joyce8/EMBER2024-capa huggingface dataset:
Function at 0x433001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
push 4
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
je 0x433072
nop
nop
nop
nop
nop
mov ebx, 0x40de38
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x2f41418b
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x433060
nop
nop
nop
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
je 0x4330d2
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x27e3fd0
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x419dd0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x13000]
push edi
or ebp, 0xffffffff
jmp 0x419df2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x419df9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
mov al, byte [edi]
jb 0x419de8
mov eax, 1
add ebx, ebx
jne 0x419e0d
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x419e02
jne 0x419e1e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x419e02
xor ecx, ecx
sub eax, 3
jb 0x419e32
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x419ea6
mov ebp, eax
add ebx, ebx
jne 0x419e3d
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x419e4a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x419e6e
inc ecx
add ebx, ebx
jne 0x419e5a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x419e4f
jne 0x419e6b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x419e4f
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
mov al, byte [edi + ecx]
jbe 0x419e90
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x419e82
jmp 0x419dee
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x419e90
add edi, ecx
jmp 0x419dee
pop esi
mov edi, esi
mov ecx, 0x2ba
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x419eae
cmp byte [edi], 7
jne 0x419eae
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x419eb3
lea edi, [esi + 0x17000]
mov eax, dword [edi]
or eax, eax
je 0x419f2b
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x19000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x19078]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x419ee0
mov ecx, edi
jns 0x419f0f
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1907c]
or eax, eax
je 0x419f25
mov dword [ebx], eax
add ebx, 4
jmp 0x419efd
call dword [esi + 0x19080]
popal
jmp 0x4041b3

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404369

Function at 0x4025e7
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x40f530
call fcn.00403770
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x4024e7
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x4024e7
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x4024e7
cmp dword [eax + 0x400074], 0xe
jbe 0x4024e7
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x4024eb
and dword [ebp - 0x1c], 0
push 1
call fcn.00408afe
pop ecx
test eax, eax
jne 0x4024ff
push 0x1c
call fcn.00408afe
pop ecx
call fcn.00405287
test eax, eax
jne 0x402510
push 0x10
call fcn.00408afe
pop ecx
call fcn.00405952
and dword [ebp - 4], 0
call fcn.004032ff
test eax, eax
jge 0x40252a
push 0x1b
call fcn.00408afe
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x412ba0], eax
call fcn.00408afe
mov dword [0x41203c], eax
call fcn.00408afe
test eax, eax
jge 0x402550
push 8
call fcn.00408afe
pop ecx
call fcn.00405fde
test eax, eax
jge 0x402561
push 9
call fcn.00408afe
pop ecx
push 1
call fcn.00408afe
pop ecx
test eax, eax
je 0x402574
push eax
call fcn.00408afe
pop ecx
mov eax, dword [0x412018]
mov dword [0x41201c], eax
push eax
push dword [0x412010]
push dword [0x41200c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4025a2
push eax
call fcn.00408afe
call fcn.00402400
jmp 0x4025d7
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.004037b5
ret
call fcn.00408afe
jmp 0x402495

Function at 0x408afe
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x408b0d
pop dword [ebp - 0x2c]
mov eax, 0x408b0d
sub dword [ebp - 0x2c], eax
push 0x40
push 0x1000
push 0x386bc
push 0
mov eax, 0xb49c09ad
sub eax, 0xb45b28d5
add eax, dword [ebp - 0x2c]
call dword [eax]
mov ecx, 0xf10f630e
add ecx, 0xef0e1d3
xor edx, edx
add edx, eax
mov edi, 0x413bc4
add edi, dword [ebp - 0x2c]
mov esi, 0xba0f075e
add esi, 0x794bc24b
sub dword [ebp - 0x1c], eax
mov ebx, dword [edi]
add dword [ebp - 0x28], esi
xor ebx, esi
mov dword [ebp - 0x24], 0x31c0993b
mov dword [edx], ebx
add edx, 0x4b12918a
add edx, 0xb4ed6e7a
add edi, 4
loop 0x408b63
add eax, 0x10657
mov ebx, eax
add eax, 0x5caa2a15
sub eax, 0x5caa2a10
mov ecx, 0x400000
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x406460
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0xffffffffffffffff
push dword [ebp + 8]
call dword [sym.imp.soui.dll_public:_class_SOUI::SWindow____thiscall_SOUI::SWindow::FindChildByName_wchar_t_const___int_]
mov edi, eax
test edi, edi
je 0x406494
mov esi, dword [edi]
call dword [sym.imp.soui.dll_public:_static_wchar_t_const____cdecl_SOUI::STabCtrl::GetClassNameW_void_]
push eax
mov ecx, edi
call dword [esi + 4]
test eax, eax
je 0x406494
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8
call dword [sym.imp.soui.dll_public:_static_class_SOUI::SApplication____cdecl_SOUI::SSingleton_class_SOUI::SApplication_::getSingletonPtr_void_]
test eax, eax
je 0x4064b0
call dword [sym.imp.soui.dll_public:_static_class_SOUI::SApplication____cdecl_SOUI::SSingleton_class_SOUI::SApplication_::getSingleton_void_]
mov ecx, eax
call dword [sym.imp.soui.dll_public:_struct_SOUI::ILog4zManager____thiscall_SOUI::SApplication::GetLogManager_void_]
mov esi, eax
jmp 0x4064b2
xor esi, esi
push 0x2800
call fcn.00507cfc
add esp, 4
mov edi, eax
push 0x5000
call fcn.00507cfc
add esp, 4
mov ebx, eax
push 0xffffffffffffffff
push dword [ebp + 8]
call dword [sym.imp.soui.dll_public:_static_wchar_t_const____cdecl_SOUI::STabCtrl::GetClassNameW_void_]
push eax
push str.FindChildByName2_Failed__no_window_of_class___s__with_name_of___s__was_found_within___d__levels
push 0xffffffffffffffff
push 0x2800
push ebx
call fcn.00404a10
add esp, 0x1c
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp eax, 0x2800
jae 0x406520
push 0
push 0
push eax
push edi
push 0xffffffffffffffff
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
call fcn.00507ce1
add esp, 4
test esi, esi
je 0x406575
mov eax, dword [esi]
mov ecx, esi
push 1
push 0
mov eax, dword [eax + 0x2c]
call eax
test al, al
je 0x406575
mov eax, dword [ebp + 4]
mov ecx, esi
mov edx, dword [esi]
push eax
push str.SOUI::SWindow::FindChildByName2
push 0x20e
push str.D:codeworkspace_souiSOUIincludecoreSWnd.h
push edi
push str.soui
push 1
push 0
call dword [edx + 0x34]
push edi
call fcn.00507ce1
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8
push 0x2800
call fcn.00507cfc
add esp, 4
mov esi, eax
push 0x20e
push str.D:codeworkspace_souiSOUIincludecoreSWnd.h
push str.SOUI::SWindow::FindChildByName2
push edi
push str._s__s__s:_d_n
push 0xffffffffffffffff
push 0x2800
push esi
call fcn.00404a70
add esp, 0x20
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push esi
call fcn.00507ce1
add esp, 4
push edi
call fcn.00507ce1
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8
Function at 0x4065d0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0xffffffffffffffff
push str.update_msg_text
call dword [sym.imp.soui.dll_public:_class_SOUI::SWindow____thiscall_SOUI::SWindow::FindChildByName_wchar_t_const___int_]
mov edi, eax
test edi, edi
je 0x406606
mov esi, dword [edi]
call dword [sym.imp.soui.dll_public:_static_wchar_t_const____cdecl_SOUI::SRichEdit::GetClassNameW_void_]
push eax
mov ecx, edi
call dword [esi + 4]
test eax, eax
je 0x406606
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8
call dword [sym.imp.soui.dll_public:_static_class_SOUI::SApplication____cdecl_SOUI::SSingleton_class_SOUI::SApplication_::getSingletonPtr_void_]
test eax, eax
je 0x406622
call dword [sym.imp.soui.dll_public:_static_class_SOUI::SApplication____cdecl_SOUI::SSingleton_class_SOUI::SApplication_::getSingleton_void_]
mov ecx, eax
call dword [sym.imp.soui.dll_public:_struct_SOUI::ILog4zManager____thiscall_SOUI::SApplication::GetLogManager_void_]
mov esi, eax
jmp 0x406624
xor esi, esi
push 0x2800
call fcn.00507cfc
add esp, 4
mov edi, eax
push 0x5000
call fcn.00507cfc
add esp, 4
mov ebx, eax
push 0xffffffffffffffff
push str.update_msg_text
call dword [sym.imp.soui.dll_public:_static_wchar_t_const____cdecl_SOUI::SRichEdit::GetClassNameW_void_]
push eax
push str.FindChildByName2_Failed__no_window_of_class___s__with_name_of___s__was_found_within___d__levels
push 0xffffffffffffffff
push 0x2800
push ebx
call fcn.00404a10
add esp, 0x1c
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp eax, 0x2800
jae 0x406694
push 0
push 0
push eax
push edi
push 0xffffffffffffffff
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
call fcn.00507ce1
add esp, 4
test esi, esi
je 0x4066e9
mov eax, dword [esi]
mov ecx, esi
push 1
push 0
mov eax, dword [eax + 0x2c]
call eax
test al, al
je 0x4066e9
mov eax, dword [ebp + 4]
mov ecx, esi
mov edx, dword [esi]
push eax
push str.SOUI::SWindow::FindChildByName2
push 0x20e
push str.D:codeworkspace_souiSOUIincludecoreSWnd.h
push edi
push str.soui
push 1
push 0
call dword [edx + 0x34]
push edi
call fcn.00507ce1
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8
push 0x2800
call fcn.00507cfc
add esp, 4
mov esi, eax
push 0x20e
push str.D:codeworkspace_souiSOUIincludecoreSWnd.h
push str.SOUI::SWindow::FindChildByName2
push edi
push str._s__s__s:_d_n
push 0xffffffffffffffff
push 0x2800
push esi
call fcn.00404a70
add esp, 0x20
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push esi
call fcn.00507ce1
add esp, 4
push edi
call fcn.00507ce1
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8
Function at 0x406740
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0xffffffffffffffff
push str.text_pg_install
call dword [sym.imp.soui.dll_public:_class_SOUI::SWindow____thiscall_SOUI::SWindow::FindChildByName_wchar_t_const___int_]
mov edi, eax
test edi, edi
je 0x406776
mov esi, dword [edi]
call dword [sym.imp.soui.dll_public:_static_wchar_t_const____cdecl_SOUI::SStatic::GetClassNameW_void_]
push eax
mov ecx, edi
call dword [esi + 4]
test eax, eax
je 0x406776
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8
call dword [sym.imp.soui.dll_public:_static_class_SOUI::SApplication____cdecl_SOUI::SSingleton_class_SOUI::SApplication_::getSingletonPtr_void_]
test eax, eax
je 0x406792
call dword [sym.imp.soui.dll_public:_static_class_SOUI::SApplication____cdecl_SOUI::SSingleton_class_SOUI::SApplication_::getSingleton_void_]
mov ecx, eax
call dword [sym.imp.soui.dll_public:_struct_SOUI::ILog4zManager____thiscall_SOUI::SApplication::GetLogManager_void_]
mov esi, eax
jmp 0x406794
xor esi, esi
push 0x2800
call fcn.00507cfc
add esp, 4
mov edi, eax
push 0x5000
call fcn.00507cfc
add esp, 4
mov ebx, eax
push 0xffffffffffffffff
push str.text_pg_install
call dword [sym.imp.soui.dll_public:_static_wchar_t_const____cdecl_SOUI::SStatic::GetClassNameW_void_]
push eax
push str.FindChildByName2_Failed__no_window_of_class___s__with_name_of___s__was_found_within___d__levels
push 0xffffffffffffffff
push 0x2800
push ebx
call fcn.00404a10
add esp, 0x1c
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp eax, 0x2800
jae 0x406804
push 0
push 0
push eax
push edi
push 0xffffffffffffffff
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
call fcn.00507ce1
add esp, 4
test esi, esi
je 0x406859
mov eax, dword [esi]
mov ecx, esi
push 1
push 0
mov eax, dword [eax + 0x2c]
call eax
test al, al
je 0x406859
mov eax, dword [ebp + 4]
mov ecx, esi
mov edx, dword [esi]
push eax
push str.SOUI::SWindow::FindChildByName2
push 0x20e
push str.D:codeworkspace_souiSOUIincludecoreSWnd.h
push edi
push str.soui
push 1
push 0
call dword [edx + 0x34]
push edi
call fcn.00507ce1
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8
push 0x2800
call fcn.00507cfc
add esp, 4
mov esi, eax
push 0x20e
push str.D:codeworkspace_souiSOUIincludecoreSWnd.h
push str.SOUI::SWindow::FindChildByName2
push edi
push str._s__s__s:_d_n
push 0xffffffffffffffff
push 0x2800
push esi
call fcn.00404a70
add esp, 0x20
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push esi
call fcn.00507ce1
add esp, 4
push edi
call fcn.00507ce1
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8
Function at 0x4068b0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0xffffffffffffffff
push str.pg_install
call dword [sym.imp.soui.dll_public:_class_SOUI::SWindow____thiscall_SOUI::SWindow::FindChildByName_wchar_t_const___int_]
mov edi, eax
test edi, edi
je 0x4068e6
mov esi, dword [edi]
call dword [sym.imp.soui.dll_public:_static_wchar_t_const____cdecl_SOUI::SProgress::GetClassNameW_void_]
push eax
mov ecx, edi
call dword [esi + 4]
test eax, eax
je 0x4068e6
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8
call dword [sym.imp.soui.dll_public:_static_class_SOUI::SApplication____cdecl_SOUI::SSingleton_class_SOUI::SApplication_::getSingletonPtr_void_]
test eax, eax
je 0x406902
call dword [sym.imp.soui.dll_public:_static_class_SOUI::SApplication____cdecl_SOUI::SSingleton_class_SOUI::SApplication_::getSingleton_void_]
mov ecx, eax
call dword [sym.imp.soui.dll_public:_struct_SOUI::ILog4zManager____thiscall_SOUI::SApplication::GetLogManager_void_]
mov esi, eax
jmp 0x406904
xor esi, esi
push 0x2800
call fcn.00507cfc
add esp, 4
mov edi, eax
push 0x5000
call fcn.00507cfc
add esp, 4
mov ebx, eax
push 0xffffffffffffffff
push str.pg_install
call dword [sym.imp.soui.dll_public:_static_wchar_t_const____cdecl_SOUI::SProgress::GetClassNameW_void_]
push eax
push str.FindChildByName2_Failed__no_window_of_class___s__with_name_of___s__was_found_within___d__levels
push 0xffffffffffffffff
push 0x2800
push ebx
call fcn.00404a10
add esp, 0x1c
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp eax, 0x2800
jae 0x406974
push 0
push 0
push eax
push edi
push 0xffffffffffffffff
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
call fcn.00507ce1
add esp, 4
test esi, esi
je 0x4069c9
mov eax, dword [esi]
mov ecx, esi
push 1
push 0
mov eax, dword [eax + 0x2c]
call eax
test al, al
je 0x4069c9
mov eax, dword [ebp + 4]
mov ecx, esi
mov edx, dword [esi]
push eax
push str.SOUI::SWindow::FindChildByName2
push 0x20e
push str.D:codeworkspace_souiSOUIincludecoreSWnd.h
push edi
push str.soui
push 1
push 0
call dword [edx + 0x34]
push edi
call fcn.00507ce1
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8
push 0x2800
call fcn.00507cfc
add esp, 4
mov esi, eax
push 0x20e
push str.D:codeworkspace_souiSOUIincludecoreSWnd.h
push str.SOUI::SWindow::FindChildByName2
push edi
push str._s__s__s:_d_n
push 0xffffffffffffffff
push 0x2800
push esi
call fcn.00404a70
add esp, 0x20
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push esi
call fcn.00507ce1
add esp, 4
push edi
call fcn.00507ce1
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8
Function at 0x407e60
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push 0xffffffffffffffff
push dword [ebp + 8]
call dword [sym.imp.soui.dll_public:_class_SOUI::SWindow____thiscall_SOUI::SWindow::FindChildByName_wchar_t_const___int_]
mov edi, eax
test edi, edi
je 0x407e90
mov esi, dword [edi]
call dword [sym.imp.soui.dll_public:_static_wchar_t_const____cdecl_SOUI::SAnimateImgWnd::GetClassNameW_void_]
push eax
mov ecx, edi
call dword [esi + 4]
test eax, eax
je 0x407e90
mov eax, edi
pop edi
pop esi
pop ebp
ret 8
call dword [sym.imp.soui.dll_public:_static_class_SOUI::SApplication____cdecl_SOUI::SSingleton_class_SOUI::SApplication_::getSingletonPtr_void_]
test eax, eax
je 0x407eac
call dword [sym.imp.soui.dll_public:_static_class_SOUI::SApplication____cdecl_SOUI::SSingleton_class_SOUI::SApplication_::getSingleton_void_]
mov ecx, eax
call dword [sym.imp.soui.dll_public:_struct_SOUI::ILog4zManager____thiscall_SOUI::SApplication::GetLogManager_void_]
mov esi, eax
jmp 0x407eae
xor esi, esi
push ebx
push 0x2800
call fcn.00507cfc
push 0x5000
mov edi, eax
call fcn.00507cfc
add esp, 8
mov ebx, eax
push 0xffffffffffffffff
push dword [ebp + 8]
call dword [sym.imp.soui.dll_public:_static_wchar_t_const____cdecl_SOUI::SAnimateImgWnd::GetClassNameW_void_]
push eax
push str.FindChildByName2_Failed__no_window_of_class___s__with_name_of___s__was_found_within___d__levels
push 0xffffffffffffffff
push 0x2800
push ebx
call fcn.00404a10
add esp, 0x1c
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp eax, 0x2800
jae 0x407f1a
push 0
push 0
push eax
push edi
push 0xffffffffffffffff
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
call fcn.00507ce1
add esp, 4
pop ebx
test esi, esi
je 0x407f6e
mov eax, dword [esi]
mov ecx, esi
push 1
push 0
mov eax, dword [eax + 0x2c]
call eax
test al, al
je 0x407f6e
mov eax, dword [ebp + 4]
mov ecx, esi
mov edx, dword [esi]
push eax
push str.SOUI::SWindow::FindChildByName2
push 0x20e
push str.D:codeworkspace_souiSOUIincludecoreSWnd.h
push edi
push str.soui
push 1
push 0
call dword [edx + 0x34]
push edi
call fcn.00507ce1
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
ret 8
push 0x2800
call fcn.00507cfc
push 0x20e
push str.D:codeworkspace_souiSOUIincludecoreSWnd.h
push str.SOUI::SWindow::FindChildByName2
push edi
push str._s__s__s:_d_n
push 0xffffffffffffffff
mov esi, eax
push 0x2800
push esi
call fcn.00404a70
add esp, 0x24
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push esi
call fcn.00507ce1
add esp, 4
push edi
call fcn.00507ce1
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
ret 8
Function at 0x4086a0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax], 0
je 0x4086ff
push 0x720f9c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4086cc
mov eax, 1
jmp 0x40871d
push str.RegDeleteKeyTransactedW
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4086fd
push 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
push eax
push 0
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0xc]
jmp 0x40871d
jmp 0x408718
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x408718
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x40871d
mov eax, 1
mov esp, ebp
pop ebp
ret 8

Function at 0x408d00
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
xor eax, eax
jne 0x408d09
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
shl edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x408d4c
mov eax, dword [ebp - 8]
jmp 0x408db2
cmp dword [ebp - 0xc], 1
je 0x408d5f
cmp dword [ebp - 0xc], 2
je 0x408d5f
mov eax, 0xd
jmp 0x408db2
cmp dword [ebp + 0xc], 0
je 0x408da6
cmp dword [ebp - 4], 0
je 0x408d95
mov eax, dword [ebp - 4]
xor edx, edx
mov ecx, 2
div ecx
test edx, edx
jne 0x408d8c
mov edx, dword [ebp - 4]
shr edx, 1
mov eax, dword [ebp + 0xc]
movzx ecx, word [eax + edx*2 - 2]
test ecx, ecx
je 0x408d93
mov eax, 0xd
jmp 0x408db2
jmp 0x408da6
mov edx, 2
imul eax, edx, 0
xor ecx, ecx
mov edx, dword [ebp + 0xc]
mov word [edx + eax], cx
mov eax, dword [ebp - 4]
shr eax, 1
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc