joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b3340
Capabilities:
Get file version info

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
lea eax, [esp + 0xc]
push eax
xor ebx, ebx
push ebp
mov dword [esp + 0x14], ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
cmp esi, ebx
je 0x4b33ff
xor ecx, ecx
mov edx, 2
mul edx
seto cl
push edi
neg ecx
or ecx, eax
push ecx
call fcn.00548a37
push esi
mov edi, eax
push ebx
push edi
call fcn.005695a0
mov eax, dword [esp + 0x20]
add esp, 0x10
push edi
push esi
push eax
push ebp
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x4b33f5
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x18]
push edx
push 0x5aeb10
xor esi, esi
push edi
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4b33f5
mov eax, dword [esp + 0x14]
cmp eax, esi
je 0x4b33f5
movzx ecx, word [eax + 0xc]
movzx edx, word [eax + 0xe]
mov edi, dword [esp + 0x24]
push ecx
movzx ecx, word [eax + 8]
push edx
movzx edx, word [eax + 0xa]
push ecx
push edx
push str._d._d._d._d
call fcn.00481690
add esp, 0x14
pop edi
pop esi
pop ebp
lea eax, [ebx + 1]
pop ebx
add esp, 0xc
ret
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0xc
ret
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0xc
ret
Function at 0x4b3410
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x58dfb0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5eb3c0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x30]
mov eax, dword [0x5f7780]
mov edx, dword [eax + 0xc]
mov ecx, 0x5f7780
call edx
add eax, 0x10
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x34]
lea edx, [esp + 0x1c]
mov dword [esp + 0x28], 0
mov ecx, dword [eax]
push edx
call fcn.00474220
mov byte [esp + 0x28], 1
mov eax, dword [eax]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x18]
push edx
mov ecx, eax
mov dword [esp + 0x20], str.301_302
call fcn.004b3560
add esp, 8
test eax, eax
mov byte [esp + 0x28], 0
mov eax, dword [esp + 0x1c]
setne bl
add eax, 0xfffffff0
or edi, 0xffffffff
lea ecx, [eax + 0xc]
mov edx, edi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4b34b8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
je 0x4b34f3
mov dword [esp + 0x28], edi
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edi
dec edi
test edi, edi
jg 0x4b34dd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
mov eax, dword [esp + 0x14]
cmp dword [eax - 0xc], 0
jne 0x4b3503
mov dword [esp + 0x28], edi
jmp 0x4b34c4
mov ecx, dword [ebp]
call fcn.004b4630
lea esi, [esp + 0x14]
mov eax, ebp
call fcn.00533f60
mov dword [esp + 0x28], edi
test eax, eax
mov eax, dword [esp + 0x14]
je 0x4b34c4
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edi
dec edi
test edi, edi
jg 0x4b353b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x4b3c40
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x58af70
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebp
push esi
push edi
mov eax, dword [0x5eb3c0]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov eax, dword [0x5f7780]
mov edx, dword [eax + 0xc]
mov ecx, 0x5f7780
mov dword [esp + 0x18], 0
call edx
add eax, 0x10
mov dword [esp + 0x10], eax
xor esi, esi
mov dword [esp + 0x24], 0
mov dword [esp + 0x14], esi
mov byte [esp + 0x24], 1
mov eax, dword [0x5f8cb8]
push eax
push str.SoftwareKingsoftKVip_d
lea edi, [esp + 0x18]
call fcn.00481690
mov edi, dword [esp + 0x18]
add esp, 8
lea ecx, [esp + 0x14]
push ecx
push 1
push esi
push edi
push SysReAllocStringLen
mov dword [esp + 0x28], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4b3cf7
mov esi, dword [esp + 0x14]
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x18]
push ecx
push 0
push str.Proxy_Mode
push esi
mov dword [esp + 0x2c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test esi, esi
mov ebp, dword [esp + 0x18]
je 0x4b3d06
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [edi - 0x10]
mov dword [esp + 0x24], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4b3d2a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, ebp
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x18
ret
Function at 0x4b3d40
Capabilities:
Get proxy

Disassembly:
push 0xffffffffffffffff
push 0x58af26
mov eax, dword fs:[0]
push eax
sub esp, 0x42c
mov eax, dword [0x5eb3c0]
xor eax, esp
mov dword [esp + 0x428], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5eb3c0]
xor eax, esp
push eax
lea eax, [esp + 0x440]
mov dword fs:[0], eax
mov eax, dword [esp + 0x450]
xor esi, esi
mov ebx, edx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], ecx
xor ebp, ebp
mov dword [esp + 0x20], esi
mov dword [esp + 0x14], 0x104
push 0x206
lea edx, [esp + 0x32]
push ebp
mov dword [esp + 0x450], ebp
push edx
mov word [esp + 0x38], bp
call fcn.005695a0
push 0x206
lea eax, [esp + 0x246]
push ebp
push eax
mov word [esp + 0x24c], bp
call fcn.005695a0
add esp, 0x18
call fcn.004b3f40
test eax, eax
je 0x4b3f11
lea ecx, [esp + 0x18]
push ecx
push 1
push ebp
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push SysReAllocStringLen
mov dword [esp + 0x2c], ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebp
jne 0x4b3f11
mov edx, dword [esp + 0x18]
push str.ProxyServer
lea eax, [esp + 0x28]
push eax
lea edi, [esp + 0x1c]
lea esi, [esp + 0x34]
mov dword [esp + 0x2c], edx
call fcn.004817c0
cmp eax, ebp
jne 0x4b3efe
cmp word [esp + 0x2c], bp
je 0x4b3efe
mov ecx, esi
push 0x104
push ecx
call fcn.005638d3
mov edx, esi
push str.socks
push edx
mov dword [ebx], 2
call fcn.0056685f
add esp, 0x10
cmp eax, ebp
je 0x4b3e77
add eax, 0xc
lea esi, [esp + 0x234]
mov dword [ebx], 3
call fcn.004b3fc0
jmp 0x4b3ebe
lea eax, [esp + 0x2c]
push str.http
push eax
call fcn.0056685f
add esp, 8
cmp eax, ebp
mov dword [ebx], 2
je 0x4b3ea4
add eax, 0xa
lea esi, [esp + 0x234]
call fcn.004b3fc0
jmp 0x4b3ebe
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x238]
push 0x104
push edx
call fcn.0056362b
add esp, 0xc
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x238]
call fcn.00481430
mov ecx, dword [esp + 0x1c]
mov esi, dword [esp + 0x28]
push ecx
mov ecx, esi
lea ebx, [esp + 0x18]
mov byte [esp + 0x44c], 1
call fcn.004b3fe0
mov ecx, ebx
call fcn.004818c0
mov edx, dword [esi]
cmp dword [edx - 0xc], ebp
mov esi, 1
jne 0x4b3f02
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
cmp eax, ebp
je 0x4b3f11
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [esp + 0x440]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x428]
xor ecx, esp
call fcn.00564207
add esp, 0x438
ret 4
Function at 0x4b3f40
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
push ebp
push esi
push edi
lea eax, [esp + 0xc]
push eax
push 1
xor esi, esi
push esi
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push SysReAllocStringLen
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jne 0x4b3fa8
mov esi, dword [esp + 0xc]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x20]
push eax
push 0
push str.ProxyEnable
push esi
mov dword [esp + 0x2c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test esi, esi
je 0x4b3fa8
push esi
call ebp
xor esi, esi
test esi, esi
mov edi, dword [esp + 0x10]
je 0x4b3fb3
push esi
call ebp
mov eax, edi
pop edi
pop esi
pop ebp
add esp, 0x10
ret

Function at 0x4b40f0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x58aec0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push edi
mov eax, dword [0x5eb3c0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov eax, dword [0x5f7780]
mov edx, dword [eax + 0xc]
mov ecx, 0x5f7780
mov dword [esp + 0x14], 0x50
call edx
add eax, 0x10
mov dword [esp + 0xc], eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x10], 0
mov byte [esp + 0x20], 1
mov eax, dword [0x5f8cb8]
push eax
push str.SoftwareKingsoftKVip_d
lea edi, [esp + 0x14]
call fcn.00481690
mov ebx, dword [esp + 0x14]
add esp, 8
lea ecx, [esp + 0x10]
push ecx
push 1
push 0
push ebx
push SysReAllocStringLen
mov dword [esp + 0x24], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4b41cd
mov edi, dword [esp + 0x10]
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x18]
push ecx
push 0
push str.Proxy_Port
push edi
mov dword [esp + 0x24], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4b41c2
cmp dword [esp + 0x10], 4
jne 0x4b41c2
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x28]
mov dword [eax], edx
test edi, edi
je 0x4b41cd
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebx - 0x10]
mov dword [esp + 0x20], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4b41f1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0x18
ret 4
Function at 0x4b4210
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x58ae76
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x5eb3c0]
xor eax, esp
mov dword [esp + 0x218], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5eb3c0]
xor eax, esp
push eax
lea eax, [esp + 0x230]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x240]
xor ebx, ebx
push 0x206
lea eax, [esp + 0x2a]
push ebx
push eax
mov dword [esp + 0x2c], 0x104
mov word [esp + 0x30], bx
call fcn.005695a0
mov edx, dword [0x5f7780]
mov eax, dword [edx + 0xc]
add esp, 0xc
mov ecx, 0x5f7780
call eax
add eax, 0x10
mov dword [esp + 0x18], eax
mov dword [esp + 0x238], ebx
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x238], 1
mov ecx, dword [0x5f8cb8]
push ecx
push str.SoftwareKingsoftKVip_d
lea edi, [esp + 0x20]
call fcn.00481690
mov eax, dword [esp + 0x20]
add esp, 8
lea edx, [esp + 0x14]
push edx
push 1
push ebx
push eax
push SysReAllocStringLen
mov dword [esp + 0x28], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x4b4311
mov ecx, dword [esp + 0x14]
push str.Proxy_Host
lea edx, [esp + 0x20]
push edx
lea edi, [esp + 0x28]
lea esi, [esp + 0x2c]
mov dword [esp + 0x24], ecx
call fcn.004817c0
cmp eax, ebx
jne 0x4b4302
mov edx, esi
mov edi, ebp
call fcn.00481720
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x4b4311
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x238], 0xffffffff
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4b433c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x230]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.00564207
add esp, 0x228
ret 4
Function at 0x4b4370
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x58ae26
mov eax, dword fs:[0]
push eax
sub esp, 0x434
mov eax, dword [0x5eb3c0]
xor eax, esp
mov dword [esp + 0x430], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5eb3c0]
xor eax, esp
push eax
lea eax, [esp + 0x448]
mov dword fs:[0], eax
mov eax, dword [esp + 0x458]
xor ebx, ebx
push 0x206
lea edx, [esp + 0x3a]
push ebx
push edx
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
mov dword [esp + 0x24], ebx
mov word [esp + 0x40], bx
call fcn.005695a0
push 0x206
lea eax, [esp + 0x24e]
push ebx
push eax
mov word [esp + 0x254], bx
call fcn.005695a0
mov edx, dword [0x5f7780]
mov eax, dword [edx + 0xc]
add esp, 0x18
mov ecx, 0x5f7780
call eax
add eax, 0x10
mov dword [esp + 0x20], eax
xor ebp, ebp
mov dword [esp + 0x450], ebx
mov dword [esp + 0x1c], ebp
mov byte [esp + 0x450], 1
mov ecx, dword [0x5f8cb8]
push ecx
push str.SoftwareKingsoftKVip_d
lea edi, [esp + 0x28]
call fcn.00481690
mov eax, dword [esp + 0x28]
add esp, 8
lea edx, [esp + 0x14]
push edx
push 1
push ebx
push eax
push SysReAllocStringLen
mov dword [esp + 0x28], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x4b44ec
mov ebp, dword [esp + 0x14]
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x38]
push eax
push ebx
push str.Proxy_Authorization
push ebp
mov dword [esp + 0x34], ebp
mov dword [esp + 0x3c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [esp + 0x18], ebx
je 0x4b44ec
push str.Proxy_User
lea ecx, [esp + 0x20]
push ecx
lea edi, [esp + 0x1c]
lea esi, [esp + 0x3c]
mov dword [esp + 0x1c], 0x104
call fcn.004817c0
test eax, eax
jne 0x4b44bb
mov edi, dword [esp + 0x28]
mov edx, esi
call fcn.00481720
push str.Proxy_Password
lea edx, [esp + 0x20]
push edx
lea edi, [esp + 0x1c]
lea esi, [esp + 0x244]
mov dword [esp + 0x1c], 0x104
call fcn.004817c0
cmp eax, ebx
jne 0x4b44ec
mov edi, dword [esp + 0x2c]
mov edx, esi
call fcn.00481720
cmp ebp, ebx
mov esi, dword [esp + 0x18]
je 0x4b44fb
push ebp
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x450], 0xffffffff
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4b4526
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x448]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x430]
xor ecx, esp
call fcn.00564207
add esp, 0x440
ret 4
Function at 0x4b5d50
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5946f8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x5eb3c0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
lea eax, [esp + 8]
push eax
mov ecx, 0x5aead8
call fcn.00481430
push 1
lea ecx, [esp + 0xc]
mov dword [esp + 0x34], 0
mov edx, dword [esp + 0x40]
push ecx
push edx
lea eax, [esp + 0x18]
push eax
call fcn.0047b540
mov dword [esp + 0x30], 0xffffffff
mov eax, dword [esp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4b5dc8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x38]
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0x10]
add ecx, 0x1c
push eax
mov dword [esp + 0x44], ecx
call fcn.004b5e00
lea eax, [esp + 0xc]
call fcn.004679a0
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
add esp, 0x30
ret 8
Function at 0x4b6e70
Capabilities:
Terminate thread

Disassembly:
push 0xffffffffffffffff
push 0x58ad38
mov eax, dword fs:[0]
push eax
push ebp
push esi
push edi
mov eax, dword [0x5eb3c0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, dword [esp + 0x20]
mov dword [esi], vtable.KSpeedDlg.0
mov dword [esi + method.KSlideAnimateWnd_class_KSpeedDlg_.virtual_0], vtable.KSpeedDlg.1.0
mov dword [esi + method.CBkImageSkin.virtual_36], vtable.KSpeedDlg.2.0
mov dword [esp + 0x18], 0
mov eax, dword [esi + 0x3e0]
test eax, eax
mov ebp, dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
je 0x4b6ef0
push 0x64
push eax
call edi
cmp eax, 0x102
jne 0x4b6ef0
mov eax, dword [esi + 0x3e0]
push 0
push eax
call ebp
mov dword [esi + 0x3e0], 0
mov eax, dword [esi + 0x3e4]
test eax, eax
je 0x4b6f1b
push 0x64
push eax
call edi
cmp eax, 0x102
jne 0x4b6f1b
mov ecx, dword [esi + 0x3e4]
push 0
push ecx
call ebp
mov dword [esi + 0x3e4], 0
mov eax, dword [0x5f8b74]
test eax, eax
je 0x4b6f39
mov edx, dword [eax]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [0x5f8b74]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x60]
push eax
call edx
mov ecx, esi
mov dword [esp + 0x18], 0xffffffff
call fcn.00529a80
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0xc
ret 4
Function at 0x4b6f60
Capabilities:
Create thread
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x596898
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
mov eax, dword [0x5eb3c0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
lea esi, [esp + 0x10]
call fcn.004b6300
xor eax, eax
mov dword [esp + 0x30], eax
mov esi, dword [sym.imp.USER32.dll_LoadIconW]
push 1
push 0x400000
mov dword [edi + 0x3ec], eax
call esi
push eax
mov eax, dword [edi + 4]
push 1
lea ebx, [edi + 4]
push 0x80
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 1
push 0x400000
call esi
mov ecx, dword [ebx]
push eax
push 0
push 0x80
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [esp + 0x10]
call fcn.004b8620
test eax, eax
push 0x5ae3fc
lea esi, [edi + 0x50]
push 0xca
mov dword [edi + 0x3cc], eax
push esi
mov ecx, str.speed_switch_on
jne 0x4b7009
mov ecx, str.speed_switch_off
call fcn.004b7f20
lea eax, [esp + 0x10]
call fcn.004b85b0
test eax, eax
push 0x5ae3fc
push 0xcb
mov dword [edi + 0x3d0], eax
push esi
mov ecx, str.speed_switch_on
jne 0x4b7036
mov ecx, str.speed_switch_off
call fcn.004b7f20
mov edx, dword [ebx]
push 0
push 0x96
push 2
push edx
call dword [sym.imp.USER32.dll_SetTimer]
mov esi, edi
call fcn.004b70d0
mov eax, dword [ebx]
push 0
push 0
push eax
push 0x4b71a0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 0x3e0], eax
push ebx
xor eax, eax
call fcn.0044bbb0
mov dword [esp + 0x30], 0xffffffff
mov eax, dword [esp + 0x20]
test eax, eax
je 0x4b7097
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x20], 0
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4b70b7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4b70d0
Capabilities:
Get memory capacity

Disassembly:
push 0xffffffffffffffff
push 0x596868
mov eax, dword fs:[0]
push eax
sub esp, 0x48
push edi
mov eax, dword [0x5eb3c0]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov eax, dword [0x5f7780]
mov edx, dword [eax + 0xc]
mov ecx, 0x5f7780
call edx
add eax, 0x10
mov dword [esp + 8], eax
push 0x3c
lea eax, [esp + 0x14]
push 0
push eax
mov dword [esp + 0x64], 0
call fcn.005695a0
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
mov dword [esp + 0x10], 0x40
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov edx, dword [esp + 0x10]
push edx
push str._d__
lea edi, [esp + 0x10]
call fcn.00481690
mov eax, dword [esp + 0x18]
mov edi, dword [esp + 0x10]
add esp, 8
mov dword [esi + 0x3d4], eax
push edi
lea eax, [esi + 0x50]
mov ecx, 0x6a
call fcn.004b7e90
lea eax, [edi - 0x10]
mov dword [esp + 0x58], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4b718c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
add esp, 0x54
ret
Function at 0x4b7350
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x58ad11
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x5eb3c0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov eax, dword [esp + 0x34]
mov esi, dword [esp + 0x30]
xor ebx, ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x10], ebx
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0x14], ecx
mov ecx, eax
and eax, 0x7fffffff
mov dword [esp + 0x18], eax
fild qword [esp + 0x14]
and ecx, 0x80000000
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], ebx
fild qword [esp + 0x14]
lea edx, [esp + 0x34]
push edx
mov ecx, str.BDMS
fchs
faddp st(1)
fstp qword [esp + 0x18]
call fcn.00481430
mov edi, 1
mov dword [esp + 0x28], edi
mov eax, dword [0x5f7780]
mov edx, dword [eax + 0xc]
mov ecx, 0x5f7780
call edx
add eax, 0x10
mov dword [esi], eax
fld qword [esp + 0x14]
fcom qword [0x5bdf88]
mov dword [esp + 0x10], edi
fnstsw ax
test ah, 0x41
jne 0x4b746a
fmul qword [0x5bdf80]
push 0x5b5558
lea ebx, [edi + 1]
lea eax, [esp + 0x38]
fstp qword [esp + 0x18]
call fcn.00480ff0
fld qword [esp + 0x14]
fcom qword [0x5bdf88]
fnstsw ax
test ah, 0x41
jne 0x4b7468
fmul qword [0x5bdf80]
mov edx, 0x5b5560
lea edi, [esp + 0x34]
fstp qword [esp + 0x14]
call fcn.00481720
fld qword [esp + 0x14]
fcom qword [0x5bdf88]
fnstsw ax
test ah, 0x41
jne 0x4b7468
fmul qword [0x5bdf80]
mov edx, 0x5b5568
fstp qword [esp + 0x14]
call fcn.00481720
fld qword [esp + 0x14]
xor ebx, ebx
mov eax, dword [esp + 0x34]
push eax
sub esp, 8
fstp qword [esp]
push str._.2f_s
mov edi, esi
call fcn.00481690
mov byte [esp + 0x38], bl
mov eax, dword [esp + 0x44]
add eax, 0xfffffff0
add esp, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4b74a8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret 8

Function at 0x4b7780
Capabilities:
Create thread

Disassembly:
cmp dword [esi + 0x3dc], 0
je 0x4b781c
mov eax, dword [esi + 4]
push edi
push 2
push eax
call dword [sym.imp.USER32.dll_KillTimer]
lea edi, [esi + 0x50]
push 0
mov ecx, 0x69
mov eax, edi
call fcn.004b65c0
push 0
mov ecx, 0x66
mov eax, edi
call fcn.004b65c0
push 0
mov ecx, 0x6c
mov eax, edi
call fcn.004b65c0
cmp dword [esi + 0x3d8], 0
jle 0x4b7808
push 1
mov ecx, 0x67
mov eax, edi
call fcn.004b65c0
push 1
mov ecx, 0x68
mov eax, edi
call fcn.004b65c0
push 0
push 0
push esi
push 0x4b7820
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x3e0], eax
pop edi
ret
mov ecx, dword [esi + 4]
push 0
push 0
push 0x465
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
ret