joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5c00d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
call fcn.005bf7b0
push 0xc
call fcn.00428650
add esp, 4
test eax, eax
je 0x5c0100
mov dword [eax], 0
mov dword [eax + 8], 0
mov dword [eax + 4], 0
jmp 0x5c0102
xor eax, eax
push dword [ebp + 0xc]
mov ecx, esi
mov dword [esi + 0x4c], eax
call fcn.005c06a0
test eax, eax
jne 0x5c011a
pop esi
mov esp, ebp
pop ebp
ret 0x14
push dword [ebp + 8]
mov ecx, esi
push dword [ebp + 0x14]
push dword [ebp + 0x18]
push dword [ebp + 0x10]
push 0
call fcn.005c0400
lea eax, [ebp - 4]
push eax
push 0
push esi
push 0x5c0780
push 0
push 0
call fcn.006b8cf3
xor ecx, ecx
mov dword [esi + 0x54], eax
add esp, 0x18
test eax, eax
setne cl
mov eax, ecx
pop esi
mov esp, ebp
pop ebp
ret 0x14

Function at 0x5c0160
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x54]
test eax, eax
je 0x5c018f
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
je 0x5c018f
push dword [esi + 0x54]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x54], 0
mov eax, dword [0x7f8c8c]
dec dword [eax + 0x1c]
pop esi
ret
Function at 0x5c0230
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x32a0
call fcn.006b59e0
mov eax, dword [0x7e6410]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x325c], eax
mov eax, dword [ebp + 0x10]
push esi
mov dword [ebp - 0x3260], eax
mov esi, ecx
mov eax, dword [ebp + 0x14]
push 0x3c
mov dword [ebp - 0x3264], eax
lea eax, [ebp - 0x32a0]
push 0
push eax
call fcn.006b47d0
lea eax, [ebp - 0x48]
mov dword [ebp - 0x32a0], 0x3c
mov dword [ebp - 0x329c], eax
add esp, 0xc
lea eax, [ebp - 0x24c]
mov dword [ebp - 0x3298], 0x42
mov dword [ebp - 0x3290], eax
lea eax, [ebp - 0x3258]
mov dword [ebp - 0x3274], eax
lea eax, [ebp - 0x2254]
mov dword [ebp - 0x326c], eax
lea eax, [ebp - 0x32a0]
push eax
push 0
push 0
push dword [esi + 8]
mov dword [ebp - 0x328c], 0x202
mov dword [ebp - 0x3270], 0x1002
mov dword [ebp - 0x3268], 0x1002
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
jne 0x5c0305
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006b3266
mov esp, ebp
pop ebp
ret 0x10
xor eax, eax
jmp 0x5c0310
movzx ecx, word [ebp + eax - 0x3256]
lea eax, [eax + 2]
mov word [ebp + eax - 0x1252], cx
test cx, cx
jne 0x5c0310
lea edx, [ebp - 0x2254]
mov esi, edx
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x5c0330
push edi
lea edi, [ebp - 0x1250]
sub edx, esi
add edi, 0xfffffffe
jmp 0x5c0350
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x5c0350
movzx eax, word [ebp - 0x3288]
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, dword [ebp - 0x325c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x3260]
mov dword [edx], eax
lea eax, [ebp - 0x1250]
push eax
call fcn.00428a30
lea eax, [ebp - 0x24c]
mov ecx, ebx
push eax
call fcn.00428a30
mov ecx, dword [ebp - 0x3264]
lea eax, [ebp - 0x48]
push eax
call fcn.00428a30
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006b3266
mov esp, ebp
pop ebp
ret 0x10

Function at 0x5c07e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
xor esi, esi
mov dword [ebp - 4], esi
mov eax, dword [edi + 0x50]
cmp eax, 0xffffffff
je 0x5c0826
push esi
lea ecx, [ebp - 4]
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x5c0813
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
mov esi, dword [ebp - 4]
mov eax, 1
add dword [edi + 0x48], esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [edi + 0x4c]
test ecx, ecx
je 0x5c0839
mov esi, dword [ebp + 0xc]
push esi
push dword [ebp + 8]
call fcn.005be000
add dword [edi + 0x48], esi
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x5c0ac0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop ebp
ret
Function at 0x5c1440
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], 0
push str._BAK
mov eax, dword [edi + 0x20]
push dword [edi + 0x14]
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ebx, dword [ebp + 8]
lea eax, [ebp - 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push eax
push dword [edi + 0x1c]
lea eax, [ebp - 4]
push eax
push 0
push dword [edi + 0x14]
push ebx
call esi
test eax, eax
je 0x5c1544
mov eax, dword [edi + 0x20]
push 0x790eb0
push dword [edi + 0x14]
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 8]
push eax
push dword [edi + 0x1c]
lea eax, [ebp - 4]
push eax
push 0
push dword [edi + 0x14]
push ebx
call esi
test eax, eax
jne 0x5c1544
mov edx, dword [edi + 0x1c]
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x5c14c1
sub ecx, esi
sar ecx, 1
jne 0x5c14ec
push dword [ebp + 0xc]
push edx
push str._nCSysSoundOff2::BackupValue___
call fcn.005b1290
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 4]
cmp eax, 1
je 0x5c14f9
cmp eax, 2
jne 0x5c1544
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 1
push 0x790eb0
push eax
push 0
push dword [edi + 0x14]
push ebx
call esi
push str._BAK
push dword [edi + 0x14]
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push dword [edi + 0x1c]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
push eax
push dword [edi + 0x1c]
push dword [ebp - 4]
push 0
push dword [edi + 0x14]
push ebx
call esi
push 0x790eb0
push dword [edi + 0x1c]
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x5c1550
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov esi, ecx
push str._BAK
mov dword [ebp - 4], 0
mov eax, dword [esi + 0x20]
push dword [esi + 0x14]
mov dword [ebp - 8], eax
call edi
mov ebx, dword [ebp + 8]
lea eax, [ebp - 8]
push eax
push dword [esi + 0x1c]
lea eax, [ebp - 4]
push eax
push 0
push dword [esi + 0x14]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x5c15f9
mov ecx, dword [esi + 0x1c]
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x5c15a0
sub ecx, edx
sar ecx, 1
je 0x5c15f9
mov eax, dword [ebp - 4]
cmp eax, 1
je 0x5c15be
cmp eax, 2
jne 0x5c15f9
push dword [esi + 0x14]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push 0x790eb0
push dword [esi + 0x14]
call edi
push dword [esi + 0x1c]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
push eax
push dword [esi + 0x1c]
push dword [ebp - 4]
push 0
push dword [esi + 0x14]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x790eb0
push dword [esi + 0x1c]
call edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x5c31c0
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x718871
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x7e6410]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.00429050
lea ecx, [esi + 4]
mov dword [ebp - 4], 0
call fcn.00429050
lea ecx, [esi + 8]
mov byte [ebp - 4], 1
call fcn.00429050
lea ecx, [esi + 0xc]
mov byte [ebp - 4], 2
call fcn.00429050
lea ecx, [esi + 0x10]
mov byte [ebp - 4], 3
call fcn.00429050
lea ecx, [esi + 0x14]
mov byte [ebp - 4], 4
call fcn.00429050
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 5
call fcn.00429050
lea ecx, [esi + 0x1c]
mov byte [ebp - 4], 6
call fcn.00429050
lea ebx, [esi + 0x20]
mov byte [ebp - 4], 7
mov ecx, ebx
call fcn.00429050
lea edi, [esi + 0x24]
mov byte [ebp - 4], 8
mov ecx, edi
call fcn.00429050
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 9
call fcn.00429050
lea ecx, [esi + 0x34]
mov byte [ebp - 4], 0xa
call fcn.00429050
mov ecx, dword [ebp - 0x10]
mov dword [esi + 0x38], 0
mov esi, dword [ebp + 8]
push esi
mov byte [ebp - 4], 0xb
call fcn.004289a0
mov ecx, dword [ebp - 0x10]
lea eax, [esi + 4]
push eax
lea ecx, [ecx + 4]
call fcn.004289a0
mov ecx, dword [ebp - 0x10]
lea eax, [esi + 8]
push eax
lea ecx, [ecx + 8]
call fcn.004289a0
mov ecx, dword [ebp - 0x10]
lea eax, [esi + 0xc]
push eax
lea ecx, [ecx + 0xc]
call fcn.004289a0
mov ecx, dword [ebp - 0x10]
lea eax, [esi + 0x10]
push eax
lea ecx, [ecx + 0x10]
call fcn.004289a0
mov ecx, dword [ebp - 0x10]
lea eax, [esi + 0x14]
push eax
lea ecx, [ecx + 0x14]
call fcn.004289a0
lea eax, [esi + 0x18]
push eax
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx + 0x18]
call fcn.004289a0
mov ecx, dword [ebp - 0x10]
lea eax, [esi + 0x1c]
push eax
lea ecx, [ecx + 0x1c]
call fcn.004289a0
lea eax, [esi + 0x20]
mov ecx, ebx
push eax
call fcn.004289a0
lea eax, [esi + 0x24]
mov ecx, edi
push eax
call fcn.004289a0
mov ebx, dword [ebp - 0x10]
mov eax, dword [esi + 0x28]
mov dword [ebx + 0x28], eax
lea ecx, [ebx + 0x30]
mov eax, dword [esi + 0x2c]
mov dword [ebx + 0x2c], eax
lea eax, [esi + 0x30]
push eax
call fcn.004289a0
lea eax, [esi + 0x34]
push eax
lea ecx, [ebx + 0x34]
call fcn.004289a0
mov eax, dword [esi + 0x38]
mov dword [ebx + 0x38], eax
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x5c3360
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x718932
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x7e6410]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.00429050
lea ecx, [esi + 0xc]
mov dword [ebp - 4], 0
call fcn.00429050
lea ecx, [esi + 0x10]
mov byte [ebp - 4], 1
call fcn.00429050
lea ecx, [esi + 0x14]
mov byte [ebp - 4], 2
call fcn.00429050
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 3
call fcn.00429050
lea ecx, [esi + 0x1c]
mov byte [ebp - 4], 4
call fcn.00429050
lea ecx, [esi + 0x20]
mov byte [ebp - 4], 5
call fcn.00429050
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 6
call fcn.00429050
lea ecx, [esi + 0x28]
mov byte [ebp - 4], 7
call fcn.00429050
lea ecx, [esi + 0x2c]
mov byte [ebp - 4], 8
call fcn.00429050
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 9
call fcn.00429050
lea ecx, [esi + 0x34]
mov byte [ebp - 4], 0xa
call fcn.00429050
lea ecx, [esi + 0x38]
mov byte [ebp - 4], 0xb
call fcn.00429050
lea ecx, [esi + 0x3c]
mov byte [ebp - 4], 0xc
call fcn.00429050
lea ecx, [esi + 0x40]
mov byte [ebp - 4], 0xd
call fcn.00429050
lea ecx, [esi + 0x44]
mov byte [ebp - 4], 0xe
call fcn.00429050
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5c35f0
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x718a9a
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x7e6410]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 8]
call fcn.00429050
lea ecx, [esi + 0xc]
mov dword [ebp - 4], 0
call fcn.00429050
lea ecx, [esi + 0x10]
mov byte [ebp - 4], 1
call fcn.00429050
lea ecx, [esi + 0x14]
mov byte [ebp - 4], 2
call fcn.00429050
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 3
call fcn.00429050
lea ecx, [esi + 0x1c]
mov byte [ebp - 4], 4
call fcn.00429050
lea ecx, [esi + 0x20]
mov byte [ebp - 4], 5
call fcn.00429050
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 6
call fcn.00429050
lea ecx, [esi + 0x28]
mov byte [ebp - 4], 7
call fcn.00429050
lea ecx, [esi + 0x2c]
mov byte [ebp - 4], 8
call fcn.00429050
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 9
call fcn.00429050
lea ecx, [esi + 0x34]
mov byte [ebp - 4], 0xa
call fcn.00429050
lea ecx, [esi + 0x38]
mov byte [ebp - 4], 0xb
call fcn.00429050
lea ecx, [esi + 0x3c]
mov byte [ebp - 4], 0xc
call fcn.00429050
lea ecx, [esi + 0x44]
mov byte [ebp - 4], 0xd
call fcn.00429050
lea ecx, [esi + 0x48]
mov byte [ebp - 4], 0xe
call fcn.00429050
lea ecx, [esi + 0x4c]
mov byte [ebp - 4], 0xf
call fcn.00429050
lea ecx, [esi + 0x58]
mov byte [ebp - 4], 0x10
call fcn.00429050
lea ecx, [esi + 0x5c]
mov byte [ebp - 4], 0x11
call fcn.00429050
lea ecx, [esi + 0x70]
mov byte [ebp - 4], 0x12
call fcn.005a8c30
mov byte [ebp - 4], 0x13
lea ecx, [esi + 0x150]
call fcn.00429050
lea ecx, [esi + 0x154]
mov byte [ebp - 4], 0x14
call fcn.00429050
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5c4200
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x720386
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x7e6410]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0x34]
mov dword [ebp - 4], 0xa
call fcn.00428810
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 9
call fcn.00428810
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 8
call fcn.00428810
lea ecx, [esi + 0x20]
mov byte [ebp - 4], 7
call fcn.00428810
lea ecx, [esi + 0x1c]
mov byte [ebp - 4], 6
call fcn.00428810
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 5
call fcn.00428810
lea ecx, [esi + 0x14]
mov byte [ebp - 4], 4
call fcn.00428810
lea ecx, [esi + 0x10]
mov byte [ebp - 4], 3
call fcn.00428810
lea ecx, [esi + 0xc]
mov byte [ebp - 4], 2
call fcn.00428810
lea ecx, [esi + 8]
mov byte [ebp - 4], 1
call fcn.00428810
lea ecx, [esi + 4]
mov byte [ebp - 4], 0
call fcn.00428810
mov ecx, esi
mov dword [ebp - 4], 0xffffffff
call fcn.00428810
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x5c42d0
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x718932
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x7e6410]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0x44]
mov dword [ebp - 4], 0xe
call fcn.00428810
lea ecx, [esi + 0x40]
mov byte [ebp - 4], 0xd
call fcn.00428810
lea ecx, [esi + 0x3c]
mov byte [ebp - 4], 0xc
call fcn.00428810
lea ecx, [esi + 0x38]
mov byte [ebp - 4], 0xb
call fcn.00428810
lea ecx, [esi + 0x34]
mov byte [ebp - 4], 0xa
call fcn.00428810
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 9
call fcn.00428810
lea ecx, [esi + 0x2c]
mov byte [ebp - 4], 8
call fcn.00428810
lea ecx, [esi + 0x28]
mov byte [ebp - 4], 7
call fcn.00428810
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 6
call fcn.00428810
lea ecx, [esi + 0x20]
mov byte [ebp - 4], 5
call fcn.00428810
lea ecx, [esi + 0x1c]
mov byte [ebp - 4], 4
call fcn.00428810
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 3
call fcn.00428810
lea ecx, [esi + 0x14]
mov byte [ebp - 4], 2
call fcn.00428810
lea ecx, [esi + 0x10]
mov byte [ebp - 4], 1
call fcn.00428810
lea ecx, [esi + 0xc]
mov byte [ebp - 4], 0
call fcn.00428810
mov ecx, esi
mov dword [ebp - 4], 0xffffffff
call fcn.00428810
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5c4520
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x718a9a
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x7e6410]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0x154]
mov dword [ebp - 4], 0x14
call fcn.00428810
lea ecx, [esi + 0x150]
mov byte [ebp - 4], 0x13
call fcn.00428810
lea ecx, [esi + 0x70]
mov byte [ebp - 4], 0x12
call fcn.00541980
lea ecx, [esi + 0x5c]
mov byte [ebp - 4], 0x11
call fcn.00428810
lea ecx, [esi + 0x58]
mov byte [ebp - 4], 0x10
call fcn.00428810
lea ecx, [esi + 0x4c]
mov byte [ebp - 4], 0xf
call fcn.00428810
lea ecx, [esi + 0x48]
mov byte [ebp - 4], 0xe
call fcn.00428810
lea ecx, [esi + 0x44]
mov byte [ebp - 4], 0xd
call fcn.00428810
lea ecx, [esi + 0x3c]
mov byte [ebp - 4], 0xc
call fcn.00428810
lea ecx, [esi + 0x38]
mov byte [ebp - 4], 0xb
call fcn.00428810
lea ecx, [esi + 0x34]
mov byte [ebp - 4], 0xa
call fcn.00428810
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 9
call fcn.00428810
lea ecx, [esi + 0x2c]
mov byte [ebp - 4], 8
call fcn.00428810
lea ecx, [esi + 0x28]
mov byte [ebp - 4], 7
call fcn.00428810
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 6
call fcn.00428810
lea ecx, [esi + 0x20]
mov byte [ebp - 4], 5
call fcn.00428810
lea ecx, [esi + 0x1c]
mov byte [ebp - 4], 4
call fcn.00428810
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 3
call fcn.00428810
lea ecx, [esi + 0x14]
mov byte [ebp - 4], 2
call fcn.00428810
lea ecx, [esi + 0x10]
mov byte [ebp - 4], 1
call fcn.00428810
lea ecx, [esi + 0xc]
mov byte [ebp - 4], 0
call fcn.00428810
lea ecx, [esi + 8]
mov dword [ebp - 4], 0xffffffff
call fcn.00428810
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5c4cd0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x719058
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x7e6410]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
push dword [ebx + 4]
mov ecx, dword [ebx]
mov dword [ebp - 4], 0
call fcn.005c4800
push eax
call dword [sym.imp.USER32.dll_EnumWindows]
mov esi, dword [ebx + 4]
cmp dword [esi + 0x10], 0
jbe 0x5c4daa
nop
push 1
lea eax, [ebp - 0x24]
mov ecx, esi
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.00626ac0
mov ecx, eax
call fcn.006259e0
mov edi, dword [eax]
test edi, edi
je 0x5c4d40
mov edi, dword [edi]
mov edx, dword [eax + 8]
mov eax, edx
mov ecx, dword [edi + 8]
and edx, 3
shr eax, 2
dec ecx
and ecx, eax
mov eax, dword [edi + 4]
mov eax, dword [eax + ecx*4]
mov edi, dword [eax + edx*4]
dec dword [esi + 0x10]
jne 0x5c4d66
mov dword [esi + 0xc], 0
lea ecx, [ebp + 8]
call fcn.004290e0
lea ecx, [ebp + 8]
mov dword [ebp - 0x18], 0x232f
lea eax, [eax*2 + 2]
mov dword [ebp - 0x14], eax
call fcn.00429100
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0xc]
push 0x4a
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jne 0x5c4dd1
mov esi, dword [ebx + 4]
cmp dword [esi + 0x10], eax
ja 0x5c4d20
xor esi, esi
lea ecx, [ebp + 8]
mov dword [ebp - 4], 0xffffffff
call fcn.00428810
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov esi, 1
jmp 0x5c4dac
Function at 0x5c72c0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7193d8
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push esi
mov eax, dword [0x7e6410]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [ebp - 0x3c]
call fcn.00663f50
mov eax, dword [0x7f758c]
mov ecx, esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], eax
call fcn.005c5cb0
mov eax, dword [0x7f758c]
mov dword [0x7f7598], 0xffffffff
mov dword [0x7f759c], 0xffffffff
cmp eax, 1
jne 0x5c736a
mov dword [0x7f758c], 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 9
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea ecx, [ebp - 0x3c]
call fcn.005c71e0
mov ecx, esi
cmp eax, 0x7d00
jne 0x5c73e8
call fcn.005dcda0
jmp 0x5c7401
cmp eax, 2
jne 0x5c73ae
mov dword [0x7f758c], 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 9
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea ecx, [ebp - 0x3c]
call fcn.005c71e0
mov ecx, esi
cmp eax, 0x7d00
jne 0x5c73e8
call fcn.005dc7d0
jmp 0x5c7401
cmp eax, 3
jne 0x5c7401
push 0
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea ecx, [ebp - 0x3c]
call fcn.005c71e0
cmp eax, 0x7d00
jne 0x5c73e6
push 0
push 0
push 0x10
mov dword [0x7f758c], 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x5c7401
mov ecx, esi
mov dword [0x7f758c], 0
mov dword [0x7f72a0], 4
call fcn.00614830
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], 0xffffffff
call fcn.00663f90
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5ca560
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7197f0
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x7e6410]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], ecx
lea eax, [ebp - 0x18]
mov dword [ebp - 0x10], 0
push eax
call fcn.005b6a10
add esp, 4
push str.songtitlehtmlindex.html
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 0
push eax
call fcn.00428bd0
push 0x786b50
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.00429100
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.006b57b8
add esp, 0xc
mov byte [ebp - 4], 0
test eax, eax
lea ecx, [ebp - 0x14]
sete bl
call fcn.00428810
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 0xffffffff
call fcn.00428810
test bl, bl
je 0x5ca725
push 2
push 0
push dword [ebp - 0x10]
call fcn.006b724c
push dword [ebp - 0x10]
call fcn.006b765f
push 0
push 0
push dword [ebp - 0x10]
mov edi, eax
call fcn.006b724c
lea ebx, [edi + 2]
push ebx
call fcn.006b1920
mov esi, eax
add esp, 0x20
test esi, esi
je 0x5ca725
push ebx
push 0
push esi
call fcn.006b47d0
push dword [ebp - 0x10]
push edi
push 1
push esi
call fcn.006b6232
push dword [ebp - 0x10]
call fcn.006b5369
mov edi, dword [ebp - 0x1c]
lea eax, [esi + 2]
push eax
add edi, 0x1488
mov dword [ebp - 0x10], 0
push 0x78407c
push edi
call fcn.0042a0e0
push esi
call fcn.006b3261
mov ecx, dword [0x7f7170]
add esp, 0x30
test ecx, ecx
je 0x5ca691
mov eax, dword [ecx]
push 0x7425a0
push str.IDS_PREFERENCE
call dword [eax + 8]
jmp 0x5ca696
mov eax, 0x790eb0
push eax
push str._TT_OPTION_
mov ecx, edi
call fcn.00429560
mov ecx, dword [0x7f7170]
test ecx, ecx
je 0x5ca6be
mov eax, dword [ecx]
push 0x7425a0
push str.IDS_BTE_BN_CLOSE
call dword [eax + 8]
jmp 0x5ca6c3
mov eax, 0x790eb0
push eax
push str._TT_CLOSE_
mov ecx, edi
call fcn.00429560
lea eax, [ebp - 0x24]
push eax
call fcn.005b6a10
add esp, 4
push str.songtitlehtml_
push eax
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 2
push eax
call fcn.00428bd0
mov ecx, eax
mov byte [ebp - 4], 3
call fcn.00429100
push eax
push str._IMAGE_PATH_
mov ecx, edi
call fcn.00429560
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 2
call fcn.00428810
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.00428810
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret