joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4047d0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2014
call fcn.0043d750
mov eax, dword [0x47b014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ecx
lea eax, [ebp - 0x408]
mov ebx, edx
mov esi, ecx
mov dword [ebp - 0x2010], ebx
push eax
mov dword [ebp - 0x2014], esi
call fcn.004021b0
add esp, 8
mov dword [ebp - 0x200c], 0
lea eax, [ebp - 0x200c]
push eax
push 0x10000
push 0
lea eax, [ebp - 0x408]
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x40489a
push dword [ebp - 0x200c]
call edi
push 0
push 0
lea eax, [ebp - 0x408]
mov edx, ebx
push 0x200
push eax
mov ecx, esi
call fcn.00402720
add esp, 0x10
test eax, eax
jne 0x4048bc
mov dword [ebp - 0x200c], eax
lea eax, [ebp - 0x200c]
push eax
push 0x10000
push 0
lea eax, [ebp - 0x408]
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4048b7
push dword [ebp - 0x200c]
call edi
jmp 0x4048bc
cmp eax, 2
je 0x404846
mov esi, 0xd
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00422009
mov esp, ebp
pop ebp
ret
cmp eax, 2
jne 0x40489f
push ecx
lea eax, [ebp - 0x2008]
mov edx, esi
push eax
push ebx
xor cl, cl
call fcn.004033c0
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x4049e0
push eax
push eax
push 3
push eax
push eax
push 0x40000000
lea eax, [ebp - 0x2008]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xffffffff
jne 0x404923
call ebx
cmp eax, 2
je 0x404926
mov esi, 0x12
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00422009
mov esp, ebp
pop ebp
ret
push eax
call edi
mov edx, dword [ebp - 0x2014]
lea eax, [ebp - 0x2008]
push ecx
push eax
push dword [ebp - 0x2010]
mov cl, 1
call fcn.004033c0
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x4049e0
push eax
push eax
push 3
push eax
push eax
push 0x40000000
lea eax, [ebp - 0x2008]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x40498a
call ebx
cmp eax, 2
je 0x40498d
mov esi, 0x12
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00422009
mov esp, ebp
pop ebp
ret
push eax
call edi
mov edx, 0x1000
lea ecx, [ebp - 0x2008]
call fcn.00401fc0
push 0
push 0
push 3
push 0
push 0
push 0x40000000
lea eax, [ebp - 0x2008]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x4049dd
call ebx
cmp eax, 2
je 0x4049e0
mov esi, 0xc
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00422009
mov esp, ebp
pop ebp
ret
push eax
call edi
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00422009
mov esp, ebp
pop ebp
ret
Function at 0x404a00
Capabilities:
Delete file
Delete registry key

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2410
call fcn.0043d750
mov eax, dword [0x47b014]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov al, dl
mov byte [ebp - 0x240d], al
mov ebx, ecx
test edi, edi
jne 0x404a3f
lea eax, [edi + 0x14]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00422009
mov esp, ebp
pop ebp
ret
xor esi, esi
mov edx, edi
test al, al
lea eax, [ebp - 0x40c]
je 0x404a63
push esi
push esi
push 0x200
push eax
call fcn.00402720
add esp, 0x10
test eax, eax
jne 0x404aa5
jmp 0x404a6d
push ecx
push eax
call fcn.004021b0
add esp, 8
lea eax, [ebp - 0x40c]
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
cmp eax, 2
je 0x404aa5
cmp eax, 5
jne 0x404aa1
mov esi, 0xd
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00422009
mov esp, ebp
pop ebp
ret
test eax, eax
jne 0x404ad1
push ecx
mov cl, byte [ebp - 0x240d]
lea eax, [ebp - 0x240c]
push eax
push edi
mov edx, ebx
call fcn.004033c0
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x404ad1
lea eax, [ebp - 0x240c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 8]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00422009
mov esp, ebp
pop ebp
ret
Function at 0x404e40
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x2120
call fcn.0043d750
mov eax, dword [0x47b014]
xor eax, esp
mov dword [esp + 0x211c], eax
mov edx, 0x1080
lea ecx, [esp + 0x18]
call fcn.00401fc0
lea eax, [esp + 0x18]
mov dword [esp], 0
xorps xmm0, xmm0
mov dword [esp + 4], 0
push eax
movlpd qword [esp + 0xc], xmm0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x404eb7
lea eax, [esp]
xor edx, edx
push eax
xor ecx, ecx
call fcn.004035c0
add esp, 4
test al, al
jne 0x404ebc
call fcn.00404330
mov ecx, dword [esp + 0x211c]
xor ecx, esp
call fcn.00422009
mov esp, ebp
pop ebp
ret
Function at 0x4055d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
push dword [esi + 0x24]
push dword [esi + 0x20]
push dword [esi + 0x1c]
push dword [esi + 0x38]
push dword [esi + 0x34]
call dword [sym.imp.USER32.dll_CallWindowProcW]
mov edx, dword [esi]
mov ecx, esi
mov ebx, eax
call dword [edx + 0x12c]
mov edx, esi
mov ecx, 0x44a278
call fcn.00406a10
mov word [esi + 0x6c], 0
mov dword [esi + 0xcc], 0
mov edi, dword [esi + 0xd8]
mov ecx, edi
mov edx, dword [esi + 0xe0]
lea eax, [edi + edi*2]
lea eax, [edx + eax*8]
mov dword [ebp - 4], eax
mov eax, edi
sub ecx, edi
je 0x40564c
lea eax, [ecx + ecx*2]
shl eax, 3
push eax
push dword [ebp - 4]
push edx
call fcn.00424db0
mov eax, dword [esi + 0xd8]
add esp, 0xc
sub eax, edi
push 0xfffffffffffffff0
mov dword [esi + 0xd8], eax
push dword [esi + 0xa8]
call dword [sym.imp.USER32.dll_GetWindowLongW]
or eax, 8
push eax
push 0xfffffffffffffff0
push dword [esi + 0xa8]
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 0x64
push 1
push 0x40a
push dword [esi + 0xa8]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push esi
push 0x405540
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x4056c4
mov eax, dword [esi]
mov ecx, esi
mov byte [esi + 0x6d], 1
mov dword [esi + 0xcc], 6
call dword [eax + 0x134]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [esi + 0x64]
cmp eax, 1
jne 0x4056d9
mov edi, dword [str.Discovering_Bluetooth_Devices...]
mov ecx, 0x44a6ec
jmp 0x4056eb
cmp eax, 2
mov ecx, 0x44a708
mov edx, 0x44a67c
cmovne ecx, edx
mov edi, dword [ecx]
cmp edi, 0xffffffff
jne 0x4056fc
cmp dword [ecx + 4], edi
jne 0x4056fc
lea edx, [ecx + 8]
test edx, edx
jne 0x40570b
mov eax, dword [0x481aa4]
mov edx, edi
mov eax, dword [ecx + eax*4]
test eax, eax
cmovne edx, eax
push edx
push 0x3f2
push dword [esi + 0x38]
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x408080
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x20a8
call fcn.0043d750
mov eax, dword [0x47b014]
xor eax, esp
mov dword [esp + 0x20a4], eax
push esi
push edi
mov edi, dword [str.Unknown]
mov dword [esp + 0x1c], ecx
cmp edi, 0xffffffff
jne 0x4080be
cmp dword [0x44a8b0], edi
jne 0x4080be
mov esi, 0x44a8b4
jmp 0x4080d4
mov eax, dword [0x481aa4]
mov esi, dword [eax*4 + 0x44a8ac]
test esi, esi
jne 0x4080d4
mov esi, edi
test esi, esi
je 0x4080ff
lea eax, [esp + 0x68]
mov edx, 0x20
sub esi, eax
nop
movzx ecx, word [esi + eax]
test cx, cx
je 0x4080f5
mov word [eax], cx
dec edx
add eax, 2
cmp edx, 1
ja 0x4080e0
xor ecx, ecx
mov word [eax], cx
mov eax, dword [0x481aa4]
cmp edi, 0xffffffff
jne 0x408113
cmp dword [0x44a8b0], edi
jne 0x408113
mov esi, 0x44a8b4
jmp 0x408124
mov esi, dword [eax*4 + 0x44a8ac]
test esi, esi
jne 0x408124
mov esi, edi
test esi, esi
je 0x40814a
lea eax, [esp + 0x28]
mov ecx, 0x20
sub esi, eax
nop
movzx edx, word [esi + eax]
test dx, dx
je 0x408145
mov word [eax], dx
dec ecx
add eax, 2
cmp ecx, 1
ja 0x408130
xor ecx, ecx
mov word [eax], cx
call fcn.0040d350
mov esi, eax
lea eax, [esp + 0x20]
push eax
push 1
push 0
push str.SoftwarePassThruSupport.04.04Scanmatik___SM2_USB
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4081e4
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 0x2000
push eax
lea eax, [esp + 0xac]
push eax
push 0
push 0
push str.FunctionLibrary
push dword [esp + 0x34]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [esp + 0x20]
test eax, eax
jne 0x4081de
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [esp + 0xc]
lea ecx, [esp + 0xa8]
call fcn.0040a090
test al, al
je 0x4081e4
push dword [esp + 0x18]
lea eax, [esp + 0x6c]
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [esp + 0x18]
push 0x46fc84
push 0x20
push eax
call fcn.004019b0
add esp, 0x1c
jmp 0x4081e4
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0xa8]
call fcn.00401d10
test al, al
je 0x40822c
lea edx, [esp + 0xc]
lea ecx, [esp + 0xa8]
call fcn.0040a090
test al, al
je 0x40822c
push dword [esp + 0x18]
lea eax, [esp + 0x2c]
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [esp + 0x18]
push 0x46fc84
push 0x20
push eax
call fcn.004019b0
add esp, 0x1c
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x6c]
push eax
push 0x44aadc
push esi
call fcn.0040d400
add esp, 0x10
test esi, esi
je 0x408258
cmp dword [esi], 0
je 0x408258
mov eax, dword [0x481aa4]
mov eax, dword [esi + eax*4 + 4]
jmp 0x40825a
xor eax, eax
push eax
mov eax, dword [esp + 0x20]
push 0x3f6
push dword [eax + 0x38]
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
push esi
call fcn.00430bb8
mov ecx, dword [esp + 0x20b0]
add esp, 4
pop edi
pop esi
xor ecx, esp
call fcn.00422009
mov esp, ebp
pop ebp
ret
Function at 0x409a10
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x47b014]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x60]
mov dword [ebp - 8], 0
push eax
lea eax, [ebp - 0x50]
mov dword [ebp - 0x50], 0x44
push eax
push 0
push 0
push 0x8000000
push 0
xorps xmm0, xmm0
push 0
push 0
push ecx
push 0
movlpd qword [ebp - 0x4c], xmm0
movlpd qword [ebp - 0x44], xmm0
movlpd qword [ebp - 0x3c], xmm0
movlpd qword [ebp - 0x34], xmm0
movlpd qword [ebp - 0x2c], xmm0
movlpd qword [ebp - 0x24], xmm0
movlpd qword [ebp - 0x1c], xmm0
movlpd qword [ebp - 0x14], xmm0
movups xmmword [ebp - 0x60], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x409a95
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00422009
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
push dword [ebp - 0x60]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x60]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x409aba
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
push dword [ebp - 0x60]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x5c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 8]
xor ecx, ebp
call fcn.00422009
mov esp, ebp
pop ebp
ret
Function at 0x40a090
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x47b014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor bl, bl
mov dword [ebp - 0x18], edx
mov byte [ebp - 0xd], bl
test edx, edx
je 0x40a19d
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x40a18b
push edi
mov edi, dword [sym.imp.KERNEL32.dll_FindResourceW]
push 0x10
push 1
push esi
call edi
mov ebx, eax
test ebx, ebx
jne 0x40a0f8
push 0x10
push 0x64
push esi
call edi
mov ebx, eax
test ebx, ebx
jne 0x40a0f8
mov al, byte [ebp - 0xd]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00422009
mov esp, ebp
pop ebp
ret
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push ebx
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
push edi
push 0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push edi
push esi
push eax
mov dword [ebp - 0x14], eax
call fcn.00424db0
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov esi, dword [ebp - 0x14]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x4664b4
push esi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
mov eax, dword [ebp - 0xc]
mov ebx, dword [ebp - 0x18]
push esi
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov eax, ecx
shr eax, 0x10
mov dword [ebx], eax
movzx eax, cx
mov dword [ebx + 4], eax
mov eax, edx
shr eax, 0x10
mov dword [ebx + 8], eax
movzx eax, dx
mov dword [ebx + 0xc], eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00422009
mov esp, ebp
pop ebp
ret
pop esi
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00422009
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.00422009
mov esp, ebp
pop ebp
ret

Function at 0x40aca0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x47b014]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [ebp + 8], 0
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x14]
mov ecx, dword [ecx + 0x10]
je 0x40aceb
test ecx, ecx
je 0x40ad31
test eax, eax
je 0x40ad31
push 4
push eax
push 4
push 0
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00422009
mov esp, ebp
pop ebp
ret 0x18
test ecx, ecx
je 0x40ad31
test eax, eax
je 0x40ad31
push esi
lea esi, [ebp - 8]
mov dword [ebp - 8], 4
push esi
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
pop esi
test eax, eax
jne 0x40ad31
cmp dword [ebp - 0xc], 4
jne 0x40ad31
cmp dword [ebp - 8], 4
ja 0x40ad31
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00422009
mov esp, ebp
pop ebp
ret 0x18
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
call fcn.00422009
mov esp, ebp
pop ebp
ret 0x18
Function at 0x40b3f0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43de3d
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x47b014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x68], edi
push 0x3c
lea eax, [ebp - 0x58]
push 0
push eax
call fcn.00423950
add esp, 0xc
mov dword [ebp - 0x58], vtable.KWnd.0
cmp dword [0x481a5c], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x44], 0
jne 0x40b465
push 0x470c78
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
mov dword [0x481a5c], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 0
test esi, esi
jne 0x40b48c
call fcn.0040a8a0
mov ecx, dword [eax + 8]
mov esi, dword [ecx + 4]
mov dword [ebp + 8], esi
test esi, esi
jne 0x40b48c
xor eax, eax
jmp 0x40b5b8
mov ebx, dword [sym.imp.USER32.dll_GetWindowLongW]
push 0xfffffffffffffff0
push esi
mov dword [ebp - 0x20], esi
call ebx
test eax, 0x40000000
je 0x40b4c6
mov edi, dword [sym.imp.USER32.dll_GetParent]
push esi
call edi
xor esi, esi
test eax, eax
push 0xfffffffffffffff0
cmovne esi, eax
push esi
mov dword [ebp - 0x20], esi
call ebx
test eax, 0x40000000
jne 0x40b4a7
mov edi, dword [ebp - 0x68]
mov dword [ebp + 8], esi
test esi, esi
je 0x40b5b6
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp esi, eax
je 0x40b5b6
push esi
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x40b5b6
mov eax, dword [edi + 0x38]
lea ebx, [edi + 0x54]
mov dword [ebp - 0x60], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 0x64], esi
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x68], esi
cmp eax, dword [ebx + 8]
je 0x40b510
mov dword [eax], esi
add dword [ebx + 4], 4
jmp 0x40b51c
lea ecx, [ebp - 0x68]
push ecx
push eax
mov ecx, ebx
call fcn.0040bb60
lea eax, [ebp - 0x64]
push eax
push 0x40afe0
call dword [sym.imp.USER32.dll_EnumWindows]
mov edi, dword [ebx + 4]
sub edi, dword [ebx]
sar edi, 2
test edi, edi
je 0x40b5b6
mov esi, dword [ebp - 0x6c]
nop word [eax + eax]
mov eax, dword [esi]
dec edi
push 6
mov ebx, dword [eax + edi*4]
lea eax, [ebp - 0x1c]
push eax
push ebx
mov dword [ebp - 0x6c], ebx
call dword [sym.imp.USER32.dll_GetClassNameW]
cmp eax, 5
jne 0x40b5a4
cmp word [ebp - 0x1c], 0x5f
jne 0x40b5a4
cmp word [ebp - 0x1a], 0x6b
jne 0x40b5a4
cmp word [ebp - 0x18], 0x6c
jne 0x40b5a4
cmp word [ebp - 0x16], 0x69
jne 0x40b5a4
cmp word [ebp - 0x14], 0x62
jne 0x40b5a4
push 0xffffffffffffffeb
push ebx
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov ebx, eax
test ebx, ebx
je 0x40b5a1
push 0
push dword [ebx + 0x38]
call dword [sym.imp.USER32.dll_EnableWindow]
mov edx, dword [ebx]
mov ecx, ebx
call dword [edx + 0x14]
jmp 0x40b5ad
mov ebx, dword [ebp - 0x6c]
push 0
push ebx
call dword [sym.imp.USER32.dll_EnableWindow]
test edi, edi
jne 0x40b540
mov eax, dword [ebp + 8]
jmp 0x40b5b8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00422009
mov esp, ebp
pop ebp
ret 4
Function at 0x40d050
Capabilities:
Check mutex on windows
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x47b014]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
movzx eax, word [esi + 0x2a]
push eax
movzx eax, word [esi + 0x28]
push eax
push dword [esi + 0x24]
lea eax, [ebp - 0x804]
push 0x470f58
push 0x400
push eax
call fcn.004019b0
add esp, 0x18
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0x804]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 0x38], eax
test eax, eax
je 0x40d1cd
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40d0ce
push dword [esi + 0x38]
mov byte [esi + 0x34], 0
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
movzx eax, word [esi + 0x2a]
push eax
movzx eax, word [esi + 0x28]
push eax
push dword [esi + 0x24]
lea eax, [ebp - 0x804]
push str._KlibAppSharedNotifyEvent:__08X__04X__04X
push 0x400
push eax
call fcn.004019b0
add esp, 0x18
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0x804]
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x3c], eax
test eax, eax
je 0x40d1cd
movzx eax, word [esi + 0x2a]
push eax
movzx eax, word [esi + 0x28]
push eax
push dword [esi + 0x24]
lea eax, [ebp - 0x804]
push str._KlibAppSharedSwithedEvent:__08X__04X__04X
push 0x400
push eax
call fcn.004019b0
add esp, 0x18
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0x804]
push eax
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x40], eax
test eax, eax
je 0x40d1cd
movzx eax, word [esi + 0x2a]
push eax
movzx eax, word [esi + 0x28]
push eax
push dword [esi + 0x24]
lea eax, [ebp - 0x804]
push str._KlibAppSharedMemory:__08X__04X__04X
push 0x400
push eax
call fcn.004019b0
add esp, 0x18
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0x804]
push eax
push 0x20c
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [esi + 0x44], eax
test eax, eax
je 0x40d1cd
cmp byte [esi + 0x34], 0
je 0x40d1cd
lea eax, [ebp - 0x808]
push eax
push 0
push esi
push 0x40cf20
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x48], eax
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.00422009
mov esp, ebp
pop ebp
ret
Function at 0x40ed90
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x47b014]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x21
xor esi, esi
push 0x42
mov dword [ebp - 8], esi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
jne 0x40edca
pop edi
lea eax, [esi + 0xc]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00422009
mov esp, ebp
pop ebp
ret
mov edx, dword [0x481aa8]
lea eax, [ebp - 8]
push ebx
mov ebx, dword [sym.imp.WINMM.dll_timeGetTime]
push eax
mov ecx, dword [edx + 0x2c]
test ecx, ecx
je 0x40ee0e
call ecx
add esp, 4
test eax, eax
jne 0x40ee81
mov esi, 0xd
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [ebp - 4]
mov eax, esi
pop ebx
pop edi
xor ecx, ebp
pop esi
call fcn.00422009
mov esp, ebp
pop ebp
ret
mov eax, dword [edx + 0x4c]
push edi
call eax
add esp, 8
test eax, eax
jne 0x40ee81
push 2
push eax
push eax
push str.TosBtMng.exe
push eax
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jbe 0x40edef
call ebx
mov dword [ebp - 0xc], eax
nop word [eax + eax]
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 8]
push eax
mov eax, dword [0x481aa8]
push edi
mov eax, dword [eax + 0x4c]
call eax
add esp, 8
test eax, eax
mov eax, 0xd
cmove esi, eax
call ebx
sub eax, dword [ebp - 0xc]
cmp eax, 0x1388
jae 0x40ee79
test esi, esi
jne 0x40ee40
jmp 0x40ee81
test esi, esi
jne 0x40edf4
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [0x481aa8]
mov eax, dword [eax + 0x30]
call eax
add esp, 8
test eax, eax
je 0x40edef
test esi, esi
jne 0x40edf4
call ebx
mov dword [ebp - 0xc], eax
mov esi, 0xd
lea eax, [ebp - 8]
push eax
mov eax, dword [0x481aa8]
push edi
mov eax, dword [eax + 0x4c]
call eax
add esp, 8
test eax, eax
jne 0x40eee1
cmp dword [ebp - 8], 0xfffffffe
jne 0x40edef
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40eee3
xor esi, esi
call ebx
sub eax, dword [ebp - 0xc]
cmp eax, 0x1388
jae 0x40edf4
test esi, esi
jne 0x40eeb7
jmp 0x40edf4