joyce8/EMBER2024-capa huggingface dataset:
Function at 0x426bb0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x49f026
mov eax, dword fs:[0]
push eax
sub esp, 0x240
mov eax, dword [0x4d6720]
xor eax, esp
mov dword [esp + 0x23c], eax
push ebp
push esi
push edi
mov eax, dword [0x4d6720]
xor eax, esp
push eax
lea eax, [esp + 0x250]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x264]
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x14], 0
call fcn.00424310
add esp, 4
lea ecx, [esp + 0x30]
mov dword [esp + 0x258], 0
call fcn.00420260
lea ecx, [esp + 0x30]
push ecx
mov byte [esp + 0x25c], 1
call fcn.00424410
add esp, 4
test ebp, ebp
je 0x426c3a
mov dword [ebp], 0
mov eax, dword [esp + 0x260]
mov ecx, dword [esp + 0x24]
neg eax
sbb eax, eax
lea edx, [esp + 0x14]
push edx
and eax, 0x20006
or eax, 0x20019
push eax
push 0
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x426d5e
mov edi, dword [esp + 0x3c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push eax
push eax
lea edx, [esp + 0x24]
push edx
push eax
mov eax, dword [esp + 0x24]
push edi
push eax
call esi
test eax, eax
jne 0x426d3f
cmp dword [esp + 0x1c], 1
jne 0x426d51
xor ecx, ecx
lea edx, [esp + 0x28]
push edx
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x48]
push eax
mov word [esp + 0x4c], cx
lea ecx, [esp + 0x24]
push ecx
push 0
push edi
push edx
mov dword [esp + 0x40], 0x104
call esi
test eax, eax
jne 0x426d3f
lea eax, [esp + 0x44]
push eax
call fcn.00483e9a
xor ecx, ecx
add esp, 4
test eax, eax
setne cl
mov dword [esp + 0x10], ecx
test ebp, ebp
je 0x426d51
lea edx, [esp + 0x2c]
push edx
mov edx, dword [esp + 0x44]
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x28]
push ecx
push 0
push edx
mov edi, 4
push eax
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0x38], 0
mov dword [esp + 0x44], edi
call esi
test eax, eax
jne 0x426d51
cmp dword [esp + 0x20], edi
jne 0x426d51
cmp dword [esp + 0x18], 1
jne 0x426d51
mov ecx, dword [esp + 0x14]
push ecx
mov dword [ebp], 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x426d70
cmp eax, 2
je 0x426d51
cmp eax, 3
je 0x426d51
mov dword [esp + 0x10], 0xffffffff
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x426d70
cmp eax, 2
je 0x426d70
cmp eax, 3
je 0x426d70
mov dword [esp + 0x10], 0xffffffff
lea ecx, [esp + 0x30]
call fcn.00420310
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
mov dword [esp + 0x258], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x426da4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x250]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x23c]
xor ecx, esp
call fcn.00482b5f
add esp, 0x24c
ret
Function at 0x427820
Capabilities:
Get geographical location

Disassembly:
push 0xffffffffffffffff
push 0x49f10b
mov eax, dword fs:[0]
push eax
sub esp, 0x198
mov eax, dword [0x4d6720]
xor eax, esp
mov dword [esp + 0x194], eax
push ebx
push esi
push edi
mov eax, dword [0x4d6720]
xor eax, esp
push eax
lea eax, [esp + 0x1a8]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c0]
mov edi, dword [esp + 0x1b8]
xor ebx, ebx
cmp esi, ebx
jne 0x427876
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
mov esi, eax
cmp esi, dword [0x4d7da4]
je 0x427987
call fcn.00468b49
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x42789c
push 0x80004005
call fcn.00401210
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x10], eax
movzx eax, si
sub eax, 0x407
mov dword [esp + 0x1b0], ebx
je 0x427924
sub eax, 2
je 0x427909
push 0x18e
lea edx, [esp + 0x1a]
xor ecx, ecx
push ebx
push edx
mov word [esp + 0x20], cx
call fcn.00482db0
mov ecx, dword [esp + 0x1c8]
add esp, 0xc
neg ecx
sbb ecx, ecx
push 0xc8
lea eax, [esp + 0x18]
and ecx, 0xfe4
push eax
add ecx, 0x1f
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
lea edx, [esp + 0x14]
push edx
jmp 0x427939
lea ecx, [esp + 0x10]
cmp dword [esp + 0x1bc], ebx
jne 0x42791d
push str.M_d_yyyy
jmp 0x42793d
push str.h:mm:ss_X
jmp 0x42793d
cmp dword [esp + 0x1bc], ebx
jne 0x427934
push str.dd.MM.yyyy
jmp 0x427939
push 0x4abc00
lea ecx, [esp + 0x14]
call fcn.00401d90
mov esi, dword [esp + 0x10]
cmp dword [esi - 0xc], ebx
je 0x42795e
mov eax, dword [edi + 0x20]
push esi
push ebx
push 0x1032
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ebx, eax
lea eax, [esi - 0x10]
mov dword [esp + 0x1b0], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42798c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x42798c
mov ebx, 1
mov eax, ebx
mov ecx, dword [esp + 0x1a8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x194]
xor ecx, esp
call fcn.00482b5f
add esp, 0x1a4
ret
Function at 0x4279c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x4c9140
push 0x483470
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x4d6720]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
xor esi, esi
mov dword [ebp - 0x34], esi
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x28]
push ecx
push esi
push 0x20019
push esi
push esi
push esi
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x427af2
mov dword [ebp - 0x20], esi
lea ecx, [ebp - 0x20]
push ecx
lea edx, [ebp - 0x19]
push edx
lea eax, [ebp - 0x24]
push eax
push esi
mov edi, dword [ebp + 0x10]
push edi
mov ecx, dword [ebp - 0x28]
push ecx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
call ebx
cmp eax, 0xea
jne 0x427ae8
mov eax, dword [ebp - 0x24]
cmp eax, 1
je 0x427a5b
cmp eax, 2
jne 0x427ae8
mov dword [ebp - 0x30], esi
mov dword [ebp - 4], esi
mov edx, dword [ebp - 0x20]
add edx, 2
push edx
call fcn.0046083a
add esp, 4
mov esi, eax
mov dword [ebp - 0x30], esi
xor eax, eax
mov ecx, dword [ebp - 0x20]
mov word [esi + ecx], ax
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x2c], edx
lea eax, [ebp - 0x2c]
push eax
push esi
lea ecx, [ebp - 0x24]
push ecx
push 0
push edi
mov edx, dword [ebp - 0x28]
push edx
call ebx
test eax, eax
jne 0x427abf
mov eax, dword [ebp - 0x24]
cmp eax, 1
je 0x427aa7
cmp eax, 2
jne 0x427abf
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x20]
jne 0x427abf
push esi
mov ecx, dword [ebp + 0x14]
call fcn.00401d90
mov dword [ebp - 0x34], 1
mov dword [ebp - 4], 0xfffffffe
jmp 0x427adb
test esi, esi
je 0x427ae8
push esi
call fcn.0046082f
add esp, 4
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42aae0
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x418
mov eax, dword [0x4d6720]
xor eax, esp
mov dword [esp + 0x414], eax
push ebx
push ebp
mov ebp, dword [esp + 0x424]
push edi
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x1a]
push ecx
mov dword [esp + 0x18], 0
mov word [esp + 0x1c], ax
call fcn.00482db0
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x22e]
push eax
mov word [esp + 0x230], dx
call fcn.00482db0
mov edi, dword [esp + 0x444]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
add esp, 0x18
push 0x103
lea ecx, [esp + 0x14]
push ecx
push 0x1001
push edi
call ebx
test eax, eax
je 0x42ac6f
push esi
lea eax, [esp + 0x21c]
lea esi, [esp + 0x14]
mov ecx, eax
mov edx, 0x104
sub esi, ecx
lea esp, [esp]
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x42aba0
movzx ecx, word [esi + eax]
test cx, cx
je 0x42aba0
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x42ab80
jmp 0x42aba4
test edx, edx
jne 0x42aba7
sub eax, 2
xor edx, edx
push 0x103
mov word [eax], dx
lea eax, [esp + 0x18]
push eax
push 0x1002
push edi
call ebx
pop esi
test eax, eax
je 0x42ac6f
lea eax, [esp + 0x10]
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x42abd0
sub eax, edx
sar eax, 1
je 0x42ac0f
push 0x4ac090
push 0x104
lea ecx, [esp + 0x220]
push ecx
call fcn.00405fd0
lea edx, [esp + 0x10]
push edx
push 0x104
lea eax, [esp + 0x220]
push eax
call fcn.00405fd0
push 0x103
lea ecx, [esp + 0x14]
push ecx
push 0x1004
push edi
call ebx
test eax, eax
je 0x42ac6f
lea eax, [esp + 0x10]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x42ac30
sub eax, edx
sar eax, 1
je 0x42ac6f
push 0x4ac08c
push 0x104
lea edx, [esp + 0x220]
push edx
call fcn.00405fd0
lea eax, [esp + 0x10]
push eax
push 0x104
lea ecx, [esp + 0x220]
push ecx
call fcn.00405fd0
lea edx, [esp + 0x218]
push edx
mov ecx, ebp
call fcn.00403c10
mov ecx, dword [esp + 0x420]
pop edi
mov eax, ebp
pop ebp
pop ebx
xor ecx, esp
call fcn.00482b5f
add esp, 0x418
ret
Function at 0x42b440
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x49f78b
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
mov eax, dword [0x4d6720]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov dword [esp + 0x30], 0
mov dword [esp + 0xc], 0
call fcn.00468b49
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x42b48f
push 0x80004005
call fcn.00401210
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
mov esi, dword [esp + 0x38]
add eax, 0x10
mov dword [esi], eax
cmp dword [esp + 0x44], 0
mov eax, dword [esp + 0x3c]
mov ebx, 1
mov dword [esp + 0x30], 0
mov dword [esp + 0xc], ebx
jne 0x42b51b
cmp eax, 5
ja case.default.0x42b524
jmp dword [eax*4 + 0x42b6d8]
cmp dword [0x4d7df4], 0
mov eax, str.Sleep_mode
jne 0x42b4e0
mov eax, str.Stand_by_mode
push eax
jmp 0x42b6bb
push str.Hibernation
jmp 0x42b6bb
push 0x4ac2b8
jmp 0x42b6bb
cmp dword [esp + 0x40], 0
mov eax, 0x4ac2a0
jne 0x42b50b
mov eax, 0x4a7664
push eax
jmp 0x42b6bb
push 0x4ac290
jmp 0x42b6bb
cmp eax, 5
ja case.default.0x42b524
jmp dword [eax*4 + 0x42b6f0]
mov ecx, dword [0x4d7df4]
neg ecx
sbb ecx, ecx
push ebx
add ecx, 0x16c
push ecx
lea edx, [esp + 0x18]
push edx
call fcn.00401dd0
add esp, 0xc
push eax
mov ecx, esi
mov dword [esp + 0x34], ebx
call fcn.00401a50
lea ecx, [esp + 0x10]
call fcn.0041f860
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x28
ret
push ebx
lea eax, [esp + 0x18]
push 0x16d
push eax
call fcn.00401dd0
add esp, 0xc
push eax
mov ecx, esi
mov dword [esp + 0x34], 2
call fcn.00401a50
lea ecx, [esp + 0x14]
call fcn.0041f860
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x28
ret
push ebx
lea ecx, [esp + 0x1c]
push 0x16e
push ecx
call fcn.00401dd0
add esp, 0xc
push eax
mov ecx, esi
mov dword [esp + 0x34], 3
call fcn.00401a50
lea ecx, [esp + 0x18]
call fcn.0041f860
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x28
ret
cmp dword [esp + 0x40], 0
je 0x42b61c
push ebx
lea edx, [esp + 0x24]
push 0x16f
push edx
call fcn.00401dd0
add esp, 0xc
mov dword [esp + 0x30], 4
mov ebx, 3
jmp 0x42b637
push 0x4a7664
lea ecx, [esp + 0x20]
call fcn.00403c10
mov dword [esp + 0x30], 5
mov ebx, 5
push eax
mov ecx, esi
mov dword [esp + 0x10], ebx
call fcn.00401a50
test bl, 4
je 0x42b654
lea ecx, [esp + 0x1c]
and ebx, 0xfffffffb
call fcn.0041f860
test bl, 2
je 0x42b6c2
lea ecx, [esp + 0x20]
call fcn.0041f860
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x28
ret
push ebx
lea eax, [esp + 0x28]
push 0x170
push eax
call fcn.00401dd0
add esp, 0xc
push eax
mov ecx, esi
mov dword [esp + 0x34], 6
call fcn.00401a50
lea ecx, [esp + 0x24]
call fcn.0041f860
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x28
ret
push 0x4a801c
mov ecx, esi
call fcn.00401d90
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x28
ret
Function at 0x433b40
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x4a0310
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4d6720]
xor eax, esp
push eax
lea eax, [esp + 0x4c]
mov dword fs:[0], eax
xor esi, esi
push esi
push esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x34], esi
call fcn.00426bb0
add esp, 8
cmp eax, esi
jne 0x433b96
lea eax, [esi + 1]
mov ecx, dword [esp + 0x4c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x44
ret
lea ecx, [esp + 0x38]
call fcn.00420260
lea eax, [esp + 0x38]
push eax
mov dword [esp + 0x58], esi
call fcn.00424410
lea ecx, [esp + 0x2c]
push ecx
call fcn.00424310
add esp, 8
mov eax, dword [esp + 0x28]
push esi
lea edx, [esp + 0x18]
push edx
push esi
push 0x2001f
push esi
push esi
push esi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [esp + 0x78], 1
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, esi
jne 0x433cd4
mov ebp, dword [esp + 0x48]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [esp + 0x30]
push ecx
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x24]
push eax
push esi
push ebp
mov edi, 4
push ecx
mov dword [esp + 0x38], 0xffffffff
mov dword [esp + 0x34], esi
mov dword [esp + 0x48], edi
call ebx
test eax, eax
jne 0x433cbf
cmp dword [esp + 0x1c], edi
jne 0x433cbf
cmp dword [esp + 0x20], 1
jne 0x433cbf
mov edi, dword [esp + 0x40]
mov edx, dword [esp + 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push edi
push edx
call esi
mov eax, dword [esp + 0x14]
push ebp
push eax
call esi
push 0x4aef14
lea ecx, [esp + 0x28]
call fcn.00403c10
mov eax, dword [esp + 0x24]
mov ecx, dword [eax - 0xc]
mov edx, dword [esp + 0x44]
lea ecx, [ecx + ecx + 2]
push ecx
push eax
mov eax, dword [esp + 0x1c]
mov esi, 1
push esi
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x433ca7
mov edx, dword [esp + 0x14]
push eax
push eax
lea ecx, [esp + 0x3c]
push ecx
push eax
push edi
push edx
call ebx
test eax, eax
je 0x433ca7
mov dword [esp + 0x18], esi
mov dword [esp + 0x2c], esi
lea ecx, [esp + 0x24]
call fcn.0041f860
mov eax, dword [esp + 0x14]
push eax
xor esi, esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x433cdc
mov eax, dword [esp + 0x14]
push eax
mov dword [esp + 0x1c], 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x433cdc
mov dword [esp + 0x18], 1
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
mov byte [esp + 0x54], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x433d01
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x38]
mov dword [esp + 0x54], 0xffffffff
call fcn.00420310
mov edi, dword [esp + 0x18]
cmp edi, esi
je 0x433d29
cmp dword [esp + 0x2c], esi
je 0x433d3a
push esi
push str.Removed_WOSB_from_Windows_auto_logon
push esi
jmp 0x433d32
push 0x7d
push 0x4aee70
push 4
call fcn.0042fc90
add esp, 0xc
mov eax, edi
mov ecx, dword [esp + 0x4c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x44
ret
Function at 0x434790
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x49de80
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x4d6720]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
push str.http:__www.dennisbabkin.com_php_dwnld_fdbk.php_whatinfonameWakeupOnStandByver1.7.20.3
lea ecx, [esp + 0xc]
call fcn.00403c10
lea eax, [esp + 8]
push eax
mov dword [esp + 0x1c], 0
call fcn.0042d7a0
push 1
lea ecx, [esp + 0x14]
push 0x187
push ecx
call fcn.00401dd0
mov eax, dword [eax]
mov edx, dword [esp + 0x18]
push eax
push edx
mov byte [esp + 0x30], 1
call fcn.00433d50
mov esi, eax
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
add esp, 0x18
mov byte [esp + 0x18], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x434821
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 8]
add eax, 0xfffffff0
mov dword [esp + 0x18], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x434849
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x14
ret
Function at 0x436040
Capabilities:
Create thread
Resume thread

Disassembly:
push ecx
mov edx, dword [0x4d888c]
mov eax, dword [0x4d8888]
push ebx
push esi
xor ecx, ecx
push edi
mov edi, dword [esp + 0x14]
test edx, edx
jle 0x436078
mov esi, dword [edi]
add eax, 8
mov edi, edi
cmp dword [eax + 4], esi
jne 0x436070
mov ebx, dword [eax]
cmp ebx, dword [edi + 0xc]
je 0x436122
inc ecx
add eax, 0x10
cmp ecx, edx
jl 0x436060
lea eax, [esp + 0xc]
push eax
push 4
push edi
push 0x434570
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x436104
mov ecx, dword [esp + 0xc]
mov edx, dword [edi]
mov ebx, dword [edi + 0xc]
mov edi, dword [0x4d888c]
sub esp, 0x10
mov eax, esp
mov dword [eax], esi
mov dword [eax + 4], ecx
mov dword [eax + 8], ebx
push edi
mov ecx, 0x4d8884
mov dword [eax + 0xc], edx
call fcn.0041d210
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 1
jne 0x4360d0
pop edi
pop esi
pop ebx
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CWakeOnStandbyApp::_beginShell_NotifyThread_RAW.ResumeThread
push 3
call fcn.0042fc90
add esp, 0xc
push 1
push edi
mov ecx, 0x4d8884
or ebx, 0xffffffff
call fcn.0041cd70
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CWakeOnStandbyApp::_beginShell_NotifyThread_RAW.CreateThread
push 3
call fcn.0042fc90
add esp, 0xc
or eax, 0xffffffff
pop edi
pop esi
pop ebx
pop ecx
ret
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret

Function at 0x436310
Capabilities:
Create thread

Disassembly:
push ecx
push esi
mov ecx, 0x4d7d50
or esi, 0xffffffff
call fcn.0040c8f0
test eax, eax
je 0x436370
mov eax, dword [esp + 0xc]
push eax
push 0
call fcn.0041c970
mov ecx, dword [0x4d889c]
add esp, 8
push ecx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea edx, [esp + 4]
push edx
push 0
push 0
push 0x434860
push 0
push 0
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x4d8898], eax
test eax, eax
je 0x436375
mov eax, 1
pop esi
pop ecx
ret
xor eax, eax
pop esi
pop ecx
ret
mov eax, esi
pop esi
pop ecx
ret
Function at 0x439480
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x20
cmp dword [esp + 0x24], 0
je 0x43956c
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, dword [esp + 0x38]
mov ebp, dword [sym.imp.USER32.dll_MsgWaitForMultipleObjectsEx]
mov ebx, dword [sym.imp.USER32.dll_PeekMessageW]
mov dword [esp + 0x10], eax
or esi, 0xffffffff
nop
cmp edi, 0xffffffff
je 0x4394cb
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esp + 0x10]
cmp eax, edi
jae 0x439549
mov esi, edi
sub esi, eax
push 0
push 0x4ff
push esi
lea eax, [esp + 0x40]
push eax
push 1
call ebp
mov ecx, dword [esp + 0x34]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x43955f
push 1
push 0
push 0
push 0
lea edx, [esp + 0x24]
push edx
call ebx
test eax, eax
je 0x4394b0
cmp dword [esp + 0x18], 0x12
je 0x439554
push 0x5300
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.USER32.dll_CallMsgFilterW]
test eax, eax
jne 0x439531
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 1
push 0
push 0
push 0
lea eax, [esp + 0x24]
push eax
call ebx
test eax, eax
jne 0x439500
jmp 0x4394b0
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x20
ret
mov ecx, dword [esp + 0x1c]
push ecx
call dword [sym.imp.USER32.dll_PostQuitMessage]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x20
ret
xor eax, eax
add esp, 0x20
ret
Function at 0x439840
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 8
cmp dword [0x4d8950], 0
mov dword [esp + 4], 0
je 0x43994c
cmp dword [0x4d8954], 0
je 0x43994c
push ebx
push ebp
push esi
mov esi, dword [esp + 0x20]
push edi
test esi, esi
jne 0x439879
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
mov esi, eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
movzx ebx, word [esp + 0x1c]
mov ebp, dword [esp + 0x20]
push esi
push ebx
mov edi, eax
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
mov esi, eax
test esi, esi
jne 0x4398af
push ebp
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x439940
mov ebp, dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push edi
call ebp
push esi
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test ebx, ebx
je 0x439940
test eax, eax
je 0x439940
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push edi
mov ebx, eax
call ebp
mov edi, eax
test ebx, ebx
je 0x439940
test edi, edi
je 0x439940
push edi
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x439940
push edi
push ebx
push eax
call fcn.00484120
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea eax, [esp + 0x10]
push eax
push 1
push esi
mov dword [esp + 0x1c], 0
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x439940
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
push edx
call dword [0x4d8950]
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
xor eax, eax
add esp, 8
ret
Function at 0x43c470
Capabilities:
Find taskbar

Disassembly:
sub esp, 0x24
push esi
push 0
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, eax
test esi, esi
je 0x43c4a7
push edi
mov edi, dword [esp + 0x30]
push edi
push esi
call dword [sym.imp.USER32.dll_GetWindowRect]
push edi
push 0x43a460
push esi
call dword [sym.imp.USER32.dll_EnumChildWindows]
pop edi
pop esi
add esp, 0x24
ret
lea eax, [esp + 4]
push eax
push 5
mov dword [esp + 0xc], 0x24
call dword [sym.imp.SHELL32.dll_SHAppBarMessage]
test eax, eax
je 0x43c51c
mov eax, dword [esp + 0x10]
cmp eax, 3
ja case.default.0x43c4c9
jmp dword [eax*4 + 0x43c548]
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x2c]
lea edx, [ecx - 0x64]
add ecx, 0xfffffff0
mov dword [eax + 4], edx
mov edx, dword [esp + 0x1c]
mov dword [eax + 0xc], ecx
mov ecx, dword [esp + 0x14]
mov dword [eax], ecx
mov dword [eax + 8], edx
pop esi
add esp, 0x24
ret
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x20]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x1c]
mov dword [eax + 0xc], edx
lea edx, [ecx - 0x64]
add ecx, 0xfffffff0
mov dword [eax], edx
mov dword [eax + 8], ecx
pop esi
add esp, 0x24
ret
mov esi, dword [esp + 0x2c]
push 0
push esi
push 0
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0xc]
sub eax, 0x96
sub ecx, 0x1e
mov dword [esi], eax
mov dword [esi + 4], ecx
pop esi
add esp, 0x24
ret