joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46b220
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5c4b5c
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x63727c]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
call fcn.00543a2f
lea ecx, [esi + 0x54]
mov dword [esp + 0x20], 0
mov dword [esi], vtable.CPreviewClientWnd.0
call fcn.004694a0
lea ecx, [esi + 0x6c]
mov byte [esp + 0x20], 1
call fcn.00469500
lea eax, [esp + 0xa]
push eax
lea edx, [esp + 0xf]
lea ecx, [esi + 0x8c]
push edx
mov byte [esp + 0x28], 2
mov dword [esi + 0x84], 0
mov dword [esi + 0x88], 0
call fcn.004682f0
lea eax, [esp + 0x10]
push eax
mov ecx, esi
mov byte [esp + 0x24], 3
call fcn.00468a80
push str.FRPreview.exe
push eax
lea ecx, [esp + 0x14]
push ecx
mov byte [esp + 0x2c], 4
call fcn.00467350
add esp, 0xc
mov eax, dword [eax]
push eax
push 0x5d5a94
push str._wmpplay_
push str.FRPreviewCtrl
mov ecx, esi
mov byte [esp + 0x30], 5
call fcn.0046aff0
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x20], 4
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x46b30c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov byte [esp + 0x20], 3
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x46b331
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x1c
ret

Function at 0x46b590
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x440], 0
je 0x46b5cf
push edi
call fcn.00483f50
mov edi, eax
test edi, edi
je 0x46b5ce
mov eax, dword [esi + 0x440]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esi + 0x440]
push 0
push 0
push 0x522c
push ecx
mov ecx, edi
call sub.USER32.dll_SendMessageW
pop edi
pop esi
ret

Function at 0x46bad0
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x440], 0
je 0x46bb34
push edi
call fcn.00483f50
mov edi, eax
test edi, edi
je 0x46bb0e
mov eax, dword [esi + 0x440]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esi + 0x440]
push 0
push 0
push 0x522c
push ecx
mov ecx, edi
call sub.USER32.dll_SendMessageW
cmp dword [esi + 0x440], 0
pop edi
je 0x46bb34
call fcn.00483f50
test eax, eax
je 0x46bb34
mov ecx, dword [esi + 0x440]
mov edx, dword [eax]
mov edx, dword [edx + 0x140]
push ecx
mov ecx, eax
call edx
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esi + 0x3f0]
test eax, eax
je 0x46bb5d
lea ecx, [eax + 4]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
call edx
mov dword [esi + 0x3f0], 0
mov ecx, esi
pop esi
jmp dword [sym.imp.soui.dll_protected:_void___thiscall_SOUI::SHostWnd::OnDestroy_void_]
Function at 0x46ca20
Capabilities:
Hide graphical window

Disassembly:
push 0xffffffffffffffff
push 0x5c4d1b
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebp
push esi
push edi
mov eax, dword [0x63727c]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x440], 0
je 0x46ca82
call fcn.00483f50
mov edi, eax
test edi, edi
je 0x46ca82
mov eax, dword [esi + 0x440]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esi + 0x440]
push 0
push 0
push 0x522c
push ecx
mov ecx, edi
call sub.USER32.dll_SendMessageW
mov edx, dword [esp + 0x28]
push edx
mov ecx, 0x6318a8
call fcn.0046f410
mov edi, eax
mov dword [esp + 0x14], edi
mov eax, dword [edi]
mov edx, dword [eax + 4]
mov ecx, edi
mov dword [esp + 0x20], 0
call edx
lea ebp, [esi + 0x400]
test eax, eax
jne 0x46cab6
xor ecx, ecx
jmp 0x46cad1
mov ecx, eax
lea edx, [ecx + 2]
mov dword [esp + 0x10], edx
nop
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x46cac0
sub ecx, dword [esp + 0x10]
sar ecx, 1
push ecx
push eax
mov ecx, ebp
call fcn.00403dd0
mov eax, dword [ebp]
mov eax, dword [eax - 0xc]
test eax, eax
je 0x46cb84
call fcn.0053fed4
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x46cb02
push 0x80004005
call fcn.00401020
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0x404]
mov ecx, dword [eax + 0x10]
sub ecx, dword [eax + 0xc]
mov edx, dword [esi + 0x408]
mov eax, dword [ebp]
sar ecx, 2
push ecx
inc edx
push edx
push eax
lea ecx, [esp + 0x1c]
push str.____s___d__d_
push ecx
mov byte [esp + 0x34], 1
call fcn.004096d0
add esp, 0x14
push 0xffffffffffffffff
push 0x5d5250
lea ecx, [esi + 4]
call dword [sym.imp.soui.dll_public:_class_SOUI::SWindow____thiscall_SOUI::SWindow::FindChildByName_wchar_t_const___int_]
mov edx, dword [eax]
mov ebp, dword [esp + 0x10]
mov ecx, eax
mov eax, dword [edx + 0x40]
push ebp
call eax
lea eax, [ebp - 0x10]
mov byte [esp + 0x20], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x46cb84
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [edi]
mov eax, dword [edx + 0xc]
mov ecx, edi
call eax
push 2
mov ecx, esi
mov dword [esi + 0x3e4], 1
call dword [sym.imp.soui.dll_public:_int___thiscall_SOUI::SHostWnd::KillTimer_unsigned_int_]
push 0x1f4
push 2
mov ecx, esi
call dword [sym.imp.soui.dll_public:_unsigned_int___thiscall_SOUI::SHostWnd::SetTimer_unsigned_int__unsigned_int_]
push 0x48
call fcn.0053e4de
add esp, 4
mov dword [esp + 0x10], eax
mov byte [esp + 0x20], 2
test eax, eax
je 0x46cbd0
mov ecx, eax
call fcn.0046c640
jmp 0x46cbd2
xor eax, eax
mov ecx, dword [esp + 0x28]
mov dword [eax + 0x38], ecx
mov ecx, dword [esi + 0x248]
mov dword [eax + 0x30], ecx
push eax
lea ecx, [esi + 0x3d4]
mov byte [esp + 0x24], 0
mov dword [eax + 0x34], 0x2340
call fcn.00401c20
mov edx, dword [edi]
mov eax, dword [edx]
mov ecx, edi
mov dword [esp + 0x20], 0xffffffff
call eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x14
ret 4
Function at 0x46df40
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, dword [esp + 8]
mov ecx, esi
call dword [sym.imp.soui.dll_public:_void__const___thiscall_SOUI::SRealWnd::GetData_void_]
test eax, eax
je 0x46df6a
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 4]
push 1
call eax
push 0
mov ecx, esi
call dword [sym.imp.soui.dll_public:_void___thiscall_SOUI::SRealWnd::SetData_void__]
pop esi
ret 4
push edi
mov edi, dword [sym.imp.soui.dll_public:_struct_HWND____const___thiscall_SOUI::SRealWnd::GetRealHwnd_int_]
push 0
push 0
mov ecx, esi
call edi
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0
mov ecx, esi
call edi
push eax
call dword [sym.imp.USER32.dll_SetParent]
pop edi
pop esi
ret 4

Function at 0x471420
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x5c5178
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x63727c]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
lea ebp, [esi + 0x3d0]
push ebp
mov dword [esp + 0x18], ebp
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [esi + 0x400]
add edi, dword [esp + 0x2c]
mov ebx, dword [esi + 0x404]
adc ebx, dword [esp + 0x30]
mov dword [esp + 0x24], 0
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov eax, 0x10624dd3
mul ecx
shr edx, 6
push 0
push edx
lea ecx, [esi + 0x460]
call fcn.00482e50
mov eax, dword [esi + 0x3f0]
mov ecx, dword [esi + 0x3f4]
mov edx, eax
or edx, ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ecx
jne 0x4714ce
mov edx, dword [esi + 0x3e8]
or edx, dword [esi + 0x3ec]
jne 0x4714ce
push ebp
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
jmp 0x471598
or eax, ecx
push 0
push 0x64
jne 0x471505
mov eax, dword [esi + 0x3fc]
mov ecx, dword [esi + 0x3f8]
push eax
push ecx
call fcn.00588bf0
mov ecx, dword [esi + 0x3ec]
push ecx
mov ecx, dword [esi + 0x3e8]
push ecx
push edx
push eax
call fcn.00589550
mov esi, eax
jmp 0x47158f
mov eax, dword [esi + 0x3e8]
mov ecx, dword [esi + 0x3ec]
mov dword [esp + 0x34], eax
or eax, ecx
mov dword [esp + 0x38], ecx
jne 0x471539
push ebx
push edi
call fcn.00588bf0
mov ecx, dword [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x18]
push ecx
push edx
push eax
call fcn.00589550
mov esi, eax
jmp 0x47158f
mov edx, dword [esi + 0x3fc]
mov eax, dword [esi + 0x3f8]
push edx
push eax
call fcn.00588bf0
mov ecx, dword [esp + 0x30]
push ecx
mov ecx, dword [esp + 0x30]
push ecx
push edx
push eax
call fcn.00589550
push 0
push 0x64
mov esi, eax
push ebx
mov eax, edx
push edi
mov dword [esp + 0x3c], eax
call fcn.00588bf0
mov ecx, dword [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x18]
push ecx
push edx
push eax
call fcn.00589550
add esi, eax
mov eax, dword [esp + 0x2c]
adc eax, edx
shrd esi, eax, 1
shr eax, 1
push ebp
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 8
Function at 0x472470
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x5c51d8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x63727c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
call fcn.0053fed4
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4724ae
push 0x80004005
call fcn.00401020
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 8], eax
mov ecx, dword [esi + 0x450]
push ecx
lea edx, [esp + 0xc]
push str.__e__select__s
push edx
mov dword [esp + 0x20], 0
call fcn.004096d0
mov esi, dword [esp + 0x14]
add esp, 0xc
push 1
push 0
push esi
push str.explorer.exe
push 0x5d6108
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea eax, [esi - 0x10]
mov dword [esp + 0x14], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x47251e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x474a20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5c5538
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x63727c]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0x10]
call dword [sym.imp.utilities.dll_public:_void___thiscall_SOUI::TStringT_wchar_t__struct_SOUI::wchar_traits_::constructor_void_]
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
push ecx
lea ecx, [esp + 0x14]
mov dword [esp + 0x24], 0
mov dword [esp + 0x10], eax
call dword [sym.imp.utilities.dll_public:_class_SOUI::TStringT_wchar_t__struct_SOUI::wchar_traits_____thiscall_SOUI::TStringT_wchar_t__struct_SOUI::wchar_traits_::operator_wchar_t_const__]
mov edx, dword [esp + 0x30]
lea edi, [esi + 0x3d0]
push edi
mov dword [esp + 0x18], edx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [esp + 0xc]
push eax
lea ecx, [esi + 0x3b0]
call fcn.00474040
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 0xffffffff
call dword [sym.imp.utilities.dll_public:_void___thiscall_SOUI::TStringT_wchar_t__struct_SOUI::wchar_traits_::destructor_void_]
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x18
ret 0xc
Function at 0x478270
Capabilities:
Check if file exists
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x5c5990
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebp
push esi
push edi
mov eax, dword [0x63727c]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0x10], 0
call fcn.0053fed4
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4782ba
push 0x80004005
call fcn.00401020
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [esp + 0x10], esi
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, 0x104
or eax, ecx
mov dword [esp + 0x20], 0
jge 0x4782f8
push 0x104
lea ecx, [esp + 0x14]
call fcn.00403200
mov esi, dword [esp + 0x10]
mov ecx, dword [edi + 0x248]
push 1
push 0x1a
push esi
push ecx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov eax, dword [esi - 8]
push eax
push esi
call fcn.00588bcb
add esp, 8
test eax, eax
jl 0x4783e9
cmp eax, dword [esi - 8]
jg 0x4783e9
push 0x13
xor edx, edx
mov dword [esi - 0xc], eax
push str.GlarysoftUndelete
lea ecx, [esp + 0x18]
mov word [esi + eax*2], dx
call fcn.00409450
mov ebp, dword [esp + 0x10]
push ebp
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x47835e
mov eax, dword [edi + 0x248]
push ebp
push eax
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
push str.History.dat
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x1c]
push edx
call fcn.00467350
add esp, 0xc
mov eax, dword [eax]
mov esi, dword [esp + 0x28]
push eax
mov ecx, esi
mov byte [esp + 0x24], 1
call dword [sym.imp.utilities.dll_public:_void___thiscall_SOUI::TStringT_wchar_t__struct_SOUI::wchar_traits_::constructor_wchar_t_const__]
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x20], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4783ae
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [ebp - 0x10]
mov dword [esp + 0x20], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4783d2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x14
ret 4
push 0x80070057
call fcn.00401020
int3
Function at 0x47a330
Capabilities:
Print debug messages

Disassembly:
mov eax, dword [esp + 4]
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
push ebx
push eax
call dword [sym.imp.soui.dll_public:_class_SOUI::SWindow____thiscall_SOUI::SWindow::FindChildByName_wchar_t_const___int_]
mov esi, eax
test esi, esi
je 0x47a365
mov edi, dword [esi]
call dword [sym.imp.soui.dll_public:_static_wchar_t_const____cdecl_SOUI::SComboBox::GetClassNameW_void_]
mov edx, dword [edi + 4]
push eax
mov ecx, esi
call edx
test eax, eax
je 0x47a365
pop edi
mov eax, esi
pop esi
pop ebx
ret 8
push ebp
call dword [sym.imp.soui.dll_public:_static_class_SOUI::SApplication____cdecl_SOUI::SSingleton_class_SOUI::SApplication_::getSingletonPtr_void_]
test eax, eax
je 0x47a382
call dword [sym.imp.soui.dll_public:_static_class_SOUI::SApplication____cdecl_SOUI::SSingleton_class_SOUI::SApplication_::getSingleton_void_]
mov ecx, eax
call dword [sym.imp.soui.dll_public:_struct_SOUI::ILog4zManager____thiscall_SOUI::SApplication::GetLogManager_void_]
mov ebp, eax
jmp 0x47a384
xor ebp, ebp
push 0x2800
call fcn.00584b20
push 0x5000
mov edi, eax
call fcn.00584b20
add esp, 8
mov esi, eax
mov eax, dword [esp + 0x14]
push ebx
push eax
call dword [sym.imp.soui.dll_public:_static_wchar_t_const____cdecl_SOUI::SComboBox::GetClassNameW_void_]
push eax
push str.FindChildByName2_Failed__no_window_of_class___s__with_name_of___s__was_found_within___d__levels
push 0xffffffffffffffff
push 0x2800
push esi
call fcn.0058495c
mov ebx, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
add esp, 0x1c
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push esi
push 0
push 0
call ebx
cmp eax, 0x2800
jae 0x47a3ee
push 0
push 0
push eax
push edi
push 0xffffffffffffffff
push esi
push 0
push 0
call ebx
push esi
call fcn.005847fc
add esp, 4
test ebp, ebp
je 0x47a447
mov edx, dword [ebp]
mov eax, dword [edx + 0x2c]
push 1
push 0
mov ecx, ebp
call eax
test al, al
je 0x47a447
mov eax, dword [esp + 0x10]
mov edx, dword [ebp]
mov edx, dword [edx + 0x34]
push eax
push str.SOUI::SWindow::FindChildByName2
push 0x20e
push str.d:winappsdr_trunk_thirdparty_soui_master_souiincludecoreSWnd.h
push edi
push str.soui
push 1
push 0
mov ecx, ebp
call edx
push edi
call fcn.005847fc
add esp, 4
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
ret 8
push 0x2800
call fcn.00584b20
push 0x20e
push str.d:winappsdr_trunk_thirdparty_soui_master_souiincludecoreSWnd.h
push str.SOUI::SWindow::FindChildByName2
push edi
push str._s__s__s:_d_n
push 0xffffffffffffffff
mov esi, eax
push 0x2800
push esi
call fcn.00584720
add esp, 0x24
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push esi
call fcn.005847fc
add esp, 4
push edi
call fcn.005847fc
add esp, 4
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
ret 8
Function at 0x47a4a0
Capabilities:
Print debug messages

Disassembly:
mov eax, dword [esp + 4]
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
push ebx
push eax
call dword [sym.imp.soui.dll_public:_class_SOUI::SWindow____thiscall_SOUI::SWindow::FindChildByName_wchar_t_const___int_]
mov esi, eax
test esi, esi
je 0x47a4d5
mov edi, dword [esi]
call dword [sym.imp.soui.dll_public:_static_wchar_t_const____cdecl_SOUI::SListBox::GetClassNameW_void_]
mov edx, dword [edi + 4]
push eax
mov ecx, esi
call edx
test eax, eax
je 0x47a4d5
pop edi
mov eax, esi
pop esi
pop ebx
ret 8
push ebp
call dword [sym.imp.soui.dll_public:_static_class_SOUI::SApplication____cdecl_SOUI::SSingleton_class_SOUI::SApplication_::getSingletonPtr_void_]
test eax, eax
je 0x47a4f2
call dword [sym.imp.soui.dll_public:_static_class_SOUI::SApplication____cdecl_SOUI::SSingleton_class_SOUI::SApplication_::getSingleton_void_]
mov ecx, eax
call dword [sym.imp.soui.dll_public:_struct_SOUI::ILog4zManager____thiscall_SOUI::SApplication::GetLogManager_void_]
mov ebp, eax
jmp 0x47a4f4
xor ebp, ebp
push 0x2800
call fcn.00584b20
push 0x5000
mov edi, eax
call fcn.00584b20
add esp, 8
mov esi, eax
mov eax, dword [esp + 0x14]
push ebx
push eax
call dword [sym.imp.soui.dll_public:_static_wchar_t_const____cdecl_SOUI::SListBox::GetClassNameW_void_]
push eax
push str.FindChildByName2_Failed__no_window_of_class___s__with_name_of___s__was_found_within___d__levels
push 0xffffffffffffffff
push 0x2800
push esi
call fcn.0058495c
mov ebx, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
add esp, 0x1c
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push esi
push 0
push 0
call ebx
cmp eax, 0x2800
jae 0x47a55e
push 0
push 0
push eax
push edi
push 0xffffffffffffffff
push esi
push 0
push 0
call ebx
push esi
call fcn.005847fc
add esp, 4
test ebp, ebp
je 0x47a5b7
mov edx, dword [ebp]
mov eax, dword [edx + 0x2c]
push 1
push 0
mov ecx, ebp
call eax
test al, al
je 0x47a5b7
mov eax, dword [esp + 0x10]
mov edx, dword [ebp]
mov edx, dword [edx + 0x34]
push eax
push str.SOUI::SWindow::FindChildByName2
push 0x20e
push str.d:winappsdr_trunk_thirdparty_soui_master_souiincludecoreSWnd.h
push edi
push str.soui
push 1
push 0
mov ecx, ebp
call edx
push edi
call fcn.005847fc
add esp, 4
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
ret 8
push 0x2800
call fcn.00584b20
push 0x20e
push str.d:winappsdr_trunk_thirdparty_soui_master_souiincludecoreSWnd.h
push str.SOUI::SWindow::FindChildByName2
push edi
push str._s__s__s:_d_n
push 0xffffffffffffffff
mov esi, eax
push 0x2800
push esi
call fcn.00584720
add esp, 0x24
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push esi
call fcn.005847fc
add esp, 4
push edi
call fcn.005847fc
add esp, 4
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
ret 8
Function at 0x47f0a0
Capabilities:
Get storage device properties

Disassembly:
sub esp, 0x14
mov eax, dword [0x63727c]
xor eax, esp
mov dword [esp + 0x10], eax
push esi
push edi
mov edi, dword [esp + 0x20]
push 0x70
mov dword [esp + 0x10], 7
mov dword [esp + 0x14], 0
mov byte [esp + 0x18], 0
call fcn.0053e518
push 0x70
mov esi, eax
push 0
push esi
call fcn.00585e50
add esp, 0x10
push 0
lea eax, [esp + 0xc]
push eax
push 0x70
push esi
push 0xc
lea ecx, [esp + 0x20]
push ecx
push 0x2d1400
push edi
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x47f134
cmp dword [esp + 8], 0xc
jb 0x47f134
movzx edi, byte [esi + 8]
push esi
call fcn.0053e523
add esp, 4
xor eax, eax
test edi, edi
pop edi
sete al
pop esi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.00584267
add esp, 0x14
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call fcn.0053e523
mov ecx, dword [esp + 0x1c]
add esp, 4
pop edi
pop esi
xor ecx, esp
or eax, 0xffffffff
call fcn.00584267
add esp, 0x14
ret

Function at 0x47f9f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5c61f3
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x63727c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 8], 0
mov esi, dword [esp + 0x28]
cmp esi, eax
jne 0x47fa4a
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x1c]
push eax
mov ecx, esi
call dword [sym.imp.utilities.dll_public:_void___thiscall_SOUI::TStringT_char__struct_SOUI::char_traits_::constructor_class_SOUI::TStringT_char__struct_SOUI::char_traits__const__]
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
mov ecx, dword [esp + 0x20]
push 0
push eax
push ecx
lea edx, [esp + 0x34]
push edx
call sym.FileRecovery.exe_public:_static_class_SOUI::TStringT_wchar_t__struct_SOUI::wchar_traits____cdecl_SOUI::CStrCpCvt::CvtA2W_class_SOUI::TStringT_char__struct_SOUI::char_traits__const___unsigned_int__unsigned_int_
push esi
mov esi, dword [esp + 0x30]
lea eax, [esp + 0x3c]
push eax
push esi
mov dword [esp + 0x30], 1
call sym.FileRecovery.exe_public:_static_class_SOUI::TStringT_char__struct_SOUI::char_traits____cdecl_SOUI::CStrCpCvt::CvtW2A_class_SOUI::TStringT_wchar_t__struct_SOUI::wchar_traits__const___unsigned_int_
add esp, 0x1c
lea ecx, [esp + 0x28]
mov dword [esp + 8], 1
mov byte [esp + 0x14], 0
call dword [sym.imp.utilities.dll_public:_void___thiscall_SOUI::TStringT_wchar_t__struct_SOUI::wchar_traits_::destructor_void_]
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret