joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1007a547
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1008d38c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.10072f1c
mov dword [ebp - 0x14], eax
cmp dword [0x10679ed0], esi
jne 0x1007a63a
push 0x800
push esi
push 0x1000a7bc
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x1007a5c7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x1007a71a
push esi
push esi
push 0x1000a7bc
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x1007a71a
push 0x1000a7d4
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1007a71a
push eax
call ebx
push 0x1000a7e0
push edi
mov dword [0x10679ed0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x1000a7f0
push edi
mov dword [0x10679ed4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x1000a804
push edi
mov dword [0x10679ed8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10679ee0], eax
test eax, eax
je 0x1007a637
push 0x1000a820
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10679edc], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1007a65f
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x1007a652
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x1007a674
push 4
pop eax
jmp 0x1007a71c
cmp dword [ebp - 0x14], esi
je 0x1007a674
push dword [0x10679ed0]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x1007a659
mov eax, dword [0x10679edc]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x1007a6d2
cmp dword [0x10679ee0], edi
je 0x1007a6d2
push eax
call ebx
push dword [0x10679ee0]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x1007a6d2
test eax, eax
je 0x1007a6d2
call ecx
test eax, eax
je 0x1007a6c7
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x1007a6c7
test byte [ebp - 8], 1
jne 0x1007a6d2
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x1007a702
mov eax, dword [0x10679ed4]
cmp eax, edi
je 0x1007a6ff
push eax
call ebx
test eax, eax
je 0x1007a6ff
call eax
mov esi, eax
test esi, esi
je 0x1007a6ff
mov eax, dword [0x10679ed8]
cmp eax, edi
je 0x1007a6ff
push eax
call ebx
test eax, eax
je 0x1007a6ff
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x10679ed0]
call ebx
test eax, eax
je 0x1007a71a
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x1007a71c
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call main
mov esp, ebp
pop ebp
ret
Function at 0x417c10
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0xc0
push esi
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov ecx, dword [0x4c5adc]
push ecx
call sub.IMM32.dll_ImmGetContext
test esi, esi
mov dword [0x4c5adc], eax
je 0x417c53
lea edx, [esp + 4]
push edx
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
pop esi
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0xe]
mov eax, dword [esp + 0xc4]
and ecx, 0xffff
and edx, 0xffff
mov dword [eax], ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 4], edx
mov edx, dword [esp + 0xa]
and ecx, 0xffff
and edx, 0xffff
mov dword [eax + 8], ecx
mov ecx, dword [esp + 6]
mov dword [eax + 0xc], edx
mov edx, dword [esp + 4]
and ecx, 0xffff
and edx, 0xffff
mov dword [eax + 0x10], ecx
mov ecx, dword [esp + 0xbc]
mov dword [eax + 0x14], edx
mov edx, dword [esp + 0x14]
add edx, ecx
xor ecx, ecx
test edx, edx
mov edx, dword [eax + 0x20]
setl cl
shl ecx, 1
and edx, 0xfffffffd
or ecx, edx
or ecx, 1
mov dword [eax + 0x20], ecx
add esp, 0xc0
ret 4

Function at 0x42e7c7
Capabilities:
Encode data using xor

Disassembly:
push edx
dec edx
cmc
invalid
loopne 0x42e75c
loope 0x42e822
daa
sbb edx, eax
mov al, 0xe6
fucomi st(6)
daa
dec esi
cmc
xor ebx, edi
les ecx, [eax]
loopne 0x42e7d4
hlt
pop esi
int1
jp 0x42e835
xchg ebp, eax
pop ss
dec edx
xchg esi, eax
dec ecx
rcr byte [eax - 0x1d], 0x90
invalid
repne stosb byte es:[edi], al
call 0x40406ec6
mov ebx, 0xccf89fe8
and byte [edi - 7], dl
xchg ebp, eax
inc eax
nop
xchg esp, eax
and esi, dword [ecx - 0x7c]
salc
and bl, byte [ebp - 0x18bfff55]
adc ebp, 0xc0bf7b7a
xchg ebp, eax
rcr bl, 1
shl dword [ebx - 0x74bae0b4], 0xe7
movsd dword es:[edi], dword [esi]
mov dh, 0xaf
imul esp, edx, 0x2a81e778
out dx, al
scasd eax, dword es:[edi]
bound edx, qword [esp + eax - 0x6e076d4a]
invalid

Function at 0x44dfe7
Capabilities:
Encode data using xor

Disassembly:
in eax, 0xa9
xor dword [edi - 0x4f], ebx
inc esp
xor eax, 0xb3380178
sbb ah, byte [ebx + 0x647845e2]
adc byte [esi - 0x27], 0x9d
aaa
xor al, 0xf8
cmp byte [0x65edb795], bl
movsb byte es:[edi], byte [esi]
insb byte es:[edi], dx
jno 0x44dfd2
cmp byte [edi - 0x35], dl
cmp eax, 0x9819c53a
sbb eax, 0x6b782e94
dec edx
in al, 0x96
mov edi, 0x387da0f5
les esp, [edi]
add al, 0x12
salc
push es
test dl, 0x75
cmc
cmpsb byte [esi], byte es:[edi]
xchg edi, eax
std
adc byte [ebp - 0x5bdb69d6], ah
or ch, dh
pop ebx
test al, 0xc0
lodsd eax, dword [esi]
sbb eax, 0xfb9637ce
out 0x16, al
das
add eax, 0x6717f60d
and dword [0xd4165047], eax
jo 0x44e080
push eax
push ss
aam 0x70
inc ebp
mov ch, cl
sbb ah, byte [ecx]
out 0x9d, eax
ret
js 0x44e036
mov cl, 0xe7
push esi
aam 0x59
popfd
jo 0x44e04f
fsubr dword [ebp + 0x11]
invalid
Function at 0x47bbb3
Capabilities:
Encode data using xor

Disassembly:
push esi
jg 0x47bbb8
push ebp
xor al, 0x6f
pop es
salc
bound esp, qword [esi - 0x50]
push ds
xchg edx, eax
das
out dx, al
inc esi
jmp 0x47bba6
movsb byte es:[edi], byte [esi]
pop ss
add edx, dword [esi]
xchg byte [ecx], dl
mov ah, byte [0xf576aa67]
scasb al, byte es:[edi]
mov dword [0xd1d9638], eax
outsd dx, dword [esi]
xchg ebx, eax
xchg esi, edx
pop esp
adc ecx, dword [eax - 0x241b33aa]
add bl, cl
push esi
cmpsb byte [esi], byte es:[edi]
pop ecx
mov bx, 0xbecb
inc bp
xor byte cs:[esi + 0x6dd3aea6], ah
test esi, edi
jne 0x47bbcf
insb byte es:[edi], dx
or al, dh
xchg edx, eax
test dh, ch
mov dh, 0xb3
out dx, al
invalid

Function at 0x4ba3b5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c2398
cmp edx, dword [eax]
je 0x4ba3d7
add eax, 8
inc ecx
cmp eax, 0x4c2428
jl 0x4ba3c8
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c2398]
jne 0x4ba505
mov eax, dword [0x4c6d1c]
cmp eax, 1
je 0x4ba4df
test eax, eax
jne 0x4ba408
cmp dword [0x4c22c4], 1
je 0x4ba4df
cmp edx, 0xfc
je 0x4ba505
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4ba43f
lea eax, [ebp - 0x1a4]
push 0x4bf848
push eax
call fcn.004bada0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bb230
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4ba482
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bb230
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4bf844
push edi
call fcn.004bd100
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x4bf828
push eax
call fcn.004bada0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004badb0
lea eax, [ebp - 0xa0]
push 0x4bf824
push eax
call fcn.004badb0
push dword [esi + 0x4c239c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004badb0
push 0x12010
lea eax, [ebp - 0xa0]
push 0x4bf7fc
push eax
call fcn.004bd074
add esp, 0x2c
pop edi
jmp 0x4ba505
lea eax, [ebp + 8]
lea esi, [esi + 0x4c239c]
push 0
push eax
push dword [esi]
call fcn.004bb230
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x4afce4
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
jmp 0x4afda3
cmp dword [esi + 0x10], 0x1000
jne 0x4afd8f
test byte [esi + 0x15], 1
jne 0x4afd8f
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4afd40
cmp ebp, 2
je 0x4afd40
cmp ebp, 0x10
je 0x4afd40
cmp ebp, 0x20
jne 0x4afd5c
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4afd5c
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4afd6d
mov eax, dword [esi]
add eax, ebx
call fcn.004afcdc
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4afd60
cmp byte [esp + 4], 0
je 0x4afd8f
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4afd15
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403ac5
nop
nop
sub eax, 0x403a6b
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x42e01e
nop
nop
popal
nop
nop
nop
jmp fcn.00401219
Function at 0x405a3d
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
push eax
and dword [eax + 0x24], 0
mov dword [eax], 0x3c
call dword [sym.imp.shell32.dll_ShellExecuteExW]
ret 4

Function at 0x405b23
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x405b32
pop dword [ebp - 0x44]
mov eax, 0xb86a0033
sub eax, 0xb829a501
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0x842043cc
add dword [ebp - 0x54], 0xca32017f
mov dword [ebp - 0x50], 0xd6aec6e5
add dword [ebp - 0x50], 0x5b848560
mov dword [ebp - 0x4c], 0xa2f1f052
add dword [ebp - 0x4c], 0xa95a53dc
mov dword [ebp - 0x48], 0x2d7fc7f4
add dword [ebp - 0x48], 0xd280380c
lea eax, [ebp - 0x54]
push eax
mov eax, 0xa34d55f3
sub eax, 0xa30cd57b
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0xf9163483
add dword [ebp - 0x54], 0x7b5c34d3
mov dword [ebp - 0x50], 0x2898bfe3
add dword [ebp - 0x50], 0x18d3a192
mov dword [ebp - 0x4c], 0xa5c44773
sub dword [ebp - 0x4c], 0x4254db07
mov dword [ebp - 0x48], 0x4fa3ea8
sub dword [ebp - 0x48], 0x4fa3ea8
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x3a0c4
push 0
call eax
mov ecx, 0x5427
mov ebx, eax
mov edi, 0xd1a90d06
add edi, 0x2e9c06fa
add edi, dword [ebp - 0x44]
mov edx, 0xcf93f0a8
sub edx, 0x6ec5d096
add dword [ebp - 0x30], ecx
mov esi, dword [edi]
add dword [ebp - 0x34], ecx
add esi, edx
xor dword [ebp - 0xc], 0x7830effb
mov dword [ebx], esi
xor dword [ebp - 0x10], ebx
add ebx, 4
add edi, 0x6087ea5e
add edi, 0x9f7815a6
loop 0x405c49
add eax, 0x5860364d
add eax, 0xa7a10d22
mov ebx, eax
add eax, 0x1fab472
sub eax, 0x1fab46d
mov ecx, 0xbc7d96ca
sub ecx, 0xbc3d96ca
add ecx, dword [ebp - 0x44]
call ebx
leave
ret

Function at 0x405dee
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x42fa70
push esi
call fcn.00406411
push esi
call fcn.00405d91
mov edi, eax
test edi, edi
jne 0x405e0f
xor eax, eax
jmp 0x405e67
push edi
call fcn.004066c0
test byte [0x434f1c], 0x80
je 0x405e2c
mov ax, word [edi]
test ax, ax
je 0x405e0b
cmp ax, 0x5c
je 0x405e0b
sub edi, esi
sar edi, 1
jmp 0x405e46
call fcn.0040676f
test eax, eax
je 0x405e40
test byte [eax], 0x10
je 0x405e0b
push esi
call fcn.00405d32
push esi
call sub.kernel32.dll_lstrlenW
cmp eax, edi
push esi
jg 0x405e32
call fcn.00405ce6
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x405ee2
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
je 0x405f01
and al, 0xfe
push eax
push dword [esp + 0xc]
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
mov eax, esi
pop esi
ret 4
Function at 0x403e5e
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0x7c
mov edx, dword [ebx + 0x30]
mov eax, dword [ebx + 0x34]
mov dword [esp + 0xc], 0
sub eax, edx
mov dword [esp + 4], edx
mov dword [esp + 8], eax
mov eax, dword [ebx + 0x40]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_send]
sub esp, 0x10
cmp eax, 0xffffffff
jne 0x403f0e
mov edi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call edi
cmp eax, 0x2733
je 0x403f8a
call edi
mov dword [esp + 8], str.send_error__d
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x68]
mov dword [esp + 4], 0x50
mov dword [esp], eax
call fcn.00520860
mov dword [esp + 4], str.ERROR:_while_sending_err
mov dword [esp], 0x5694e0
call fcn.004c8905
mov esi, eax
call edi
mov dword [esp], esi
lea esi, [ebp - 0x6c]
mov dword [esp + 4], eax
call fcn.004c8a58
mov dword [esp], eax
call fcn.004c8cf3
mov eax, dword [ebx]
mov ecx, esi
mov edi, dword [eax + 0x14]
mov dword [esp], str.peer_closed_connection
call fcn.004c639a
push ecx
jmp 0x403f45
mov edx, dword [ebx + 0x30]
lea ecx, [ebx + 0x30]
add eax, edx
mov dword [esp], edx
mov dword [esp + 4], eax
call fcn.004c71d8
mov eax, dword [ebx + 0x34]
push edx
push edx
cmp dword [ebx + 0x30], eax
jne 0x403e69
cmp byte [ebx + 0x45], 0
je 0x403f5f
mov eax, dword [ebx]
lea esi, [ebp - 0x68]
mov ecx, esi
mov edi, dword [eax + 0x14]
call fcn.004c62d0
mov ecx, ebx
mov dword [esp + 4], esi
mov dword [esp], 0
call edi
mov ecx, esi
push eax
push eax
call fcn.004c616a
jmp 0x403f8a
mov ecx, dword [ebx + 0x38]
call method.IWindow.getHandle__
mov dword [esp + 0xc], 0x21
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x40]
mov dword [esp + 8], 0x8001
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_WSAAsyncSelect]
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x42dd66
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, ecx
push ebx
sub esp, 0x3c
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
test byte [eax], 0x10
jne 0x42dd82
cmp dword [eax + 8], 0
jne 0x42dd95
add eax, 0x14
mov ecx, esi
mov dword [esp], eax
call fcn.004c6316
push edi
jmp 0x42de82
mov ecx, dword [ebp + 8]
call method.IWindow.getHandle__
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
push ebx
test eax, eax
jne 0x42ddb7
mov ecx, esi
call fcn.004c62d0
jmp 0x42de82
lea ebx, [eax + 1]
mov eax, dword [ebp + 8]
cmp byte [eax + 4], 0
je 0x42de16
lea eax, [ebx + ebx]
mov edx, esp
add eax, 0xf
mov dword [ebp - 0x2c], edx
shr eax, 4
shl eax, 4
call fcn.004cb790
mov ecx, dword [ebp + 8]
sub esp, eax
call method.IWindow.getHandle__
lea edi, [esp + 0xc]
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
sub esp, 0xc
mov dword [esp + 8], 0xffffffff
mov dword [esp + 4], edi
mov dword [esp], esi
call fcn.0042ce4b
mov edx, dword [ebp - 0x2c]
mov esp, edx
jmp 0x42de82
lea edi, [ebp - 0x1c]
mov ecx, edi
call fcn.004c62d0
mov dword [esp + 4], 0
mov ecx, edi
mov dword [esp], ebx
call fcn.004c6976
push eax
push eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + 8]
lea edx, [eax + 4]
mov dword [ebp - 0x2c], edx
call method.IWindow.getHandle__
mov dword [esp + 8], ebx
mov edx, dword [ebp - 0x2c]
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, edi
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.004c6976
mov ecx, esi
push edx
push edx
mov dword [esp], edi
call fcn.004c633e
push ecx
mov ecx, edi
call fcn.004c616a
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret 4
Function at 0x42e820
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0x2c
mov edx, dword [ecx + 8]
mov al, byte [edx]
mov ecx, eax
shr cl, 1
and ecx, 1
and ecx, dword [ebp + 8]
mov byte [ebp - 0x19], cl
mov ecx, eax
shr cl, 2
and ecx, 1
cmp cl, byte [ebp - 0x19]
je 0x42e964
movzx esi, byte [ebp - 0x19]
and eax, 0xfffffffb
lea ecx, [esi*4]
or eax, ecx
mov byte [edx], al
mov eax, dword [ebx + 8]
test byte [eax], 0x10
jne 0x42e88e
cmp dword [eax + 8], 0
je 0x42e88e
cmp byte [ebp - 0x19], 0
jne 0x42e88e
mov ecx, ebx
call method.IWindow.getHandle__
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
push esi
mov dword [esp], 0
mov ecx, ebx
call method.IWindow.getChild_IWindow_
movzx esi, byte [ebp - 0x19]
push ecx
mov edi, eax
test edi, edi
je 0x42e8c1
mov dword [esp], esi
mov ecx, edi
call method.IWindow.parentVisibilityChanged_bool_
mov ecx, ebx
push eax
mov dword [esp], edi
call method.IWindow.getChild_IWindow_
mov edi, eax
push edx
jmp 0x42e8a3
cmp byte [ebp - 0x19], 0
je 0x42e8ce
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x7c]
mov eax, dword [ebx + 8]
test byte [eax], 0x10
jne 0x42e8fc
cmp dword [eax + 8], 0
je 0x42e8fc
cmp byte [ebp - 0x19], 0
je 0x42e8fc
mov ecx, ebx
call method.IWindow.getHandle__
mov dword [esp + 4], 8
mov dword [esp], eax
call dword [sym.imp.USER32.dll_ShowWindow]
push ecx
push ecx
mov edi, dword [ebx + 8]
test byte [edi], 0x10
je 0x42e92c
cmp dword [edi + 8], 0
je 0x42e92c
mov ecx, ebx
add edi, 0x24
call method.IWindow.getHandle__
mov dword [esp + 8], 0
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.USER32.dll_InvalidateRect]
sub esp, 0xc
mov eax, dword [ebx]
mov dword [esp], esi
mov ecx, ebx
call dword [eax + 0xc]
cmp byte [ebp - 0x19], 0
push edx
jne 0x42e964
cmp ebx, dword [0x568978]
jne 0x42e964
mov dword [0x568978], 0
mov dword [esp], 0
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, ebx
push eax
mov eax, dword [ebx]
call dword [eax + 0x3c]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 4

Function at 0x42eedc
Capabilities:
Hash data using murmur3

Disassembly:
mov ebx, eax
test eax, eax
jne 0x42eec1
mov dword [esp + 4], str.ERROR:_DeferWindowPos_failed
mov dword [esp], 0x5694e0
call fcn.004c8905
mov dword [esp], eax
call fcn.004c8cf3
mov eax, dword [esi]
mov ecx, esi
mov dword [esp], ebx
call dword [eax + 0xc]
test ebx, ebx
push eax
setne al
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, ecx
pushal
pushfd
dec ebx
inc edi
shr edi, 2
test eax, ebp
jo 0x42ee9f
add esi, eax
mov ebx, esi
xor eax, 0xe1895e4
neg esi
shr eax, 0x16
neg esi
rol esi, 0x15
xor edx, 0x130fa08b
mov dword [0x522998], ecx
dec eax
xchg esi, edx
or ebx, dword [0x522248]
xchg esi, eax
mov edx, edx
mov esi, eax
rol ecx, 1
dec eax
shl esi, 6
sub dword [0x522b1e], ecx
xor ebx, esi
sub ebx, 0x25feb10
or esi, edi
or esi, edi
mov ebx, esp
xchg ebx, eax
xor edx, esi
mov ebx, edi
xor ecx, dword [str.This_is_for_peer_challenge]
mov ecx, 0x899046
Function at 0x42ef4a
Capabilities:
Hash data using murmur3

Disassembly:
xchg eax, eax
mov edi, dword [0x522596]
sub dword [0x522a34], 0x4cf4958
inc esi
mov dword [0x522b2b], ecx
ror esi, 0x1b
test esp, ebx
jo 0x42ef82
inc ebx
sub ebx, dword [0x52212a]
loop method.IWindow.create_IWindow_
shl eax, 0x1f
xor ecx, ebp
rol eax, 0x16
mov ecx, dword [0x5226be]
shl eax, 0x17
loopne 0x42ef9b
rol esi, 0x1e
mov eax, esi
add edx, 0xbef7758
shl edx, 0x13
shr ecx, 9
shl eax, 6
mov ecx, 0x345e1c
xor al, 0
shr edx, 0x11
inc eax
xchg esi, eax
inc esi
mov dword [0x5229d4], 0x27c00c36
neg eax
mov dword [0x5229b0], 0x6a69800
xor dword [0x522ab7], 0x730c224
shl ebx, 0xc
mov dword [0x522b28], edx
loop 0x42ef9d
xor esi, esi
and esi, edi
call fcn.00422c0b
invalid
invalid
mov edi, 0x1a4a96e0
dec edx
rol eax, 0x19
dec eax
mov esi, edx
neg esi
mov edi, esi
dec eax
neg ecx
xchg esi, edx
rol eax, 0xe
or esi, edi
xor ecx, dword [0x522020]
shl ebx, 0x18
invalid

Function at 0x42f0ce
Capabilities:
Hash data using murmur3

Disassembly:
sbb eax, 0x334a0600
test byte [eax - 0x75], 0xf4

Function at 0x42f0ec
Capabilities:
Hash data using murmur3

Disassembly:
mov byte [0x33096e0b], al
enter 0xffffffffffffe9c1, 0x12

Function at 0x42f136
Capabilities:
Hash data using murmur3

Disassembly:
or dword [0x522926], edi
not esi
add esi, eax
call fcn.0040299a
mov dword [0x522b18], ecx
xor esi, dword [0x52234b]
xor edx, dword [0x522752]
add dword [0x522ad2], edi
call fcn.0040749c

Function at 0x42f162
Capabilities:
Hash data using murmur3

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
add ebx, eax
xor esi, 0x41dcf0
ror ecx, 0x1e
xor edx, ecx
sub ecx, dword [0x522e00]
neg edx
invalid

Function at 0x42f17e
Capabilities:
Hash data using murmur3

Disassembly:
ror byte [ecx], 0xe8
lodsb al, byte [esi]
and edi, ebp
push dword [ebx]
sbb eax, 0x522e68

Function at 0x42f19a
Capabilities:
Hash data using murmur3

Disassembly:
add cl, al
ror dword [esi], 0x48
mov dword [0x522823], 0xa11dd7
sub byte [edx], dl
xlatb
sbb eax, 0x464e00a1
xor dword [0x522a86], 0x15497874
xor eax, 0x522a86
je 0x42f22b
dec ecx
adc eax, 0xec9c140
sub dword [0x5228e0], 0x18e1b354
call fcn.004010f1
std
inc ecx
enter 0xfffffffffffff709, 0xffffffffffffffda

Function at 0x42f1a2
Capabilities:
Hash data using murmur3

Disassembly:
sub byte [edx], dl
xlatb
sbb eax, 0x464e00a1

Function at 0x42f1ac
Capabilities:
Hash data using murmur3

Disassembly:
xor eax, 0x522a86
je 0x42f22b
dec ecx
adc eax, 0xec9c140
sub dword [edx], edx

Function at 0x42f1c6
Capabilities:
Hash data using murmur3

Disassembly:
std
inc ecx
enter 0xfffffffffffff709, 0xffffffffffffffda
xor edx, ecx
rol ecx, 0x1e
xor esi, 0x41dcf0
sub ebx, eax
push 0
mov dword [0x522957], edi
not eax
ror esi, 0x11
call fcn.00406823
mov dword [0x522974], edx
sub esi, dword [0x522ea4]
not esi
inc eax
not edi
invalid
out dx, al
stosb byte es:[edi], al
xchg edi, eax
wait