]
push eax
push 0x580fe0
push edi
push esi
lea ecx, [ebx + 4]
call fcn.00441420
mov edx, eax
mov ecx, 0x38e38e2
mov eax, dword [ebx + 8]
sub ecx, eax
cmp ecx, 1
jb 0x441e98
inc eax
mov ecx, ebx
mov dword [ebx + 8], eax
mov dword [esi + 4], edx
mov esi, dword [ebp + 8]
mov dword [edi], edx
mov eax, dword [ebx + 4]
mov eax, dword [eax]
push eax
add eax, 8
push eax
push esi
call fcn.00441580
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [eax], ecx
mov byte [eax + 4], 0
mov esp, ebp
pop ebp
ret 8
push str.list_T__too_long
call fcn.00460730
int3
Function at 0x441eb0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
cmp dword [edi + 0x1c], 8
lea esi, [edi + 8]
mov ebx, dword [edi + 0x18]
jb 0x441ed4
mov esi, dword [edi + 8]
xor ecx, ecx
mov edx, 0x811c9dc5
add ebx, ebx
je 0x441ef1
nop
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x441ee0
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0xc]
and eax, edx
lea edx, [eax*8]
mov eax, dword [ecx + edx]
add ecx, edx
cmp dword [ecx + 4], edi
jne 0x441f2a
cmp eax, edi
jne 0x441f22
mov eax, dword [ebx + 4]
mov dword [ecx], eax
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 4]
mov dword [edx + ecx + 4], eax
jmp 0x441f32
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x441f32
cmp eax, edi
jne 0x441f32
mov eax, dword [edi]
mov dword [ecx], eax
mov eax, dword [edi + 4]
lea ecx, [edi + 8]
mov esi, dword [edi]
mov dword [eax], esi
mov edx, dword [edi]
mov eax, dword [edi + 4]
mov dword [edx + 4], eax
dec dword [ebx + 8]
call fcn.00442360
push 0x48
push edi
call fcn.004f9e2c
mov eax, dword [ebp - 8]
add esp, 8
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8