joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4702b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x556039
mov eax, dword fs:[0]
push eax
sub esp, 0x220
mov eax, dword [0x5c5244]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x22c], esi
push 0
mov dword [ebp - 0x220], 0
push dword [ecx + 0x34]
push eax
call fcn.00470130
mov dword [ebp - 4], 1
lea eax, [ebp - 0x218]
push 0x208
push 0
push eax
call fcn.004f39e0
add esp, 0xc
mov dword [ebp - 0x228], 1
lea eax, [ebp - 0x224]
mov dword [ebp - 0x224], 0x208
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x228]
push eax
push str.repop_time_slot
push dword [ebp - 0x21c]
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x4703f3
call fcn.00430a50
mov ecx, eax
test ecx, ecx
je 0x470480
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov byte [ebp - 4], 2
lea eax, [ebp - 0x218]
push eax
mov ecx, esi
call fcn.0042d870
test al, al
jne 0x4703be
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4703a0
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.00429710
mov byte [ebp - 4], 1
mov dword [ebp - 0x220], 1
mov dword [ebp - 4], 0
or eax, 0xffffffff
mov edi, dword [ebp - 0x21c]
add edi, 0xfffffff0
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x470461
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
jmp 0x470461
call fcn.00430a50
mov ecx, eax
test ecx, ecx
je 0x47048a
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov byte [ebp - 4], 4
mov ecx, esi
push 0x56c9a8
call fcn.0042d870
test al, al
jne 0x47042e
push 0
push 0x56c9a8
mov ecx, esi
call fcn.00429710
mov byte [ebp - 4], 1
mov dword [ebp - 0x220], 1
mov dword [ebp - 4], 0
or eax, 0xffffffff
mov edx, dword [ebp - 0x21c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x470461
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004da3bd
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.004225f0
push 0x80004005
call fcn.004225f0
int3
Function at 0x471040
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
jne 0x47104c
pop ebp
ret
push esi
push edi
push eax
push 1
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
test esi, esi
je 0x47108d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x47107f
push esi
mov edi, 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebp
ret
Function at 0x4717b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x556288
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x5c5244]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x1c]
push 0
mov edi, 0x12c
mov dword [ebp - 0x10], 0
mov dword [ebx], 0x493e0
mov dword [ebx + 4], 0
push dword [eax + 0x34]
push ecx
mov ecx, eax
call fcn.00470130
mov dword [ebp - 4], 0
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x18], 4
push eax
lea eax, [ebp - 0x18]
mov dword [ebp + 8], 4
push eax
push str.auto_elapse
push dword [ebp - 0x1c]
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov ecx, dword [ebp - 0x10]
test ecx, ecx
jle 0x47185d
mov eax, ecx
cdq
mov dword [ebx], eax
mov eax, 0x10624dd3
mov dword [ebx + 4], edx
imul ecx
sar edx, 6
mov edi, edx
shr edi, 0x1f
add edi, edx
call fcn.00430a50
mov ecx, eax
test ecx, ecx
je 0x47198f
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp + 8], eax
mov byte [ebp - 4], 1
lea ecx, [ebp + 8]
push str.mininews.exe
call fcn.0042d870
test al, al
jne 0x47189b
push 0xc
push str.mininews.exe
lea ecx, [ebp + 8]
call fcn.00429710
mov byte [ebp - 4], 2
lea eax, [ebp + 8]
push eax
call fcn.004721c0
add esp, 4
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0
or esi, 0xffffffff
mov edx, dword [ebp + 8]
mov ecx, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x4718d2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x471944
mov ecx, dword [ebp - 0x14]
call fcn.0046f1b0
mov ecx, edx
mov dword [ebp + 8], eax
push ecx
push eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], ecx
push dword [eax + 0x34]
push str._mini_utils_from__d___elapseColseTime__d
push eax
call fcn.00473060
mov eax, edi
add esp, 0x14
cdq
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x18]
cmp eax, edx
jg 0x47197b
mov ecx, dword [ebp + 8]
jl 0x471913
cmp ecx, dword [ebp - 0x14]
jae 0x47197b
test eax, eax
jl 0x47197b
jg 0x47191d
test ecx, ecx
je 0x47197b
push 0
imul eax, edi, 0x3e8
push 0x3e8
push dword [ebp - 0x18]
push ecx
cdq
mov esi, eax
mov edi, edx
call fcn.004da930
sub esi, eax
mov dword [ebx], esi
sbb edi, edx
or esi, 0xffffffff
mov dword [ebx + 4], edi
xor edi, edi
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], esi
dec esi
test esi, esi
jg 0x471965
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [ebx], 0
mov edi, 1
mov dword [ebx + 4], 0
jmp 0x471946
push 0x80004005
call fcn.004225f0
int3
Function at 0x471b00
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x556368
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x5c5244]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 8]
mov ebx, 1
mov dword [ebp - 0x10], 0
test eax, eax
jne 0x471bab
push ebx
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.00470130
mov dword [ebp - 4], 0
lea ecx, [ebp + 8]
push ecx
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x14], 4
push ecx
lea ecx, [ebp - 0x14]
mov dword [ebp + 8], 4
push ecx
push str.lds_show
push dword [eax]
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
neg eax
sbb esi, esi
inc esi
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x18]
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x471d0f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x471d0f
cmp eax, 1
jne 0x471c77
push 0
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00470130
mov dword [ebp - 4], 2
lea ecx, [ebp + 8]
push ecx
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x18], 4
push ecx
lea ecx, [ebp - 0x18]
mov dword [ebp + 8], 4
push ecx
push str.show
push dword [eax]
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
neg eax
sbb edi, edi
inc edi
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x471c1a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test edi, edi
jne 0x471d13
push 1
push edi
lea eax, [ebp - 0x14]
mov ecx, esi
push eax
call fcn.00470130
mov dword [ebp - 4], 4
lea ecx, [ebp + 8]
push ecx
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x18], 4
push ecx
lea ecx, [ebp - 0x18]
mov dword [ebp + 8], 4
push ecx
push str.show
push dword [eax]
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
neg eax
sbb esi, esi
inc esi
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
jmp 0x471b8a
cmp eax, 2
jne 0x471ccf
push 0
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00470130
mov dword [ebp - 4], 6
lea ecx, [ebp + 8]
push ecx
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x18], 4
push ecx
lea ecx, [ebp - 0x18]
mov dword [ebp + 8], 4
push ecx
push str.lite_show
push dword [eax]
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
neg eax
sbb esi, esi
inc esi
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
jmp 0x471b8a
cmp eax, 3
jne 0x471d1b
push 0
push eax
lea eax, [ebp + 8]
push eax
call fcn.00470130
mov dword [ebp - 4], 8
lea ecx, [ebp - 0x10]
push ecx
push str.desktop_show
push dword [eax]
mov ecx, esi
push SysReAllocString
call fcn.00470230
mov esi, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00427700
test esi, esi
je 0x471d1b
xor ebx, ebx
cmp dword [ebp - 0x10], ebx
setne bl
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x471d40
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5563a0
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x5c5244]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x10]
push eax
call fcn.0046fd00
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
push dword [ebp - 0x10]
jne 0x471d8c
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x471d9f
push dword [ebp - 0x10]
call fcn.004cf4a0
add esp, 4
test eax, eax
je 0x471d9f
mov esi, 1
jmp 0x471da1
xor esi, esi
mov dword [ebp - 4], 0xffffffff
or ecx, 0xffffffff
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x471dc3
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4721c0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55649b
mov eax, dword fs:[0]
push eax
sub esp, 0x23c
mov eax, dword [0x5c5244]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x248], 0
mov dword [ebp - 0x244], 0
mov dword [ebp - 0x240], 0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x248]
push eax
push dword [ebp - 0x244]
call fcn.00469110
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
je 0x472270
push 0x228
lea eax, [ebp - 0x238]
push 0
push eax
call fcn.004f39e0
add esp, 0xc
mov dword [ebp - 0x23c], 0x22c
lea eax, [ebp - 0x23c]
push eax
push edi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x472274
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
jmp 0x4722d0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, eax
nop dword [eax]
cmp ebx, dword [ebp - 0x234]
je 0x4722b6
mov esi, dword [ebp - 0x248]
cmp esi, dword [ebp - 0x244]
je 0x4722b6
lea eax, [ebp - 0x218]
push eax
push dword [esi]
call fcn.0051070a
add esp, 8
test eax, eax
je 0x472300
add esi, 4
cmp esi, dword [ebp - 0x244]
jne 0x472296
lea eax, [ebp - 0x23c]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x472280
xor ebx, ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x248]
call fcn.0042efc0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004da3bd
mov esp, ebp
pop ebp
ret
mov ebx, 1
jmp 0x4722c9
Function at 0x472640
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5564e0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x5c5244]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
push 0
push esi
call fcn.00479d90
test esi, esi
mov esi, dword [sym.imp.USER32.dll_KillTimer]
jne 0x47271f
push 0
push dword [edi + 0x34]
lea eax, [ebp - 0x10]
mov dword [ebp + 8], 0
push eax
mov ecx, edi
call fcn.00470130
mov dword [ebp - 4], 0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp + 8]
mov dword [ebp - 0x18], 4
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 4
push eax
push str.auto_24_elapse
push dword [ebp - 0x10]
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov eax, dword [ebp + 8]
mov ecx, 0x5265c00
test eax, eax
cmovle eax, ecx
mov dword [ebp - 0x1c], eax
mov dword [ebp + 8], eax
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x472702
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0x17d5
push dword [edi + 4]
call esi
push 0
push dword [ebp - 0x1c]
push 0x17d5
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetTimer]
cmp dword [edi + 0x50], 0
mov eax, dword [edi + 4]
je 0x47274b
push str.Has_pop_second_times__will_NOT_pop_again.
push dword [edi + 0x48]
call fcn.00473060
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x19c8
push eax
mov dword [edi + 0x44], eax
call esi
push 0
lea ecx, [edi + 0x40]
call fcn.0046e920
push eax
push 0x19c8
push dword [edi + 0x44]
call dword [sym.imp.USER32.dll_SetTimer]
lea ecx, [edi + 0x40]
call fcn.0046e920
mov ecx, eax
mov eax, 0x10624dd3
mul ecx
shr edx, 6
push edx
push str.start_timer_to_check_repop__seconds_d
push dword [edi + 0x48]
call fcn.00473060
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4727b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55652d
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x5c5244]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x218]
push 0x208
push 0
mov dword [ebp - 0x220], esi
push eax
mov dword [ebp - 0x21c], 0
call fcn.004f39e0
add esp, 0xc
lea eax, [ebp - 0x218]
push 0
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.LudashiComputerZ.set
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
call fcn.00430a50
mov ecx, eax
test ecx, ecx
je 0x4728ae
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov dword [ebp - 4], 1
lea eax, [ebp - 0x218]
push eax
mov ecx, esi
call fcn.0042d870
test al, al
jne 0x47287f
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x472861
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.00429710
mov dword [ebp - 4], 0
mov dword [ebp - 0x21c], 1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004da3bd
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.004225f0
int3
Function at 0x4728c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5565ae
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x5c5244]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x218]
mov esi, dword [ebp + 0xc]
push 0x208
push 0
mov dword [ebp - 0x224], edi
push eax
mov dword [ebp - 0x220], 0
call fcn.004f39e0
add esp, 0xc
lea eax, [ebp - 0x218]
push 0
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.Ludashi_apk
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push eax
call fcn.004941a0
add esp, 4
call fcn.00430a50
mov ecx, eax
test ecx, ecx
je 0x472a3d
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x21c], eax
mov dword [ebp - 4], 2
lea eax, [ebp - 0x21c]
push dword [esi]
push str.mobiledevicesrvcache__s.dat
push eax
call fcn.0042de00
mov esi, dword [ebp - 0x21c]
lea eax, [ebp - 0x218]
add esp, 0xc
push esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
call fcn.00430a50
mov ecx, eax
test ecx, ecx
je 0x472a47
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov byte [ebp - 4], 3
lea eax, [ebp - 0x218]
push eax
mov ecx, edi
call fcn.0042d870
test al, al
jne 0x4729f1
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4729d3
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
mov ecx, edi
call fcn.00429710
mov byte [ebp - 4], 2
mov dword [ebp - 0x220], 1
mov dword [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x472a1e
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004da3bd
mov esp, ebp
pop ebp
ret 8
push 0x80004005
call fcn.004225f0
push 0x80004005
call fcn.004225f0
int3
Function at 0x473060
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x556731
mov eax, dword fs:[0]
push eax
sub esp, 0x408
mov eax, dword [0x5c5244]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x30], 0
je 0x47319b
push 0x400
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.004f39e0
add esp, 0xc
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 0xc]
lea eax, [ebp - 0x410]
push 0x1ff
push eax
call fcn.00423cd0
mov ecx, dword [eax]
push dword [eax + 4]
or ecx, 1
push ecx
call fcn.0050fc55
or edi, 0xffffffff
add esp, 0x1c
test eax, eax
cmovs eax, edi
test eax, eax
js 0x4730f0
cmp eax, 0x1ff
ja 0x4730f0
jne 0x4730f6
xor eax, eax
mov word [ebp - 0x12], ax
call fcn.00430a50
mov ecx, eax
test ecx, ecx
je 0x4731b6
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x414], eax
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x414]
push 0x57561c
call fcn.0042d870
test al, al
jne 0x473140
push 0xd
push 0x57561c
lea ecx, [ebp - 0x414]
call fcn.00429710
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x410]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x473150
sub ecx, edx
lea eax, [ebp - 0x410]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x414]
call fcn.0042d7c0
mov esi, dword [ebp - 0x414]
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], edi
dec edi
test edi, edi
jg 0x47319b
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004da3bd
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.004225f0
int3
Function at 0x476b90
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0xc
add eax, 0xfffffc18
push edi
mov edi, ecx
cmp eax, 8
ja case.default.0x476bab
push esi
jmp dword [eax*4 + 0x476dac]
call fcn.004778a0
pop esi
pop edi
mov esp, ebp
pop ebp
ret 4
call fcn.00477120
pop esi
pop edi
mov esp, ebp
pop ebp
ret 4
push 0
call fcn.00471590
test eax, eax
je 0x476bed
push 0x3eb
push dword [edi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
pop esi
pop edi
mov esp, ebp
pop ebp
ret 4
mov ecx, edi
call fcn.004774c0
pop esi
pop edi
mov esp, ebp
pop ebp
ret 4
push ebx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, eax
push esi
call ebx
push eax
push str.__tid:_d__OnTimerAutoShutdown_hForeWnd:0x_08x
call fcn.00492250
mov eax, dword [edi + 0x1a4]
add esp, 0xc
test esi, esi
jne 0x476c76
cmp eax, 0xffffffff
jne 0x476c31
mov dword [edi + 0x1a4], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [edi + 0x1a0]
cmp eax, 0xbb8
jbe 0x476cab
cmp dword [edi + 0x1a4], 0xffffffff
jne 0x476cab
push 0x3ee
push dword [edi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
call ebx
push eax
push str.__tid:_d__EnterLockWindow_failed
call fcn.00492250
add esp, 8
pop ebx
pop esi
pop edi
mov esp, ebp
pop ebp
ret 4
test eax, eax
jne 0x476c31
push 0x3ee
push dword [edi + 4]
mov dword [edi + 0x1a4], 1
call dword [sym.imp.USER32.dll_KillTimer]
call ebx
push eax
push str.__tid:_d__Unlock_StopTimerAutoShutdown
call fcn.00492250
add esp, 8
pop ebx
pop esi
pop edi
mov esp, ebp
pop ebp
ret 4
call esi
sub eax, dword [edi + 0x1a0]
cmp eax, dword [edi + 0x19c]
jbe 0x476c6d
push 0x3ee
push dword [edi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
push dword [edi + 0x1a4]
call ebx
push eax
push str.__tid:_d__MySystemShutdown_LockWindowState:_d
call fcn.00492250
add esp, 0xc
cmp dword [edi + 0x1a4], 0
jne 0x476c6d
call fcn.004986d0
pop ebx
pop esi
pop edi
mov esp, ebp
pop ebp
ret 4
call fcn.00433100
test eax, eax
je case.0x476bab.1002
push 0x3ef
push dword [edi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
push 0
xorps xmm0, xmm0
mov dword [ebp - 0xc], 0xfa1
push str.ComputerZMonitorMainWnd
movlpd qword [ebp - 8], xmm0
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je case.0x476bab.1002
push 0
push 0xbb8
push 2
lea eax, [ebp - 0xc]
push eax
push dword [edi + 4]
push 0x4a
push esi
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
pop esi
pop edi
mov esp, ebp
pop ebp
ret 4
push str._boot__come_in_OnTimerBootMonitor
call fcn.00492250
add esp, 4
push 0x3f0
push dword [edi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
call fcn.00497650
test eax, eax
je case.0x476bab.1002
push str._boot__OnTimerBootMonitor::ProcessBootMonitor
call fcn.00492250
add esp, 4
lea ecx, [edi + 0x2d0]
push 1
call fcn.00430380
pop esi
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x479310
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x28]
test eax, eax
je 0x479342
push 0
push dword [eax + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esi + 0x28]
call fcn.004ac260
mov ecx, dword [esi + 0x28]
test ecx, ecx
je 0x479342
mov eax, dword [ecx]
push 1
call dword [eax + 4]
mov dword [esi + 0x28], 0
push 0
push 0
push 1
push 0
push str.trayquit
call fcn.00430130
mov ecx, eax
call fcn.004cfd30
push str._boot__Quit::ProcessBootMonitor
call fcn.00492250
add esp, 4
lea ecx, [esi + 0x2d0]
push 0
call fcn.00430380
call fcn.0042df90
mov ecx, eax
call fcn.0044a770
test eax, eax
je 0x47939b
push 0
mov ecx, eax
call fcn.00446160
push eax
call fcn.0046f370
mov ecx, eax
call fcn.0042e9b0
push 0
push 0
push 0x10
push dword [esi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
pop esi
ret