joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404420
Capabilities:
Delete registry value

Disassembly:
push ecx
push esi
mov esi, eax
mov edx, dword [esi + 0xc]
mov eax, dword [esi + 4]
lea ecx, [esp + 4]
push ecx
or edx, 2
push edx
push 0
push eax
mov eax, dword [esi]
push eax
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40446c
mov esi, dword [esi + 8]
mov ecx, dword [esp + 4]
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edx, dword [esp + 4]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ecx
ret
xor eax, eax
pop esi
pop ecx
ret

Function at 0x404720
Capabilities:
Set registry value

Disassembly:
push ecx
push esi
push 0
mov esi, eax
mov edx, dword [esi + 0xc]
mov eax, dword [esi + 4]
lea ecx, [esp + 8]
push ecx
push 0
or edx, 0x20006
push edx
push 0
push 0
push 0
push eax
mov eax, dword [esi]
push eax
mov dword [esp + 0x28], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40478d
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
mov esi, dword [esi + 8]
push ecx
mov ecx, dword [esp + 8]
push edx
push eax
push 0
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [esp + 4]
mov esi, eax
neg esi
sbb esi, esi
push edx
inc esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ecx
ret
xor eax, eax
pop esi
pop ecx
ret

Function at 0x4064f0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esi + 4]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esi + 0xa0]
push 0
push 0
push 0x1009
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [esi + 0xa4], 0
je 0x406523
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
xor eax, eax
ret
Function at 0x4095b0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5024c6
mov eax, dword fs:[0]
push eax
sub esp, 0xf0
push ebx
push esi
push edi
mov eax, dword [0x5364d0]
xor eax, esp
push eax
lea eax, [esp + 0x100]
mov dword fs:[0], eax
xor edi, edi
xor ebx, ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], edi
lea eax, [esp + 0x14]
push eax
push 0x2001f
push edi
push 0x510bac
mov dword [esp + 0x118], edi
push SHChangeNotifyDeregister
mov dword [esp + 0x28], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x409624
mov ebx, dword [esp + 0x14]
mov dword [esp + 0x24], edi
mov dword [esp + 0x20], ebx
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x20]
push eax
push edi
push str.PWarn
push ebx
mov dword [esp + 0x34], edi
mov dword [esp + 0x2c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [esp + 0x1c], edi
jne 0x40970b
lea ecx, [esp + 0x18]
push 0x141
push ecx
call fcn.00433510
mov edx, dword [ebp + 8]
mov edi, dword [eax]
mov eax, dword [edx + 4]
add esp, 8
lea esi, [esp + 0x14]
mov dword [esp + 0x28], eax
call fcn.00401140
mov ecx, dword [esp + 0x14]
push 0x30
push ecx
push edi
lea edx, [esp + 0xa0]
push edx
call fcn.004bb6a0
mov eax, dword [esp + 0x28]
push eax
lea edi, [esp + 0x98]
call fcn.0048b3b0
mov ecx, edi
call fcn.004bb800
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4096ca
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4096ea
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 4
lea ecx, [esp + 0x1c]
push ecx
push 4
push 0
push str.PWarn
push ebx
mov dword [esp + 0x30], 1
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor edi, edi
lea esi, [esp + 0x2c]
call fcn.00408400
mov dword [esp + 0x8c], edi
mov dword [esp + 0x90], edi
mov dword [esp + 0x2c], vtable.C360zipDialogT_class_CPasswordManageDlgImpl__0__1__0_.0
mov edx, dword [ebp + 8]
mov byte [esp + 0x108], 1
mov eax, dword [edx + 4]
push eax
mov edi, esi
call fcn.00410ad0
mov eax, esi
push eax
mov byte [esp + 0x10c], 0
call fcn.00466490
test ebx, ebx
je 0x40975b
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [esp + 0x100]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40aab0
Capabilities:
Check if file exists
Check os version

Disassembly:
sub esp, 0x420
mov eax, dword [0x5364d0]
xor eax, esp
mov dword [esp + 0x418], eax
push ebx
push esi
push edi
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x1a]
push ecx
mov word [esp + 0x1c], ax
call fcn.004e8fe0
add esp, 0xc
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x222]
push eax
mov word [esp + 0x224], dx
call fcn.004e8fe0
add esp, 0xc
push 0x104
lea ecx, [esp + 0x21c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea edx, [esp + 0x218]
push edx
call esi
mov edi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
push str.CrashReport.dll
lea eax, [esp + 0x21c]
push eax
lea ecx, [esp + 0x18]
push ecx
call edi
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea edx, [esp + 0x10]
push edx
call ebx
test eax, eax
jne 0x40ab82
push 0x208
push eax
lea eax, [esp + 0x18]
push eax
call fcn.004e8fe0
add esp, 0xc
lea ecx, [esp + 0x218]
push ecx
call esi
push str.CrashReport.dll
lea edx, [esp + 0x21c]
push edx
lea eax, [esp + 0x18]
push eax
call edi
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 5
jne 0x40ab93
shr eax, 8
test al, al
je 0x40aba9
lea edi, [esp + 0x10]
call fcn.0041d860
test eax, eax
jne 0x40abc3
mov ecx, edi
push ecx
call ebx
test eax, eax
jne 0x40abe6
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x418]
xor ecx, esp
call fcn.004e3edb
add esp, 0x420
ret
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ecx, dword [esp + 0x424]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004e3edb
add esp, 0x420
ret
lea eax, [esp + 0x10]
push eax
mov esi, 0x55f670
call fcn.0041da10
int3
Function at 0x40c220
Capabilities:
Check for software breakpoints

Disassembly:
push esi
xor esi, esi
mov eax, dword [esi + 0x538ac8]
push eax
push edi
call fcn.004e4707
add esp, 8
test eax, eax
je 0x40c26a
add esi, 4
cmp esi, 0xcc
jb 0x40c223
xor esi, esi
mov ecx, dword [esi + 0x538b98]
push ecx
push edi
call fcn.004e4707
add esp, 8
test eax, eax
je 0x40c26e
add esi, 4
cmp esi, 0x80
jb 0x40c244
mov eax, 2
pop esi
ret
xor eax, eax
pop esi
ret
mov eax, 1
pop esi
ret
Function at 0x40edf0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x50248b
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5364d0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
mov eax, dword [edi]
mov dword [esi], eax
mov ecx, dword [edi + 4]
mov dword [esi + 4], ecx
mov edx, dword [edi + 8]
lea eax, [edi + 0xc]
push eax
lea ecx, [esi + 0xc]
push ecx
mov dword [esi + 8], edx
call fcn.004104d0
mov dword [esp + 0x14], 0
mov eax, dword [edi + 0x24]
sub eax, 0x10
call fcn.004048c0
add eax, 0x10
mov dword [esi + 0x24], eax
mov edx, dword [edi + 0x28]
mov dword [esi + 0x28], edx
mov eax, dword [edi + 0x2c]
mov dword [esi + 0x2c], eax
mov ecx, dword [edi + 0x30]
mov dword [esi + 0x30], ecx
mov edx, dword [edi + 0x34]
mov dword [esi + 0x34], edx
mov eax, dword [edi + 0x38]
mov dword [esi + 0x38], eax
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4
Function at 0x413d40
Capabilities:
Get number of processors

Disassembly:
lea ebp, [ebx + esi*8 - 1]
dec dword [ebx - 0x5036b]
dec dword [ebx - 0x7a76cfbe]
jo 0x413d45
invalid
Function at 0x4141e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [ebp - 0xc9c], ecx
xor edx, edx
mov word [ebp - 0x214], dx
xor eax, eax
mov word [ebp - 0x110], ax

Function at 0x414230
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push edx
push ecx
add esp, 4
or edx, 0x6b6f
sub edx, 0x16
pop edx
push ecx
push ecx
add esp, 4
sub ecx, 0x3ca3
add ecx, 0x10dc
jmp 0x414222
pop ecx
push esi
jmp 0x414229
pop esi
mov ecx, dword [ebp - 0xc9c]
mov dx, word [ecx]
mov word [ebp - 0x1036], dx
mov eax, dword [ebp - 0xc9c]
add eax, 2
mov dword [ebp - 0xc9c], eax
mov cx, word [ebp - 0x1036]
mov word [ebp - 0x214], cx
mov edx, dword [ebp - 0xca0]
mov ax, word [edx]
mov word [ebp - 0x1038], ax
mov ecx, dword [ebp - 0xca0]
add ecx, 2
mov dword [ebp - 0xca0], ecx
mov dx, word [ebp - 0x1038]
mov word [ebp - 0x110], dx
push edi
sub edi, 0x17f54
pop edi
push eax
sub eax, 0x7107
pop eax
push edi
and edi, 0x139d0
and edi, 0x18326
pop edi
push eax
add eax, 0xde25
add eax, 0x10a4a
sub eax, 0x7ae1
pop eax
movzx eax, word [ebp - 0x110]
test eax, eax
jne 0x4142d9
movzx ecx, word [ebp - 0x214]
movzx edx, word [ebp - 0x110]
sub ecx, edx
mov dword [ebp - 0x15ec], ecx
jmp 0x41433c
movzx eax, word [ebp - 0x214]
movzx ecx, word [ebp - 0x110]
cmp eax, ecx
je 0x4141f8
movzx edx, word [ebp - 0x214]
xor edx, 0x20
movzx eax, word [ebp - 0x110]
cmp edx, eax
je 0x4141f8
movzx ecx, word [ebp - 0x214]
movzx edx, word [ebp - 0x110]
cmp ecx, edx
jge 0x414326
mov dword [ebp - 0x15e8], 0xffffffff
jmp fcn.00414330
mov dword [ebp - 0x15e8], 1
cmp dword [ebp - 0x15ec], 0
jne 0x414385
push ebx
push esi
add esp, 4
sub ebx, 0x16475
sub ebx, 0x49bf
or ebx, 0x16828
pop ebx
push edi
and edi, 0x507b
pop edi
push ebx
push ecx
add esp, 4
sub ebx, 0x176cb
push edx
push edx
add esp, 4
call 0x414396
add byte [eax + 0x4e], cl
cmp eax, 0x833b3432
les eax, [eax + ebp*8]
or byte [eax], al
add byte [eax], al
add byte [edi], dh
inc edx
inc ebp
aas
cmp ecx, dword [edi + edi - 0x7d]
les eax, [ebx + ebp*8]
add eax, 0x4b4d4033
dec edi
xor edx, 0x110db
pop edx
mov edx, dword [ebp - 0x508]
mov eax, dword [edx]
mov dword [ebp - 0x508], eax
mov ecx, dword [ebp - 0x508]
cmp ecx, dword [ebp - 0xca4]
je 0x4143e3
mov edx, dword [ebp - 0x508]
cmp dword [edx + 0x30], 0
jne 0x414199
mov dword [ebp - 0x750], 0
Function at 0x4159cf
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edx
mov ecx, dword [ebp - 0x774]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x3a4], edx
mov dword [ebp - 0x784], 0
mov eax, dword [ebp - 0x3a4]
mov dword [ebp - 0x166c], eax
cmp dword [ebp - 0x166c], 0
jne 0x415a12
mov ecx, dword [ebp - 0x784]
mov dword [ebp - 0x3f8], ecx
jmp 0x415d03
mov edx, dword [ebp - 0x166c]
mov eax, dword [ebp - 0x3a4]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x1670], eax
jne 0x415a3a
mov ecx, dword [ebp - 0x784]
mov dword [ebp - 0x3f8], ecx
jmp 0x415d03
mov edx, 8
imul eax, edx, 0
mov ecx, dword [ebp - 0x1670]
mov edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0x1678], edx
cmp dword [ebp - 0x1678], 0
jne 0x415a6c
mov eax, dword [ebp - 0x784]
mov dword [ebp - 0x3f8], eax
jmp 0x415d03
mov ecx, dword [ebp - 0x3a4]
add ecx, dword [ebp - 0x1678]
mov dword [ebp - 0x778], ecx
jne 0x415a91
mov edx, dword [ebp - 0x784]
mov dword [ebp - 0x3f8], edx
jmp 0x415d03
mov eax, dword [ebp - 0x778]
mov ecx, dword [ebp - 0x3a4]
add ecx, dword [eax + 0x20]
mov dword [ebp - 0x19a4], ecx
mov edx, dword [ebp - 0x778]
mov eax, dword [ebp - 0x3a4]
add eax, dword [edx + 0x24]
mov dword [ebp - 0x19a8], eax
mov ecx, dword [ebp - 0x778]
mov edx, dword [ebp - 0x3a4]
add edx, dword [ecx + 0x1c]
mov dword [ebp - 0x19ac], edx
mov dword [ebp - 0x77c], 0
jmp 0x415aeb
Function at 0x4341c0
Capabilities:
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x5079a8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x5364d0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov eax, dword [0x56324c]
push str...360zipc.dll
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.00434e40
add esp, 0xc
mov dword [esp + 0x28], 0
mov esi, dword [esp + 0x10]
call fcn.0041dd50
or edi, 0xffffffff
test eax, eax
je 0x43423d
push esi
push 0x565c80
lea esi, [esp + 0x1c]
mov dword [esp + 0x1c], edi
call fcn.00429500
test eax, eax
je 0x43423d
mov eax, dword [esp + 0x14]
cmp eax, 3
je 0x43423d
cmp eax, edi
jne 0x4342f4
lea esi, [esp + 0x1c]
call fcn.00401140
mov esi, eax
lea edx, [esp + 0x18]
push 0x17d
push edx
mov byte [esp + 0x30], 1
call fcn.00433510
push esi
push eax
lea eax, [esp + 0x24]
push eax
mov byte [esp + 0x3c], 2
call fcn.0041d700
mov ecx, dword [esp + 0x24]
mov eax, dword [eax]
add esp, 0x14
push ecx
push eax
push 0x40040
push 0
call fcn.00488bf0
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
add esp, 0x10
lea edx, [eax + 0xc]
mov ecx, edi
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4342a6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x28], 1
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov edx, edi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4342ca
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x28], 0
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edi
dec edi
test edi, edi
jg 0x4342ec
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x566c70], eax
test eax, eax
je 0x434353
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CreateNZPObject
push eax
call esi
mov edx, dword [0x566c70]
push 0x514fbc
push edx
mov dword [0x566c74], eax
call esi
mov dword [0x566c78], eax
mov eax, dword [0x566c70]
push str.CreateExtractObject
push eax
call esi
mov ecx, dword [0x566c70]
push str.DeleteExtractObject
push ecx
mov dword [0x566c7c], eax
call esi
mov dword [0x566c80], eax
mov dword [esp + 0x28], edi
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
lock xadd dword [edx], edi
dec edi
test edi, edi
jg 0x434374
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret
Function at 0x4346b0
Capabilities:
Create thread

Disassembly:
push ecx
cmp dword [esi + 0x38], 0
jne 0x4346da
lea eax, [esp]
push eax
push 0
push esi
push 0x4348c0
push 0
push 0
mov dword [esp + 0x18], 0
call fcn.004e5813
add esp, 0x18
mov dword [esi + 0x38], eax
push edi
lea edi, [esi + 0x40]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [esp + 0xc]
push ecx
lea edx, [esi + 0x64]
push edx
call fcn.004105d0
mov eax, dword [esp + 0x10]
push edi
mov dword [esi + 0x7c], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esi + 0x58]
push ecx
mov dword [esi + 0x80], 1
call dword [sym.imp.KERNEL32.dll_SetEvent]
xor eax, eax
pop edi
pop ecx
ret 8
Function at 0x436150
Capabilities:
Get common file path

Disassembly:
sub esp, 0x210
mov eax, dword [0x5364d0]
xor eax, esp
mov dword [esp + 0x20c], eax
push esi
xor eax, eax
push 0x20a
mov esi, ecx
push eax
lea ecx, [esp + 0xe]
push ecx
mov word [esp + 0x10], ax
call fcn.004e8fe0
add esp, 0xc
lea edx, [esp + 4]
push edx
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jl 0x4361bd
lea eax, [esp + 4]
push eax
call fcn.00436250
mov eax, 1
pop esi
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.004e3edb
add esp, 0x210
ret
mov ecx, dword [esp + 0x210]
pop esi
xor ecx, esp
xor eax, eax
call fcn.004e3edb
add esp, 0x210
ret

Function at 0x4361e0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x88
mov eax, dword [0x5364d0]
xor eax, esp
mov dword [esp + 0x84], eax
push ebx
mov ebx, dword [esp + 0x90]
push edi
push 0x7f
lea eax, [esp + 0xd]
push 0
push eax
mov byte [esp + 0x14], 0
call fcn.004e8fe0
add esp, 0xc
lea edi, [esp + 8]
call fcn.004cc700
xor eax, eax
test ebx, ebx
jle 0x436233
mov ecx, eax
and ecx, 0x7f
mov dl, byte [esp + ecx + 8]
xor byte [esi + eax], dl
inc eax
cmp eax, ebx
jl 0x436222
mov ecx, dword [esp + 0x8c]
pop edi
pop ebx
xor ecx, esp
call fcn.004e3edb
add esp, 0x88
ret 4

Function at 0x436410
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x436438
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x436438
mov edx, dword [esi + 4]
push 0
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, 1
ret

Function at 0x4364d0
Capabilities:
Get graphical window text

Disassembly:
mov edx, dword [ecx]
push esi
mov esi, dword [esp + 8]
push edi
push eax
push edx
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, eax
test edi, edi
je 0x43655d
push ebx
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ebx, [eax + 1]
mov eax, dword [esi]
mov edx, dword [eax - 8]
sub eax, 0x10
mov ecx, 1
sub ecx, dword [eax + 0xc]
sub edx, ebx
or ecx, edx
jge 0x436510
mov ecx, ebx
mov eax, esi
call fcn.004014d0
mov eax, dword [esi]
push ebx
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov edi, eax
pop ebx
cmp edi, 0xffffffff
jne 0x436536
mov eax, dword [esi]
mov ecx, dword [eax - 8]
test eax, eax
je 0x43653a
push ecx
push eax
call fcn.004e4d4d
add esp, 8
test eax, eax
jl 0x436553
mov ecx, dword [esi]
cmp eax, dword [ecx - 8]
jg 0x436553
mov dword [ecx - 0xc], eax
mov ecx, dword [esi]
xor edx, edx
mov word [ecx + eax*2], dx
mov eax, edi
pop edi
pop esi
ret 4
push 0x80070057
call fcn.00401540
call fcn.004013b0
pop edi
xor eax, eax
pop esi
ret 4
Function at 0x436f40
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
cmp dword [ebp + 0x1c], 0
push ebx
push esi
push edi
mov edi, ecx
jne 0x43708b
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x18]
mov esi, 1
cmp eax, esi
jne 0x436f8f
mov eax, dword [edi + 0x18]
mov dword [eax + 0x20], esi
mov esi, edi
call fcn.004bda60
mov dword [ebx], eax
mov ecx, dword [edi + 0x18]
cmp dword [ecx + 0x20], 0
je 0x43704d
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
cmp eax, 5
jne 0x436fac
mov eax, dword [ebp + 0x14]
push edi
call fcn.004bdae0
mov edx, ebx
mov dword [edx], eax
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
cmp eax, 0x14
jne 0x436fe3
mov eax, dword [edi + 0x18]
push ecx
mov ecx, dword [ebp + 0x10]
mov dword [eax + 0x20], esi
mov eax, esp
mov esi, edi
mov dword [esp + 0x10], esp
mov dword [eax], ecx
call fcn.004bdb80
mov dword [ebx], eax
mov edx, dword [edi + 0x18]
cmp dword [edx + 0x20], 0
je 0x43704d
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
cmp eax, 8
jne 0x436ff7
mov eax, dword [edi]
mov edx, dword [eax + 0x10]
call edx
mov dword [ebx], 0
jmp 0x437052
cmp eax, 0x401
jne 0x43702f
push 0
push 0
push eax
mov eax, dword [edi + 0x80]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [edi + 4]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, ebx
mov dword [edx], 0
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
cmp eax, 0x20a
jne 0x437052
mov eax, dword [ebp + 0x10]
call fcn.004bdd30
mov ecx, ebx
mov dword [ecx], eax
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov esi, 1
mov eax, dword [ebp + 0x10]
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x10], esi
mov esi, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0xc]
mov ecx, edi
call fcn.0041afd0
mov dword [ebx], eax
test eax, eax
jne 0x437080
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffece
cmp ecx, 6
jbe 0x43708b
cmp dword [esp + 0xc], 0
jne 0x436f81
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x437310
Capabilities:
Enumerate files on windows
Hide graphical window

Disassembly:
push 0xffffffffffffffff
push 0x50373b
mov eax, dword fs:[0]
push eax
sub esp, 0x278
mov eax, dword [0x5364d0]
xor eax, esp
mov dword [esp + 0x270], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5364d0]
xor eax, esp
push eax
lea eax, [esp + 0x28c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x2a0]
mov ebx, dword [sym.imp.USER32.dll_IsWindow]
mov ebp, dword [esp + 0x29c]
mov esi, ecx
mov ecx, dword [esi + 4]
mov dword [esp + 0x1c], eax
lea eax, [esi + 4]
push ecx
mov edi, edx
mov dword [esp + 0x1c], eax
call ebx
test eax, eax
je 0x437529
cmp dword [esp + 0x1c], 0
je 0x437529
mov eax, esi
call fcn.004bdc00
mov edi, dword [edi]
lea edx, [esp + 0x34]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
mov dword [esp + 0x20], edi
test edi, edi
je 0x437504
cmp edi, 0xffffffff
je 0x437504
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileW]
lea esp, [esp]
lea eax, [esp + 0x60]
push 0x512924
push eax
call fcn.004e4707
add esp, 8
test eax, eax
je 0x437465
lea ecx, [esp + 0x60]
push 0x5153dc
push ecx
call fcn.004e4707
add esp, 8
test eax, eax
je 0x437465
mov al, byte [esp + 0x34]
test al, 2
jne 0x437465
cmp dword [esp + 0x2a4], 0
jne 0x437406
test al, 0x10
je 0x437465
mov edx, dword [0x563288]
mov eax, dword [edx + 0xc]
mov ecx, 0x563288
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x60]
mov dword [esp + 0x294], 0
mov edx, dword [ebp]
push ecx
push edx
push 0x512580
lea edi, [esp + 0x20]
call fcn.00404890
mov ecx, dword [esp + 0x20]
add esp, 0xc
lea eax, [esi + 0x24]
push eax
call fcn.004bd130
mov ecx, edi
mov dword [esp + 0x294], 0xffffffff
call fcn.004016f0
mov edi, dword [esp + 0x20]
lea ecx, [esp + 0x34]
push ecx
push edi
call ebx
test eax, eax
jne 0x4373c0
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [esi + 0x28]
push 0
push 0
push 0x18b
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
mov ebx, eax
test ebx, ebx
jg 0x43749f
call fcn.00436410
jmp 0x437529
mov eax, 0x14
call fcn.0041cd00
mov edi, eax
mov eax, 0xc8
imul edi, ebx
call fcn.0041cd00
cmp edi, eax
jle 0x4374c8
mov eax, 0xc8
call fcn.0041cd00
mov edi, eax
mov ecx, dword [esp + 0x1c]
mov eax, dword [ecx]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x24], eax
mov eax, dword [ecx + 0xc]
mov ecx, dword [ecx + 8]
mov dword [esp + 0x28], eax
push 0
add eax, edi
push 0
mov dword [esp + 0x38], eax
push edx
lea eax, [esp + 0x30]
mov dword [esp + 0x38], ecx
call fcn.00437ea0
call fcn.004370b0
mov eax, 1
jmp 0x43752b
mov esi, dword [esp + 0x18]
mov eax, dword [esi]
push eax
call ebx
test eax, eax
je 0x437529
mov ecx, dword [esi]
push ecx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x437529
mov edx, dword [esi]
push 0
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
mov ecx, dword [esp + 0x28c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x270]
xor ecx, esp
call fcn.004e3edb
add esp, 0x284
ret 0xc