joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4095f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x540fe8
mov eax, dword fs:[0]
push eax
sub esp, 0x234
mov eax, dword [0x5d8024]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x238], esi
mov dword [ebp - 0x23c], esi
mov dword [ebp - 0x234], 0
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0x5de798]
cmp eax, dword [ecx + 4]
jle 0x4096b8
push 0x5de798
call fcn.005221a5
add esp, 4
cmp dword [0x5de798], 0xffffffff
jne 0x4096b8
mov dword [ebp - 4], 1
xor eax, eax
mov dword [0x5de7ac], 0
mov dword [0x5de7b0], 0
mov dword [0x5de7ac], 0
mov dword [0x5de7b0], 7
mov word [0x5de79c], ax
mov byte [ebp - 4], 1
push 0x576fd0
call fcn.0052205d
add esp, 4
mov byte [ebp - 4], 0
push 0x5de798
call fcn.0052215b
add esp, 4
cmp dword [0x5de7ac], 0
jne 0x40976d
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x40976d
add eax, eax
cmp eax, 0x208
jae 0x4097a6
xor ecx, ecx
mov dword [ebp - 0x220], ecx
mov word [ebp + eax - 0x218], cx
xor eax, eax
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x220], ecx
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x21c], 7
lea edx, [ecx + 2]
mov word [ebp - 0x230], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x409724
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x230]
call fcn.00407c60
mov dword [ebp - 4], 4
lea eax, [ebp - 0x230]
push eax
mov ecx, 0x5de79c
call fcn.00486850
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x230]
call fcn.00407f30
push 0x5de79c
mov ecx, esi
call fcn.00406c50
mov dword [ebp - 4], 0
mov dword [ebp - 0x234], 1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00521dac
mov esp, ebp
pop ebp
ret
call fcn.0052239c
int3
Function at 0x409880
Capabilities:
Create directory
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x541169
mov eax, dword fs:[0]
push eax
sub esp, 0x234
mov eax, dword [0x5d8024]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x238], edi
mov eax, dword [ebp + 8]
mov dword [ebp - 0x23c], edi
mov dword [ebp - 0x234], 0
cmp dword [edx + 0x14], 8
jb 0x4098d0
mov edx, dword [edx]
lea ecx, [ebp - 0x218]
push ecx
push 0
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x40990f
xorps xmm0, xmm0
movups xmmword [edi], xmm0
movq qword [edi + 0x10], xmm0
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], 7
mov word [edi], ax
mov dword [ebp - 4], eax
mov dword [ebp - 0x234], 1
jmp 0x4099f0
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor eax, eax
mov dword [ebp - 0x220], 0
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x220], 0
lea edx, [ecx + 2]
mov dword [ebp - 0x21c], 7
mov word [ebp - 0x230], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x409965
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x230]
call fcn.00407c60
mov dword [ebp - 4], 3
lea eax, [ebp - 0x230]
push 1
sub esp, 0x18
mov dword [ebp - 0x238], esp
mov esi, esp
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x240], esp
push eax
call fcn.00406c50
mov byte [ebp - 4], 4
mov byte [ebp - 4], 3
mov ecx, esi
call fcn.00486920
add esp, 0x18
mov byte [ebp - 4], 5
mov byte [ebp - 4], 3
mov ecx, edi
call fcn.00486d50
mov byte [ebp - 4], 3
mov dword [ebp - 0x234], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x230]
call fcn.00407f30
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00521dac
mov esp, ebp
pop ebp
ret
Function at 0x409fe0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54148b
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x5d8024]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword fs:[0x2c]
mov edi, dword [eax]
mov eax, dword [0x5de7b4]
cmp eax, dword [edi + 4]
jle 0x40a06b
push 0x5de7b4
call fcn.005221a5
add esp, 4
cmp dword [0x5de7b4], 0xffffffff
jne 0x40a06b
mov dword [ebp - 4], 0
mov ecx, 0x5de7b8
call fcn.0040a1f0
mov byte [ebp - 4], 0
push 0x577020
call fcn.0052205d
mov dword [ebp - 4], 0xffffffff
push 0x5de7b4
call fcn.0052215b
add esp, 8
mov eax, dword [0x5de77c]
cmp eax, dword [edi + 4]
jle 0x40a0e7
push 0x5de77c
call fcn.005221a5
add esp, 4
cmp dword [0x5de77c], 0xffffffff
jne 0x40a0e7
mov dword [ebp - 4], 2
xor eax, eax
mov dword [0x5de790], 0
mov dword [0x5de794], 0
mov dword [0x5de790], 0
mov dword [0x5de794], 7
mov word [0x5de780], ax
mov byte [ebp - 4], 2
push 0x576f80
call fcn.0052205d
mov dword [ebp - 4], 0xffffffff
push 0x5de77c
call fcn.0052215b
add esp, 8
cmp dword [esi + 0x14], 8
mov edi, esi
mov ebx, dword [esi + 0x10]
jb 0x40a0f4
mov edi, dword [esi]
xor ecx, ecx
mov edx, 0x811c9dc5
add ebx, ebx
je 0x40a111
nop
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x40a100
push edx
push esi
lea eax, [ebp - 0x6c]
mov ecx, 0x5de7b8
push eax
call fcn.0040ad60
mov eax, dword [eax + 4]
test eax, eax
je 0x40a135
cmp eax, dword [0x5de7bc]
je 0x40a135
add eax, 0x20
jmp 0x40a13a
mov eax, 0x5de780
cmp dword [eax + 0x10], 0
jne 0x40a1cc
cmp dword [esi + 0x14], 8
mov edx, esi
jb 0x40a14e
mov edx, dword [esi]
push ecx
lea ecx, [ebp - 0x58]
call fcn.004097b0
add esp, 4
mov dword [ebp - 4], 5
lea ecx, [ebp - 0x40]
push esi
call fcn.00406c50
mov byte [ebp - 4], 6
lea eax, [ebp - 0x28]
mov dword [ebp - 0x5c], eax
lea ecx, [ebp - 0x28]
lea eax, [ebp - 0x58]
push eax
call fcn.00406c50
mov byte [ebp - 4], 0xa
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x60]
mov ecx, 0x5de7b8
push eax
call fcn.0040a470
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x28]
mov dword [ebp - 0x68], eax
mov byte [ebp - 4], 0xb
mov ecx, eax
call fcn.00407f30
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x40]
call fcn.00407f30
mov esi, dword [ebp - 0x60]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x58]
call fcn.00407f30
lea eax, [esi + 0x20]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00521dac
mov esp, ebp
pop ebp
ret
Function at 0x40b820
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54190d
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x5d8024]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x54], ecx
mov edi, dword [ebp + 0x14]
mov dword [ebp - 4], 0
mov dword [edi], 0
mov esi, dword [ebp + 0x10]
mov eax, dword [esi + 4]
sub eax, 0x200
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
cmp eax, 0xe
ja 0x40b8a4
push 0x10
call ebx
bt ax, 0xf
jb 0x40b948
push 0x11
call ebx
bt ax, 0xf
jb 0x40b948
push 0x12
call ebx
bt ax, 0xf
jb 0x40b948
mov eax, dword [esi + 4]
sub eax, 0x100
cmp eax, 9
ja 0x40b98e
push 0x11
call ebx
bt ax, 0xf
jae 0x40b8d2
mov eax, dword [esi + 8]
cmp eax, 0x58
je 0x40b8d2
cmp eax, 0x43
je 0x40b8d2
cmp eax, 0x56
jne 0x40b948
push 0x12
call ebx
bt ax, 0xf
jae 0x40b8ea
mov eax, dword [esi + 8]
cmp eax, 0x25
je 0x40b948
cmp eax, 0x27
je 0x40b948
cmp dword [esi + 4], 0x100
jne 0x40b98e
mov eax, dword [esi + 8]
cmp eax, 8
jne 0x40b940
mov ecx, dword [ebp - 0x54]
mov ecx, dword [ecx + 0x14]
call fcn.004153a0
mov dword [ebp - 0x54], eax
test eax, eax
je 0x40b917
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
mov byte [ebp - 4], 1
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x54]
test ecx, ecx
je 0x40b955
mov dl, 1
call fcn.00415480
test al, al
je 0x40b955
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x54]
call fcn.0040b5d0
mov eax, dword [esi + 8]
add eax, 0xffffff90
cmp eax, 0xb
ja 0x40b98e
mov dword [edi], 1
mov eax, 1
jmp 0x40b997
mov dword [edi], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x54]
call fcn.0040b5d0
mov eax, 1
jmp 0x40b997
mov dword [ebp - 4], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00521dac
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40cc20
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x541f7d
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5d8024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov eax, dword [edi]
cmp dword [eax - 0xc], 0
je 0x40cd5a
mov eax, dword [0x5de4c8]
mov ecx, edi
push dword [eax - 0xc]
lea eax, [ebp + 8]
push eax
call fcn.0040d090
mov dword [ebp - 4], 0
mov edx, eax
mov ecx, 0x5de4c8
call fcn.0040cff0
mov bl, al
mov dword [ebp - 4], 0xffffffff
or esi, 0xffffffff
mov edx, dword [ebp + 8]
mov ecx, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x40cca1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test bl, bl
je 0x40ccfa
mov eax, dword [0x5de4c8]
mov ecx, edi
push dword [eax - 0xc]
lea eax, [ebp + 8]
push eax
call fcn.0040d220
mov dword [ebp - 4], 2
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40cd3b
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x40cd3b
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40ccfa
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 1
lea eax, [ebp + 8]
mov ecx, edi
push eax
call fcn.0040d150
mov dword [ebp - 4], 5
mov ecx, 0x5856ec
mov eax, dword [eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40cd70
test dx, dx
je 0x40cd37
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40cd70
add eax, 4
add ecx, 4
test dx, dx
jne 0x40cd15
xor edi, edi
jmp 0x40cd75
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
lea edx, [eax - 0x10]
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x40cd5a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
sbb edi, edi
or edi, 1
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
lea edx, [eax - 0x10]
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x40cd94
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test edi, edi
je 0x40cd5a
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x415050
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x540960
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x5d8024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4150d5
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4150d5
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x4150b7
cmp esi, edx
jae 0x4150d5
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x4150a5
cmp esi, edx
jae 0x4150d5
cmp word [esi], 0
je 0x4150d5
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x415560
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x543860
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x5d8024]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov esi, ecx
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x44], 0
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0x5de804]
cmp eax, dword [ecx + 4]
jle 0x415657
push 0x5de804
call fcn.005221a5
add esp, 4
cmp dword [0x5de804], 0xffffffff
jne 0x415657
mov dword [ebp - 4], 1
mov dword [0x5de808], 0
mov dword [0x5de80c], 0
mov dword [0x5de810], 0
mov byte [ebp - 4], 2
mov dword [0x5de814], 0
mov dword [0x5de818], 0
mov dword [0x5de81c], 0
mov byte [ebp - 4], 3
mov dword [0x5de820], 0
mov dword [0x5de824], 0
mov dword [0x5de828], 0
mov byte [ebp - 4], 1
push 0x5772d0
call fcn.0052205d
mov byte [ebp - 4], 0
push 0x5de804
call fcn.0052215b
add esp, 8
push 0x585f08
push str.html
mov edx, 0x585f1c
lea ecx, [ebp - 0x28]
call fcn.00409a10
add esp, 8
mov dword [ebp - 4], 5
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.00486640
mov byte [ebp - 4], 6
cmp dword [eax + 0x14], 8
jb 0x415690
mov eax, dword [eax]
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0x50], 0x5853b8
mov dword [ebp - 0x4c], edi
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x40]
call fcn.00407f30
cmp edi, 0xffffffff
jne 0x4156fe
xor eax, eax
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov dword [ebp - 0x44], 1
mov byte [ebp - 4], 5
push edi
mov dword [ebp - 0x50], 0x5853b8
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x4c], 0
jmp 0x415783
mov eax, dword [0x5de80c]
lea ecx, [ebp - 0x28]
push ecx
cmp eax, dword [0x5de810]
je 0x415726
mov ecx, eax
mov dword [ebp - 0x58], eax
call fcn.00406c50
mov byte [ebp - 4], 8
add dword [0x5de80c], 0x18
jmp 0x415731
push eax
mov ecx, 0x5de808
call fcn.00490060
cmp dword [ebx + 0x14], 8
mov ecx, ebx
jb 0x41573b
mov ecx, dword [ebx]
mov eax, dword [ebx + 0x10]
lea edx, [ebp - 0x48]
push 0
push edx
add eax, eax
mov dword [ebp - 0x48], 0
push eax
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
lea ecx, [ebp - 0x28]
call fcn.00486640
mov dword [ebp - 0x44], 1
mov byte [ebp - 4], 5
mov dword [ebp - 0x50], 0x5853b8
test edi, edi
je 0x415783
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x4c], 0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00407f30
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00521dac
mov esp, ebp
pop ebp
ret
Function at 0x4161d0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x543b9d
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x5d8024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edx, dword [ebp + 0xc]
mov edi, edx
cmp dword [edx + 0x14], 8
mov eax, dword [edx + 0x10]
jb 0x41620a
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
add eax, eax
je 0x41622b
mov edx, eax
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x416217
mov edx, dword [ebp + 0xc]
push esi
push edx
lea eax, [ebp - 0x20]
mov ecx, ebx
push eax
call fcn.0040ad60
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x41625c
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [ebx + 8], 0x5d1745d
je 0x4163bf
lea eax, [ebx + 4]
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0
push 0x2c
mov dword [ebp - 0x14], 0
call fcn.00521dee
mov edi, eax
add esp, 4
mov dword [ebp - 0x14], edi
push dword [ebp + 0xc]
lea eax, [edi + 8]
mov ecx, eax
mov dword [ebp - 0x10], eax
call fcn.00406c50
mov byte [ebp - 4], 1
xorps xmm0, xmm0
movq qword [edi + 0x20], xmm0
mov dword [edi + 0x28], 0
mov dword [ebp - 4], 3
mov eax, dword [ebx + 8]
inc eax
movss xmm3, dword [ebx]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x59f5a0]
mov eax, dword [ebx + 0x1c]
movd xmm1, eax
cvtdq2pd xmm1, xmm1
shr eax, 0x1f
cvtpd2ps xmm0, xmm0
addsd xmm1, qword [eax*8 + 0x59f5a0]
movaps xmm2, xmm0
cvtpd2ps xmm1, xmm1
divss xmm2, xmm1
comiss xmm2, xmm3
jbe 0x41634f
divss xmm0, xmm3
call fcn.0040adf0
call fcn.005403d0
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebx + 0x1c]
cmp eax, ecx
jae 0x416333
cmp eax, 0x200
jae 0x416331
shl eax, 3
cmp eax, ecx
jae 0x416333
mov eax, ecx
push eax
mov ecx, ebx
call fcn.00416510
push esi
lea eax, [edi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.0040ad60
mov edx, dword [eax]
jmp 0x416352
mov edx, dword [ebp - 0x20]
mov eax, dword [ebx + 8]
mov ecx, dword [edx + 4]
inc eax
mov dword [ebx + 8], eax
mov dword [edi], edx
mov dword [edi + 4], ecx
mov dword [ecx], edi
mov dword [edx + 4], edi
mov eax, dword [ebx + 0x18]
mov dword [ebp + 0xc], ecx
and eax, esi
mov ecx, dword [ebx + 0xc]
mov dword [ebp - 0x14], 0
mov esi, dword [ecx + eax*8]
cmp esi, dword [ebx + 4]
jne 0x416385
mov dword [ecx + eax*8], edi
jmp 0x416397
cmp esi, edx
jne 0x41638e
mov dword [ecx + eax*8], edi
jmp 0x41639b
mov edx, dword [ebp + 0xc]
cmp dword [ecx + eax*8 + 4], edx
jne 0x41639b
mov dword [ecx + eax*8 + 4], edi
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.0051ff55
int3
Function at 0x418ca0
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
mov ebx, ecx
push edi
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea edi, [eax + 1]
test edi, edi
js 0x418d1a
mov esi, dword [esp + 0x10]
mov ecx, 1
mov edx, dword [esi]
mov eax, dword [edx - 8]
sub ecx, dword [edx - 4]
sub eax, edi
or ecx, eax
jge 0x418cd5
push edi
mov ecx, esi
call fcn.00408d50
mov edx, dword [esi]
push edi
push edx
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov edi, eax
mov ecx, edi
cmp edi, 0xffffffff
jne 0x418cfc
mov ecx, dword [esi]
test ecx, ecx
je 0x418d00
push dword [ecx - 8]
push ecx
call fcn.0052a05f
add esp, 8
mov ecx, eax
test ecx, ecx
js 0x418d1a
mov eax, dword [esi]
cmp ecx, dword [eax - 8]
jg 0x418d1a
mov dword [eax - 0xc], ecx
xor edx, edx
mov eax, dword [esi]
mov word [eax + ecx*2], dx
mov eax, edi
pop edi
pop esi
pop ebx
ret 4
push 0x80070057
call fcn.00408fc0
int3
Function at 0x422860
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x545eb2
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x5d8024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
push dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push esi
call fcn.00474ea0
mov dword [ebp - 4], 0
mov ecx, esi
mov dword [edi + 0x178], 0
add edi, 0x17c
mov dword [ebp + 0xc], edi
mov eax, dword [esi]
call dword [eax + 8]
mov edx, dword [esi]
mov ecx, esi
mov ebx, eax
call dword [edx + 4]
lea esi, [edi + 8]
mov dword [edi], eax
mov dword [ebp - 0x14], esi
mov dword [esi + 8], eax
xor eax, eax
mov dword [edi + 4], ebx
mov dword [esi], 0x58bacc
mov dword [esi + 4], ebx
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 7
mov word [esi + 0xc], ax
mov byte [ebp - 4], 1
mov byte [esi + 0x24], al
mov byte [ebp - 4], 2
lea ecx, [edi + 0x30]
call fcn.00425580
mov byte [ebp - 4], 3
mov dword [edi + 0x50], 0
mov dword [edi + 0x54], 0
mov dword [edi + 0x58], 0
mov byte [ebp - 4], 4
lea ecx, [edi + 0x5c]
call fcn.00425650
mov byte [ebp - 4], 5
mov ecx, esi
mov eax, dword [esi]
push ebx
call dword [eax + 0xc]
mov byte [ebp - 4], 6
mov ebx, dword [ebp - 0x10]
lea eax, [ebx + 0x1f8]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp + 8]
mov dword [eax], str.AI_CHECK_BOX_IMAGES
mov dword [eax + 4], ecx
mov dword [eax + 8], 0
mov byte [ebp - 4], 7
mov dword [eax + 0xc], 0
mov byte [ebp - 4], 9
mov dword [ebx], 0x588488
mov dword [ebx + 0x24], 0x5883a4
mov dword [ebx + 0x28], 0x588390
mov dword [ebx + 0x20c], 0
mov byte [ebp - 4], 0xa
mov dword [ebx + 0x210], 0x40
mov dword [ebx + 0x214], 0
mov dword [ebx + 0x218], 0
mov dword [ebx + 0x21c], 0
mov byte [ebp - 4], 0xb
lea ecx, [ebx + 0x220]
call fcn.00424b20
mov byte [ebp - 4], 0xc
lea ecx, [ebx + 0x240]
call fcn.00424b20
mov byte [ebp - 4], 0xd
lea ecx, [ebx + 0x260]
call fcn.00424b20
mov byte [ebp - 4], 0xe
lea esi, [ebx + 0x280]
mov dword [ebp + 8], esi
push 0x40
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00521dee
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov byte [ebp - 4], 0x10
mov dword [ebx + 0x288], 0
mov dword [ebx + 0x28c], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x422b50
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54601d
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x5d8024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 2
lea esi, [edi + 0x5c]
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 5
lea ecx, [esi + 0xc]
call fcn.0040a2a0
mov byte [ebp - 4], 2
mov edx, dword [esi + 4]
call fcn.00426a70
push 0x38
push dword [esi + 4]
call fcn.00521dbd
add esp, 8
mov byte [ebp - 4], 1
lea ecx, [edi + 0x50]
call fcn.00424d00
mov byte [ebp - 4], 0
lea esi, [edi + 0x30]
mov dword [ebp - 0x18], esi
mov byte [ebp - 4], 8
lea ecx, [esi + 0xc]
call fcn.0040a2a0
mov byte [ebp - 4], 0
mov edx, dword [esi + 4]
call fcn.00426800
push 0x24
push dword [esi + 4]
call fcn.00521dbd
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [edi + 8]
call fcn.0044be70
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret