joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x14]
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
jle 0x40103a
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
movzx eax, byte [edi + ebx]
mov ecx, esi
shr ecx, 8
xor cl, al
add eax, esi
imul esi, eax, 0xce6d
mov byte [edx], cl
add esi, 0x58bf
inc edx
inc edi
cmp edi, dword [ebp + 0x10]
jl 0x401016
pop esi
pop ebx
sub edx, dword [ebp + 0x14]
mov eax, edx
pop edi
pop ebp
ret

Function at 0x403217
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x5107c0]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x18]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40328e
push esi
lea eax, [ebp - 0x10]
xor esi, esi
push eax
push str.SeShutdownPrivilege
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push esi
push esi
push esi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 1
push eax
push esi
push dword [ebp - 0x18]
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x40327e
xor eax, eax
jmp 0x40328d
push esi
push 0x12
call dword [sym.imp.USER32.dll_ExitWindowsEx]
neg eax
sbb eax, eax
neg eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b35e5
mov esp, ebp
pop ebp
ret

Function at 0x40329c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x5107c0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov edx, 0xc14c8563
push 0xb7ea92f7
mov ecx, 0xb6ea5aee
call fcn.0040108c
lea edx, [ebp - 0x108]
pop ecx
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4032cf
test esi, esi
je 0x40330a
lea ecx, [ebp - 0x108]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4032e6
sub ecx, edx
mov byte [ebp + ecx - 0x108], 0x2f
lea ecx, [ebp + ecx - 0x107]
sub ecx, esi
mov al, byte [esi]
mov byte [ecx + esi], al
inc esi
test al, al
jne 0x403300
push 0x104
lea eax, [ebp - 0x310]
xor esi, esi
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x108]
push eax
push esi
push esi
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 5
push esi
push esi
lea eax, [ebp - 0x310]
push eax
push str.open
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004b35e5
mov esp, ebp
pop ebp
ret
Function at 0x40334f
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x98]
sub esp, 0x118
mov eax, dword [0x5107c0]
xor eax, ebp
mov dword [ebp + 0x94], eax
push edi
xor edi, edi
mov dword [ebp - 0x80], 0x114
push 0x10c
lea eax, [ebp - 0x78]
mov dword [ebp - 0x7c], edi
push edi
push eax
call fcn.004b6030
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x7c], 6
jae 0x4033d2
push esi
mov esi, dword [0x521824]
mov eax, dword [esi + 4]
sub eax, dword [esi]
sar eax, 2
test eax, eax
je 0x4033c4
mov eax, dword [esi]
push dword [eax + edi*4]
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [esi + 4]
inc edi
sub eax, dword [esi]
sar eax, 2
cmp edi, eax
jb 0x4033ac
mov eax, dword [esi]
sub esp, 0xc
mov dword [esi + 4], eax
call fcn.00415807
pop esi
mov ecx, dword [ebp + 0x94]
xor ecx, ebp
pop edi
call fcn.004b35e5
lea esp, [ebp + 0x98]
pop ebp
ret

Function at 0x40341c
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
push 0x18
mov dword [0x521814], esi
call fcn.004b3d9e
pop ecx
test eax, eax
je 0x403449
mov ecx, dword [0x521828]
mov dword [eax], ecx
xor ecx, ecx
mov dword [eax + 4], esi
mov dword [eax + 8], ecx
mov dword [eax + 0x10], ecx
mov byte [eax + 0x16], cl
jmp 0x40344b
xor eax, eax
mov dword [0x521820], eax
mov eax, dword [0x52181c]
mov eax, dword [eax + 0x14]
shr eax, 6
and al, 1
movzx eax, al
push eax
call fcn.00407b76
push esi
call fcn.004093b1
pop esi
jmp 0x4071c6
push ecx
push esi
push 0x5e83c855
mov edx, 0xb4eda772
mov ecx, 0xf9f27c26
call fcn.004011f2
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
je 0x40720c
push 0x4bb62d0b
mov edx, 0xa1d8423c
mov ecx, 0xecc79912
call fcn.004011d1
pop ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x5218fc], eax
xor edx, edx
mov ecx, fcn.00407293
call fcn.004073c1
lea eax, [esp + 4]
push eax
xor eax, eax
push eax
push eax
push 0x406c0c
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x5218d4], eax
pop esi
pop ecx
ret
Function at 0x403472
Capabilities:
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b8
mov eax, dword [0x5107c0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor edx, edx
mov ecx, 0x893069dd
push edi
mov dword [ebp - 0x29c], edx
mov edx, 0xfe96b67e
push 0x8830a1f8
call fcn.004010ad
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
je 0x4034fc
push 0x44cbe2c8
mov edx, 0x326df553
mov ecx, 0x45cb2aee
call fcn.0040108c
pop ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4034fc
lea ecx, [ebp - 0x29c]
push ecx
lea ecx, [ebp - 0x2a8]
push ecx
lea ecx, [ebp - 0x2ac]
push ecx
call eax
mov eax, dword [ebp - 0x29c]
and eax, 0xfffffff
mov dword [ebp - 0x29c], eax
jmp 0x403502
mov eax, dword [ebp - 0x29c]
xor esi, esi
cmp eax, 0x55f0
jb 0x4036a5
lea eax, [ebp - 0x294]
mov edx, 0xdffb53b0
push eax
push 0x20019
push esi
push 0xa95d441d
mov ecx, 0xa85d8ce3
call fcn.004010ad
pop ecx
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4036a5
lea eax, [ebp - 0x2b4]
mov dword [ebp - 0x298], 0x40
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x298]
mov edi, esi
push eax
lea eax, [ebp - 0x88]
push eax
push esi
jmp 0x403685
lea eax, [ebp - 0x2a0]
inc edi
push eax
push 0x2001f
push esi
lea eax, [ebp - 0x88]
push eax
push dword [ebp - 0x294]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40366c
lea eax, [ebp - 0x298]
mov dword [ebp - 0x298], 0x208
push eax
lea eax, [ebp - 0x290]
mov edx, 0x707eebfd
push eax
lea eax, [ebp - 0x2b8]
mov ecx, 0x7d834e2
push eax
push esi
push 0x6d8fc7e
call fcn.004010ad
pop ecx
push eax
push dword [ebp - 0x2a0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea esi, [ebp - 0x290]
xor edx, edx
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, dx
jne 0x4035e5
sub esi, ecx
sar esi, 1
cmp esi, 0xc
jbe 0x40365e
push 0x71482661
mov edx, 0x7ee31e0
mov ecx, 0x7048eedf
call fcn.004010ad
pop ecx
push eax
lea eax, [ebp + esi*2 - 0x2a8]
push eax
call fcn.004b3e74
pop ecx
xor esi, esi
pop ecx
test eax, eax
jne 0x403660
push 4
lea eax, [ebp - 0x2a4]
mov dword [ebp - 0x2a4], 1
push eax
push 4
push esi
push 0xff8ec765
mov edx, 0x8928d0e2
mov ecx, 0xfe8e0e31
call fcn.004010ad
pop ecx
push eax
push dword [ebp - 0x2a0]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x403660
xor esi, esi
push dword [ebp - 0x2a0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x2b4]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x298]
push eax
lea eax, [ebp - 0x88]
push eax
push edi
push dword [ebp - 0x294]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x40356f
push dword [ebp - 0x294]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x521820]
cmp dword [eax + 8], esi
je 0x4036b6
call fcn.00407e7b
jmp 0x4036c1
push esi
xor edx, edx
xor ecx, ecx
call fcn.00413aaf
pop ecx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004b35e5
mov esp, ebp
pop ebp
ret
Function at 0x403e96
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
push edi
push 0x38
lea eax, [ebp - 0x38]
mov edi, edx
push 0
push eax
mov esi, ecx
call fcn.004b6030
push 0x61744493
mov edx, 0x17d25314
mov dword [ebp - 0x3c], 0x3c
mov ecx, 0x60748d51
mov dword [ebp - 0x38], 0xc
mov dword [ebp - 0x34], esi
call fcn.004010ad
push 0xc452042c
mov edx, 0xb2f413a1
mov dword [ebp - 0x30], eax
mov ecx, 0xc552cdfc
mov dword [ebp - 0x2c], edi
call fcn.004010ad
and dword [ebp - 0x24], 0
add esp, 0x14
and dword [ebp - 0x1c], 0
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x20], 5
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x403f70
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x5107c0]
xor eax, ebp
mov dword [ebp - 4], eax
add cl, 0x41
movzx eax, cl
mov ecx, dword [eax*4 + 0x5217fc]
test ecx, ecx
je 0x403fe2
cmp byte [ecx + 0x7f], 0
je 0x403fe2
lea eax, [ebp - 0x20c]
push eax
call fcn.004210b3
lea eax, [ebp - 0x20c]
push eax
call fcn.00419cdb
pop ecx
test al, al
je 0x403fe2
push 5
push 0
push 0
lea eax, [ebp - 0x20c]
mov edx, 0x2fedfff8
push eax
push 0x594be871
mov ecx, 0x584b21a1
call fcn.004010ad
pop ecx
push eax
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b35e5
mov esp, ebp
pop ebp
ret

Function at 0x403ff0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x5107c0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x3a
pop edi
mov word [ebp - 0xa], di
mov esi, ecx
push 0x5c
pop edi
movzx ecx, dl
and edx, 0xff00
mov word [ebp - 8], di
xor edi, edi
mov word [ebp - 6], di
mov edi, 0x2400
lea eax, [ecx + 0x41]
mov word [ebp - 0xc], ax
cmp edx, edi
ja 0x4040bc
je 0x4040b4
cmp edx, 0x2000
je 0x4040a0
cmp edx, 0x2100
je 0x404077
cmp edx, 0x2200
je 0x404069
cmp edx, 0x2300
jne 0x4040fa
mov edx, eax
mov ecx, esi
call fcn.0040bf30
jmp 0x4040fa
mov edx, eax
mov ecx, esi
call fcn.0040bebe
jmp 0x4040fa
push 5
xor esi, esi
lea eax, [ebp - 0xc]
push esi
push esi
push eax
push 0xa9e469b
mov edx, 0x7c385112
mov ecx, 0xb9e8f7f
call fcn.004010ad
pop ecx
push eax
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x4040fa
add cl, 0x41
movzx eax, cl
mov ecx, esi
push eax
push 7
pop edx
call fcn.00413aaf
pop ecx
jmp 0x4040fa
push eax
call fcn.00408c12
jmp 0x4040fa
cmp edx, 0x2500
je 0x4040f5
cmp edx, 0x2600
je 0x4040ec
cmp edx, 0x2700
je 0x4040e8
cmp edx, 0x2800
jne 0x4040fa
lea edx, [ebp - 0xc]
mov ecx, esi
call fcn.00403e96
jmp 0x4040fa
xor dl, dl
jmp 0x4040ee
mov dl, 1
call fcn.00403f13
jmp 0x4040fa
call fcn.00403f70
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004b35e5
mov esp, ebp
pop ebp
ret
Function at 0x404740
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x5107c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, 0x104
lea eax, [ebp - 0x414]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov ebx, 0x4e8940
lea eax, [ebp - 0x414]
push ebx
push eax
push 0xf820e0a9
mov edx, 0xc3fa2bbd
mov ecx, 0xa9ac33cb
call fcn.00401534
pop ecx
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x20c]
push eax
call fcn.00419cdb
add esp, 0x14
test al, al
jne 0x4047fb
mov ecx, dword [0x521818]
lea eax, [ebp - 0x20c]
push edi
push eax
push 0xf
call fcn.0041c148
test eax, eax
jne 0x4047e5
movzx edx, word [0x516efc]
lea eax, [ebp - 0x20c]
push edi
push eax
xor edx, 0xc7c7
mov ecx, 0x516efe
call fcn.00415bfb
pop ecx
pop ecx
push 0x10
push ebx
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
jmp 0x404869
push esi
call fcn.004141df
mov esi, eax
call fcn.004142c3
test esi, esi
je 0x404879
test eax, eax
je 0x404879
push edi
lea eax, [ebp - 0x20c]
xor esi, esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call fcn.004b3fe0
pop ecx
pop ecx
test eax, eax
je 0x404865
push 1
push esi
push 0x379386e1
mov edx, 0x41359169
mov ecx, 0x36934f6e
call fcn.004010ad
pop ecx
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.004199c8
add esp, 0x10
test eax, eax
jne 0x40490b
xor eax, eax
inc eax
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.004b35e5
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x521818]
lea eax, [ebp - 0x20c]
push edi
push eax
push 0x10
call fcn.0041c148
test eax, eax
jne 0x4048b3
movzx edx, word [0x516f84]
lea eax, [ebp - 0x20c]
push edi
push eax
xor edx, 0xc7c7
mov ecx, 0x516f86
call fcn.00415bfb
pop ecx
pop ecx
push 0x14
push ebx
lea eax, [ebp - 0x20c]
xor esi, esi
push eax
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x404865
push edi
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 1
push esi
push 0x7f0b4f36
mov edx, 0x9ad58be
mov ecx, 0x7e0b86cf
call fcn.004010ad
pop ecx
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.004199c8
add esp, 0x10
cmp eax, 0x64
jne 0x404865
call fcn.004046be
xor eax, eax
jmp 0x404868
Function at 0x404b65
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, ecx
mov dword [esp + 0x10], edx
push esi
xor ebx, ebx
push edi
mov dword [ebp], ebx
mov edi, ebx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [esp + 0x10]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [esp + 0x10], 1
mov dword [esp + 0x14], eax
jle 0x404c7a
test eax, eax
je 0x404c7a
xor esi, esi
inc esi
cmp dword [esp + 0x10], esi
jle 0x404c7a
mov ecx, dword [eax + esi*4]
movzx eax, word [ecx]
cmp eax, 0x2d
je 0x404bc3
cmp eax, 0x2f
jne 0x404c6b
movzx eax, word [ecx + 2]
push eax
call fcn.00419f6c
movzx eax, ax
pop ecx
sub eax, 0x64
je 0x404cb1
dec eax
je 0x404cac
sub eax, 0xd
je 0x404c84
sub eax, 6
jne 0x404c6b
mov eax, dword [esp + 0x14]
mov eax, dword [eax + esi*4]
movzx eax, word [eax + 4]
push eax
call fcn.00419f6c
movzx eax, ax
pop ecx
cmp eax, 0x69
jne 0x404c23
xor ecx, ecx
xor edi, edi
inc ecx
inc edi
call fcn.004149d1
mov dword [ebp], eax
call fcn.00414a7c
call fcn.00404b03
jmp 0x404c6b
cmp eax, 0x75
jne 0x404c3c
xor edi, edi
xor ecx, ecx
inc edi
call fcn.004149d1
mov dword [ebp], eax
call fcn.004150fa
jmp 0x404c6b
cmp eax, 0x66
jne 0x404c4e
xor ecx, ecx
xor edi, edi
inc ecx
inc edi
call fcn.004149d1
jmp 0x404c5b
cmp eax, 0x72
jne 0x404c60
xor edi, edi
inc edi
call fcn.00415760
mov dword [ebp], eax
jmp 0x404c6b
cmp eax, 0x68
jne 0x404c6b
mov eax, dword [esp + 0x18]
mov byte [eax], bl
mov eax, dword [esp + 0x14]
inc esi
cmp esi, dword [esp + 0x10]
jl 0x404baf
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
push 0x48
call fcn.004b3d9e
pop ecx
test eax, eax
je 0x404c9a
push ebx
mov ecx, eax
call fcn.00407ee5
mov ebx, eax
xor ecx, ecx
mov dword [0x52181c], ebx
call fcn.00419300
xor eax, eax
inc eax
jmp 0x404c7c
xor ecx, ecx
inc ecx
jmp 0x404cb3
xor ecx, ecx
call fcn.00404ade
jmp 0x404ca7
Function at 0x405006
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
mov byte [0x52182c], 1
push ebx
push esi
push edi
push 0x4c
call fcn.004b3d9e
xor ebx, ebx
pop ecx
test eax, eax
je 0x405030
mov ecx, eax
call fcn.0041b7c6
jmp 0x405032
mov eax, ebx
mov esi, dword [ebp + 8]
mov dword [0x521818], eax
mov dword [0x521828], esi
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
push 6
push ebx
call dword [sym.imp.ole32.dll_CoInitializeEx]
push 0xb311e059
mov edx, 0xc5b7f7c1
mov ecx, 0xb2112c74
call fcn.0040108c
pop ecx
push eax
push 0x28f26dd2
mov edx, 0x5e547a57
mov ecx, 0x29f2a1f6
call fcn.0040108c
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4050a0
lea ecx, [esp + 0x14]
push ecx
call eax
movzx eax, word [esp + 0x14]
test eax, eax
jne 0x4051ea
push dword [ebp + 0x10]
call fcn.0041d62b
pop ecx
test al, al
jne 0x4051ea
lea edx, [esp + 0xf]
mov dword [esp + 0x10], ebx
lea ecx, [esp + 0x10]
mov byte [esp + 0xf], 1
call fcn.00404b65
test eax, eax
je 0x4050d4
mov eax, dword [esp + 0x10]
jmp 0x4051ec
push 0x48
call fcn.004b3d9e
pop ecx
test eax, eax
je 0x4050ea
push ebx
mov ecx, eax
call fcn.00407ee5
jmp 0x4050ec
mov eax, ebx
mov dword [0x52181c], eax
call fcn.00418d7a
test eax, eax
jne 0x40510b
call fcn.00404f58
test eax, eax
jne 0x40510b
push 3
pop eax
jmp 0x4051ec
push str.MUTEX_XREVEAL
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40514e
push ebx
push str.XrevealWndClass
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x405146
push ebx
push ebx
push 0x400
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
xor eax, eax
inc eax
jmp 0x4051ec
call fcn.00404a43
test eax, eax
jne 0x40515b
push 2
jmp 0x405105
call fcn.00404dac
test eax, eax
jne 0x405168
push 6
jmp 0x405105
mov ecx, esi
call fcn.00404503
test eax, eax
je 0x4051d8
push 0x10
call fcn.004b3d9e
pop ecx
test eax, eax
je 0x40518d
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov byte [eax + 0xc], 1
jmp 0x40518f
mov eax, ebx
sub esp, 0xc
mov dword [0x521824], eax
call fcn.00415807
movzx edx, byte [esp + 0xf]
mov ecx, esi
call fcn.00404575
test eax, eax
je 0x4051d8
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
jmp 0x4051ca
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push ebx
push ebx
push ebx
lea eax, [esp + 0x20]
push eax
call esi
test eax, eax
jne 0x4051b4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x52181c]
call fcn.00408721
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x406d61
Capabilities:
Terminate thread

Disassembly:
push dword [0x5218d8]
mov dword [0x521834], 1
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [0x521968]
test ecx, ecx
je 0x406d86
call fcn.004071a3
push 0x2710
push dword [0x5218d4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x406dac
push 0
push dword [0x5218d4]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [0x5218d4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov ecx, fcn.00407328
jmp fcn.004073c1

Function at 0x40715d
Capabilities:
Create thread

Disassembly:
push ecx
push esi
push edi
xor edi, edi
mov esi, ecx
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi], eax
lea eax, [esp + 8]
push eax
push edi
push esi
push 0x407141
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x40719b
push eax
call edi
push 0xffffffffffffffff
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esi]
call edi
pop edi
pop esi
pop ecx
ret
Function at 0x4074f0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x72c
mov eax, dword [0x5107c0]
xor eax, esp
mov dword [esp + 0x728], eax
push ebx
push ebp
push esi
push edi
mov ebp, ecx
mov edi, edx
push 0x35
push ebp
mov dword [esp + 0x20], ebp
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ecx, 0x7f01
mov esi, eax
call fcn.00407480
push eax
push 1
push 0x172
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
mov eax, 0x3e8
push eax
push eax
push ebp
call dword [sym.imp.USER32.dll_SetTimer]
push 0x3c
push 0xffffffffffffffeb
push ebp
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov al, byte [edi + 0x6a]
mov ecx, edi
mov esi, dword [edi + 0x74]
mov byte [esp + 0x13], al
call fcn.00425d10
mov ebx, eax
cmp esi, 0x20
je 0x4076c9
cmp esi, 0x1a
je 0x4076c9
cmp esi, 0x21
jne 0x4075cc
mov ecx, dword [0x521818]
lea eax, [esp + 0x20]
mov esi, 0x104
push esi
push eax
push 0x1b
call fcn.0041c148
test eax, eax
jne 0x4075b4
movzx edx, word [0x5173a0]
lea eax, [esp + 0x20]
push esi
push eax
xor edx, 0xc7c7
mov ecx, 0x5173a2
call fcn.00415bfb
pop ecx
pop ecx
mov ecx, dword [0x52181c]
lea eax, [esp + 0x228]
push eax
call fcn.00408b00
jmp 0x407719
push 0
push 4
push ebp
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [0x521818]
mov eax, ebx
shr eax, 0x14
and ebx, 0xfffff
mov dword [esp + 0x14], eax
mov esi, 0x104
movzx eax, bl
mov edi, ebx
mov dword [esp + 0x1c], eax
mov ebp, ebx
push esi
lea eax, [esp + 0x24]
shr edi, 0x10
push eax
shr ebp, 8
and edi, 0xf
push 0x1c
and ebp, 0xff
call fcn.0041c148
test eax, eax
jne 0x407642
movzx edx, word [0x5173ce]
lea eax, [esp + 0x20]
push esi
push eax
xor edx, 0xc7c7
mov ecx, 0x5173d0
call fcn.00415bfb
pop ecx
pop ecx
push dword [esp + 0x14]
mov edx, 0x11f84e86
mov ecx, 0xd26dba92
push 0xed736139
call fcn.0040125f
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
pop ecx
push eax
lea eax, [esp + 0x230]
push eax
call esi
add esp, 0xc
lea eax, [esp + eax*2 + 0x228]
mov dword [esp + 0x14], eax
test ebx, ebx
je 0x4076a3
push dword [esp + 0x1c]
mov edx, 0x3cfddc33
mov ecx, 0xff68282f
push ebp
push edi
push 0xc076f381
call fcn.0040125f
pop ecx
push eax
push dword [esp + 0x24]
call esi
add esp, 0x14
lea eax, [esp + 0x228]
push eax
movzx eax, byte [esp + 0x17]
push eax
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x43c]
push eax
call esi
mov ebp, dword [esp + 0x28]
add esp, 0x10
jmp 0x407737
mov ecx, dword [0x521818]
lea eax, [esp + 0x20]
mov esi, 0x104
push esi
push eax
push 0x1a
call fcn.0041c148
test eax, eax
jne 0x407704
movzx edx, word [0x517360]
lea eax, [esp + 0x20]
push esi
push eax
xor edx, 0xc7c7
mov ecx, 0x517362
call fcn.00415bfb
pop ecx
pop ecx
mov ecx, dword [0x52181c]
lea eax, [esp + 0x228]
push 0
push eax
call fcn.00408948
lea eax, [esp + 0x228]
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x438]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [esp + 0x430]
push eax
push 0x32
push ebp
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
mov ecx, dword [esp + 0x738]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004b35e5
add esp, 0x72c
ret