joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c450
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40c4dc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x40c476
test bl, 0x10
je 0x40c476
mov esi, 2
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
je 0x40c4d9
push 0x438ca8
push edi
call fcn.00420687
mov esi, eax
add esp, 8
test esi, esi
je 0x40c4d9
push str.real_time_alert
push str.REGEDIT4_r_n_r_n__r_n__This_is_a_sample_template._It_contains_only__s_information__and_r_n__therefore_is_useful_as_a_template_for_resetting__not_installing_or_upgrading_._r_n__r_n__Templates_used_for_resetting_should_only_contain_the_information_you_want_to_change._r_n__r_n_r_n
push esi
call fcn.0042069e
add esp, 0xc
cmp byte [esp + 0xc], 0
mov eax, str.Client
jne 0x40c4b9
mov eax, str.Server
push 0x4494a0
push eax
push str._HKEY_LOCAL_MACHINESOFTWAREGreywareDomain_Time__sLogs_and_AlertsAudit__r_n__r_n__This_section_contains_two_entries:_Enabled_and_Server._Enabled_determines_whether_r_n__or_not_this_machine_sends_packets_to_Audit_Server_for_real_time_alerts._Server_is_r_n__the_DNS_name__IP_address__or_NetBIOS_name_of_the_server._This_example_shows_your_r_n__machines_NetBIOS_name._The_remote_machine_must_be_able_to_translate_whatever_you_r_n__use_for_Server_into_an_IP_address._r_n__r_n_Enabled__True__r_n_Server___s__r_n_r_n
push esi
call fcn.0042069e
push esi
call fcn.00420567
push esi
call fcn.00420901
add esp, 0x18
pop esi
pop ebx
ret
xor esi, esi
jmp 0x40c46c

Function at 0x40c4e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40c567
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x40c506
test bl, 0x10
je 0x40c506
mov esi, 2
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
je 0x40c564
push 0x438ca8
push edi
call fcn.00420687
mov esi, eax
add esp, 8
test esi, esi
je 0x40c564
push str.real_time_alert
push str.REGEDIT4_r_n_r_n__r_n__This_is_a_sample_template._It_contains_only__s_information__and_r_n__therefore_is_useful_as_a_template_for_resetting__not_installing_or_upgrading_._r_n__r_n__Templates_used_for_resetting_should_only_contain_the_information_you_want_to_change._r_n__r_n_r_n
push esi
call fcn.0042069e
add esp, 0xc
cmp byte [esp + 0xc], 0
mov eax, str.Client
jne 0x40c549
mov eax, str.Server
push eax
push str._HKEY_LOCAL_MACHINESOFTWAREGreywareDomain_Time__sLogs_and_AlertsAudit__r_n__r_n__This_section_sets_all_of_the_Real_time_Alert_options._r_n__r_n_Enabled__True__r_n_Server__auditserver1.yourdomain.com__r_n_Backup_Server__auditserver2.yourdomain.com__r_n_Always_Send_to_Backup__True__r_n_TCP__False__r_n_r_n
push esi
call fcn.0042069e
push esi
call fcn.00420567
push esi
call fcn.00420901
add esp, 0x14
pop esi
pop ebx
ret
xor esi, esi
jmp 0x40c4fc
Function at 0x40c570
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40c5d2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x40c596
test bl, 0x10
je 0x40c596
mov esi, 2
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
je 0x40c5cf
push 0x438ca8
push edi
call fcn.00420687
mov esi, eax
add esp, 8
test esi, esi
je 0x40c5cf
push str._r_n_Example_of_setting_just_the_timesources_r_n_r_n_Note_how_timesources_may_be_either_names_or_IP_addresses._r_n_r_n_r_ntimesource__192.168.1.3_protocol_NTP_samples_3_delay_128___Local_NTP_appliance_r_ntimesource__pool.ntp.org_protocol_NTP______________________Internet_NTP_pool_source_r_ntimesource__tick.greyware.com_protocol_DT2_________________Internet_DT2_server_r_ntimesource__tock.greyware.com_protocol_DT2_________________Internet_DT2_server_r_n_r_n
push esi
call fcn.0042069e
push esi
call fcn.00420567
push esi
call fcn.00420901
add esp, 0x10
pop esi
pop ebx
ret
xor esi, esi
jmp 0x40c58c

Function at 0x40c5e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40c642
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x40c606
test bl, 0x10
je 0x40c606
mov esi, 2
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
je 0x40c63f
push 0x438ca8
push edi
call fcn.00420687
mov esi, eax
add esp, 8
test esi, esi
je 0x40c63f
push str._r_n_Example_of_setting_just_the_list_of_acceptable_PTP_multicast_masters_r_n_r_n_Multicast_masters_must_be_IPv4_or_IPv6_literals__or_CIDR_masks._r_n_r_n_r_nptp:multicastMaster__10.1.1.17________IP_of_authorized_PTP_multicast_master_r_nptp:multicastMaster__172.16.12.93_____Another_authorized_multicast_master_r_nptp:multicastMaster__192.168.1.0_24___Any_master_in_192.168.1.x_r_n_r_n
push esi
call fcn.0042069e
push esi
call fcn.00420567
push esi
call fcn.00420901
add esp, 0x10
pop esi
pop ebx
ret
xor esi, esi
jmp 0x40c5fc
Function at 0x40c650
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40c6b2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x40c676
test bl, 0x10
je 0x40c676
mov esi, 2
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
je 0x40c6af
push 0x438ca8
push edi
call fcn.00420687
mov esi, eax
add esp, 8
test esi, esi
je 0x40c6af
push str._r_n_Example_of_setting_a_list_of_addresses_allowed_to_control_or_audit_r_n_the_node._IPv4_or_IPv6_literals__as_well_as_CIDR_masks__are_allowed._r_n_r_n_This_is_an_allow_list__with_an_implict_deny_following_any_entries._r_n_If_the_list_is_blank__neither_Manager_nor_Audit_Server_will_be_able_r_n_to_access_the_node._Otherwise__any_IP_on_the_list_has_access._r_n_r_n_r_ndt2Security:allow__192.168.0.0_16___allow_access_from_192.168._r_ndt2Security:allow__172.16.0.0_12____allow_access_from_172.16._r_ndt2Security:allow__10.0.0.0_8_______allow_access_from_10._r_ndt2Security:allow__fe80::0_10_______allow_access_IPv6_link_local_r_ndt2Security:allow__192.168.10.13____allow_just_a_specific_host_r_n_r_n
push esi
call fcn.0042069e
push esi
call fcn.00420567
push esi
call fcn.00420901
add esp, 0x10
pop esi
pop ebx
ret
xor esi, esi
jmp 0x40c66c

Function at 0x40c6c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40c722
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x40c6e6
test bl, 0x10
je 0x40c6e6
mov esi, 2
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
je 0x40c71f
push 0x438ca8
push edi
call fcn.00420687
mov esi, eax
add esp, 8
test esi, esi
je 0x40c71f
push str._r_n_To_change_a_node_from_using_a_list_of_acceptable_multicast_masters_r_n_to_use_any_at_all__no_list___all_you_need_to_do_is_have_a_template_r_n_with_one_entry____a_blank_multicast_master._This_removes_any_current_r_n_multicast_master_entries__and_replaces_them_with_the_placeholder._r_n_nptp:multicastMaster_____IP_of_authorized_PTP_multicast_master_r_n_r_n
push esi
call fcn.0042069e
push esi
call fcn.00420567
push esi
call fcn.00420901
add esp, 0x10
pop esi
pop ebx
ret
xor esi, esi
jmp 0x40c6dc
Function at 0x40c730
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40c792
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x40c756
test bl, 0x10
je 0x40c756
mov esi, 2
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
je 0x40c78f
push 0x438ca8
push edi
call fcn.00420687
mov esi, eax
add esp, 8
test esi, esi
je 0x40c78f
push str._r_n_Example_of_setting_properties_to_use_the_Telecom_2008_profile_r_n_The_telecom_profile_uses_negotiated_unicast__and_the_preference_r_n_depends_on_the_order_the_telecom_master_s__are_listed._r_n_r_n_Specify_a_telecom_master_using_IP_domain_where__IP__is_an_IPv4_r_n_or_IPv6_literal_and__domain__is_the_PTP_domain_number_that_master_r_n_is_using._Only_a_comma_is_allowed__no_spaces_or_other_punctuation._r_n_r_n_r_nptp:enabled___________true______________Enable_PTP_r_nptp:profile___________Telecom___________Select_the_Telecom_2008_Profile_r_nptp:telecomLeaseSecs__300_______________how_many_seconds_to_hold_a_lease___30_1000__r_nptp:telecomAnnounce___1_________________2n___announce_every_2_seconds_r_nptp:telecomSync_______0_________________2n___sync_every_second_r_nptp:telecomDelay______1_________________2n___delay_request_every_2_seconds_r_nptp:telecomMaster_____192.168.1.10_0____First_choice__IP_in_domain_0_r_nptp:telecomMaster_____172.16.12.33_77___Second_choice__IP_in_domain_77_r_n_r_n
push esi
call fcn.0042069e
push esi
call fcn.00420567
push esi
call fcn.00420901
add esp, 0x10
pop esi
pop ebx
ret
xor esi, esi
jmp 0x40c74c
Function at 0x40c7a0
Capabilities:
Check if file exists
Copy file
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x234
mov eax, dword [0x446050]
xor eax, esp
mov dword [esp + 0x230], eax
mov eax, dword [esp + 0x238]
push ebx
push ebp
mov ebp, dword [esp + 0x244]
mov dword [esp + 0x20], ecx
mov ecx, dword [ebp + 0x10]
sub ecx, dword [ebp + 0xc]
mov dword [esp + 0x18], eax
mov eax, 0x92492493
imul ecx
add edx, ecx
push esi
push edi
sar edx, 4
mov edi, edx
shr edi, 0x1f
mov bl, 1
add edi, edx
mov eax, 0
mov byte [esp + 0x17], bl
mov dword [esp + 0x24], edi
mov dword [esp + 0x18], eax
je 0x40c92f
mov dword [esp + 0x1c], eax
mov ecx, dword [ebp + 0x10]
sub ecx, dword [ebp + 0xc]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp dword [esp + 0x18], eax
jb 0x40c828
call fcn.00420164
mov eax, dword [ebp + 0xc]
add eax, dword [esp + 0x1c]
cmp dword [eax + 0x18], 0x10
jb 0x40c83a
mov esi, dword [eax + 4]
jmp 0x40c83d
lea esi, [eax + 4]
mov ecx, dword [esp + 0x20]
push esi
push ecx
lea edx, [esp + 0x13c]
push 0x436a34
push edx
call fcn.0041fa79
mov eax, dword [esp + 0x38]
push esi
push eax
lea ecx, [esp + 0x44]
push 0x436a34
push ecx
call fcn.0041fa79
add esp, 0x20
lea edx, [esp + 0x134]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40c8f5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x40c898
test bl, 0x10
je 0x40c898
mov esi, 2
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
jne 0x40c913
push 0x80
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push esi
lea ecx, [esp + 0x30]
push ecx
lea edx, [esp + 0x13c]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x40c8f9
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x138]
push edx
push str.Could_not_copy__s_to__s
mov edi, eax
mov byte [esp + 0x23], 0
call fcn.0040d7c0
mov edi, dword [esp + 0x30]
jmp 0x40c910
xor esi, esi
jmp 0x40c88e
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x138]
push ecx
push str.Copied__s_to__s_successfully
call fcn.0040d8e0
add esp, 0xc
mov eax, dword [esp + 0x18]
add dword [esp + 0x1c], 0x1c
inc eax
mov dword [esp + 0x18], eax
cmp eax, edi
jb 0x40c804
mov al, byte [esp + 0x17]
jmp 0x40c931
mov al, bl
mov ecx, dword [esp + 0x240]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0041f826
add esp, 0x234
ret
Function at 0x40c950
Capabilities:
Delete file
Set file attributes

Disassembly:
sub esp, 0x110
mov eax, dword [0x446050]
xor eax, esp
mov dword [esp + 0x10c], eax
mov eax, dword [esp + 0x114]
mov ecx, dword [ebx + 0x10]
sub ecx, dword [ebx + 0xc]
mov dword [esp], eax
mov eax, 0x92492493
imul ecx
add edx, ecx
push esi
push edi
sar edx, 4
mov edi, edx
shr edi, 0x1f
add edi, edx
mov esi, 0
je 0x40ca04
push ebp
xor ebp, ebp
mov ecx, dword [ebx + 0x10]
sub ecx, dword [ebx + 0xc]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
cmp esi, ecx
jb 0x40c9b5
call fcn.00420164
mov eax, dword [ebx + 0xc]
add eax, ebp
cmp dword [eax + 0x18], 0x10
jb 0x40c9c5
mov eax, dword [eax + 4]
jmp 0x40c9c8
add eax, 4
mov edx, dword [esp + 0xc]
push eax
push edx
lea eax, [esp + 0x18]
push 0x436a34
push eax
call fcn.0041fa79
add esp, 0x10
push 0x80
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
inc esi
add ebp, 0x1c
cmp esi, edi
jb 0x40c993
pop ebp
mov ecx, dword [esp + 0x114]
pop edi
pop esi
xor ecx, esp
call fcn.0041f826
add esp, 0x110
ret

Function at 0x40ca20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x432ec8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x446050]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
mov eax, dword [0x446050]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
push 0x448c60
push str._sversion.txt
lea ecx, [esp + 0x10]
call fcn.004172c0
add esp, 8
mov dword [esp + 0x30], 0
cmp dword [esp + 0x20], 0x10
mov eax, dword [esp + 0xc]
jae 0x40ca7c
lea eax, [esp + 0xc]
push 0x438ca8
push eax
call fcn.00420687
mov esi, eax
add esp, 8
test esi, esi
je 0x40caaa
push str.Domain_Time_II_5.2.b.20241123R_r_n_r_nGreyware_Automation_Products__Inc._r_n308_Oriole_Ct_r_nMurphy__TX_75094_USA_r_ntechsupport_greyware.com_r_nPhone:_1_972_867_2794_r_n_r_n
push esi
call fcn.0042069e
push esi
call fcn.00420567
push esi
call fcn.00420901
add esp, 0x10
mov dword [esp + 0x30], 0xffffffff
cmp dword [esp + 0x20], 0x10
jb 0x40cac6
mov eax, dword [esp + 0xc]
push eax
call fcn.0042019e
add esp, 4
mov dword [esp + 0x20], 0xf
mov dword [esp + 0x1c], 0
mov byte [esp + 0xc], 0
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.0041f826
add esp, 0x2c
ret
Function at 0x40cb00
Capabilities:
Delete file
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x432e98
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x446050]
xor eax, esp
mov dword [esp + 0x1c], eax
mov eax, dword [0x446050]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
push 0x448c60
push str._sversion.txt
lea ecx, [esp + 0xc]
call fcn.004172c0
add esp, 8
mov dword [esp + 0x2c], 0
cmp dword [esp + 0x1c], 0x10
mov eax, dword [esp + 8]
jae 0x40cb5b
lea eax, [esp + 8]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
cmp dword [esp + 0x1c], 0x10
mov eax, dword [esp + 8]
jae 0x40cb76
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [esp + 0x2c], 0xffffffff
cmp dword [esp + 0x1c], 0x10
jb 0x40cb99
mov eax, dword [esp + 8]
push eax
call fcn.0042019e
add esp, 4
mov dword [esp + 0x1c], 0xf
mov dword [esp + 0x18], 0
mov byte [esp + 8], 0
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.0041f826
add esp, 0x2c
ret
Function at 0x40d6d0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x3c
mov eax, dword [0x446050]
xor eax, esp
mov dword [esp + 0x34], eax
push esi
push edi
push 0
push 0
push 4
push 0
push 3
push 0xc0000000
push 0x448d68
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
test esi, esi
je 0x40d7ad
cmp esi, 0xffffffff
je 0x40d7ad
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [esp + 0x1a]
movzx edx, word [esp + 0x18]
movzx eax, word [esp + 0x16]
push ecx
movzx ecx, word [esp + 0x18]
push edx
push eax
push ecx
lea edx, [esp + 0x2c]
push str._02d:_02d:_02d._03d
push edx
call fcn.0041fa79
add esp, 0x18
push 2
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [esp + 0x1c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40d756
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea ecx, [esp + 0xc]
push ecx
sub eax, edx
push eax
lea edx, [esp + 0x28]
push edx
push esi
call edi
mov eax, ebx
lea ecx, [eax + 1]
lea ebx, [ebx]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40d780
push 0
sub eax, ecx
lea ecx, [esp + 0xc]
push ecx
push eax
push ebx
push esi
call edi
push 0
lea edx, [esp + 0xc]
push edx
push 2
push 0x436b28
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
xor ecx, esp
call fcn.0041f826
add esp, 0x3c
ret

Function at 0x40d940
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x104
mov eax, dword [0x446050]
xor eax, esp
mov dword [esp + 0x100], eax
mov eax, dword [esp + 0x108]
push 0x4371a0
push eax
push str.dtsetup
push str.https:__www.greyware.com_onlinehelp.asp
lea eax, [esp + 0x10]
push str._s_product_ssubject_sversion_s
push eax
call fcn.0041fa79
add esp, 0x18
push 1
push 0
push 0
lea ecx, [esp + 0xc]
push ecx
push str.open
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.0041f826
add esp, 0x104
ret
Function at 0x40dbc0
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push ebp
push esi
push edi
push 2
mov esi, str.16A17506_800D_424d_A141_678152857698_dtreader_shutdown_event
call fcn.004124f0
mov ebx, dword [sym.imp.KERNEL32.dll_SetEvent]
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, eax
test esi, esi
je 0x40dbed
cmp esi, 0xffffffff
je 0x40dbed
push esi
call ebx
push esi
call ebp
push 2
mov esi, str.9A0C188C_C88E_4a14_8B57_C5EA8FC10CE2_dtdrift_shutown_event
call fcn.004124f0
mov esi, eax
test esi, esi
je 0x40dc0a
cmp esi, 0xffffffff
je 0x40dc0a
push esi
call ebx
push esi
call ebp
push 1
mov esi, str.domtime_cpl_all_shutdown_event
xor edi, edi
call fcn.004125c0
mov esi, eax
test esi, esi
je 0x40dc29
cmp esi, 0xffffffff
je 0x40dc29
push esi
call ebx
push esi
call ebp
mov ebx, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
push 0
mov byte [ebx], 0
push str.gwdtclockproc
mov byte [ebp], 0
call dword [sym.imp.USER32.dll_FindWindowA]
mov esi, eax
test esi, esi
je 0x40dc71
mov edi, dword [sym.imp.USER32.dll_PostMessageA]
push 0
push 0
push 0x12
push esi
call edi
push 0
push 0
push 2
push esi
call edi
push 0xfa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov byte [ebx], 1
mov esi, dword [sym.imp.USER32.dll_EnumWindows]
push ebp
push 0x40dac0
call esi
push 0
push 0x40d9b0
call esi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x40e300
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 0xffffffffffffffff
push 0x432ce0
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x446050]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x446050]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov edi, ecx
push edi
push 0x449080
push 0x436a34
lea ecx, [esp + 0x3c]
call fcn.004172c0
add esp, 0xc
xor ebx, ebx
mov dword [esp + 0x58], ebx
cmp dword [esp + 0x48], 0x10
mov eax, dword [esp + 0x34]
jae 0x40e360
lea eax, [esp + 0x34]
push eax
call fcn.0040bf40
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, ebx
jne 0x40e412
call ebp
push edi
push 0x448c60
push 0x436a34
lea ecx, [esp + 0x20]
call fcn.004172c0
add esp, 0xc
mov byte [esp + 0x58], 1
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x3c]
call fcn.004096e0
mov byte [esp + 0x58], bl
mov esi, 0x10
cmp dword [esp + 0x2c], esi
jb 0x40e3bd
mov eax, dword [esp + 0x18]
push eax
call fcn.0042019e
add esp, 4
mov eax, dword [esp + 0x34]
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
cmp dword [esp + 0x48], esi
jae 0x40e3db
lea eax, [esp + 0x34]
push eax
call fcn.0040bf40
mov esi, eax
cmp esi, ebx
jne 0x40e412
call ebp
mov edi, eax
cmp edi, ebx
je 0x40e412
mov dword [esp + 0x58], 0xffffffff
cmp dword [esp + 0x48], 0x10
jb 0x40e40b
mov ecx, dword [esp + 0x34]
push ecx
call fcn.0042019e
add esp, 4
mov eax, edi
jmp 0x40e4ea
push str.CPlApplet
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
cmp edi, ebx
jne 0x40e452
call ebp
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [esp + 0x58], 0xffffffff
cmp dword [esp + 0x48], 0x10
jb 0x40e40b
mov edx, dword [esp + 0x34]
push edx
call fcn.0042019e
add esp, 4
mov eax, edi
jmp 0x40e4ea
mov eax, 0x44b0d4
mov ecx, 1
lock xadd dword [eax], ecx
inc ecx
cmp ecx, 1
jne 0x40e479
push 0x7f02
push ebx
call dword [sym.imp.USER32.dll_LoadCursorA]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
mov edx, dword [0x448730]
push ebx
push ebx
push 1
push edx
call edi
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebp
mov eax, dword [0x448730]
push ebx
push ebx
push 5
push eax
call edi
call ebp
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
call fcn.004117c0
mov ecx, 0x44b0d4
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40e4cc
push 0x7f00
push ebx
call dword [sym.imp.USER32.dll_LoadCursorA]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
mov dword [esp + 0x58], 0xffffffff
cmp dword [esp + 0x48], 0x10
jb 0x40e4e8
mov eax, dword [esp + 0x34]
push eax
call fcn.0042019e
add esp, 4
xor eax, eax
mov dword [esp + 0x48], 0xf
mov dword [esp + 0x44], ebx
mov byte [esp + 0x34], bl
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.0041f826
add esp, 0x48
ret
Function at 0x40e520
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x60
xor eax, eax
push esi
push 0x40
push eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x14], 0
call fcn.004249d0
mov eax, dword [esp + 0x74]
add esp, 0xc
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x1c]
push edx
push 0x448840
push 0
push 0x20
push 0
push 0
push 0
push eax
push 0
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x40e58b
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
add esp, 0x60
ret
cmp byte [esp + 0x6c], 0
je 0x40e5af
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 8]
lea edx, [esp + 4]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov ecx, dword [esp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [esp + 8]
push edx
call esi
mov eax, dword [esp + 4]
pop esi
add esp, 0x60
ret