joyce8/EMBER2024-capa huggingface dataset:
Function at 0x462630
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x4e080c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10c]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
push 0x105
push eax
push 0
push esi
call edi
test eax, eax
jne 0x4626c3
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop word [eax + eax]
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x10c]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x46269f
push dword [ebp - 0x110]
call fcn.00462630
add esp, 4
push dword [ebp - 0x110]
call ebx
lea eax, [ebp - 0x10c]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push 0x105
lea eax, [ebp - 0x10c]
push eax
push 0
push esi
call edi
test eax, eax
je 0x462670
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00465cab
mov esp, ebp
pop ebp
ret

Function at 0x462700
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov ecx, edi
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x462710
sub ecx, edx
mov edx, dword [ebp + 0x10]
lea esi, [edx + 1]
nop
mov al, byte [edx]
inc edx
test al, al
jne 0x462720
sub edx, esi
lea eax, [ecx + 5]
add eax, edx
push 1
lea eax, [eax + eax*2]
push eax
call fcn.0040e450
push dword [ebp + 0x10]
mov esi, eax
push dword [ebp + 0xc]
push edi
push esi
call fcn.004620f0
add esp, 0x18
lea eax, [ebp - 4]
push eax
push 0x4d2f5c
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x462795
mov edx, dword [ebp + 0x14]
mov ecx, edx
lea edi, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x462770
sub ecx, edi
lea eax, [ecx + 1]
push eax
push edx
push 1
push 0
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call fcn.0040e430
add esp, 4
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x462a30
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jne 0x462a7c
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x462a6f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x462a6f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0045d180
push eax
push dword [ebp + 8]
push str.Unable_to_delete__s:__s
call fcn.00458b20
add esp, 0x10
mov eax, dword [ebp + 0x10]
mov dword [eax], 0xffffffff
xor eax, eax
pop ebp
ret
xor eax, eax
mov edx, 0x80
push 0
cmp ecx, 2
cmove eax, edx
push eax
xor eax, eax
cmp ecx, 2
setne al
xor edx, edx
add eax, 2
cmp ecx, 2
push eax
push 0
mov eax, 3
cmove eax, edx
mov edx, 0x40000000
push eax
mov eax, 0x80000000
cmove eax, edx
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, dword [ebp + 0x10]
mov edx, eax
xor eax, eax
cmp edx, 0xffffffff
setne al
mov dword [ecx], edx
pop ebp
ret
Function at 0x462e20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 2
call fcn.00461ae0
mov esi, eax
add esp, 4
cmp esi, 0xffffffff
je 0x462e50
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x49b882
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0049b469

Function at 0x49b88d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0049b5f3

Function at 0x4a583b
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004a570f

Function at 0x4a8149
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004a7b0b
Function at 0x45c258
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ecx
push edx
push esi
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov edx, ecx
cmp edx, 4
jl 0x45c29f
cmp edx, 0x10
jl 0x45c28b
shr ecx, 4
nop
xor eax, dword [ebx]
mov esi, dword [ebx + 4]
xor eax, dword [ebx + 8]
xor esi, dword [ebx + 0xc]
add ebx, 0x10
xor eax, esi
dec ecx
jne 0x45c278
mov ecx, edx
shr ecx, 2
and ecx, 3
test ecx, ecx
je 0x45c29f
xor eax, dword [ebx]
add ebx, 4
dec ecx
jne 0x45c297
and edx, 3
cmp edx, 3
jne 0x45c2b3
xor ecx, ecx
mov cl, byte [ebx]
inc ebx
shl ecx, 0x10
xor eax, ecx
jmp 0x45c2b8
cmp edx, 2
jne 0x45c2c4
xor ecx, ecx
mov cl, byte [ebx]
inc ebx
shl ecx, 8
xor eax, ecx
jmp 0x45c2c9
cmp edx, 1
jne 0x45c2cf
xor ecx, ecx
mov cl, byte [ebx]
xor eax, ecx
pop esi
pop edx
pop ecx
pop ebx
ret
Function at 0xf67d50
Capabilities:
Encode data using xor

Disassembly:
jmp 0xf67d5a
pushal
call 0xf67d60
pop ebp
sub ebp, 0x10
sub ebp, 0xb67d50
jmp 0xf67d76
mov eax, 0xb67d50
add eax, ebp
add eax, 0x4c
mov ecx, 0x5b4
mov edx, 0x817259d1
xor byte [eax], dl
inc eax
dec ecx
jne 0xf67d8d
jmp 0xf67da0
pop edx
sbb al, 0x5a
pop eax
in eax, dx
rcl ecx, 1
rcl dword [eax + 0x10]
sub ecx, edx
rcl ecx, 1
rcr byte [ecx + ebp*2], cl
xlatb
rcl ecx, 1
shr dword [ebx - 7], 1
rcl ecx, 1
shl dword [esi], 1
xor edx, edx
sbb dword [edx + 0x50], ebx
fst st(1)
rcl ecx, 1
rcl byte [esp + ebx*2], cl
mov ch, 0xf5
sub eax, 0x5cf5d558
mov ch, 0xf5
sub eax, 0xb9f5d558
fstp qword [eax]
int1
sar dword [ecx - 0x2ebb9a6b], 1
sar ch, 1
cmc
mov ecx, 0xe77c205b
cmp esp, edx
rcl ecx, 1
sar dword [eax], 1
sti
rcl ecx, 1
rol dword [esp + ebx*2 + 0x5ad1f5bd], 1
push esp
invalid
Function at 0x415cc6
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x415d63
push ebx
push esi
call fcn.00415c8f
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00414914
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x415d10
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x415d62
push edi
push eax
call fcn.00412cd1
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x415d30
call fcn.0040f432
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x415d61
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00414914
add esp, 0x20
test eax, eax
jne 0x415d4f
push edi
call fcn.0040f432
jmp 0x415d57
push ebx
call fcn.0040f432
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x41b930
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41b95d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41b95d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x4015a0
Capabilities:
Terminate process

Disassembly:
call fcn.00401940
jmp fcn.004012d0

Function at 0x4015b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x403008]
jne 0x4015ba
repz ret
jmp fcn.004019f0
Function at 0x10005650
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101d4deb
mov eax, dword fs:[0]
push eax
sub esp, 0xc8
mov eax, dword [0x1024e014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
lea edx, [esi + 0x49c]
movq xmm0, qword [edi]
movq qword [esi + 0x488], xmm0
mov eax, dword [edi + 8]
mov dword [esi + 0x490], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0x494], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0x498], eax
lea eax, [edi + 0x14]
cmp edx, eax
je 0x100056cb
cmp dword [eax + 0x14], 8
mov ecx, eax
jb 0x100056c0
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
mov ecx, edx
call fcn.100045d0
cmp dword [edi], 5
jne 0x100057be
mov eax, dword [edi + 0x10]
cmp eax, 1
jne 0x10005770
push 0xc4
lea eax, [ebp - 0xd4]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [ebp - 0xd4]
call fcn.10015850
mov dword [ebp - 4], 0
push str.736f6674_6d6772_706f_7042_7562626c654d
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x10005751
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x10005751
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd4]
call fcn.10015940
xor al, al
jmp 0x100057c7
lea ecx, [ebp - 0xd4]
call fcn.10015a10
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd4]
call fcn.10015940
jmp 0x100057c5
cmp eax, 3
jne 0x10005797
mov ecx, dword [esi + 0x4d4]
test ecx, ecx
je 0x100057c5
mov eax, dword [ecx]
mov eax, dword [eax + 4]
call eax
test al, al
je 0x100057c5
mov ecx, dword [esi + 0x4d4]
mov eax, dword [ecx]
call dword [eax + 8]
jmp 0x100057c5
cmp eax, 4
jne 0x100057c5
mov ecx, dword [esi + 0x4dc]
test ecx, ecx
je 0x100057c5
mov eax, dword [ecx]
mov eax, dword [eax + 4]
call eax
test al, al
je 0x100057c5
mov ecx, dword [esi + 0x4dc]
mov eax, dword [ecx]
call dword [eax + 8]
jmp 0x100057c5
mov ecx, esi
call fcn.10005a00
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101d284b
mov esp, ebp
pop ebp
ret 4
Function at 0x10006e50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x7c
mov eax, dword [0x1024e014]
xor eax, esp
mov dword [esp + 0x78], eax
push ebx
push esi
push edi
push str.ntdll.dll
mov dword [esp + 0x10], ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x10006fd6
push str.NtQuerySystemInformation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x10006fcf
push 0x30
lea eax, [esp + 0x54]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esp + 0x18], 0
lea eax, [esp + 0x18]
push eax
push 0x30
lea eax, [esp + 0x58]
push eax
push 3
call edi
test eax, eax
jne 0x10006fcf
mov ecx, dword [esp + 0x50]
sub ecx, dword [esp + 0x70]
mov eax, dword [esp + 0x54]
sbb eax, dword [esp + 0x74]
xor bl, bl
mov dword [esp + 0x14], eax
lea eax, [esp + 0x10]
push eax
push eax
mov dword [esp + 0x18], ecx
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
test eax, eax
je 0x10006f07
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
cmp eax, 1
sete bl
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test bl, bl
je 0x10006fd6
movzx eax, word [esp + 0x28]
mov dword [esp + 0x2c], eax
movzx eax, word [esp + 0x26]
mov dword [esp + 0x30], eax
movzx eax, word [esp + 0x24]
mov dword [esp + 0x34], eax
movzx eax, word [esp + 0x22]
mov dword [esp + 0x38], eax
movzx eax, word [esp + 0x1e]
dec eax
mov dword [esp + 0x4c], 0xffffffff
mov dword [esp + 0x3c], eax
movzx eax, word [esp + 0x1c]
sub eax, 0x76c
mov dword [esp + 0x40], eax
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__mktime64]
add esp, 4
mov esi, eax
mov edi, edx
push 0
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
add esp, 4
sub eax, esi
sbb edx, edi
push 0
push 0x3c
push edx
push eax
call fcn.101d3f00
mov esi, edx
mov ecx, eax
test esi, esi
jl 0x10006fd6
jg 0x10006f94
test ecx, ecx
je 0x10006fd6
mov edx, dword [esp + 0xc]
mov eax, dword [edx + 8]
test esi, esi
jg 0x10006fd6
jl 0x10006fa5
cmp ecx, eax
jae 0x10006fd6
sub eax, ecx
imul eax, eax, 0xea60
push eax
push dword [edx + 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x10006fd6
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x78]
xor ecx, esp
call fcn.101d284b
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x84]
mov al, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.101d284b
mov esp, ebp
pop ebp
ret
Function at 0x1000b030
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101d5658
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x1024e014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [ebp + 8], 0x40001
jne 0x1000b236
push 0x40001
call dword [sym.imp.2345MiniUI.dll_public:_void___thiscall_RC::RCMiniUIWindow::KillWindowTimer_unsigned_int_]
cmp dword [0x1024e4e4], 0
je 0x1000b130
push 0
mov ecx, 0x1024e4e0
call fcn.1002a240
mov eax, dword [0x1024e4e4]
cmp byte [eax + 0x54], 0
je 0x1000b130
cmp dword [eax + 0x58], 5
jb 0x1000b130
mov bl, byte [eax + 0x5c]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x28]
push 8
push 0x101fc338
call fcn.100045d0
push 0x99
push str.RC::RCUpdateRemindDlg::OnDialogTimer
push str.d:jenkinsworkspacepc_2345softmgr_build_softmgrmain_src_softnotify_srcdlg_rcupdatereminddlg.cpp
lea eax, [ebp - 0x28]
mov ecx, 0x1024e4e0
push eax
push 5
call fcn.1002abd0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test bl, bl
je 0x1000b121
lea eax, [ebp - 0x28]
mov ecx, 0x1024e4e0
push eax
call fcn.1002aef0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10004570
call fcn.10026940
push 0
mov esi, eax
push 1
push 0x1024e4c8
mov ecx, esi
call fcn.10057870
push 5
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0x28]
push str.A2007
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.100045d0
mov dword [ebp - 4], 1
call fcn.10030d20
movzx eax, al
mov ecx, esi
cdq
push edx
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.10057830
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10004570
mov esi, dword [esi]
call fcn.10070560
mov dword [ebp - 0x18], esi
lea ecx, [ebp - 0x2c]
xor esi, esi
mov dword [ebp - 0x1c], 0x400
push 4
mov ebx, eax
mov dword [ebp - 0x14], esi
call sym.SoftNotify.dll_public:_void___thiscall_RC::RCSQLiteConnection::__autoclassinit2_unsigned_int_
lea ecx, [ebx + 0x58]
push ecx
lea ecx, [ebp - 0x2c]
call fcn.1002a0d0
mov dword [ebp - 4], 2
lea ecx, [ebx + 0x5c]
mov eax, dword [ecx + 4]
cmp dword [ecx + 8], eax
je 0x1000b1f6
movq xmm0, qword [ebp - 0x1c]
movq qword [eax], xmm0
mov dword [eax + 8], esi
add dword [ecx + 4], 0xc
jmp 0x1000b200
lea edx, [ebp - 0x1c]
push edx
push eax
call fcn.100728b0
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x1000b20e
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.1002a100
lea ecx, [edi - 0x24]
mov dword [ecx + 0x8c], 2
mov byte [ecx + 0x88], 0
call fcn.1000bd10
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101d284b
mov esp, ebp
pop ebp
ret 8
Function at 0x10012600
Capabilities:
Enumerate gui resources
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101d6710
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x1024e014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
call fcn.1002b600
test al, al
je 0x1001264b
push 2
call fcn.100136f0
mov ecx, eax
call fcn.10013780
xor al, al
jmp 0x10012803
lea esi, [edi + 0xbc]
mov byte [esi], 0
push esi
push 0x10036ac0
call dword [sym.imp.USER32.dll_EnumWindows]
cmp byte [esi], 0
je 0x10012739
cmp dword [0x1024e4e4], 0
je 0x10012724
push 0
mov ecx, 0x1024e4e0
call fcn.1002a240
mov eax, dword [0x1024e4e4]
cmp byte [eax + 0x54], 0
je 0x10012724
cmp dword [eax + 0x58], 2
jb 0x10012724
mov bl, byte [eax + 0x5c]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x28]
push 1
push 0x101fca04
call fcn.100045d0
push 0x417
push str.RC::RCPushNotification::IsShowPushDlg
push str.d:jenkinsworkspacepc_2345softmgr_build_softmgrmain_src_softnotify_srcpushnotification_rcpushnotification.cpp
lea eax, [ebp - 0x28]
mov ecx, 0x1024e4e0
push eax
push 2
call fcn.1002abd0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test bl, bl
je 0x10012715
lea eax, [ebp - 0x28]
mov ecx, 0x1024e4e0
push eax
call fcn.1002aef0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10004570
push 6
call fcn.100136f0
mov ecx, eax
call fcn.10013780
xor al, al
jmp 0x10012803
cmp dword [edi + 0x24], 2
jne 0x100127f9
mov ecx, dword [edi + 0xb4]
test ecx, ecx
je 0x100127f9
mov eax, dword [ecx]
mov eax, dword [eax]
call eax
test al, al
je 0x10012770
mov ecx, dword [edi + 0xb4]
mov eax, dword [ecx]
mov eax, dword [eax + 4]
call eax
test al, al
jne 0x100127f9
push 2
mov ecx, 0x1024e4e0
call fcn.1002ab90
mov esi, eax
test esi, esi
je 0x10012724
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x28]
push 1
push 0x101fca08
call fcn.100045d0
push 0x423
push str.RC::RCPushNotification::IsShowPushDlg
push str.d:jenkinsworkspacepc_2345softmgr_build_softmgrmain_src_softnotify_srcpushnotification_rcpushnotification.cpp
lea eax, [ebp - 0x28]
mov ecx, 0x1024e4e0
push eax
push 2
call fcn.1002abd0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp esi, 1
jbe 0x10012715
jmp 0x10012707
call fcn.10030c20
test al, al
sete al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101d284b
mov esp, ebp
pop ebp
ret
Function at 0x10016ef0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101d7258
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x1024e014]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0x10]
call fcn.10018740
mov dword [ebp - 0x34], eax
test eax, eax
jne 0x10016f31
xor al, al
jmp 0x1001706f
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x30], 0
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push dword [ebp - 0x30]
push 0
push 0x438
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x10016f2a
push 4
push 0x1000
push 0x10
push 0
push esi
mov dword [ebx], 1
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
push 0
push 0x10
push ebx
mov edi, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
push 0x3e8
push 2
push edi
push dword [ebp + 8]
push 0x100e
push dword [ebp - 0x34]
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
mov dword [ebp - 0x34], eax
test eax, eax
jne 0x10017045
push 5
mov ecx, 0x1024e4e0
call fcn.1002ab90
mov ebx, eax
test ebx, ebx
je 0x10017052
xor eax, eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x2c]
push 7
push 0x101fb98c
call fcn.100045d0
push 0x193
push str.RC::RCShortcutBubbleCtrl::GetSoftMgrShortcutRect
push str.d:jenkinsworkspacepc_2345softmgr_build_softmgrmain_src_softnotify_src_shortcutbubble_rcshortcutbubblectrl.cpp
lea eax, [ebp - 0x2c]
mov ecx, 0x1024e4e0
push eax
push 5
call fcn.1002abd0
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp ebx, 1
jbe 0x10017034
lea eax, [ebp - 0x2c]
mov ecx, 0x1024e4e0
push eax
call fcn.1002aef0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.10004570
jmp 0x10017052
push 0
push 0x10
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0x8000
push 0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x34], 0
setne al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.101d284b
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100170e0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101d7298
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x1024e014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xorps xmm0, xmm0
mov dword [ebp - 0x2c], 0
lea ecx, [ebp - 0x34]
movq qword [ebp - 0x34], xmm0
call fcn.100197d0
mov dword [ebp - 4], 0
cmp byte [ebp - 0x2c], 0
je 0x1001723f
push 5
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0x28]
push str.A2222
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.100045d0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x30]
mov eax, dword [ebp + 8]
cdq
push edx
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.10057850
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.10004570
cmp dword [0x1024e4e4], 0
je 0x1001723f
push 0
mov ecx, 0x1024e4e0
call fcn.1002a240
mov eax, dword [0x1024e4e4]
cmp byte [eax + 0x54], 0
je 0x1001723f
cmp dword [eax + 0x58], 4
jb 0x1001723f
mov bl, byte [eax + 0x5c]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov byte [ebp - 4], 2
lea eax, [ebp - 0x28]
push dword [ebp + 8]
push 0x101fd53c
push eax
call fcn.100c4740
add esp, 0xc
lea eax, [ebp - 0x28]
mov ecx, 0x1024e4e0
push 0x3a
push str.RC::RCShortcutBubbleStat::SendBubbleNotShowStat
push str.d:jenkinsworkspacepc_2345softmgr_build_softmgrmain_src_softnotify_src_shortcutbubble_stat_rcshortcutbubblestat.cpp
push eax
push 4
call fcn.1002abd0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test bl, bl
je 0x10017233
lea eax, [ebp - 0x28]
mov ecx, 0x1024e4e0
push eax
call fcn.1002aef0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.10004570
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.10019990
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101d284b
mov esp, ebp
pop ebp
ret 4