joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404324
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 4
mov eax, 0x4615f5
call fcn.00456faa
mov esi, ecx
mov eax, dword [0x4833bc]
mov ecx, 0x4833bc
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
call fcn.00402030
push eax
lea ecx, [ebp - 0x10]
call fcn.00402207
mov ebx, str.selfupd.ini
lea eax, [ebp - 0x10]
call fcn.004045fb
lea edi, [esi + 0x1c]
lea eax, [ebp - 0x10]
call fcn.004052c3
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x40438f
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00404929
xor eax, eax
call fcn.00457082
ret
push dword [edi]
push esi
call fcn.0044baf7
xor esi, esi
test eax, eax
jge 0x4043ac
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00404929
mov eax, esi
jmp 0x404389
inc esi
jmp 0x40439d

Function at 0x4049a4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push dword [esp + 0xc]
mov esi, eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4049bb
pop esi
ret
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x4049f0
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, edi
and esi, 0xf
jbe 0x4049ec
cmp edi, eax
jae 0x4049f0
dec esi
movzx ecx, word [edi]
lea edi, [edi + ecx*2 + 2]
jne 0x4049de
cmp edi, eax
jb 0x4049f4
xor eax, eax
jmp 0x4049fe
mov ax, word [edi]
neg ax
sbb eax, eax
and eax, edi
pop edi
pop esi
ret

Function at 0x404f79
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [esi]
and dword [esi], 0
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push 0
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x404fdc
cmp dword [ebp + 0xc], 1
je 0x404fb5
cmp dword [ebp + 0xc], 2
je 0x404fb5
push 0xd
pop eax
jmp 0x404fdc
test edi, edi
mov eax, dword [ebp - 4]
je 0x404fd6
test eax, eax
je 0x404fd2
test al, 1
jne 0x404fb0
mov ecx, eax
shr ecx, 1
cmp word [edi + ecx*2 - 2], 0
je 0x404fd6
jmp 0x404fb0
and word [edi], 0
shr eax, 1
mov dword [esi], eax
xor eax, eax
leave
ret 8

Function at 0x405a58
Capabilities:
Check if file exists
Create directory
Set file attributes

Disassembly:
push ecx
push esi
push edi
push dword [esp + 0x14]
mov edi, eax
push dword [esp + 0x14]
call fcn.004059de
mov esi, eax
test esi, esi
jl 0x405aae
push dword [edi]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x405aac
mov eax, dword [edi]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jl 0x405aae
push 2
push dword [edi]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ecx, dword [edi]
push 0x20
push 0x120089
call fcn.0040231b
mov esi, eax
test esi, esi
jge 0x405aac
xor esi, esi
inc esi
mov eax, esi
pop edi
pop esi
pop ecx
ret 8
Function at 0x406281
Capabilities:
Delete file

Disassembly:
push 0x18
mov eax, 0x464b80
call fcn.00456faa
mov eax, dword [0x4833bc]
mov esi, 0x4833bc
mov ecx, esi
call dword [eax + 0xc]
lea edi, [eax + 0x10]
mov dword [ebp - 0x10], edi
and dword [ebp - 4], 0
mov eax, dword [0x4833bc]
mov ecx, esi
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x18], esi
mov byte [ebp - 4], 1
push dword [ebp + 0xc]
lea eax, [ebp - 0x20]
push eax
call fcn.00405099
test ebx, ebx
mov byte [ebp - 4], 2
jne 0x4062da
mov dword [ebp - 0x14], 0x80070057
jmp 0x40636d
lea eax, [ebx + 0x60]
lea edi, [ebp - 0x10]
mov dword [ebp - 0x1c], eax
call fcn.004052c3
lea eax, [ebp + 0xc]
push str..pack
push eax
mov ecx, edi
call fcn.00406a50
pop ecx
pop ecx
lea edi, [ebp - 0x18]
mov byte [ebp - 4], 3
call fcn.004052c3
mov byte [ebp - 4], 2
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
call fcn.00404929
mov esi, dword [ebp - 0x18]
push esi
push dword [ebp - 0x1c]
call fcn.00405232
and dword [ebp + 0xc], 0
mov edi, dword [ebp - 0x10]
push dword [ebp - 0x20]
mov ecx, ebx
push dword [ebp + 8]
call fcn.00405fd1
test eax, eax
mov dword [ebp - 0x14], eax
jl 0x40636d
call fcn.004057ca
push dword [ebp + 0x10]
push edi
push esi
call fcn.00424de5
test eax, eax
mov dword [ebp - 0x14], eax
jge 0x40635d
inc dword [ebp + 0xc]
cmp dword [ebp + 0xc], 1
jl 0x406328
jmp 0x40636d
push edi
push dword [ebp - 0x1c]
call fcn.00405232
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff0
call fcn.00404929
lea eax, [esi - 0x10]
call fcn.00404929
lea eax, [edi - 0x10]
call fcn.00404929
mov eax, dword [ebp - 0x14]
call fcn.00457082
ret 0xc
Function at 0x406c48
Capabilities:
Create process on windows
Shutdown system

Disassembly:
push ebx
push esi
xor esi, esi
mov ebx, ecx
mov ecx, dword [eax + 8]
inc esi
cmp ecx, esi
push edi
jne 0x406d63
mov eax, dword [eax + 0xc]
cmp eax, 0x1b5b
jne 0x406c76
mov edi, str.do:UI_Setting_Protection
call fcn.0040a64a
mov eax, esi
jmp 0x406d68
cmp eax, 0x1b58
jne 0x406c86
mov ecx, ebx
call fcn.0043c9ae
jmp 0x406c6f
cmp eax, 0x1b5a
jne 0x406c94
call fcn.0043cb3e
jmp 0x406c6f
cmp eax, 0x1b5c
jne 0x406ca5
mov ecx, dword [ebx + 0x50]
mov eax, dword [ecx]
call dword [eax + 0x1c]
jmp 0x406c6f
cmp eax, 0x1b5d
jne 0x406cc4
call fcn.00407d0e
test eax, eax
je 0x406c6f
push 0x80020011
push 0x12
call dword [sym.imp.USER32.dll_ExitWindowsEx]
jmp 0x406c6f
cmp eax, 0x1b59
je 0x406c9b
cmp eax, 0xea76
jne 0x406cd9
call fcn.0043cba0
jmp 0x406c6f
cmp eax, 0xea8e
je 0x406cd2
cmp eax, 0x1bc4
jne 0x406cf3
mov esi, ebx
call fcn.0043cca1
xor eax, eax
inc eax
jmp 0x406d68
cmp eax, 0x1bc3
jne 0x406d03
mov esi, ebx
call fcn.0043cc45
jmp 0x406cee
cmp eax, 0x1bc2
je 0x406c9b
cmp eax, 0xea8f
jne 0x406d2d
push 5
xor eax, eax
push eax
push eax
push str.http:__bbs.duba.net_forum_6505_1.html
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x406c6f
cmp eax, 0xee4a
jne 0x406d3f
push ebx
call fcn.0043cd34
jmp 0x406c6f
cmp eax, 0xee4b
jne 0x406d51
push ebx
call fcn.0043cd7a
jmp 0x406c6f
cmp eax, 0xee4c
jne 0x406d63
push ebx
call fcn.0043cdc0
jmp 0x406c6f
and dword [ebx], 0
xor eax, eax
pop edi
pop esi
pop ebx
ret
Function at 0x40715c
Capabilities:
Check if file exists

Disassembly:
push 0xc
mov eax, 0x4627b4
call fcn.00456faa
call fcn.0041189b
xor ebx, ebx
cmp dword [eax], ebx
jne 0x407183
call fcn.00414f02
call fcn.0041189b
mov dword [eax], 1
call fcn.00407658
mov ecx, eax
call fcn.00407694
cmp eax, ebx
jne 0x40719a
xor eax, eax
jmp 0x4072b8
mov eax, dword [0x4833bc]
mov esi, 0x4833bc
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x4679c8
mov dword [ebp - 4], ebx
call fcn.004072be
cmp eax, ebx
pop ecx
mov dword [0x483890], eax
jne 0x4071df
lea eax, [ebp - 0x10]
push eax
mov ecx, str.Microsoft_YaHei
call fcn.004072be
mov dword [0x483890], eax
jmp 0x4071e7
push dword [ebp - 0x10]
call fcn.00414fe9
mov edi, dword [0x483890]
pop ecx
call fcn.00412f13
cmp dword [0x483890], ebx
mov dword [eax + 0x98], edi
je 0x407206
push dword [ebp - 0x10]
jmp 0x40720b
push 0x4679f4
call fcn.00414fe9
mov eax, dword [0x4833bc]
pop ecx
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.00407484
mov edi, dword [ebp - 0x14]
cmp dword [edi - 0xc], ebx
je 0x40728f
mov eax, dword [0x4833bc]
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 2
call fcn.00407658
push edi
push dword [eax]
lea eax, [ebp - 0x18]
push str._s_s.ksfskin
call fcn.00404ecc
mov esi, dword [ebp - 0x18]
add esp, 0xc
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ebx, eax
lea eax, [esi - 0x10]
mov byte [ebp - 4], 1
call fcn.00404929
test ebx, ebx
je 0x40728f
call fcn.0040740c
mov esi, eax
test esi, esi
jne 0x4072a3
call fcn.0040743e
jmp 0x4072a3
call fcn.0040743e
xor esi, esi
inc esi
push esi
call fcn.004079a4
pop ecx
call fcn.00407a0a
lea eax, [edi - 0x10]
call fcn.00404929
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00404929
mov eax, esi
call fcn.00457082
ret

Function at 0x407484
Capabilities:
Read .ini file

Disassembly:
push 4
mov eax, 0x46383b
call fcn.00456faa
mov esi, ecx
call fcn.004051f2
push str._skincfg.ini
call fcn.00407658
lea ecx, [ebp - 0x10]
push ecx
mov ecx, eax
call fcn.00406a50
pop ecx
pop ecx
and dword [ebp - 4], 0
push dword [eax]
push 0x104
push 0x105
call fcn.004050f0
push eax
push 0x467710
push str.current
push 0x4679bc
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
or dword [ebp - 4], 0xffffffff
mov edi, eax
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00404929
mov eax, dword [esi]
test eax, eax
je 0x4074f8
push eax
call dword [sym.imp.MSVCR80.dll_wcslen]
pop ecx
mov edx, esi
call fcn.00404d70
mov eax, edi
call fcn.00457082
ret
Function at 0x407e01
Capabilities:
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x46416a
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x481028]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov edi, dword [esp + 0x24]
xor eax, eax
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
lea ebp, [edi + 0x10]
mov ebx, 0x4833bc
mov ecx, ebx
mov esi, ebp
mov dword [esp + 0x1c], eax
call fcn.00404b28
lea esi, [edi + 0x14]
mov ecx, ebx
mov byte [esp + 0x1c], 1
call fcn.00404b28
lea esi, [edi + 0x18]
mov ecx, ebx
mov byte [esp + 0x1c], 2
call fcn.00404b28
fld dword [0x46f3e0]
sub esp, 0xc
fstp dword [esp + 8]
lea eax, [edi + 0x58]
fld dword [0x46f3e4]
fstp dword [esp + 4]
fld dword [0x46f3e8]
fstp dword [esp]
call fcn.004109bf
lea eax, [edi + 0x1c]
mov byte [esp + 0x1c], 4
and dword [edi], 0
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 1
call fcn.00402030
push eax
mov ecx, ebp
call fcn.00402177
push str.ksfmon.ini
push ebp
call fcn.004046e1
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov esi, 0x80
push esi
push dword [ebp]
call ebx
call fcn.00402030
push eax
lea ecx, [edi + 0x18]
call fcn.00402207
push str.ksfmonfun.ini
lea eax, [edi + 0x18]
push eax
call fcn.004046e1
push esi
push dword [edi + 0x18]
call ebx
push 1
call fcn.00402030
push eax
lea ecx, [edi + 0x14]
call fcn.00402177
push str.ksftray.ini
lea eax, [edi + 0x14]
push eax
call fcn.004046e1
push esi
push dword [ebp]
call ebx
push esi
push dword [edi + 0x18]
call ebx
push esi
push dword [edi + 0x14]
call ebx
push 0x24
push 0
lea eax, [edi + 0x34]
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
mov eax, edi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 4
Function at 0x408e16
Capabilities:
Read .ini file

Disassembly:
push ebp
lea ebp, [esp - 0x18c]
sub esp, 0x20c
mov eax, dword [0x481028]
xor eax, ebp
mov dword [ebp + 0x188], eax
test esi, esi
mov eax, dword [ebp + 0x194]
mov dword [ebp - 0x80], eax
je 0x408e93
test edi, edi
je 0x408e93
and word [ebp - 0x78], 0
push 0x1fe
lea eax, [ebp - 0x76]
push 0
push eax
mov dword [ebp - 0x7c], 0x80004005
call sub.MSVCR80.dll_memset
add esp, 0xc
push esi
push pe_nt_image_headers32
lea eax, [ebp - 0x78]
push eax
push 0
push edi
push str.SPCfg
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x408e8e
mov ecx, dword [ebp - 0x80]
lea eax, [ebp - 0x78]
push eax
call dword [0x466464]
and dword [ebp - 0x7c], 0
mov eax, dword [ebp - 0x7c]
jmp 0x408e98
mov eax, 0x80004005
mov ecx, dword [ebp + 0x188]
xor ecx, ebp
call fcn.004568ce
add ebp, 0x18c
leave
ret

Function at 0x408faf
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x481028]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
test esi, esi
jne 0x408fd0
mov eax, 0x80004005
jmp 0x40904f
and word [ebp - 0x804], 0
push ebx
push 0x7fe
lea eax, [ebp - 0x802]
push 0
push eax
mov ebx, 0x80004005
call sub.MSVCR80.dll_memset
add esp, 0xc
push esi
push 0x400
lea eax, [ebp - 0x804]
push eax
push 0
mov eax, str.SPRoot
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x40904c
lea eax, [ebp - 0x804]
mov esi, 0x4842c8
push eax
mov ecx, esi
call dword [0x466464]
mov eax, dword [0x4842dc]
dec eax
push eax
mov ecx, esi
call dword [sym.imp.MSVCP80.dll_public:_wchar_t____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator___unsigned_int_]
cmp word [eax], 0x5c
je 0x40904a
push 0x467230
mov ecx, esi
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::append_wchar_t_const__]
xor ebx, ebx
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004568ce
leave
ret

Function at 0x4090cb
Capabilities:
Read .ini file

Disassembly:
push ebp
lea ebp, [esp - 0x78c]
sub esp, 0x80c
mov eax, dword [0x481028]
xor eax, ebp
mov dword [ebp + 0x788], eax
test edi, edi
mov eax, dword [ebp + 0x794]
push esi
mov dword [ebp - 0x80], eax
je 0x40914e
xor eax, eax
mov esi, str.kxebase.dll
cmp eax, esi
je 0x40914e
and word [ebp - 0x78], ax
push 0x7fe
push eax
lea eax, [ebp - 0x76]
push eax
mov dword [ebp - 0x7c], 0x80004005
call sub.MSVCR80.dll_memset
add esp, 0xc
push edi
push 0x400
lea eax, [ebp - 0x78]
push eax
push 0
push esi
push str.ProductInfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x409149
mov ecx, dword [ebp - 0x80]
lea eax, [ebp - 0x78]
push eax
call dword [0x466464]
and dword [ebp - 0x7c], 0
mov eax, dword [ebp - 0x7c]
jmp 0x409153
mov eax, 0x80004005
mov ecx, dword [ebp + 0x788]
xor ecx, ebp
pop esi
call fcn.004568ce
add ebp, 0x78c
leave
ret
Function at 0x4093b1
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
cmp dword [eax + 0x34], esi
jne 0x4093c6
mov eax, 0xe0000017
jmp 0x409437
cmp dword [eax + 0x38], 8
mov dword [ebp - 0xc], 1
mov dword [ebp - 8], 0x208
mov dword [ebp - 4], esi
jb 0x4093e2
mov eax, dword [eax + 0x24]
jmp 0x4093e5
add eax, 0x24
lea ecx, [ebp - 4]
push ecx
push 0x20019
push esi
push eax
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x409437
push edi
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
push esi
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
je 0x409429
mov eax, edi
jmp 0x409436
push 4
push dword [ebp + 8]
call dword [sym.imp.MSVCR80.dll__waccess]
pop ecx
pop ecx
pop edi
pop esi
leave
ret 4

Function at 0x40943c
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x19c]
sub esp, 0x21c
mov eax, dword [0x481028]
xor eax, ebp
mov dword [ebp + 0x198], eax
push esi
push edi
mov esi, ecx
xor edi, edi
cmp dword [esi + 0x34], edi
jne 0x40946c
mov eax, 0xe0000017
jmp 0x409532
cmp ebx, edi
jne 0x409478
or eax, 0xffffffff
jmp 0x409532
push 0x206
lea eax, [ebp - 0x6e]
push edi
push eax
mov dword [ebp - 0x74], edi
mov word [ebp - 0x70], di
call sub.MSVCR80.dll_memset
add esp, 0xc
cmp dword [esi + 0x38], 8
mov dword [ebp - 0x80], 1
mov dword [ebp - 0x7c], 0x208
mov dword [ebp - 0x78], edi
jb 0x4094ad
mov esi, dword [esi + 0x24]
jmp 0x4094b0
add esi, 0x24
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x74]
push eax
push edi
push 0xf003f
push edi
push edi
push edi
push esi
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, edi
jne 0x409532
cmp dword [ebp - 0x78], 2
jne 0x409507
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x80]
push eax
push edi
push edi
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x409507
lea eax, [ebp - 0x70]
push eax
push ebx
call dword [sym.imp.MSVCR80.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x409507
xor esi, esi
jmp 0x409522
push ebx
call dword [sym.imp.MSVCR80.dll_wcslen]
pop ecx
add eax, eax
push eax
push ebx
push 1
push edi
push edi
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
cmp dword [ebp - 0x74], edi
je 0x409530
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp + 0x198]
pop edi
xor ecx, ebp
pop esi
call fcn.004568ce
add ebp, 0x19c
leave
ret
Function at 0x40a0d5
Capabilities:
Create thread

Disassembly:
push 0
mov eax, 0x46505d
call fcn.00456faa
mov edi, dword [ebp + 8]
push edi
call fcn.00453538
xor ebx, ebx
mov dword [ebp - 4], ebx
lea eax, [edi + 0x380]
mov dword [eax], vtable.ICtrlTransparent.0
mov dword [eax], vtable.CLeaksDlg.1.0
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
mov dword [edi], vtable.CLeaksDlg.0
mov dword [edi + 0x388], ebx
mov dword [edi + 0x38c], ebx
mov dword [edi + 0x390], ebx
mov dword [edi + 0x394], ebx
mov dword [edi + 0x398], ebx
mov dword [edi + 0x3a0], ebx
mov dword [edi + 0x3b0], ebx
mov dword [edi + 0x3b4], ebx
mov dword [edi + 0x3b8], ebx
mov dword [edi + 0x3bc], eax
mov dword [edi + method.CLeakListViewHeader.virtual_0], vtable.CLeakListViewHeader.0
lea esi, [edi + 0x3c8]
mov eax, esi
call fcn.00408d37
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi], vtable.CLeakListView.0
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], edi
lea eax, [edi + 0x430]
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
lea eax, [edi + 0x440]
push eax
mov ecx, edi
mov byte [ebp - 4], 3
call fcn.0043bf02
lea eax, [edi + 0x4f4]
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
lea eax, [edi + 0x504]
mov byte [ebp - 4], 5
push eax
mov dword [edi + 0x500], ebx
call fcn.00433408
lea eax, [edi + 0x680]
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov byte [ebp - 4], 7
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
mov dword [edi + 0x694], ebx
mov dword [edi + 0x6a4], ebx
lea esi, [edi + 0x6c4]
mov ecx, 0x4833bc
mov dword [edi + 0x6a8], ebx
mov dword [edi + 0x6ac], ebx
mov dword [edi + 0x6b0], eax
mov dword [edi + 0x690], 0x46e948
call fcn.00404b28
lea esi, [edi + 0x6c8]
mov ecx, 0x4833bc
call fcn.00404b28
lea esi, [edi + 0x6cc]
mov ecx, 0x4833bc
call fcn.00404b28
mov dword [edi + 0x6b4], ebx
mov dword [edi + 0x6b8], ebx
mov dword [edi + 0x6bc], ebx
mov dword [edi + 0x6ec], ebx
mov dword [edi + 0x6dc], 5
lea ecx, [edi + 0x440]
mov byte [ebp - 4], 8
call fcn.0043c0f1
push ebx
push ebx
push 1
push ebx
mov dword [edi + 0x358], ebx
mov dword [edi + 0x368], 6
mov dword [edi + 0x360], 2
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push ebx
push ebx
push edi
push 0x4357ae
push ebx
push ebx
mov dword [edi + 0x500], eax
call dword [sym.imp.MSVCR80.dll__beginthreadex]
add esp, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
call fcn.00457082
ret 4
Function at 0x40a64a
Capabilities:
Create process on windows

Disassembly:
push ebp
sub esp, 0x414
lea ebp, [esp - 4]
mov eax, dword [0x481028]
xor eax, ebp
mov dword [ebp + 0x414], eax
push 4
mov eax, 0x461dff
call fcn.00456faa
mov eax, dword [0x4833bc]
mov ecx, 0x4833bc
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
xor esi, esi
push eax
mov dword [ebp - 4], esi
call fcn.00402030
mov ecx, eax
call fcn.0040215f
push 0x467230
lea eax, [ebp - 0x10]
push eax
call fcn.004046e1
push str.KSafe.exe
lea eax, [ebp - 0x10]
push eax
call fcn.004046e1
cmp edi, esi
je 0x40a6d6
push edi
push 0x468434
lea eax, [ebp]
push 0x208
push eax
call fcn.0040cce2
add esp, 0x10
push 5
push esi
lea eax, [ebp]
push eax
jmp 0x40a6da
push 5
push esi
push esi
push dword [ebp - 0x10]
push str.open
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00404929
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x414]
xor ecx, ebp
call fcn.004568ce
add ebp, 0x418
leave
ret

Function at 0x40a76e
Capabilities:
Create thread

Disassembly:
push 0x78c
mov eax, 0x465098
call fcn.00456faa
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x88], ebx
mov dword [ebp - 0x10], ebx
jne 0x40a7ae
lea esi, [edi + 0x80]
lea ebx, [ebp - 0x10]
call fcn.0041220e
test eax, eax
jl 0x40a8c1
cmp dword [ebp - 0x10], 0
jne 0x40a8c1
xor ebx, ebx
lea esi, [edi + 0x40]
mov eax, esi
call fcn.00406652
push str.hold
xor ecx, ecx
call fcn.0041512c
cmp eax, 0xffffffff
je 0x40a7f3
push ebx
push ebx
push edi
push 0x40a726
push ebx
push ebx
call dword [sym.imp.MSVCR80.dll__beginthreadex]
add esp, 0x18
mov esi, eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40a8c1
call fcn.0040715c
lea eax, [ebp - 0x798]
push eax
call fcn.0040a0d5
mov dword [ebp - 4], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
lea eax, [ebp - 0x798]
push eax
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 1
call fcn.00434416
xor esi, esi
inc esi
cmp eax, esi
jne 0x40a8a9
cmp dword [0x483924], ebx
jne 0x40a8a9
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x798]
push eax
call fcn.0040a37d
call fcn.0043598f
cmp eax, ebx
jne 0x40a881
mov dword [edi + 0x3c], esi
mov edi, str.do:ui_leakscan_fixfromlib__bksafemaindlghide
call fcn.0040a64a
lea eax, [ebp - 0xa8]
push eax
call fcn.00407e01
mov byte [ebp - 4], 2
call fcn.00407f7f
lea esi, [ebp - 0xa8]
mov byte [ebp - 4], 1
call fcn.00407f43
jmp 0x40a8a9
cmp eax, 2
je 0x40a8a9
cmp dword [0x483924], ebx
jne 0x40a8a9
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x798]
push eax
call fcn.0040a37d
lea eax, [ebp - 0x798]
call fcn.00453652
lea esi, [ebp - 0x20]
call fcn.0040ccca
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x798]
push eax
call fcn.0040a2bd
xor eax, eax
call fcn.00457082
ret