joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41f590
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x61c928
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x68d9ac]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [ebp + 0x1c], 0
jne 0x41f6e7
mov eax, dword [ebp + 0xc]
cmp eax, 1
jne 0x41f606
push 0
push dword [esi + 4]
mov dword [esi + 0x24], eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
cmp dword [esi + 0x24], 0
je 0x41f6e7
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
cmp eax, 0x7e
jne 0x41f687
mov edi, dword [ebp + 0x14]
lea ecx, [ebp + 0x1f]
push ecx
lea eax, [esi + 0x28]
movzx ebx, di
push eax
lea ecx, [ebp - 0x14]
shr edi, 0x10
call fcn.0041eb80
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 4], 0
mov eax, dword [ecx]
mov dword [ebp + 0x1c], eax
cmp eax, ecx
je 0x41f650
mov ecx, dword [eax + 0x10]
push edi
push ebx
mov eax, dword [ecx]
call dword [eax]
lea ecx, [ebp + 0x1c]
call fcn.0040bb00
mov eax, dword [ebp + 0x1c]
cmp eax, dword [ebp - 0x14]
jne 0x41f637
lea ecx, [ebp - 0x14]
call fcn.0041f760
push 0x18
push dword [ebp - 0x14]
call fcn.004f9a35
mov eax, dword [ebp + 0x18]
add esp, 8
mov dword [eax], 0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
cmp eax, 0x31a
jne 0x41f6fd
lea ecx, [ebp + 0x1f]
push ecx
lea eax, [esi + 0x28]
push eax
lea ecx, [ebp - 0x14]
call fcn.0041eb80
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 4], 1
mov eax, dword [ecx]
mov dword [ebp + 0x1c], eax
cmp eax, ecx
je 0x41f6c9
mov ecx, dword [eax + 0x10]
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp + 0x1c]
call fcn.0040bb00
mov eax, dword [ebp + 0x1c]
cmp eax, dword [ebp - 0x14]
jne 0x41f6b1
lea ecx, [ebp - 0x14]
call fcn.0041f760
push 0x18
push dword [ebp - 0x14]
call fcn.004f9a35
mov eax, dword [ebp + 0x18]
add esp, 8
mov dword [eax], 0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
cmp eax, 0x1e
jne 0x41f6e7
lea ecx, [ebp + 0x1f]
push ecx
lea eax, [esi + 0x28]
push eax
lea ecx, [ebp - 0x1c]
call fcn.0041eb80
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 4], 2
mov eax, dword [ecx]
mov dword [ebp + 0x1c], eax
cmp eax, ecx
je 0x41f73d
mov ecx, dword [eax + 0x10]
mov eax, dword [ecx]
call dword [eax + 8]
lea ecx, [ebp + 0x1c]
call fcn.0040bb00
mov eax, dword [ebp + 0x1c]
cmp eax, dword [ebp - 0x1c]
jne 0x41f725
lea ecx, [ebp - 0x1c]
call fcn.0041f760
push 0x18
push dword [ebp - 0x1c]
jmp 0x41f65d
Function at 0x427510
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x61d802
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x68d9ac]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], 0
cmp dword [ebp + 0xc], 0
je 0x42756c
mov dword [esi], 0x62fd18
mov dword [esi + 0x10], 0x62fd20
mov dword [esi + 0x68], vtable.std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__.0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
push 0
push 0
lea edi, [esi + 0x18]
mov ecx, esi
push edi
call fcn.0040de50
lea edx, [esi + 0x10]
mov dword [ebp + 0xc], edx
mov eax, dword [edx]
mov eax, dword [eax + 4]
mov dword [edx + eax], vtable.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov eax, dword [edx]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ecx + edx - 4], eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
mov dword [esi + eax], vtable.std::basic_iostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov eax, dword [esi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x20]
mov dword [ecx + esi - 4], eax
mov eax, dword [esi]
push 8
mov dword [ebp - 4], 4
mov eax, dword [eax + 4]
mov dword [esi + eax], vtable.std::basic_stringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov eax, dword [esi]
mov ecx, dword [eax + 4]
mov dword [ebp + 0xc], edi
lea eax, [ecx - 0x68]
mov dword [ecx + esi - 4], eax
mov dword [edi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.004f9a77
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x4275fc
push 1
mov byte [ebp - 4], 5
call fcn.00463181
add esp, 4
mov dword [ebx + 4], eax
jmp 0x4275fe
xor ebx, ebx
lea eax, [edi + 4]
mov dword [edi + 0x34], ebx
mov dword [edi + 0xc], eax
lea ecx, [edi + 8]
mov ebx, dword [ebp + 8]
lea eax, [edi + 0x14]
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [edi + 0x10], ecx
mov dword [ecx], 0
mov ecx, ebx
mov eax, dword [edi + 0x20]
not ecx
and ecx, 1
shl ecx, 2
mov edx, ecx
mov dword [eax], 0
or edx, 2
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, ebx
and al, 2
mov dword [edi], vtable.std::basic_stringbuf_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov eax, ebx
mov dword [edi + 0x38], 0
cmovne edx, ecx
mov ecx, edx
or ecx, 8
and al, 8
cmove ecx, edx
mov eax, ecx
or eax, 0x10
and bl, 4
cmove eax, ecx
mov dword [edi + 0x3c], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x42c1f0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edi
mov eax, dword [edi]
cmp eax, 0x270
jne 0x42c24e
lea edx, [edi + 8]
mov esi, eax
nop dword [eax]
mov ecx, dword [edx - 4]
lea edx, [edx + 4]
xor ecx, dword [edx - 4]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub esi, 1
jne 0x42c210
mov eax, dword [edi]
jmp 0x42c339
cmp eax, 0x4e0
jb 0x42c339
mov eax, dword [edi + 0x9c4]
push ebx
lea ebx, [edi + 0x9c4]
mov edi, 0xe3
nop dword [eax + eax]
mov ecx, dword [ebx + 4]
lea edx, [ebx + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx + 0x634]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub edi, 1
jne 0x42c270
mov ebx, dword [ebp - 4]
mov edi, 0x18c
add ebx, 0xd50
mov eax, dword [ebx]
nop dword [eax]
mov ecx, eax
lea edx, [ebx + 4]
xor ecx, dword [edx]
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx - 0xd4c]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub edi, 1
jne 0x42c2c0
mov edi, dword [ebp - 4]
pop ebx
mov ecx, dword [edi + 0x1380]
xor ecx, dword [edi + 4]
and ecx, 0x7fffffff
xor ecx, dword [edi + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x634]
xor eax, ecx
mov dword [edi + 0x9c0], eax
xor eax, eax
mov dword [edi], 0
mov edx, dword [edi + eax*4 + 4]
inc eax
mov dword [edi], eax
mov ecx, edx
mov eax, dword [edi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
pop edi
xor eax, edx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x42d380
Capabilities:
Check if file exists
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x61c008
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x68d9ac]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov bl, byte [ebp + 8]
push str.CreateDeskMirrorWnd
push dword [edi + 0x328]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x42d52d
call eax
mov dword [edi + 0x32c], eax
test eax, eax
je 0x42d52d
mov esi, dword [eax]
call fcn.004239d0
mov ecx, eax
call fcn.00424440
mov ecx, dword [edi + 0x32c]
movzx eax, al
neg eax
sbb eax, eax
add eax, 2
push eax
call dword [esi + 0x54]
mov ecx, dword [edi + 0x32c]
mov eax, dword [ecx]
call dword [eax]
push eax
mov dword [edi + 0x330], eax
call fcn.00423940
mov ecx, eax
call fcn.004137b0
mov eax, dword [edi + 0x330]
test eax, eax
je 0x42d506
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0x6324a4
push 1
push 0
push 0x62f6d8
mov bl, 1
call fcn.00420d80
mov ecx, eax
call fcn.0047a370
mov esi, dword [sym.imp.USER32.dll_SetTimer]
push 0
push 0x36ee80
push 0x45e
push dword [edi + 4]
call esi
call fcn.00423940
mov ecx, eax
call fcn.00410150
inc eax
push eax
call fcn.00423940
mov ecx, eax
call fcn.00411e90
mov ecx, edi
call fcn.00436560
lea eax, [ebp + 8]
push eax
call fcn.00457fe0
add esp, 4
push dword [ebp + 8]
mov dword [ebp - 4], 0
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42d4c5
push dword [ebp + 8]
call fcn.00458910
mov ecx, dword [edi + 0x32c]
add esp, 4
mov edx, eax
test ecx, ecx
je 0x42d4c5
test edx, edx
je 0x42d4c5
mov eax, dword [ecx]
push 1
push edx
push dword [ebp + 8]
call dword [eax + 0xc]
call fcn.0042e7f0
mov ecx, eax
call fcn.00453a20
push 0
push 0x2710
push 0x460
push dword [edi + 4]
call esi
mov edx, dword [ebp + 8]
or eax, 0xffffffff
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42d52d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x42d52d
push str.DestroyDeskMirrorWnd
push dword [edi + 0x328]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x42d52d
push dword [edi + 0x32c]
call eax
mov dword [edi + 0x32c], 0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x42dae0
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Find taskbar
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x61e0c8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x68d9ac]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x10]
push eax
call fcn.00458610
add esp, 4
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], 0
cmp dword [eax - 0xc], 0
je 0x42dc35
push 0
push str.Shell_TrayWnd
push 0
push 0
call dword [sym.imp.USER32.dll_FindWindowExW]
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push dword [ebp - 0x14]
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x42dc35
push 0x40
push 0x1000
push 0xc8
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov esi, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
cmp dword [esi - 4], 1
mov eax, dword [esi - 0xc]
mov dword [ebp - 0x1c], eax
jle 0x42db98
push eax
lea ecx, [ebp - 0x10]
call fcn.004071b0
mov esi, dword [ebp - 0x10]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x18], eax
test eax, eax
jne 0x42dbb8
xor ebx, ebx
jmp 0x42dbd8
push eax
call fcn.004f9e3f
add esp, 4
mov ebx, eax
push 0
push 0
push dword [ebp - 0x18]
push ebx
push 0xffffffffffffffff
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [ebp - 0x1c]
push 0
inc eax
push eax
push ebx
mov ebx, dword [ebp - 0x20]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x42dc35
push 0
push 0
push ebx
push dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov esi, eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push 0x4000
push 0x100
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push edi
call esi
mov esi, 1
jmp 0x42dc37
xor esi, esi
mov eax, dword [ebp - 0x10]
or ecx, 0xffffffff
mov dword [ebp - 4], 0xffffffff
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x42dc59
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x432bd0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push 0
mov esi, ecx
call fcn.00423940
mov ecx, eax
call fcn.00412da0
push dword [esi + 0x330]
mov edi, dword [sym.imp.USER32.dll_IsWindow]
call edi
test eax, eax
je 0x432c06
push 0
push dword [esi + 0x330]
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [esi + 0x3b4], 0
mov dword [esi + 0x3b0], 1
je 0x432c23
mov ecx, dword [esi + 0x35c]
test ecx, ecx
jne 0x432c2d
mov ecx, dword [esi + 0x378]
test ecx, ecx
je 0x432c37
mov eax, dword [ecx]
push 0
call dword [eax + 0x114]
mov ecx, dword [esi + 0x4ac]
test ecx, ecx
je 0x432c58
call fcn.004278d0
push eax
call edi
test eax, eax
je 0x432c58
mov ecx, dword [esi + 0x4ac]
call fcn.00441ec0
mov ecx, dword [esi + 0x4b0]
test ecx, ecx
je 0x432c79
call fcn.004278d0
push eax
call edi
test eax, eax
je 0x432c79
mov ecx, dword [esi + 0x4b0]
call fcn.00441ec0
push 0
push str.set_hotkey_dialog
call dword [sym.imp.USER32.dll_FindWindowW]
push eax
mov dword [ebp - 4], eax
call edi
test eax, eax
je 0x432c9f
push 0
push 0
push 0x10
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_PostMessageW]
push 0
push str.tab_more_menu
call dword [sym.imp.USER32.dll_FindWindowW]
push eax
mov dword [ebp - 4], eax
call edi
test eax, eax
je 0x432cc5
push 0
push 0
push 0x10
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [esi + 0x32c]
pop edi
pop esi
test ecx, ecx
je 0x432cda
mov eax, dword [ecx]
push 0
push 0xa
call dword [eax + 0x14]
mov esp, ebp
pop ebp
ret
Function at 0x434360
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x61eac0
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x68d9ac]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 2
push 0xc
push 1
lea ecx, [ebp - 0x34]
call fcn.004687a0
push 0
lea eax, [ebp - 0x34]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.0042e640
mov ecx, eax
call fcn.00421630
call fcn.00407320
mov ecx, eax
test ecx, ecx
je 0x434520
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
push str.https:__www.ludashi.com_service_faq
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.00408fd0
test al, al
jne 0x4343ef
push 0x23
push str.https:__www.ludashi.com_service_faq
lea ecx, [ebp - 0x10]
call fcn.0040b130
mov edi, dword [ebp - 0x10]
add edi, 0xfffffff0
mov byte [ebp - 4], 2
push edi
call fcn.00407060
add esp, 4
lea ebx, [eax + 0x10]
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 4], 3
call fcn.00407320
mov ecx, eax
test ecx, ecx
je 0x43452a
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
push ebx
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 4
push str._s_servicepidpidmidmidm2mid2appverappverososverinstdateinstdatefromjdesk
push eax
call fcn.00407230
mov ebx, dword [ebp - 0x14]
add esp, 8
mov esi, esp
add ebx, 0xfffffff0
mov dword [ebp - 0x20], esi
push ebx
call fcn.00407060
add eax, 0x10
add esp, 4
mov dword [esi], eax
lea eax, [ebp - 0x18]
push eax
call fcn.0040a860
add esp, 8
mov eax, dword [ebp - 0x18]
mov byte [ebp - 4], 5
push dword [eax - 0xc]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
test eax, eax
je 0x434534
push 5
push 0
push 0
push eax
push 0x62f6d8
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov edx, dword [ebp - 0x18]
or esi, 0xffffffff
mov byte [ebp - 4], 4
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4344af
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 3
mov eax, esi
lock xadd dword [ebx + 0xc], eax
dec eax
test eax, eax
jg 0x4344c7
mov ecx, dword [ebx]
push ebx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x1c]
mov eax, esi
mov byte [ebp - 4], 2
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4344e5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp + 0x14]
mov byte [ebp - 4], 0
mov dword [eax], 1
lock xadd dword [edi + 0xc], esi
dec esi
test esi, esi
jg 0x434504
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x34]
call fcn.004688a0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0x80004005
call fcn.00407030
push 0x80004005
call fcn.00407030
call fcn.00407ea0
int3
Function at 0x434540
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x61eb10
mov eax, dword fs:[0]
push eax
sub esp, 0x74
mov eax, dword [0x68d9ac]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2c], ecx
mov esi, dword [ebp + 0xc]
cmp esi, 1
jne 0x434653
call fcn.00407320
mov ecx, eax
test ecx, ecx
je 0x434776
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x2c], eax
push str.run_shortcuts
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0
call fcn.00408fd0
test al, al
jne 0x4345ba
push 0xd
push str.run_shortcuts
lea ecx, [ebp - 0x2c]
call fcn.0040b130
push 2
push 0xd
push 1
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], 1
call fcn.004687a0
mov esi, dword [ebp - 0x2c]
lea ecx, [ebp - 0x28]
xor eax, eax
mov byte [ebp - 4], 2
push esi
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.0043b860
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x40]
call fcn.00468700
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.0040eec0
push 0
lea eax, [ebp - 0x40]
push 0
push eax
call fcn.0042e640
mov ecx, eax
call fcn.00421630
lea ecx, [ebp - 0x40]
call fcn.004688a0
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x434759
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x434759
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [0x69c3e0]
mov ebx, eax
test cl, 1
jne 0x43467f
or ecx, 1
mov dword [0x69c3e0], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov dword [0x69c3dc], ecx
jmp 0x434685
mov ecx, dword [0x69c3dc]
cmp dword [0x68d3ac], esi
jne 0x43469c
mov eax, ebx
sub eax, ecx
cmp eax, 0x7d0
jb 0x434759
lea ecx, [ebp - 0x60]
mov dword [0x69c3dc], ebx
mov dword [0x68d3ac], esi
call fcn.0044b520
lea eax, [ebp - 0x60]
mov dword [ebp - 4], 4
push eax
push esi
call fcn.0042e6d0
mov ecx, eax
call fcn.0044f200
test eax, eax
je 0x434700
mov eax, dword [ebp - 0x5c]
cmp dword [eax - 0xc], 0
je 0x434751
push 0
push str.jianquick
push 1
push 0
push str.open_shortcuts
call fcn.00420d80
mov ecx, eax
call fcn.0047a370
push 0
push dword [ebp - 0x5c]
call fcn.0044fa00
add esp, 8
jmp 0x434751
lea ecx, [ebp - 0x80]
call fcn.0044b5b0
lea eax, [ebp - 0x80]
mov byte [ebp - 4], 5
push eax
push esi
call fcn.0042e760
mov ecx, eax
call fcn.0044f8b0
test eax, eax
je 0x434749
push 0
push str.jianquick
push 1
push 0
push str.gadgets_shortcuts
call fcn.00420d80
mov ecx, eax
call fcn.0047a370
mov ecx, dword [ebp - 0x2c]
lea eax, [ebp - 0x7c]
push eax
call fcn.004374c0
lea ecx, [ebp - 0x80]
call fcn.0042bc40
lea ecx, [ebp - 0x60]
call fcn.0042b740
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f9a43
mov esp, ebp
pop ebp
ret 0x10
push 0x80004005
call fcn.00407030
int3
Function at 0x435a50
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x68d9ac]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push esi
push edi
mov edi, ecx
mov dword [eax], 1
lea ecx, [edi + 0x4b8]
call fcn.004278d0
test eax, eax
jne 0x435a91
push dword [edi + 4]
lea eax, [edi + 0x410]
push eax
lea ecx, [edi + 0x4b8]
call fcn.00444fa0
lea ecx, [edi + 0x4b8]
call fcn.004278d0
mov edi, eax
test edi, edi
je 0x435b62
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x435b62
lea eax, [ebp - 0x14]
xorps xmm0, xmm0
push eax
push edi
movups xmmword [ebp - 0x14], xmm0
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
push ecx
mov dword [esp], 0x3f800000
push ecx
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.0040a3e0
mov esi, dword [sym.imp.USER32.dll_SetWindowPos]
add esp, 0x10
movups xmm1, xmmword [eax]
push 0x15
push 0xffffffffffffffff
movaps xmm0, xmm1
psrldq xmm0, 4
push 0xffffffffffffffff
movd eax, xmm0
movups xmmword [ebp - 0x14], xmm1
push eax
movd eax, xmm1
push eax
push 0
push edi
call esi
push 5
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push edi
call dword [sym.imp.USER32.dll_SetActiveWindow]
push 3
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push edi
call esi
push 0x43
push 0
push 0
push 0
push 0
push 0xfffffffffffffffe
push edi
call esi
cmp dword [ebp + 0xc], 0
push 0
je 0x435b54
push 4
jmp 0x435b56
push 0
push 0x41b
push edi
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004f9a43
mov esp, ebp
pop ebp
ret 0x10