joyce8/EMBER2024-capa huggingface dataset:
Function at 0x448310
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [0x5f95b8]
push esi
push edi
test ecx, ecx
je 0x448328
call fcn.0044c610
mov esi, eax
jmp 0x44832a
xor esi, esi
push ebx
push 0x2801
call fcn.0055ba77
push 0x5002
mov edi, eax
call fcn.0055ba77
mov ecx, dword [ebp + 8]
mov ebx, eax
push dword [ecx + 4]
push dword [ecx]
push str.Warning:_no_object__s_of_type:_d_in_SOUI__
push 0xffffffffffffffff
push 0x2800
push ebx
call fcn.00448cd0
add esp, 0x20
mov dword [ebp + 8], eax
push 0
push 0
push 0
push 0
push eax
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, eax
mov eax, dword [ebp + 8]
cmp eax, 0x2800
jge 0x44839c
push 0
push 0
push ecx
push edi
push eax
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [ebp + 8]
mov byte [eax + edi], 0
push ebx
call fcn.0055ba5c
add esp, 4
pop ebx
test esi, esi
je 0x4483ed
mov eax, dword [esi]
mov ecx, esi
push 1
push 0
mov eax, dword [eax + 0x2c]
call eax
test al, al
je 0x4483ed
mov eax, dword [ebp + 4]
mov ecx, esi
mov edx, dword [esi]
push eax
push 0x59b528
push 0x6f
push str.F:XTrendPCdep_soui_srccoreSObjectFactory.cpp
push edi
push str.soui
push 1
push 0
call dword [edx + 0x34]
push edi
call fcn.0055ba5c
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
ret 4
push 0x2801
call fcn.0055ba77
push 0x59b528
push edi
push 0x6f
push str.F:XTrendPCdep_soui_srccoreSObjectFactory.cpp
push str._s:_d___s__s__n
push 0xffffffffffffffff
mov esi, eax
push 0x2800
push esi
call fcn.0042d1a0
add esp, 0x24
mov byte [eax + esi], 0
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push esi
call fcn.0055ba5c
add esp, 4
push edi
call fcn.0055ba5c
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
ret 4
Function at 0x451e80
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ecx + 4], 0
je 0x451f22
push esi
push edi
mov dword [ebp - 4], 0
call fcn.0044c370
mov esi, eax
test esi, esi
je 0x451f10
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push dword [ebp + 8]
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 4]
test edi, edi
je 0x451f10
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x451f10
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp - 0xc]
pop edi
mov dword [ecx], eax
lea eax, [esi + 1]
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
pop edi
pop esi
mov dword [eax], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
push dword [ecx + 8]
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov eax, 1
mov esp, ebp
pop ebp
ret 0x10
Function at 0x456220
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58e10d
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5f0a00]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x456267
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea esi, [edi + 0x50]
mov ecx, esi
mov dword [ebp - 0x14], esi
call fcn.00497540
push 0x599fa0
push ebx
mov dword [ebp - 4], 0
call fcn.00561309
add esp, 8
push dword [ebp + 0xc]
test eax, eax
jne 0x45629d
call fcn.00495830
add esp, 4
jmp 0x4563e7
push ebx
mov ecx, edi
call fcn.0044c620
mov ecx, eax
test ecx, ecx
jne 0x4563dd
mov edi, dword [0x5f95b8]
test edi, edi
je 0x4562be
mov edi, dword [edi + 0x28]
jmp 0x4562c0
xor edi, edi
push 0x2801
call fcn.0055ba77
push 0x5002
mov dword [ebp - 0x10], eax
call fcn.0055ba77
mov edx, dword [ebp + 0xc]
push edx
push ebx
push str.load_image_failed__resource_index__s:_s_not_found_
push 0xffffffffffffffff
push 0x2800
push eax
mov dword [ebp + 8], eax
call fcn.00448cd0
add esp, 0x20
mov ebx, eax
mov dword [ebp + 0xc], ebx
push 0
push 0
push 0
push 0
push ebx
push dword [ebp + 8]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp ebx, 0x2800
mov ebx, dword [ebp - 0x10]
jge 0x456337
push 0
push 0
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [ebp + 0xc]
mov byte [eax + ebx], 0
push dword [ebp + 8]
call fcn.0055ba5c
add esp, 4
test edi, edi
je 0x45638b
mov eax, dword [edi]
mov ecx, edi
push 3
push 0
mov eax, dword [eax + 0x2c]
call eax
test al, al
je 0x45638b
mov eax, dword [ebp + 4]
mov ecx, edi
mov edx, dword [edi]
push eax
push 0x59b528
push 0x464
push str.F:XTrendPCdep_soui_srcSApp.cpp
push ebx
push str.soui
push 3
push 0
call dword [edx + 0x34]
mov esi, dword [ebp - 0x14]
push ebx
call fcn.0055ba5c
add esp, 4
xor edi, edi
jmp 0x4563e9
push 0x2801
call fcn.0055ba77
push 0x59b528
push ebx
push 0x464
push str.F:XTrendPCdep_soui_srcSApp.cpp
push str._s:_d___s__s__n
push 0xffffffffffffffff
mov edi, eax
push 0x2800
push edi
call fcn.0042d1a0
add esp, 0x24
mov byte [eax + edi], 0
push edi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push edi
call fcn.0055ba5c
add esp, 4
push ebx
call fcn.0055ba5c
add esp, 4
xor edi, edi
jmp 0x4563e9
mov edx, dword [ebp + 0xc]
mov eax, dword [ecx]
push edx
push ebx
call dword [eax + 0x24]
mov edi, eax
mov ecx, esi
mov dword [ebp - 4], 3
call fcn.00497550
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x458550
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58edad
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5f0a00]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0x14]
mov dword [edi], 0
mov dword [ebx], 0
cmp dword [ecx + 4], 0
je 0x458667
mov dword [ebp + 0x10], 0
call fcn.0044c370
mov esi, eax
test esi, esi
je 0x458651
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp + 0x10]
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push dword [ebp + 8]
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x458651
lea eax, [ebp + 0x14]
mov dword [ebp - 0x10], 0
push eax
push 0
lea eax, [ebp - 0x10]
mov dword [ebp + 0x14], 0
push eax
push 0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp + 0x14]
mov dword [ebx], ecx
test eax, eax
jne 0x458641
push ecx
call fcn.0055278b
add esp, 4
mov dword [edi], eax
lea ecx, [ebp + 0x14]
push ecx
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x458641
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push dword [edi]
call fcn.00552794
add esp, 4
mov dword [edi], 0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [ecx]
lea edx, [ebp + 0xc]
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push edx
call dword [eax + 0xc]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], 0
mov ebx, dword [eax - 8]
test ebx, ebx
jne 0x45868d
xor esi, esi
jmp 0x4586cf
mov ecx, dword [ebp + 0x14]
mov eax, ebx
shr eax, 1
push eax
mov dword [ecx], eax
call fcn.0055278b
add esp, 4
mov dword [edi], eax
xor esi, esi
test ebx, ebx
jle 0x4586c7
mov eax, dword [ebp + 0xc]
mov ecx, esi
shr ecx, 1
mov dl, byte [eax + esi*2 + 2]
shl dl, 4
sub dl, 0x51
add dl, byte [eax + esi*2]
add esi, 2
mov eax, dword [edi]
mov byte [ecx + eax], dl
cmp esi, ebx
jl 0x4586a7
mov eax, dword [ebp + 0xc]
mov esi, 1
add eax, 0xfffffff4
mov dword [ebp - 4], 1
cmp eax, dword [0x5f012c]
je 0x4586f6
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4586f6
push eax
call fcn.00408c50
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x458710
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ecx + 4], 0
je 0x4587a3
push esi
push edi
mov dword [ebp - 4], 0
call fcn.0044c370
mov esi, eax
test esi, esi
je 0x458798
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push dword [ebp + 8]
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 4]
test edi, edi
je 0x458798
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x458798
mov eax, dword [ebp - 0xc]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp + 0x10]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
push dword [ecx + 8]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x45d3f0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, ecx
push edi
cmp dword [esi + 4], 0
je 0x45d477
mov dword [ebp + 0x10], 0
call fcn.0044c370
mov esi, eax
test esi, esi
je 0x45d46c
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 0x10]
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push dword [ebp + 8]
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x45d46c
push dword [ebp + 0x14]
push ebx
push 3
push 0
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
pop edi
pop esi
sete al
pop ebx
mov esp, ebp
pop ebp
ret 0x10
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [ebp + 0x14]
mov ecx, 2
lea eax, [eax*2 + 1]
mul ecx
mov ecx, 0xffffffff
cmovb eax, ecx
push eax
call fcn.0055278b
mov edx, dword [ebp + 0x14]
add esp, 4
xor ecx, ecx
mov edi, eax
test edx, edx
je 0x45d4cd
movzx eax, byte [ebx + ecx]
and al, 0xf
movzx eax, al
add ax, 0x41
mov word [edi + ecx*4], ax
movzx eax, byte [ebx + ecx]
shr al, 4
movzx eax, al
add ax, 0x41
mov word [edi + ecx*4 + 2], ax
inc ecx
cmp ecx, edx
jb 0x45d4a4
xor eax, eax
push edi
push dword [ebp + 0xc]
mov word [edi + ecx*4], ax
mov ecx, esi
mov eax, dword [esi]
push dword [ebp + 8]
call dword [eax + 0x10]
push edi
mov esi, eax
call fcn.00552794
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x45d500
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x5f0a00]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
cmp dword [esi + 4], 0
je 0x45d5ac
mov dword [ebp - 0x28], 0
call fcn.0044c370
mov esi, eax
test esi, esi
je 0x45d597
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x28]
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 0x28]
test edi, edi
je 0x45d597
push 4
lea eax, [ebp + 0x10]
push eax
push 4
push 0
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
pop edi
pop esi
sete al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00551e44
mov esp, ebp
pop ebp
ret 0xc
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00551e44
mov esp, ebp
pop ebp
ret 0xc
push dword [ebp + 0x10]
lea eax, [ebp - 0x24]
push 0x59af7c
push 0x10
push eax
call fcn.0045e880
add esp, 0x10
lea eax, [ebp - 0x24]
push dword [esi + 8]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00551e44
mov esp, ebp
pop ebp
ret 0xc
Function at 0x467820
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58fbd0
mov eax, dword fs:[0]
push eax
sub esp, 0xd0
mov eax, dword [0x5f0a00]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0xdc], ebx
mov esi, dword [ebp + 8]
mov eax, dword [esi]
cmp dword [eax - 8], 0
jne 0x467868
xor eax, eax
jmp 0x4679f0
lea ecx, [ebp - 0xd8]
call fcn.004411c0
mov ecx, dword [0x5f95b8]
lea eax, [ebp - 0xd8]
push esi
push eax
mov dword [ebp - 4], 0
call fcn.00456410
test eax, eax
je 0x4678bc
mov edi, dword [ebx + 8]
lea eax, [ebp - 0xdc]
push 0
push str.SOUI
push eax
lea ecx, [ebp - 0xd8]
call fcn.00441d50
lea ecx, [ebx + 8]
push dword [eax]
call dword [edi + 0x28]
mov esi, eax
jmp 0x4679e3
mov ecx, dword [0x5f95b8]
test ecx, ecx
je 0x4678cf
call fcn.0044c610
mov esi, eax
jmp 0x4678d1
xor esi, esi
push 0x2801
call fcn.0055ba77
push 0x5002
mov edi, eax
call fcn.0055ba77
mov ebx, eax
mov eax, dword [ebp - 0xdc]
push dword [eax + 0x42c]
push str.Load_layout___s__Failed
push 0xffffffffffffffff
push 0x2800
push ebx
call fcn.00448cd0
add esp, 0x1c
mov dword [ebp - 0xdc], eax
push 0
push 0
push 0
push 0
push eax
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, eax
mov eax, dword [ebp - 0xdc]
cmp eax, 0x2800
jge 0x46794f
push 0
push 0
push ecx
push edi
push eax
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [ebp - 0xdc]
mov byte [eax + edi], 0
push ebx
call fcn.0055ba5c
add esp, 4
test esi, esi
je 0x467993
mov eax, dword [esi]
mov ecx, esi
push 3
push 0
mov eax, dword [eax + 0x2c]
call eax
test al, al
je 0x467993
mov eax, dword [ebp + 4]
mov ecx, esi
mov edx, dword [esi]
push eax
push 0x59b528
push 0x25a
push str.F:XTrendPCdep_soui_srccore_shostwnd.cpp
push edi
push str.soui
push 3
push 0
call dword [edx + 0x34]
jmp 0x4679d8
push 0x2801
call fcn.0055ba77
push 0x59b528
push edi
push 0x25a
push str.F:XTrendPCdep_soui_srccore_shostwnd.cpp
push str._s:_d___s__s__n
push 0xffffffffffffffff
mov esi, eax
push 0x2800
push esi
call fcn.0042d1a0
add esp, 0x24
mov byte [eax + esi], 0
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push esi
call fcn.0055ba5c
add esp, 4
push edi
call fcn.0055ba5c
add esp, 4
xor esi, esi
lea ecx, [ebp - 0xd8]
call fcn.004412f0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00551e44
mov esp, ebp
pop ebp
ret 4
Function at 0x468fb0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [0x5f95b8]
sub esp, 0xc
push esi
push edi
test ecx, ecx
je 0x468fcb
call fcn.0044c610
mov esi, eax
jmp 0x468fcd
xor esi, esi
push 0x2801
call fcn.0055ba77
mov edi, eax
lea eax, [ebp - 0xc]
push str.unhandled_xml_node:
lea ecx, [edi + 0x2800]
mov byte [ecx], 0
push 0x5a31dc
push eax
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edi
call fcn.0046a820
add esp, 0x10
lea ecx, [ebp + 8]
call fcn.004431e0
push eax
lea ecx, [ebp - 0xc]
call fcn.0046a8a0
test esi, esi
je 0x46905c
mov eax, dword [esi]
mov ecx, esi
push 1
push 0
mov eax, dword [eax + 0x2c]
call eax
test al, al
je 0x46905c
mov eax, dword [ebp + 4]
mov ecx, esi
mov edx, dword [esi]
push eax
push str.SOUI::SHostWnd::OnUserXmlNode
push 0x70e
push str.F:XTrendPCdep_soui_srccore_shostwnd.cpp
push edi
push str.soui
push 1
push 0
call dword [edx + 0x34]
push edi
call fcn.0055ba5c
add esp, 4
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x59d21c
lea eax, [ebp - 0xc]
push 0x5a31dc
push eax
call fcn.0046a820
push str.SOUI::SHostWnd::OnUserXmlNode
lea eax, [ebp - 0xc]
push 0x5a31dc
push eax
call fcn.0046a820
push 0x59d21c
lea eax, [ebp - 0xc]
push 0x5a31dc
push eax
call fcn.0046a820
push str.F:XTrendPCdep_soui_srccore_shostwnd.cpp
lea eax, [ebp - 0xc]
push 0x5a31dc
push eax
call fcn.0046a820
push 0x5a38b0
lea eax, [ebp - 0xc]
push 0x5a31dc
push eax
call fcn.0046a820
push 0x70e
lea eax, [ebp - 0xc]
push 0x5a31e0
push eax
call fcn.0046a820
add esp, 0x48
push 0x5a38b4
push 0x5a31dc
push eax
call fcn.0046a820
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push edi
call fcn.0055ba5c
add esp, 4
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x46b890
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x5f0a00]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x24]
push eax
push str.ntdll.dll
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x46b929
push esi
call fcn.0055ba77
add esp, 4
mov ebx, eax
mov dword [ebp - 0x18], ebx
push ebx
push esi
push dword [ebp - 0x24]
push str.ntdll.dll
call sub.VERSION.dll_GetFileVersionInfoW
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x20]
push eax
push 0x59a5d0
push ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x46b913
cmp dword [ebp - 0x28], 0x34
jb 0x46b913
mov eax, dword [ebp - 0x20]
push dword [ebp - 0x18]
movzx edi, word [eax + 0xe]
movzx ebx, word [eax + 8]
movzx esi, word [eax + 0xa]
call fcn.0055ba5c
add esp, 4
jmp 0x46b932
push dword [ebp - 0x18]
mov esi, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x18]
call fcn.0055ba5c
add esp, 4
jmp 0x46b932
mov esi, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x18]
movzx eax, di
cmp si, 6
jb 0x46ba7d
ja 0x46b962
cmp bx, 1
jb 0x46ba7d
jbe 0x46b954
mov edi, 0x64
jmp 0x46b96d
mov ecx, 0x1db0
cmp ax, cx
jb 0x46ba7d
mov edi, 0x64
cmp si, 0xa
jae 0x46b9bd
cmp si, 6
ja 0x46b9ce
cmp bx, 3
jae 0x46b9ce
mov ebx, dword [ebp - 0x1c]
push ebx
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
push 0x58
push esi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
imul ecx, eax, 0x64
mov eax, 0x2aaaaaab
push esi
push ebx
imul ecx
sar edx, 4
mov edi, edx
shr edi, 0x1f
add edi, edx
call dword [sym.imp.USER32.dll_ReleaseDC]
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00551e44
mov esp, ebp
pop ebp
ret
ja 0x46ba2d
test bx, bx
jne 0x46ba2d
mov ecx, 0x3a6b
cmp ax, cx
jae 0x46ba2d
push str.Shcore.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x46ba6a
mov ebx, dword [ebp - 0x1c]
lea eax, [ebp - 0x14]
push eax
xorps xmm0, xmm0
push ebx
movups xmmword [ebp - 0x14], xmm0
call dword [sym.imp.USER32.dll_GetWindowRect]
push 2
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_MonitorFromRect]
push str.GetDpiForMonitor
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x46ba63
lea ecx, [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x18]
push ecx
push 0
push ebx
call eax
test eax, eax
js 0x46ba63
imul ecx, dword [ebp - 0x18], 0x64
jmp 0x46ba57
push str.User32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x46ba6a
push str.GetDpiForWindow
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x46ba63
mov ebx, dword [ebp - 0x1c]
push ebx
call eax
imul ecx, eax, 0x64
mov eax, 0xaaaaaaab
mul ecx
mov edi, edx
shr edi, 6
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00551e44
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 0x64
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00551e44
mov esp, ebp
pop ebp
ret
Function at 0x47f510
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
push 0x12
mov ebx, edi
call dword [sym.imp.USER32.dll_GetKeyState]
test al, al
jns 0x47f550
lea eax, [edi - 0x61]
cmp eax, 0x19
lea edi, [ebx - 0x20]
cmova edi, ebx
lea ebx, [esi + 0x2a4]
push edi
mov ecx, ebx
call fcn.004d1d10
test eax, eax
je 0x47f556
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 0xc
lea ebx, [esi + 0x2a4]
mov ecx, ebx
call fcn.004479a0
push eax
call fcn.0049a530
add esp, 4
test eax, eax
je 0x47f590
lea ecx, [ebp + 0xc]
mov dword [ebp + 0xc], 0
push ecx
push dword [ebp + 0x10]
mov ecx, eax
push edi
push dword [ebp + 8]
call fcn.0047cdd0
mov ecx, dword [ebp + 0xc]
pop edi
mov dword [esi + 0x18], ecx
pop esi
pop ebx
pop ebp
ret 0xc
pop edi
mov dword [esi + 0x18], 0
xor eax, eax
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x4862e0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x591711
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5f0a00]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
call fcn.0048ce10
mov dword [ebx], vtable.SOUI::SRichEdit.0
lea edi, [ebx + 4]
mov dword [edi], vtable.SOUI::SRichEdit.1.0
mov eax, 0x2a
mov word [ebx + 0x4cc], ax
mov dword [ebx + 8], vtable.SOUI::SRichEdit.2.0
mov dword [ebx + method.SOUI::SPanel.3.virtual_0], vtable.SOUI::SRichEdit.3.0
mov dword [ebx + 0x4c8], 0x7fff
mov dword [ebx + 0x4d0], 0xffffffff
mov dword [ebx + 0x4dc], 0
mov dword [ebx + 0x4e0], 0
mov dword [ebx + 0x4e4], 0
mov dword [ebx + 0x4e8], 0
mov eax, dword [ebx + 0x4f4]
or eax, 1
mov dword [ebx + 0x4f0], 0x80
and eax, 0xfffffffd
mov byte [ebx + 0x4f8], 0
or eax, 4
mov dword [ebp - 4], 0
or eax, 8
and eax, 0xffffffef
and eax, 0xffffffdf
and eax, 0xffffffbf
and eax, 0xffffff7f
or eax, 0x100
and eax, 0xfffffdff
and eax, 0xfffffbff
and eax, 0xfffff7ff
and eax, 0xffffefff
and eax, 0xffffdfff
mov dword [ebx + 0x4f4], eax
mov eax, dword [0x5f0130]
mov dword [ebx + 0x4fc], eax
mov dword [ebx + 0x500], 0
mov dword [ebx + 0x504], 0
mov dword [ebx + 0x508], 0
mov dword [ebx + 0x50c], 0
mov dword [ebx + 0x510], 0
mov dword [ebx + 0x514], 0
push 0x64
mov dword [ebx + 0x518], 0
mov word [ebx + 0x51c], 0
mov byte [ebx + 0x51e], 0
mov ecx, dword [0x5f95b8]
push 6
mov byte [ebp - 4], 1
call fcn.0044c430
mov dword [ebx + 0x17c], eax
lea ecx, [ebx + 0x30]
mov eax, dword [ebx + 0x164]
or eax, 0x20
mov dword [ebx + 0x4d8], 0
push 0x5a6e5c
or eax, 8
mov dword [ebx + 0x4d4], 0
push 0x3e80
mov dword [ebx + 0x164], eax
call fcn.0048c7e0
push 0x5a6ed4
push 0x3e81
lea ecx, [ebx + 0x30]
call fcn.0048c7e0
push 0x5a6df4
push 0x2008
lea ecx, [ebx + 0x30]
call fcn.0048c7e0
mov dword [ebx], vtable.SOUI::SEdit.0
mov dword [edi], vtable.SOUI::SEdit.1.0
mov dword [ebx + 8], vtable.SOUI::SEdit.2.0
mov dword [ebx + method.SOUI::SPanel.3.virtual_0], vtable.SOUI::SEdit.3.0
mov dword [ebx + 0x520], 0xffffff
mov eax, dword [0x5f0130]
mov dword [ebp - 4], 2
mov dword [ebx + 0x524], eax
mov byte [ebp - 4], 3
push edi
lea ecx, [ebx + 0x528]
call fcn.00474270
mov eax, dword [ebx + 0x4f4]
and eax, 0xfffffffb
mov dword [ebx + 0x520], 0xffcccccc
or eax, 0x800
mov dword [ebx + 0x4f4], eax
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret