joyce8/EMBER2024-capa huggingface dataset:
Function at 0x479b30
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x604f88
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x6687b8]
xor eax, esp
mov dword [esp + 0x44], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6687b8]
xor eax, esp
push eax
lea eax, [esp + 0x5c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x6c]
mov ebx, edx
xor edi, edi
mov esi, ecx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], edi
mov dword [esp + 0x64], edi
call fcn.00478e90
test eax, eax
jne 0x479be7
call fcn.00478f30
test eax, eax
jne 0x479be7
lea eax, [esp + 0x14]
push eax
push 0x20019
push edi
push esi
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x479d07
lea ecx, [esp + 0x1c]
push ecx
push ebx
lea edx, [esp + 0x20]
push edx
mov eax, 4
push edi
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x24]
push ebp
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [esp + 0x14]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp esi, edi
sete al
jmp 0x479d09
mov dword [esp + 0x54], 7
mov dword [esp + 0x50], edi
mov word [esp + 0x40], di
mov ebx, 1
lea ecx, [esp + 0x20]
mov byte [esp + 0x64], bl
call fcn.00478fb0
push 0xffffffffffffffff
push edi
lea ecx, [esp + 0x44]
mov byte [esp + 0x6c], 2
call fcn.00404ae0
mov byte [esp + 0x64], bl
cmp dword [esp + 0x38], 8
jb 0x479c33
mov edx, dword [esp + 0x24]
push edx
call fcn.005d2367
add esp, 4
push ebx
push 0x62454c
lea ecx, [esp + 0x44]
call fcn.0040a070
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x479c47
sub eax, edx
sar eax, 1
push eax
push esi
lea ecx, [esp + 0x44]
call fcn.0040a070
mov eax, dword [esp + 0x40]
mov esi, 8
cmp dword [esp + 0x54], esi
jae 0x479c74
lea eax, [esp + 0x40]
lea ecx, [esp + 0x14]
push ecx
push 0x2001f
push edi
push eax
push reloc.WS2_32.dll_closesocket
mov dword [esp + 0x28], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x479cf4
mov esi, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
push ebp
lea edx, [esp + 0x18]
push edx
mov dword [esp + 0x1c], esi
call fcn.00478d30
cmp esi, edi
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, eax
je 0x479cbb
push esi
call ebp
xor esi, esi
xor eax, eax
cmp ebx, edi
sete al
cmp dword [esp + 0x54], 8
mov ebx, eax
jb 0x479cd8
mov ecx, dword [esp + 0x40]
push ecx
call fcn.005d2367
add esp, 4
cmp esi, edi
mov dword [esp + 0x54], 7
mov dword [esp + 0x50], edi
mov word [esp + 0x40], di
je 0x479cf0
push esi
call ebp
mov eax, ebx
jmp 0x479d09
cmp dword [esp + 0x54], esi
jb 0x479d07
mov edx, dword [esp + 0x40]
push edx
call fcn.005d2367
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x5c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.005d28b3
add esp, 0x54
ret
Function at 0x479d30
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push esi
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0xc]
push edx
xor esi, esi
push esi
push eax
push ecx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [esp + 4], 4
jne 0x479d6c
cmp eax, esi
lea eax, [esi + 1]
je 0x479d6e
mov eax, esi
pop esi
add esp, 8
ret
Function at 0x47a010
Capabilities:
Delete registry value

Disassembly:
push 0xffffffffffffffff
push 0x604ec8
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x6687b8]
xor eax, esp
mov dword [esp + 0x3c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6687b8]
xor eax, esp
push eax
lea eax, [esp + 0x54]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x64]
xor edi, edi
mov esi, ecx
mov dword [esp + 0x14], edi
mov dword [esp + 0x5c], edi
call fcn.00478e90
test eax, eax
jne 0x47a0bf
call fcn.00478f30
test eax, eax
jne 0x47a0bf
lea eax, [esp + 0x14]
push eax
push 0x2001f
push edi
push esi
push SysReAllocStringLen
mov dword [esp + 0x28], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x47a1d5
mov esi, dword [esp + 0x14]
push ebp
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp esi, edi
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, eax
je 0x47a0a4
push esi
call ebp
xor esi, esi
xor ecx, ecx
cmp ebx, edi
sete cl
cmp esi, edi
mov ebx, ecx
je 0x47a1be
push esi
call ebp
mov eax, ebx
jmp 0x47a1d7
mov dword [esp + 0x4c], 7
mov dword [esp + 0x48], edi
mov word [esp + 0x38], di
mov ebx, 1
lea ecx, [esp + 0x18]
mov byte [esp + 0x5c], bl
call fcn.00478fb0
push 0xffffffffffffffff
push edi
lea ecx, [esp + 0x3c]
mov byte [esp + 0x64], 2
call fcn.00404ae0
mov byte [esp + 0x5c], bl
cmp dword [esp + 0x30], 8
jb 0x47a10b
mov edx, dword [esp + 0x1c]
push edx
call fcn.005d2367
add esp, 4
push ebx
push 0x62454c
lea ecx, [esp + 0x3c]
call fcn.0040a070
mov eax, esi
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x47a120
sub eax, edx
sar eax, 1
push eax
push esi
lea ecx, [esp + 0x3c]
call fcn.0040a070
mov eax, dword [esp + 0x38]
mov esi, 8
cmp dword [esp + 0x4c], esi
jae 0x47a14d
lea eax, [esp + 0x38]
lea ecx, [esp + 0x14]
push ecx
push 0x2001f
push edi
push eax
push reloc.WS2_32.dll_closesocket
mov dword [esp + 0x28], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x47a1c2
mov esi, dword [esp + 0x14]
push ebp
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp esi, edi
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, eax
je 0x47a189
push esi
call ebp
xor esi, esi
xor edx, edx
cmp ebx, edi
sete dl
cmp dword [esp + 0x4c], 8
mov ebx, edx
jb 0x47a1a6
mov eax, dword [esp + 0x38]
push eax
call fcn.005d2367
add esp, 4
cmp esi, edi
mov dword [esp + 0x4c], 7
mov dword [esp + 0x48], edi
mov word [esp + 0x38], di
je 0x47a1be
push esi
call ebp
mov eax, ebx
jmp 0x47a1d7
cmp dword [esp + 0x4c], esi
jb 0x47a1d5
mov ecx, dword [esp + 0x38]
push ecx
call fcn.005d2367
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x54]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.005d28b3
add esp, 0x4c
ret
Function at 0x47a200
Capabilities:
Delete registry key

Disassembly:
push 0xffffffffffffffff
push 0x604ec8
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x6687b8]
xor eax, esp
mov dword [esp + 0x3c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6687b8]
xor eax, esp
push eax
lea eax, [esp + 0x54]
mov dword fs:[0], eax
xor ebp, ebp
mov dword [esp + 0x14], ebp
mov dword [esp + 0x5c], ebp
call fcn.00478e90
test eax, eax
jne 0x47a2b1
call fcn.00478f30
test eax, eax
jne 0x47a2b1
lea eax, [esp + 0x14]
push eax
push 0x2001f
push ebp
push str.SOFTWARETencentQQPinyin
push SysReAllocStringLen
mov dword [esp + 0x28], ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebp
jne 0x47a3d8
mov esi, dword [esp + 0x14]
push str.ValidKey
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
cmp esi, ebp
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, eax
je 0x47a296
push esi
call ebx
xor esi, esi
xor ecx, ecx
cmp edi, ebp
sete cl
cmp esi, ebp
mov edi, ecx
je 0x47a3c1
push esi
call ebx
mov eax, edi
jmp 0x47a3da
mov dword [esp + 0x4c], 7
mov dword [esp + 0x48], ebp
mov word [esp + 0x38], bp
mov ebx, 1
lea ecx, [esp + 0x18]
mov byte [esp + 0x5c], bl
call fcn.00478fb0
push 0xffffffffffffffff
push ebp
lea ecx, [esp + 0x3c]
mov byte [esp + 0x64], 2
call fcn.00404ae0
mov esi, 8
mov byte [esp + 0x5c], bl
cmp dword [esp + 0x30], esi
jb 0x47a301
mov edx, dword [esp + 0x1c]
push edx
call fcn.005d2367
add esp, 4
push ebx
push 0x62454c
lea ecx, [esp + 0x3c]
call fcn.0040a070
mov eax, str.SOFTWARETencentQQPinyin
lea edx, [eax + 2]
jmp 0x47a320
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x47a320
sub eax, edx
sar eax, 1
push eax
push str.SOFTWARETencentQQPinyin
lea ecx, [esp + 0x3c]
call fcn.0040a070
cmp dword [esp + 0x4c], esi
mov eax, dword [esp + 0x38]
jae 0x47a34c
lea eax, [esp + 0x38]
lea ecx, [esp + 0x14]
push ecx
push 0x2001f
push ebp
push eax
push reloc.WS2_32.dll_closesocket
mov dword [esp + 0x28], ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebp
jne 0x47a3c5
mov esi, dword [esp + 0x14]
push str.ValidKey
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
cmp esi, ebp
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, eax
je 0x47a38c
push esi
call ebx
xor esi, esi
xor edx, edx
cmp edi, ebp
sete dl
cmp dword [esp + 0x4c], 8
mov edi, edx
jb 0x47a3a9
mov eax, dword [esp + 0x38]
push eax
call fcn.005d2367
add esp, 4
cmp esi, ebp
mov dword [esp + 0x4c], 7
mov dword [esp + 0x48], ebp
mov word [esp + 0x38], bp
je 0x47a3c1
push esi
call ebx
mov eax, edi
jmp 0x47a3da
cmp dword [esp + 0x4c], esi
jb 0x47a3d8
mov ecx, dword [esp + 0x38]
push ecx
call fcn.005d2367
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x54]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.005d28b3
add esp, 0x4c
ret
Function at 0x47ac70
Capabilities:
Check if file exists
Create directory
Get common file path

Disassembly:
sub esp, 0x214
mov eax, dword [0x6687b8]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
mov ebx, 1
test byte [0x680a1c], bl
mov dword [esp + 4], 0
jne 0x47acc4
mov eax, dword [0x677600]
mov edx, dword [eax + 0xc]
or dword [0x680a1c], ebx
mov ecx, 0x677600
call edx
add eax, 0x10
push 0x613880
mov dword [0x680a14], eax
call fcn.005d268a
add esp, 4
mov eax, dword [0x680a14]
cmp dword [eax - 0xc], 0
jne 0x47ad66
push 0x20a
lea ecx, [esp + 0xe]
push 0
push ecx
mov word [esp + 0x14], 0
call fcn.005da970
add esp, 0xc
push ebx
push 0x1a
lea edx, [esp + 0x10]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [esp + 8]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x47ad05
sub eax, edx
sar eax, 1
lea ecx, [esp + 8]
mov ebx, eax
push ecx
mov eax, 0x680a14
call fcn.004037a0
mov edx, dword [0x680a14]
cmp dword [edx - 0xc], 0
jle 0x47ad66
call fcn.00478e50
push 0x11
push str.TencentQQPinyin_
push 0x680a14
call fcn.0040aee0
mov eax, dword [0x680a14]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x47ad66
mov ecx, dword [0x680a14]
push eax
push ecx
push eax
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov eax, dword [0x680a14]
add eax, 0xfffffff0
call fcn.0040a210
mov ecx, dword [esp + 0x214]
add eax, 0x10
pop ebx
mov dword [edi], eax
xor ecx, esp
mov eax, edi
call fcn.005d28b3
add esp, 0x214
ret
Function at 0x47d550
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x6099ef
mov eax, dword fs:[0]
push eax
sub esp, 0x264
mov eax, dword [0x6687b8]
xor eax, esp
mov dword [esp + 0x260], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6687b8]
xor eax, esp
push eax
lea eax, [esp + 0x278]
mov dword fs:[0], eax
push 0x74
mov ebx, ecx
call fcn.005d2776
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov dword [esp + 0x280], 0
je 0x47d5b4
push eax
call fcn.004fdc60
mov esi, eax
jmp 0x47d5b6
xor esi, esi
or ebp, 0xffffffff
test esi, esi
mov dword [esp + 0x280], ebp
je 0x47d67f
mov eax, dword [0x677600]
mov edx, dword [eax + 0xc]
mov ecx, 0x677600
call edx
add eax, 0x10
mov dword [esp + 0x20], eax
push 0x62ab54
lea edi, [esp + 0x24]
mov dword [esp + 0x284], 1
call fcn.0040ac80
add esp, 4
lea eax, [esp + 0x1c]
push eax
mov ecx, 0x62ab64
call fcn.00409dd0
push 1
lea ecx, [esp + 0x20]
push ecx
mov edx, edi
push edx
push esi
mov eax, ebx
mov byte [esp + 0x290], 2
call fcn.004fdfa0
mov byte [esp + 0x280], 1
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov edx, ebp
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x47d64a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x280], ebp
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov edx, ebp
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x47d670
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push esi
call fcn.004fdd60
push esi
call fcn.005d2367
add esp, 4
lea ebx, [esp + 0x14]
call fcn.0047a980
mov dword [esp + 0x280], 3
mov edx, dword [esp + 0x14]
mov ecx, dword [edx - 0xc]
test ecx, ecx
jle 0x47d6c4
lea eax, [ecx - 1]
test eax, eax
jl 0x47d779
cmp eax, ecx
jg 0x47d779
movzx eax, word [edx + eax*2]
cmp ax, 0x5c
je 0x47d6c4
push 0x5c
mov edi, ebx
call fcn.0040af90
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x1c]
push edx
mov ebx, 0x626838
call fcn.0040aab0
mov ecx, dword [esp + 0x20]
add esp, 8
lea eax, [esp + 0x24]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, ebp
je 0x47d70e
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [esp + 0x18]
push 0
push 0
push 0
push edx
push 0x625c98
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov edx, ebp
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x47d72d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x280], ebp
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], ebp
dec ebp
test ebp, ebp
jg 0x47d751
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x278]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x260]
xor ecx, esp
call fcn.005d28b3
add esp, 0x270
ret
push 0x80070057
call fcn.00403650
int3
Function at 0x47dbd0
Capabilities:
Hide graphical window

Disassembly:
push 0xffffffffffffffff
push 0x5fbb90
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x6687b8]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov edi, edx
mov ebx, dword [esp + 0x24]
cmp dword [ebx + 0x1584], 0
jne 0x47dcfe
lea eax, [esp + 0x24]
push eax
call fcn.00409dd0
mov dword [esp + 0x1c], 0
mov ecx, dword [ebx + 0x1058]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 1
push ecx
call esi
mov edx, dword [ebx + 0x1060]
push 1
push edx
call esi
mov eax, dword [ebx + 0x105c]
push 0
push eax
call esi
cmp edi, 0xffffffff
je 0x47dc5a
mov ecx, dword [ebx + 0x1060]
push 0
push edi
push 0x402
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [esp + 0x24]
push edx
call fcn.0047da60
mov eax, dword [esp + 0x24]
cmp dword [eax - 0xc], 0x16
jle 0x47dcc4
mov eax, 0x14
lea ecx, [esp + 0x10]
lea edx, [esp + 0x24]
call fcn.0041a270
lea edi, [esp + 0x24]
mov byte [esp + 0x1c], 1
call fcn.0040ab90
mov byte [esp + 0x1c], 0
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x47dcb3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 3
push 0x629f88
lea ecx, [esp + 0x2c]
push ecx
call fcn.0040aee0
mov edx, dword [esp + 0x24]
mov eax, dword [ebx + 0x1058]
push edx
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov dword [esp + 0x1c], 0xffffffff
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x47dcfe
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4

Function at 0x47dd20
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
mov ebx, eax
mov eax, dword [ebx + 0x1058]
push 0
push eax
call esi
mov ecx, dword [ebx + 0x1060]
push 0
push ecx
call esi
mov edx, dword [ebx + 0x105c]
push 1
push edx
call esi
mov eax, dword [ebx + 0x105c]
push edi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
push edi
call fcn.0047da60
pop esi
pop ebx
ret

Function at 0x47dd70
Capabilities:
Check os version

Disassembly:
sub esp, 0x120
mov eax, dword [0x6687b8]
xor eax, esp
mov dword [esp + 0x11c], eax
push esi
push 0x118
lea eax, [esp + 0xc]
push 0
push eax
call fcn.005da970
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
add esp, 0xc
lea ecx, [esp + 4]
push ecx
mov dword [esp + 8], 0x11c
call esi
test eax, eax
jne 0x47ddc5
lea edx, [esp + 4]
push edx
mov dword [esp + 8], 0x114
call esi
test eax, eax
je 0x47ddee
cmp dword [esp + 0x14], 2
jne 0x47ddee
cmp dword [esp + 8], 5
ja 0x47ddee
mov eax, 1
pop esi
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.005d28b3
add esp, 0x120
ret
mov ecx, dword [esp + 0x120]
pop esi
xor ecx, esp
xor eax, eax
call fcn.005d28b3
add esp, 0x120
ret
Function at 0x47e880
Capabilities:
Check mutex on windows
Print debug messages

Disassembly:
push ecx
push ebx
push esi
push edi
push 0
push 0x1f0001
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
test eax, eax
mov dword [ebx + 4], eax
jne 0x47e8f5
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push edi
call esi
push 0x62ac34
call esi
push edi
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
push str.create_mutex
mov dword [ebx + 4], eax
call esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x47e8f5
mov ebx, dword [ebx + 4]
test ebx, ebx
je 0x47e8f5
push 0x10100001
mov eax, ebx
call fcn.0050db00
add esp, 4
test eax, eax
jne 0x47e8ef
push ebx
call fcn.0050dbd0
add esp, 4
xor eax, eax
pop esi
pop ebx
pop ecx
ret
pop esi
mov eax, 1
pop ebx
pop ecx
ret
Function at 0x480510
Capabilities:
Print debug messages

Disassembly:
push 0xffffffffffffffff
push 0x60d62b
mov eax, dword fs:[0]
push eax
sub esp, 0x864
mov eax, dword [0x6687b8]
xor eax, esp
mov dword [esp + 0x860], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6687b8]
xor eax, esp
push eax
lea eax, [esp + 0x878]
mov dword fs:[0], eax
mov eax, dword [esp + 0x88c]
mov ebp, dword [esp + 0x888]
lea esi, [esp + 0x24]
mov dword [esp + 0x14], eax
call fcn.00498dc0
mov ebx, dword [0x67ebfc]
mov esi, 0x67ebf4
lea edi, [esp + 0x1c]
call fcn.00444be0
mov esi, eax
mov eax, dword [esi]
test eax, eax
je 0x480589
cmp eax, 0x67ebf8
je 0x48058e
call fcn.005d29f1
cmp dword [esi + 4], ebx
je 0x4805a9
mov ecx, 0x67ebf4
call fcn.00444ae0
push eax
lea ebx, [esp + 0x28]
call fcn.00498eb0
jmp 0x4805da
mov esi, dword [0x67ebf4]
mov eax, 1
test byte [0x6809cc], al
jne 0x4805cf
or dword [0x6809cc], eax
push 0x613990
call fcn.005d268a
add esp, 4
lea edx, [esp + 0x24]
mov ecx, esi
call fcn.004991e0
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
lea ecx, [esp + 0x24]
push ecx
mov ecx, ebp
mov edi, eax
call fcn.00483200
mov edx, dword [0x677600]
mov eax, dword [edx + 0xc]
mov ecx, 0x677600
call eax
add eax, 0x10
mov dword [esp + 0x18], eax
mov dword [esp + 0x880], 0
call esi
sub eax, edi
push eax
push str.Refresh_SkinSetDlg_Cost_Time:__d
lea edi, [esp + 0x20]
call fcn.0040ac80
mov esi, dword [esp + 0x20]
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea eax, [esi - 0x10]
mov dword [esp + 0x880], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x480666
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x14]
mov dword [ecx], 0
jmp 0x480670
mov edx, dword [esp + 0x14]
mov dword [edx], 0
mov eax, 1
mov ecx, dword [esp + 0x878]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x860]
xor ecx, esp
call fcn.005d28b3
add esp, 0x870
ret 8
Function at 0x480940
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x18
push ebx
push ebp
movzx ebp, ax
push esi
shr eax, 0x10
mov esi, 1
push edi
mov ebx, ecx
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], eax
lea edi, [esi + 0xf]
mov ecx, dword [ebx + 0x3c]
test ecx, ecx
je 0x480972
mov eax, dword [ebx + 0x40]
sub eax, ecx
sar eax, 4
cmp esi, eax
jb 0x480977
call fcn.005d29f1
mov ecx, dword [esp + 0x14]
mov eax, dword [ebx + 0x3c]
push ecx
add eax, edi
push ebp
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne 0x4809c4
add edi, 0x10
add esi, 1
cmp edi, 0x50
jle 0x48095f
push 0x7f00
push eax
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
mov eax, dword [esp + 0x2c]
mov dword [eax], 0
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 4
lea edx, [esi - 1]
cmp dword [ebx + 0x74], edx
jne 0x480af4
cmp dword [ebx + 0x68], 0
je 0x480af4
mov ecx, dword [ebx + 0x20]
lea edi, [ebx + 0x7c]
push edi
add ecx, 0x24
call fcn.0048b500
mov ecx, dword [eax + 4]
test ecx, ecx
jne 0x4809f4
xor eax, eax
jmp 0x4809fc
mov eax, dword [eax + 8]
sub eax, ecx
sar eax, 2
mov ecx, dword [ebx + 0x78]
mov edx, dword [ebx + 0x74]
lea ebp, [ecx + edx]
cmp ebp, eax
jae 0x480af4
mov ecx, dword [ebx + 0x20]
push edi
add ecx, 0x24
call fcn.0048b500
mov edi, eax
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x480a2e
mov eax, dword [edi + 8]
sub eax, ecx
sar eax, 2
cmp ebp, eax
jb 0x480a33
call fcn.005d29f1
mov eax, dword [edi + 4]
mov eax, dword [eax + ebp*4]
test eax, eax
je 0x480a60
mov eax, dword [eax + 4]
cmp dword [eax - 0xc], 0
je 0x480af4
push str.10000000_0000_0000_0000_000000000001
push eax
call fcn.005d2da6
add esp, 8
test eax, eax
je 0x480af4
mov ecx, dword [ebx + 0x3c]
test ecx, ecx
je 0x480a73
mov eax, dword [ebx + 0x40]
sub eax, ecx
sar eax, 4
cmp esi, eax
jb 0x480a78
call fcn.005d29f1
shl esi, 4
add esi, dword [ebx + 0x3c]
lea ecx, [esp + 0x18]
push esi
push ecx
call dword [sym.imp.USER32.dll_CopyRect]
mov ecx, dword [ebx + 0x68]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x20]
sub ecx, eax
sub ecx, 2
mov dword [esp + 0x18], ecx
mov ecx, dword [ebx + 0x68]
mov edx, dword [ecx]
mov eax, dword [edx + 8]
call eax
mov ecx, dword [esp + 0x1c]
lea edx, [eax + ecx + 2]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
push eax
mov dword [esp + 0x28], edx
push ecx
lea edx, [esp + 0x20]
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x480af4
mov eax, dword [ebx + 4]
push 0x24
push 0x62ad14
push 0x62ad24
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x480af4
mov ecx, dword [ebx + 0x74]
push ecx
call fcn.00483c80
push 0x7f89
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
mov edx, dword [esp + 0x2c]
pop edi
pop esi
pop ebp
mov dword [edx], 0
mov eax, 1
pop ebx
add esp, 0x18
ret 4