joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41c280
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6208c6
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x690a1c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x430], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x418], 0
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push 0x60
push 0
push edi
mov byte [ebp - 4], 1
call ebx
mov esi, eax
mov dword [ebp - 0x424], esi
test esi, esi
jne 0x41c32c
push 2
push eax
push edi
call ebx
mov esi, eax
mov dword [ebp - 0x424], eax
test esi, esi
jne 0x41c32c
call fcn.0041b4a0
mov edi, eax
jmp 0x41c44b
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x41c34f
call fcn.0041b4a0
jmp 0x41c43e
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x420], ebx
test ebx, ebx
jne 0x41c36d
call fcn.0041b4a0
jmp 0x41c43e
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [ebp - 0x41c], edi
lea eax, [edi + 1]
cmp eax, edi
jae 0x41c38e
mov edi, 0x8007000e
jmp 0x41c440
mov ecx, 2
mov byte [ebp - 4], 2
mul ecx
test edx, edx
ja 0x41c484
jb 0x41c3ac
cmp eax, 0xffffffff
ja 0x41c484
cmp eax, 0x400
jbe 0x41c3c1
push eax
lea ecx, [ebp - 0x418]
call fcn.0041b3c0
jmp 0x41c3e7
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], eax
jmp 0x41c3e7
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
jne 0x41c3fe
mov edi, 0x8007000e
jmp 0x41c440
push edi
push dword [ebp - 0x418]
push edi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x41c41e
call fcn.0041b4a0
jmp 0x41c43e
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.0041c0e0
mov edi, eax
test esi, esi
je 0x41c44b
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x41c464
lea ecx, [ebp - 0x418]
call fcn.0041b710
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004fa103
mov esp, ebp
pop ebp
ret 0x10
push 0x80070216
call fcn.00407120
int3
Function at 0x41d820
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x41d891
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x41d891
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x41d891
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x41d891
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
push 0x40
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x41d88b
push esi
push ebx
push edi
call fcn.005e2e20
add esp, 0xc
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x41d88b
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41f6c0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x620af8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x690a1c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [ebp + 0x1c], 0
jne 0x41f817
mov eax, dword [ebp + 0xc]
cmp eax, 1
jne 0x41f736
push 0
push dword [esi + 4]
mov dword [esi + 0x24], eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
cmp dword [esi + 0x24], 0
je 0x41f817
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
cmp eax, 0x7e
jne 0x41f7b7
mov edi, dword [ebp + 0x14]
lea ecx, [ebp + 0x1f]
push ecx
lea eax, [esi + 0x28]
movzx ebx, di
push eax
lea ecx, [ebp - 0x14]
shr edi, 0x10
call fcn.0041ecb0
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 4], 0
mov eax, dword [ecx]
mov dword [ebp + 0x1c], eax
cmp eax, ecx
je 0x41f780
mov ecx, dword [eax + 0x10]
push edi
push ebx
mov eax, dword [ecx]
call dword [eax]
lea ecx, [ebp + 0x1c]
call fcn.0040bbf0
mov eax, dword [ebp + 0x1c]
cmp eax, dword [ebp - 0x14]
jne 0x41f767
lea ecx, [ebp - 0x14]
call fcn.0041f890
push 0x18
push dword [ebp - 0x14]
call fcn.004fa0f5
mov eax, dword [ebp + 0x18]
add esp, 8
mov dword [eax], 0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
cmp eax, 0x31a
jne 0x41f82d
lea ecx, [ebp + 0x1f]
push ecx
lea eax, [esi + 0x28]
push eax
lea ecx, [ebp - 0x14]
call fcn.0041ecb0
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 4], 1
mov eax, dword [ecx]
mov dword [ebp + 0x1c], eax
cmp eax, ecx
je 0x41f7f9
mov ecx, dword [eax + 0x10]
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp + 0x1c]
call fcn.0040bbf0
mov eax, dword [ebp + 0x1c]
cmp eax, dword [ebp - 0x14]
jne 0x41f7e1
lea ecx, [ebp - 0x14]
call fcn.0041f890
push 0x18
push dword [ebp - 0x14]
call fcn.004fa0f5
mov eax, dword [ebp + 0x18]
add esp, 8
mov dword [eax], 0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
cmp eax, 0x1e
jne 0x41f817
lea ecx, [ebp + 0x1f]
push ecx
lea eax, [esi + 0x28]
push eax
lea ecx, [ebp - 0x1c]
call fcn.0041ecb0
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 4], 2
mov eax, dword [ecx]
mov dword [ebp + 0x1c], eax
cmp eax, ecx
je 0x41f86d
mov ecx, dword [eax + 0x10]
mov eax, dword [ecx]
call dword [eax + 8]
lea ecx, [ebp + 0x1c]
call fcn.0040bbf0
mov eax, dword [ebp + 0x1c]
cmp eax, dword [ebp - 0x1c]
jne 0x41f855
lea ecx, [ebp - 0x1c]
call fcn.0041f890
push 0x18
push dword [ebp - 0x1c]
jmp 0x41f78d
Function at 0x427640
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6219d2
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x690a1c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], 0
cmp dword [ebp + 0xc], 0
je 0x42769c
mov dword [esi], 0x633d18
mov dword [esi + 0x10], 0x633d20
mov dword [esi + 0x68], vtable.std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__.0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
push 0
push 0
lea edi, [esi + 0x18]
mov ecx, esi
push edi
call fcn.0040df40
lea edx, [esi + 0x10]
mov dword [ebp + 0xc], edx
mov eax, dword [edx]
mov eax, dword [eax + 4]
mov dword [edx + eax], vtable.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov eax, dword [edx]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ecx + edx - 4], eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
mov dword [esi + eax], vtable.std::basic_iostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov eax, dword [esi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x20]
mov dword [ecx + esi - 4], eax
mov eax, dword [esi]
push 8
mov dword [ebp - 4], 4
mov eax, dword [eax + 4]
mov dword [esi + eax], vtable.std::basic_stringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov eax, dword [esi]
mov ecx, dword [eax + 4]
mov dword [ebp + 0xc], edi
lea eax, [ecx - 0x68]
mov dword [ecx + esi - 4], eax
mov dword [edi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.004fa137
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x42772c
push 1
mov byte [ebp - 4], 5
call fcn.0046386e
add esp, 4
mov dword [ebx + 4], eax
jmp 0x42772e
xor ebx, ebx
lea eax, [edi + 4]
mov dword [edi + 0x34], ebx
mov dword [edi + 0xc], eax
lea ecx, [edi + 8]
mov ebx, dword [ebp + 8]
lea eax, [edi + 0x14]
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [edi + 0x10], ecx
mov dword [ecx], 0
mov ecx, ebx
mov eax, dword [edi + 0x20]
not ecx
and ecx, 1
shl ecx, 2
mov edx, ecx
mov dword [eax], 0
or edx, 2
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, ebx
and al, 2
mov dword [edi], vtable.std::basic_stringbuf_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov eax, ebx
mov dword [edi + 0x38], 0
cmovne edx, ecx
mov ecx, edx
or ecx, 8
and al, 8
cmove ecx, edx
mov eax, ecx
or eax, 0x10
and bl, 4
cmove eax, ecx
mov dword [edi + 0x3c], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x42c320
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edi
mov eax, dword [edi]
cmp eax, 0x270
jne 0x42c37e
lea edx, [edi + 8]
mov esi, eax
nop dword [eax]
mov ecx, dword [edx - 4]
lea edx, [edx + 4]
xor ecx, dword [edx - 4]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub esi, 1
jne 0x42c340
mov eax, dword [edi]
jmp 0x42c469
cmp eax, 0x4e0
jb 0x42c469
mov eax, dword [edi + 0x9c4]
push ebx
lea ebx, [edi + 0x9c4]
mov edi, 0xe3
nop dword [eax + eax]
mov ecx, dword [ebx + 4]
lea edx, [ebx + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx + 0x634]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub edi, 1
jne 0x42c3a0
mov ebx, dword [ebp - 4]
mov edi, 0x18c
add ebx, 0xd50
mov eax, dword [ebx]
nop dword [eax]
mov ecx, eax
lea edx, [ebx + 4]
xor ecx, dword [edx]
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx - 0xd4c]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub edi, 1
jne 0x42c3f0
mov edi, dword [ebp - 4]
pop ebx
mov ecx, dword [edi + 0x1380]
xor ecx, dword [edi + 4]
and ecx, 0x7fffffff
xor ecx, dword [edi + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x634]
xor eax, ecx
mov dword [edi + 0x9c0], eax
xor eax, eax
mov dword [edi], 0
mov edx, dword [edi + eax*4 + 4]
inc eax
mov dword [edi], eax
mov ecx, edx
mov eax, dword [edi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
pop edi
xor eax, edx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x42d4c0
Capabilities:
Check if file exists
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6201c8
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x690a1c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov bl, byte [ebp + 8]
push str.CreateDeskMirrorWnd
push dword [edi + 0x328]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x42d66d
call eax
mov dword [edi + 0x32c], eax
test eax, eax
je 0x42d66d
mov esi, dword [eax]
call fcn.00423b00
mov ecx, eax
call fcn.00424570
mov ecx, dword [edi + 0x32c]
movzx eax, al
neg eax
sbb eax, eax
add eax, 2
push eax
call dword [esi + 0x54]
mov ecx, dword [edi + 0x32c]
mov eax, dword [ecx]
call dword [eax]
push eax
mov dword [edi + 0x330], eax
call fcn.00423a70
mov ecx, eax
call fcn.00413870
mov eax, dword [edi + 0x330]
test eax, eax
je 0x42d646
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0x63656c
push 1
push 0
push 0x6336d8
mov bl, 1
call fcn.00420eb0
mov ecx, eax
call fcn.0047aa50
mov esi, dword [sym.imp.USER32.dll_SetTimer]
push 0
push 0x36ee80
push 0x45e
push dword [edi + 4]
call esi
call fcn.00423a70
mov ecx, eax
call fcn.00410220
inc eax
push eax
call fcn.00423a70
mov ecx, eax
call fcn.00411f60
mov ecx, edi
call fcn.00436930
lea eax, [ebp + 8]
push eax
call fcn.004586d0
add esp, 4
push dword [ebp + 8]
mov dword [ebp - 4], 0
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42d605
push dword [ebp + 8]
call fcn.00459000
mov ecx, dword [edi + 0x32c]
add esp, 4
mov edx, eax
test ecx, ecx
je 0x42d605
test edx, edx
je 0x42d605
mov eax, dword [ecx]
push 1
push edx
push dword [ebp + 8]
call dword [eax + 0xc]
call fcn.0042e930
mov ecx, eax
call fcn.00454110
push 0
push 0x2710
push 0x460
push dword [edi + 4]
call esi
mov edx, dword [ebp + 8]
or eax, 0xffffffff
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42d66d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x42d66d
push str.DestroyDeskMirrorWnd
push dword [edi + 0x328]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x42d66d
push dword [edi + 0x32c]
call eax
mov dword [edi + 0x32c], 0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x42dc20
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Find taskbar
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6222c8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x690a1c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x10]
push eax
call fcn.00458d00
add esp, 4
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], 0
cmp dword [eax - 0xc], 0
je 0x42dd75
push 0
push str.Shell_TrayWnd
push 0
push 0
call dword [sym.imp.USER32.dll_FindWindowExW]
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push dword [ebp - 0x14]
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x42dd75
push 0x40
push 0x1000
push 0xc8
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov esi, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
cmp dword [esi - 4], 1
mov eax, dword [esi - 0xc]
mov dword [ebp - 0x1c], eax
jle 0x42dcd8
push eax
lea ecx, [ebp - 0x10]
call fcn.004072a0
mov esi, dword [ebp - 0x10]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x18], eax
test eax, eax
jne 0x42dcf8
xor ebx, ebx
jmp 0x42dd18
push eax
call fcn.004fa4ff
add esp, 4
mov ebx, eax
push 0
push 0
push dword [ebp - 0x18]
push ebx
push 0xffffffffffffffff
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [ebp - 0x1c]
push 0
inc eax
push eax
push ebx
mov ebx, dword [ebp - 0x20]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x42dd75
push 0
push 0
push ebx
push dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov esi, eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push 0x4000
push 0x100
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push edi
call esi
mov esi, 1
jmp 0x42dd77
xor esi, esi
mov eax, dword [ebp - 0x10]
or ecx, 0xffffffff
mov dword [ebp - 4], 0xffffffff
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x42dd99
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x432d20
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push 0
mov esi, ecx
call fcn.00423a70
mov ecx, eax
call fcn.00412e70
push dword [esi + 0x330]
mov edi, dword [sym.imp.USER32.dll_IsWindow]
call edi
test eax, eax
je 0x432d56
push 0
push dword [esi + 0x330]
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [esi + 0x3b4], 0
mov dword [esi + 0x3b0], 1
je 0x432d73
mov ecx, dword [esi + 0x35c]
test ecx, ecx
jne 0x432d7d
mov ecx, dword [esi + 0x378]
test ecx, ecx
je 0x432d87
mov eax, dword [ecx]
push 0
call dword [eax + 0x114]
mov ecx, dword [esi + 0x4ac]
test ecx, ecx
je 0x432da8
call fcn.00427a00
push eax
call edi
test eax, eax
je 0x432da8
mov ecx, dword [esi + 0x4ac]
call fcn.004425f0
mov ecx, dword [esi + 0x4b0]
test ecx, ecx
je 0x432dc9
call fcn.00427a00
push eax
call edi
test eax, eax
je 0x432dc9
mov ecx, dword [esi + 0x4b0]
call fcn.004425f0
push 0
push str.set_hotkey_dialog
call dword [sym.imp.USER32.dll_FindWindowW]
push eax
mov dword [ebp - 4], eax
call edi
test eax, eax
je 0x432def
push 0
push 0
push 0x10
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_PostMessageW]
push 0
push str.tab_more_menu
call dword [sym.imp.USER32.dll_FindWindowW]
push eax
mov dword [ebp - 4], eax
call edi
test eax, eax
je 0x432e15
push 0
push 0
push 0x10
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [esi + 0x32c]
pop edi
pop esi
test ecx, ecx
je 0x432e2a
mov eax, dword [ecx]
push 0
push 0xa
call dword [eax + 0x14]
mov esp, ebp
pop ebp
ret
Function at 0x4344a0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x622cc0
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x690a1c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 2
push 0xc
push 1
lea ecx, [ebp - 0x34]
call fcn.00468e80
push 0
lea eax, [ebp - 0x34]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.0042e780
mov ecx, eax
call fcn.00421760
call fcn.00407410
mov ecx, eax
test ecx, ecx
je 0x434660
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
push str.https:__www.ludashi.com_service_faq
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.004090c0
test al, al
jne 0x43452f
push 0x23
push str.https:__www.ludashi.com_service_faq
lea ecx, [ebp - 0x10]
call fcn.0040b220
mov edi, dword [ebp - 0x10]
add edi, 0xfffffff0
mov byte [ebp - 4], 2
push edi
call fcn.00407150
add esp, 4
lea ebx, [eax + 0x10]
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 4], 3
call fcn.00407410
mov ecx, eax
test ecx, ecx
je 0x43466a
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
push ebx
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 4
push str._s_servicepidpidmidmidm2mid2appverappverososverinstdateinstdatefromjdesk
push eax
call fcn.00407320
mov ebx, dword [ebp - 0x14]
add esp, 8
mov esi, esp
add ebx, 0xfffffff0
mov dword [ebp - 0x20], esi
push ebx
call fcn.00407150
add eax, 0x10
add esp, 4
mov dword [esi], eax
lea eax, [ebp - 0x18]
push eax
call fcn.0040a950
add esp, 8
mov eax, dword [ebp - 0x18]
mov byte [ebp - 4], 5
push dword [eax - 0xc]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
test eax, eax
je 0x434674
push 5
push 0
push 0
push eax
push 0x6336d8
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov edx, dword [ebp - 0x18]
or esi, 0xffffffff
mov byte [ebp - 4], 4
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4345ef
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 3
mov eax, esi
lock xadd dword [ebx + 0xc], eax
dec eax
test eax, eax
jg 0x434607
mov ecx, dword [ebx]
push ebx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x1c]
mov eax, esi
mov byte [ebp - 4], 2
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x434625
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp + 0x14]
mov byte [ebp - 4], 0
mov dword [eax], 1
lock xadd dword [edi + 0xc], esi
dec esi
test esi, esi
jg 0x434644
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x34]
call fcn.00468f80
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0x80004005
call fcn.00407120
push 0x80004005
call fcn.00407120
call fcn.00407f90
int3
Function at 0x434680
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x622d10
mov eax, dword fs:[0]
push eax
sub esp, 0x74
mov eax, dword [0x690a1c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2c], ecx
mov esi, dword [ebp + 0xc]
cmp esi, 1
jne 0x434793
call fcn.00407410
mov ecx, eax
test ecx, ecx
je 0x4348b6
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x2c], eax
push str.run_shortcuts
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0
call fcn.004090c0
test al, al
jne 0x4346fa
push 0xd
push str.run_shortcuts
lea ecx, [ebp - 0x2c]
call fcn.0040b220
push 2
push 0xd
push 1
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], 1
call fcn.00468e80
mov esi, dword [ebp - 0x2c]
lea ecx, [ebp - 0x28]
xor eax, eax
mov byte [ebp - 4], 2
push esi
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.0043bf90
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x40]
call fcn.00468de0
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.0040efb0
push 0
lea eax, [ebp - 0x40]
push 0
push eax
call fcn.0042e780
mov ecx, eax
call fcn.00421760
lea ecx, [ebp - 0x40]
call fcn.00468f80
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x434899
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x434899
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [0x69f770]
mov ebx, eax
test cl, 1
jne 0x4347bf
or ecx, 1
mov dword [0x69f770], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov dword [0x69f76c], ecx
jmp 0x4347c5
mov ecx, dword [0x69f76c]
cmp dword [0x69041c], esi
jne 0x4347dc
mov eax, ebx
sub eax, ecx
cmp eax, 0x7d0
jb 0x434899
lea ecx, [ebp - 0x60]
mov dword [0x69f76c], ebx
mov dword [0x69041c], esi
call fcn.0044bc40
lea eax, [ebp - 0x60]
mov dword [ebp - 4], 4
push eax
push esi
call fcn.0042e810
mov ecx, eax
call fcn.0044f8f0
test eax, eax
je 0x434840
mov eax, dword [ebp - 0x5c]
cmp dword [eax - 0xc], 0
je 0x434891
push 0
push str.jianquick
push 1
push 0
push str.open_shortcuts
call fcn.00420eb0
mov ecx, eax
call fcn.0047aa50
push 0
push dword [ebp - 0x5c]
call fcn.004500f0
add esp, 8
jmp 0x434891
lea ecx, [ebp - 0x80]
call fcn.0044bcd0
lea eax, [ebp - 0x80]
mov byte [ebp - 4], 5
push eax
push esi
call fcn.0042e8a0
mov ecx, eax
call fcn.0044ffa0
test eax, eax
je 0x434889
push 0
push str.jianquick
push 1
push 0
push str.gadgets_shortcuts
call fcn.00420eb0
mov ecx, eax
call fcn.0047aa50
mov ecx, dword [ebp - 0x2c]
lea eax, [ebp - 0x7c]
push eax
call fcn.00437b20
lea ecx, [ebp - 0x80]
call fcn.0042bd70
lea ecx, [ebp - 0x60]
call fcn.0042b870
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004fa103
mov esp, ebp
pop ebp
ret 0x10
push 0x80004005
call fcn.00407120
int3