joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4448a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, ecx
mov dword [ebp - 0x28], 0x310030
push ebx
push esi
push edi
mov ecx, dword [eax + 0x6c]
lea edx, [ebp - 4]
mov dword [ebp - 8], eax
push 0x168
push edx
mov eax, dword [ecx]
mov dword [ebp - 0x24], 0x330032
mov dword [ebp - 0x20], 0x350034
mov dword [ebp - 0x1c], 0x370036
mov dword [ebp - 0x18], 0x390038
mov dword [ebp - 0x14], 0x620061
mov dword [ebp - 0x10], 0x640063
mov dword [ebp - 0xc], 0x660065
call dword [eax]
push dword [ebp - 4]
mov edi, dword [ebp + 0xc]
add edi, 0x50
push 0x100
push edi
call fcn.004d9c76
mov edx, dword [ebp - 4]
add esp, 0xc
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x444913
mov ebx, dword [ebp + 8]
sub edx, ecx
sar edx, 1
mov esi, 8
add ebx, 0x1c
lea edi, [edi + edx*2]
mov ecx, dword [ebx]
lea edi, [edi + 0x10]
mov eax, ecx
lea ebx, [ebx - 4]
shr eax, 0x1c
movzx eax, word [ebp + eax*2 - 0x28]
mov word [edi - 0x10], ax
mov eax, ecx
shr eax, 0x18
and eax, 0xf
movzx eax, word [ebp + eax*2 - 0x28]
mov word [edi - 0xe], ax
mov eax, ecx
shr eax, 0x14
and eax, 0xf
movzx eax, word [ebp + eax*2 - 0x28]
mov word [edi - 0xc], ax
mov eax, ecx
shr eax, 0x10
and eax, 0xf
movzx eax, word [ebp + eax*2 - 0x28]
mov word [edi - 0xa], ax
mov eax, ecx
shr eax, 0xc
and eax, 0xf
movzx eax, word [ebp + eax*2 - 0x28]
mov word [edi - 8], ax
mov eax, ecx
shr eax, 8
and eax, 0xf
movzx eax, word [ebp + eax*2 - 0x28]
mov word [edi - 6], ax
mov eax, ecx
shr eax, 4
and ecx, 0xf
and eax, 0xf
movzx eax, word [ebp + eax*2 - 0x28]
mov word [edi - 4], ax
movzx eax, word [ebp + ecx*2 - 0x28]
mov word [edi - 2], ax
sub esi, 1
jne 0x444930
mov esi, dword [ebp + 0xc]
xor eax, eax
push dword [ebp + 0x1c]
mov ecx, dword [ebp - 8]
push dword [ebp + 0x18]
mov word [edi], ax
push dword [ebp + 0x14]
mov dword [esi + 0x30], eax
push dword [ebp + 0x10]
mov dword [esi + 0x48], eax
push esi
push dword [ebp + 8]
mov dword [esi + 0x4c], eax
lea eax, [edx + 0x41]
mov dword [esi + 0x34], 1
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x250], 0
mov dword [esi + 0x254], 0
mov dword [esi + 0x258], 0
mov dword [esi + 0x25c], 0
mov dword [esi + 0x260], 0
mov dword [esi + 0x264], 0
mov dword [esi + 0x26c], 0
call fcn.00445960
mov dword [esi + 0x268], 0
xor eax, eax
mov dword [esi + 0x270], 0
mov dword [esi + 0x274], 0
mov dword [esi + 0x278], 0
mov dword [esi + 0x27c], 0
mov dword [esi + 0x280], 0
mov dword [esi + 0x284], 0
mov dword [esi + 0x288], 0
mov dword [esi + 0x28c], 0
mov dword [esi + 0x2c8], 0
mov dword [esi + 0x2cc], 0
mov dword [esi + 0x2d0], 0xffffffff
mov dword [esi + 0x2d4], 0
pop edi
mov dword [esi + 0x2d8], 0
mov dword [esi + 0x2dc], 0
mov dword [esi + 0x2e0], 0
mov dword [esi + 0x2e4], 0
mov dword [esi + 0x2e8], 0
mov dword [esi + 0x2ec], 0
mov dword [esi + 0x2f0], 0
mov dword [esi + 0x2f4], 0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x4453c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, 8
lea edx, [esi + 0x50]
mov dword [ebp - 4], ecx
mov dword [edx], 0x200021
add edx, 4
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x24], 0x310030
add edi, 0x1c
mov dword [ebp - 0x20], 0x330032
mov dword [ebp - 0x1c], 0x350034
mov dword [ebp - 0x18], 0x370036
mov dword [ebp - 0x14], 0x390038
mov dword [ebp - 0x10], 0x620061
mov dword [ebp - 0xc], 0x640063
mov dword [ebp - 8], 0x660065
nop
mov ecx, dword [edi]
lea edx, [edx + 0x10]
mov eax, ecx
lea edi, [edi - 4]
shr eax, 0x1c
movzx eax, word [ebp + eax*2 - 0x24]
mov word [edx - 0x10], ax
mov eax, ecx
shr eax, 0x18
and eax, 0xf
movzx eax, word [ebp + eax*2 - 0x24]
mov word [edx - 0xe], ax
mov eax, ecx
shr eax, 0x14
and eax, 0xf
movzx eax, word [ebp + eax*2 - 0x24]
mov word [edx - 0xc], ax
mov eax, ecx
shr eax, 0x10
and eax, 0xf
movzx eax, word [ebp + eax*2 - 0x24]
mov word [edx - 0xa], ax
mov eax, ecx
shr eax, 0xc
and eax, 0xf
movzx eax, word [ebp + eax*2 - 0x24]
mov word [edx - 8], ax
mov eax, ecx
shr eax, 8
and eax, 0xf
movzx eax, word [ebp + eax*2 - 0x24]
mov word [edx - 6], ax
mov eax, ecx
shr eax, 4
and ecx, 0xf
and eax, 0xf
movzx eax, word [ebp + eax*2 - 0x24]
mov word [edx - 4], ax
movzx eax, word [ebp + ecx*2 - 0x24]
mov word [edx - 2], ax
sub ebx, 1
jne 0x445420
push dword [ebp + 0x20]
xor eax, eax
push dword [ebp + 0x1c]
mov word [edx], ax
push dword [ebp + 0x18]
mov dword [esi + 0x48], eax
push dword [ebp + 0x14]
mov dword [esi + 0x4c], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x250], eax
mov dword [esi + 0x254], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x30], 1
mov dword [esi + 0x34], 1
mov dword [esi + 0x38], 0x43
mov ecx, dword [eax + 4]
mov eax, dword [eax + 8]
mov dword [esi + 0x260], ebx
mov dword [esi + 0x264], ebx
mov ebx, dword [ebp + 8]
push esi
mov dword [esi + 0x258], ecx
mov ecx, dword [ebp - 4]
push ebx
mov dword [esi + 0x25c], eax
call fcn.00445960
mov dword [esi + 0x268], 0
mov eax, dword [ebx]
mov dword [esi + 0x270], eax
mov eax, dword [ebx + 4]
mov dword [esi + 0x274], eax
mov eax, dword [ebx + 8]
mov dword [esi + 0x278], eax
mov eax, dword [ebx + 0xc]
mov dword [esi + 0x27c], eax
mov eax, dword [ebx + 0x10]
mov dword [esi + 0x280], eax
mov eax, dword [ebx + 0x14]
mov dword [esi + 0x284], eax
mov eax, dword [ebx + 0x18]
mov dword [esi + 0x288], eax
mov eax, dword [ebx + 0x1c]
mov dword [esi + 0x28c], eax
xor eax, eax
mov dword [esi + 0x2c8], 0
mov dword [esi + 0x2cc], 0
mov dword [esi + 0x2d0], 0xffffffff
mov dword [esi + 0x2d4], 0
pop edi
mov dword [esi + 0x2d8], 0
mov dword [esi + 0x2dc], 0
mov dword [esi + 0x2e0], 0
mov dword [esi + 0x2e4], 0
mov dword [esi + 0x2e8], 0
mov dword [esi + 0x2ec], 0
mov dword [esi + 0x2f0], 0
mov dword [esi + 0x2f4], 0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x447430
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, ecx
cmp ebx, dword [edi + 0x78]
jb 0x44744c
mov eax, 1
pop edi
pop ebx
pop ecx
pop ebp
ret 4
mov ecx, dword [edi + 0x7c]
mov eax, dword [edi + 0x144]
push 0
push dword [eax + ecx*4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, edi
mov dword [edi + 0x7c], ebx
call fcn.0044a280
mov ecx, edi
call fcn.00449df0
mov ecx, dword [edi + 0x7c]
mov eax, dword [edi + 0x144]
push 5
push dword [eax + ecx*4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
xor eax, eax
pop ebx
pop ecx
pop ebp
ret 4
Function at 0x44b630
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x51e080]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi + 0xf0], 0
je 0x44b7b5
mov ebx, dword [ebp + 8]
cmp ebx, 0x2f
jne 0x44b7a0
mov eax, dword [esi + 0x18c]
cmp eax, 1
jne 0x44b7ca
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0x1c]
push eax
push dword [esi + 0x54]
call dword [sym.imp.USER32.dll_ScreenToClient]
mov edi, dword [esi + 0x15c]
xor edx, edx
mov ecx, dword [ebp - 0x18]
lea ebx, [edi + 2]
cmp ecx, ebx
jge 0x44b6a6
mov eax, ecx
sub eax, edi
sub eax, 2
cdq
sub eax, edx
mov edx, eax
sar edx, 1
jmp 0x44b6b6
mov eax, dword [esi + 0x158]
cmp ecx, eax
jle 0x44b6b6
mov edx, ecx
sub edx, eax
shr edx, 1
mov eax, dword [esi + 0x128]
add eax, edx
xor edx, edx
test eax, eax
cmovg edx, eax
mov dword [esi + 0x128], edx
cmp ecx, ebx
jge 0x44b6d3
xor ecx, ecx
jmp 0x44b6d8
sub ecx, edi
sub ecx, 2
lea eax, [edx + ecx]
xor edx, edx
div dword [esi + 0x164]
mov edi, eax
mov eax, dword [esi + 0xf0]
cmp edi, eax
jl 0x44b707
cmp dword [esi + 0x198], 0
jne 0x44b79d
lea edi, [eax - 1]
cmp edi, eax
jge 0x44b79d
lea ebx, [esi + 0x8c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [ebp - 0x20]
mov dword [esi + 0x198], 0
push eax
lea eax, [esi + 0x168]
mov ecx, esi
push eax
call fcn.0044adc0
test eax, eax
jne 0x44b757
mov edx, dword [ebp - 0x20]
mov ecx, edi
cmp edi, edx
jle 0x44b741
mov ecx, edx
mov edx, edi
cmp ecx, edx
ja 0x44b757
mov eax, dword [esi + 0x108]
mov eax, dword [eax + ecx*4]
inc ecx
or dword [eax + 0x28], 2
cmp ecx, edx
jbe 0x44b745
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, esi
call fcn.00449d30
mov eax, dword [esi + 0x15c]
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 0x158]
mov dword [ebp - 8], eax
mov eax, dword [esi + 0x154]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x14]
push 0
push eax
push dword [esi + 0x54]
mov dword [ebp - 0x14], 0
call dword [sym.imp.USER32.dll_InvalidateRect]
mov ecx, esi
call fcn.00446d00
mov ebx, dword [ebp + 8]
push dword [ebp + 0xc]
push ebx
push 0x412
push dword [esi + 0x14c]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004d3878
mov esp, ebp
pop ebp
ret 8
cmp eax, 2
jne 0x44b7a0
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [ebp - 0x18]
xor ecx, ecx
sub eax, dword [esi + 0x74]
cdq
sub eax, edx
sar eax, 1
add eax, dword [esi + 0x128]
test eax, eax
cmovg ecx, eax
mov dword [esi + 0x128], ecx
mov ecx, esi
call fcn.00449d30
mov ecx, esi
call fcn.00446ca0
jmp 0x44b7a0
Function at 0x4544d0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
sar esi, 1
add esi, esi
je 0x454501
nop dword [eax]
movzx eax, byte [edi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x4544f0
pop edi
mov eax, edx
pop esi
pop ebp
ret 8
Function at 0x45e050
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, ecx
push esi
push edi
sub eax, 0x110
je 0x45e105
sub eax, 1
je 0x45e08e
sub eax, 2
jne 0x45e085
push eax
push eax
push 0x405
push 0x3f6
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 0x10
mov eax, 1
cmp ax, word [ebp + 0x10]
jne 0x45e085
push 0xffffffffffffffff
push dword [ebx + 0x88]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebx + 0x88]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebx + 0x74], 2
mov dword [ebx + 0x88], 0
jne 0x45e0e4
mov eax, dword [ebx + 0x64]
mov esi, dword [eax + 0x4f4]
lea edi, [esi + 8]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
and dword [esi + 0x10c], 0xfffffffd
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [ebp + 8]
push 0x2f
push esi
call dword [sym.imp.USER32.dll_KillTimer]
push 1
push esi
call dword [sym.imp.USER32.dll_EndDialog]
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret 0x10
mov edi, dword [ebp + 8]
mov esi, dword [sym.imp.USER32.dll_SendDlgItemMessageW]
push 0x1e0000
push 0
push 0x401
push 0x3f6
push edi
call esi
push 0
push 1
push 0x404
push 0x3f6
push edi
call esi
mov eax, dword [ebx + 0x74]
lea edx, [ebp + 0xc]
mov ecx, dword [ebx + 0x70]
cmp eax, 1
jne 0x45e14a
mov eax, dword [ecx]
push 4
push edx
call dword [eax]
jmp 0x45e166
cmp eax, 2
mov eax, dword [ecx]
jne 0x45e158
push 3
push edx
call dword [eax]
jmp 0x45e166
push 0
push edx
call dword [eax]
push 1
push edi
call dword [sym.imp.USER32.dll_EndDialog]
push dword [ebp + 0xc]
push 0x3f2
push edi
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
mov eax, dword [ebx + 0x64]
mov esi, dword [eax + 0x4f4]
lea edi, [esi + 8]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
or dword [esi + 0x10c], 2
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea eax, [ebp + 0x10]
push eax
push 0
push ebx
push 0x45ddc0
push 0
push 0
call fcn.004d9be5
add esp, 0x18
mov dword [ebx + 0x88], eax
push 0
push 0x64
push 0x2f
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetTimer]
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret 0x10
Function at 0x460340
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x51e080]
xor eax, esp
mov dword [esp + 0x20], eax
movzx edx, word [ebp + 8]
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x90]
cmp eax, edx
je 0x46055d
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x14]
push ecx
push eax
call fcn.00460250
test eax, eax
jne 0x4603f1
push eax
mov eax, dword [esp + 0x14]
mov eax, dword [esi + eax*4 + 0xdc]
push dword [eax + 0x54]
call dword [sym.imp.USER32.dll_ShowWindow]
lea edi, [esi + 0xb0]
mov edx, 0xa
mov ebx, edi
mov dword [esp + 0x18], edx
nop word [eax + eax]
mov ecx, dword [ebx]
movzx eax, word [ecx + 0x80]
cmp eax, dword [esi + 0x90]
jne 0x4603df
cmp dword [ecx + 0x74], 0
mov dword [ecx + 0x7c], 0
jne 0x4603df
push 0
push 0
push dword [ecx + 0x54]
call dword [sym.imp.USER32.dll_InvalidateRect]
mov edx, dword [esp + 0x18]
add ebx, 4
sub edx, 1
mov dword [esp + 0x18], edx
jne 0x4603b0
movzx edx, word [ebp + 8]
jmp 0x4603f7
lea edi, [esi + 0xb0]
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x14]
push eax
push edx
call fcn.00460250
test eax, eax
je 0x460420
lea eax, [esp + 0x14]
mov edx, 0x364d
push eax
lea eax, [esp + 0x14]
push eax
push edx
call fcn.00460250
mov dword [esi + 0x90], edx
mov ebx, 0xa
nop dword [eax + eax]
mov ecx, dword [edi]
movzx eax, word [ecx + 0x80]
cmp eax, dword [esi + 0x90]
jne 0x46045b
cmp dword [ecx + 0x74], 0
mov dword [ecx + 0x7c], 1
jne 0x46045b
push 0
push 0
push dword [ecx + 0x54]
call dword [sym.imp.USER32.dll_InvalidateRect]
add edi, 4
sub ebx, 1
jne 0x460430
mov edi, dword [esp + 0x10]
cmp edi, 2
jne 0x4604b3
mov eax, dword [esp + 0x14]
mov ecx, dword [esi + 0xf4]
test eax, eax
js 0x460491
cmp eax, 7
jg 0x460491
mov edx, dword [ecx + 0x74]
mov dword [ecx + 0x80], eax
cmp eax, edi
jne 0x46049e
mov dword [edx + 0x7c], ebx
jmp 0x4604a5
mov edx, dword [ecx + 0x74]
mov dword [ecx + 0x80], 0
mov dword [edx + 0x7c], 2
push dword [ecx + 0x80]
mov ecx, dword [ecx + 0x7c]
call fcn.0048dfe0
lea eax, [esp + 0x1c]
push eax
push dword [esi + 0x54]
call dword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [esi + 0x94]
mov eax, dword [esp + 0x28]
push 4
sub eax, ecx
push eax
push dword [esp + 0x2c]
mov eax, dword [esi + edi*4 + 0xdc]
push ecx
push 0
push 0
push dword [eax + 0x54]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [esi + edi*4 + 0xdc]
push 0
push 0
push 0x75616c8a
mov eax, dword [ecx]
call dword [eax + 0x14]
mov ecx, esi
call fcn.0045f7c0
mov eax, dword [esi + edi*4 + 0xdc]
push 5
push dword [eax + 0x54]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0
push dword [esi + 0x54]
call dword [sym.imp.USER32.dll_InvalidateRect]
cmp dword [esi + 0x90], 0x364d
jne 0x46055d
mov eax, dword [esi + 0x64]
mov eax, dword [eax + 0x94]
test eax, eax
je 0x46054d
mov eax, dword [eax + 0x54]
test eax, eax
je 0x46054d
push 0
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov ecx, dword [esi + 0x64]
push 0
push 0
push 0
push 0
call fcn.0045db50
mov ecx, dword [esp + 0x2c]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004d3878
mov esp, ebp
pop ebp
ret 4
Function at 0x465d60
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x74
push ebx
push esi
push edi
push 0x4000
mov ebx, ecx
call fcn.004d9a7e
mov esi, eax
push 0x208
mov dword [esp + 0x20], esi
call fcn.004d9a7e
push 0x208
mov dword [esp + 0x1c], eax
call fcn.004d9a7e
mov edi, eax
lea eax, [esp + 0x34]
push 0x58
push 0
push eax
mov dword [esp + 0x34], edi
call fcn.004d6ed0
xor eax, eax
lea edx, [esp + 0x38]
mov word [esi], ax
add esp, 0x18
mov ecx, dword [ebx + 0x70]
mov eax, dword [ebp + 8]
mov dword [esp + 0x28], 0x58
mov dword [esp + 0x2c], eax
mov dword [esp + 0x34], 0x50dc60
mov dword [esp + 0x44], esi
mov dword [esp + 0x48], 0x2000
mov dword [esp + 0x5c], 0x8120c
mov eax, dword [ecx]
push 0x82
push edx
call dword [eax]
mov eax, dword [esp + 0x20]
push dword [esp + 0x10]
mov dword [esp + 0x5c], eax
mov eax, dword [ebx + 0x64]
push 0x26dbc013
mov ecx, dword [eax + 0x4cc]
call fcn.00471b30
test eax, eax
je 0x465e20
push dword [esp + 0x10]
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov eax, dword [esp + 0x10]
mov dword [esp + 0x54], eax
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
test eax, eax
je 0x465f77
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x465e40
sub ecx, edx
mov dword [esp + 0x14], 0
sar ecx, 1
cmp word [esi + ecx*2 + 2], 0
lea eax, [esi + ecx*2]
jne 0x465e74
push 0x5c
push esi
call fcn.004d644c
add esp, 8
xor ecx, ecx
mov word [eax], cx
jmp 0x465e89
cmp word [eax - 2], 0x5c
jne 0x465e89
xor ecx, ecx
mov dword [esp + 0x14], 1
mov word [eax - 2], cx
mov ecx, dword [ebx + 0x64]
push esi
push 0x26dbc013
mov ecx, dword [ecx + 0x4cc]
call fcn.00471bb0
mov ebx, esi
lea ecx, [ebx + 2]
mov ax, word [ebx]
add ebx, 2
test ax, ax
jne 0x465ea2
mov eax, dword [esp + 0x14]
sub ebx, ecx
sar ebx, 1
add eax, ebx
lea esi, [esi + eax*2]
add esi, 2
mov dword [esp + 0x14], esi
cmp word [esi], 0
je 0x465f73
lea eax, [edi + 2]
lea eax, [eax + ebx*2]
mov dword [esp + 0x24], eax
lea ecx, [esi + 2]
nop dword [eax + eax]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x465ee0
push dword [esp + 0x18]
sub esi, ecx
push 0x104
push edi
sar esi, 1
call fcn.004d9c76
mov eax, 0x5c
mov word [edi + ebx*2], ax
lea edi, [esi + esi]
push edi
push dword [esp + 0x24]
push dword [esp + 0x38]
call fcn.004d6950
mov ecx, dword [esp + 0x34]
lea eax, [ebx + esi]
mov esi, dword [esp + 0x2c]
add esp, 0x18
add esi, 2
xor edx, edx
add esi, edi
mov edi, ecx
mov word [ecx + eax*2 + 2], dx
push edi
push 0xffffffffffffffff
push 0x1a2
push 0x3f7
push dword [ebp + 8]
mov dword [esp + 0x28], esi
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
cmp eax, 0xffffffff
jne 0x465f69
push edi
push 0
push 0x180
push 0x3f7
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
cmp word [esi], 0
jne 0x465ed5
mov esi, dword [esp + 0x18]
push edi
call fcn.004d9a63
push dword [esp + 0x14]
call fcn.004d9a63
push esi
call fcn.004d9a63
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4682e0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
mov eax, dword [0x51e080]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x78], eax
push ebx
push esi
push edi
mov edi, ecx
test eax, eax
je 0x4684cb
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [edi + 0x40]
ja 0x4684cb
cmp dword [edi + 0x30], 1
je 0x4684cb
lea ebx, [ecx + 6]
mov eax, 0x10
and ebx, 0xf
lea esi, [edi + 0x10]
sub eax, ebx
neg ebx
push esi
sbb ebx, ebx
and ebx, eax
lea eax, [ecx + 0x15]
inc ebx
add eax, ebx
mov dword [ebp - 0x7c], eax
mov al, byte [ebp + 0x10]
or al, 1
mov byte [ebp + 0x10], al
mov byte [ebp - 0x71], al
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [edi + 0x44]
sub eax, dword [edi + 0x48]
cmp eax, dword [ebp - 0x7c]
mov eax, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jb 0x4684b0
push esi
call eax
mov eax, dword [edi + 4]
mov esi, dword [eax + 0x480]
lea eax, [ebp - 0x70]
push eax
push dword [ebp + 0xc]
mov ecx, esi
mov dword [ebp - 0x5c], 0
push dword [ebp - 0x78]
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x70], 0x67452301
mov dword [ebp - 0x6c], 0xefcdab89
mov dword [ebp - 0x68], 0x98badcfe
mov dword [ebp - 0x64], 0x10325476
call fcn.004b2200
lea eax, [ebp - 0x70]
mov ecx, esi
push eax
call fcn.004b2580
lea esi, [edi + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [edi + 0x44]
sub eax, dword [edi + 0x48]
cmp eax, dword [ebp - 0x7c]
jb 0x4684ab
test byte [ebp + 0x10], 2
mov ecx, edi
je 0x46843e
push 0x10
lea eax, [ebp - 0x70]
push eax
call fcn.004688b0
push dword [ebp + 0xc]
mov ecx, edi
push dword [ebp - 0x78]
call fcn.004688b0
push 1
lea eax, [ebp - 0x71]
mov ecx, edi
push eax
call fcn.004688b0
mov ecx, dword [edi + 4]
lea eax, [ebp - 0x14]
push ebx
push eax
mov ecx, dword [ecx + 0x488]
call fcn.004b0fb0
push ebx
lea eax, [ebp - 0x14]
mov ecx, edi
push eax
call fcn.004688b0
push 4
lea eax, [ebp + 0xc]
mov ecx, edi
push eax
call fcn.004688b0
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d3878
mov esp, ebp
pop ebp
ret 0x10
push 4
lea eax, [ebp + 0xc]
push eax
call fcn.00468830
mov ecx, dword [edi + 4]
lea eax, [ebp - 0x14]
push ebx
push eax
mov ecx, dword [ecx + 0x488]
call fcn.004b0fb0
push ebx
lea eax, [ebp - 0x14]
mov ecx, edi
push eax
call fcn.00468830
push 1
lea eax, [ebp - 0x71]
mov ecx, edi
push eax
call fcn.00468830
push dword [ebp + 0xc]
mov ecx, edi
push dword [ebp - 0x78]
call fcn.00468830
push 0x10
lea eax, [ebp - 0x70]
mov ecx, edi
push eax
call fcn.00468830
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d3878
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push esi
call eax
mov eax, 2
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d3878
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004d3878
mov esp, ebp
pop ebp
ret 0x10
Function at 0x468940
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd4
mov eax, dword [0x51e080]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc4], eax
push ebx
push esi
mov esi, ecx
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0xd0], ecx
push edi
test eax, eax
je 0x4689cf
test ecx, ecx
je 0x4689cf
cmp dword [esi + 0x30], 1
je 0x4689cf
lea ebx, [esi + 0x10]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 0x58]
mov dword [ebp - 0xc8], eax
mov eax, dword [esi + 0x54]
mov dword [ebp - 0xc0], 0
mov byte [ebp - 0xb9], 0
mov dword [ebp - 0xcc], eax
test eax, eax
je 0x468a95
push 4
lea eax, [ebp - 0xc0]
mov ecx, esi
push eax
call fcn.00468730
mov edi, dword [ebp - 0xc0]
cmp edi, dword [esi + 0x40]
jbe 0x4689e7
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d3878
mov esp, ebp
pop ebp
ret 8
lea ecx, [edi + 6]
mov eax, 0x10
and ecx, 0xf
sub eax, ecx
neg ecx
sbb ecx, ecx
and ecx, eax
lea eax, [edi + 0x16]
add eax, ecx
mov dword [ebp - 0xc0], eax
mov eax, dword [esi + 0x58]
inc eax
add eax, ecx
mov ecx, dword [esi + 0x50]
mov dword [esi + 0x58], eax
cmp eax, ecx
jb 0x468a1a
sub eax, ecx
mov dword [esi + 0x58], eax
push 1
lea eax, [ebp - 0xb9]
mov ecx, esi
push eax
call fcn.00468730
push edi
push dword [ebp - 0xc4]
mov ecx, esi
call fcn.00468730
push 0x10
lea eax, [ebp - 0xb8]
mov ecx, esi
push eax
call fcn.00468730
mov eax, dword [ebp - 0xc0]
sub dword [esi + 0x54], eax
test byte [ebp - 0xb9], 4
mov dword [ebp - 0xc0], 1
jne 0x468a9b
mov eax, dword [ebp - 0xc8]
mov dword [esi + 0x58], eax
mov eax, dword [ebp - 0xcc]
push ebx
mov dword [esi + 0x54], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 2
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d3878
mov esp, ebp
pop ebp
ret 8
mov edi, dword [ebp - 0xc0]
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp - 0xc0], 0
je 0x468a7d
cmp byte [ebp - 0xb9], 0
je 0x468a7d
mov eax, dword [esi + 4]
mov esi, dword [eax + 0x480]
lea eax, [ebp - 0x60]
push eax
push edi
push dword [ebp - 0xc4]
mov ecx, esi
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x60], 0x67452301
mov dword [ebp - 0x5c], 0xefcdab89
mov dword [ebp - 0x58], 0x98badcfe
mov dword [ebp - 0x54], 0x10325476
call fcn.004b2200
lea eax, [ebp - 0x60]
mov ecx, esi
push eax
call fcn.004b2580
mov eax, dword [ebp - 0xb8]
cmp eax, dword [ebp - 0x60]
jne 0x4689cf
mov eax, dword [ebp - 0xb4]
cmp eax, dword [ebp - 0x5c]
jne 0x4689cf
mov eax, dword [ebp - 0xb0]
cmp eax, dword [ebp - 0x58]
jne 0x4689cf
mov eax, dword [ebp - 0xac]
cmp eax, dword [ebp - 0x54]
jne 0x4689cf
mov eax, dword [ebp - 0xd0]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov dword [eax], edi
xor eax, eax
pop edi
pop esi
pop ebx
call fcn.004d3878
mov esp, ebp
pop ebp
ret 8