joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bc624
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
test dl, dl
je 0x4bc63b
add esp, 0xfffffff0
call fcn.004053e4
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0044951c
mov eax, dword [0x4c90c0]
cmp byte [eax], 0
jne 0x4bc668
push 0
call sub.ole32.dll_OleInitialize
test eax, 0x80000000
sete al
mov byte [ebx + 0x17c], al
mov eax, dword [0x4c9328]
cmp word [eax + 2], 0
jne 0x4bc682
mov eax, dword [0x4c9328]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004be6ec
mov eax, dword [0x4c9418]
cmp word [eax + 2], 0
jne 0x4bc69c
mov eax, dword [0x4c9418]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004be8f0
mov byte [ebx + 0x35], 0
mov dl, 1
mov eax, dword [0x4504d0]
call fcn.00456a34
mov esi, eax
mov dword [ebx + 0x3c], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x4bee68
mov dl, 1
mov eax, dword [0x431d60]
call fcn.00404e84
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x431d60]
call fcn.00404e84
mov dword [ebx + 0xb0], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0xa5], 1
mov byte [ebx + 0xbc], 1
mov dl, 1
mov eax, dword [0x454bcc]
call fcn.0045feec
mov esi, eax
mov dword [ebx + 0xa0], esi
push 0x4bc87c
mov eax, dword [0x4c9218]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconW
mov edx, eax
mov eax, esi
call fcn.00460380
mov eax, dword [ebx + 0xa0]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x4bf150
mov dl, 1
mov eax, dword [0x431d60]
call fcn.00404e84
mov dword [ebx + 0x98], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x202]
push eax
mov eax, dword [0x4c9218]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameW_1
lea eax, [ebp - 0x202]
mov dx, 0x5c
call fcn.0041cf1c
test eax, eax
je 0x4bc7ad
lea edx, [eax + 2]
lea eax, [ebp - 0x202]
call fcn.0041ccd0
lea eax, [ebp - 0x202]
mov dx, 0x2e
call fcn.0041cf00
test eax, eax
je 0x4bc7c5
mov word [eax], 0
lea eax, [ebp - 0x202]
push eax
call sub.user32.dll_CharNextW_1
push eax
call sub.user32.dll_CharLowerW
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.004072d8
push ebx
push 0x4be0d8
call fcn.004b2434
mov dword [ebx + 0x178], eax
mov byte [ebx + 0xd0], 0
mov eax, dword [0x4c90c0]
cmp byte [eax], 0
jne 0x4bc816
mov eax, ebx
call fcn.004bc9f0
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0xa6], 1
mov byte [ebx + 0xd1], 0
mov byte [ebx + 0xdc], 0
xor eax, eax
mov dword [ebx + 0xd4], eax
mov byte [ebx + 0xd3], 0
xor eax, eax
mov dword [ebx + 0xa8], eax
mov eax, ebx
call fcn.004bf37c
mov eax, ebx
call fcn.004bffac
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x4bc873
call fcn.0040543c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4bccbc
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x170]
test eax, eax
je 0x4bcd5e
cmp dword [ebx + 0x94], 0
jne 0x4bcd58
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x4bcc08
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x4bcd58
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x4bcd1e
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x4bcd58
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0043d204
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4bcd2d
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x4bcf7c
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x4cf284]
cmp dword [eax + 0x170], 0
je 0x4bd0e1
test bl, bl
jne 0x4bd02f
cmp dword [esi + 0x9c], 0
jne 0x4bd024
mov eax, esi
call fcn.004bfdfc
push eax
push 0x4bce88
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x44], 0
je 0x4bcff5
mov eax, dword [0x4cf284]
cmp byte [eax + 0xd3], 0
je 0x4bcff5
mov eax, dword [esi + 0xd8]
call fcn.004081e0
mov edi, eax
cmp edi, 0
jl 0x4bcff5
push 0
mov eax, dword [esi + 0xd8]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x4bcfde
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x4bd024
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.0043d204
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x4bd004
inc dword [esi + 0x9c]
jmp 0x4bd0e1
cmp dword [esi + 0x9c], 0
jle 0x4bd0e1
dec dword [esi + 0x9c]
cmp dword [esi + 0x9c], 0
jne 0x4bd0e1
cmp dword [esi + 0x44], 0
je 0x4bd08c
mov eax, dword [0x4cf284]
cmp byte [eax + 0xd3], 0
je 0x4bd08c
mov eax, dword [esi + 0xd8]
call fcn.004081e0
mov edi, eax
cmp edi, 0
jl 0x4bd08c
push 5
mov eax, dword [esi + 0xd8]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x4bd075
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x4bd0bb
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.0043d204
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x4bd09b
mov eax, dword [esi + 0x98]
mov edx, dword [eax]
call dword [edx + 8]
push 0
lea eax, [esi + 0xd8]
mov ecx, 1
mov edx, dword [0x4b030c]
call fcn.004083a0
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x4bdd24
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffdfc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x4bdd8f
cmp byte [ebx + 0xd3], 0
jne 0x4bdd8f
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x170]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00406a3c
mov eax, dword [esi]
mov dword [esp + 0x200], eax
mov eax, dword [esp + 0x200]
test eax, eax
je 0x4bdd7c
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x4bdd9c
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00406c94
jmp 0x4bdd9c
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00406c94
add esp, 0x204
pop esi
pop ebx
ret

Function at 0x4bf564
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x4bf5d2
mov eax, esi
call fcn.0047cc7c
test al, al
je 0x4bf5d2
mov eax, dword [ebx + 0x84]
call fcn.0047c8d0
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4bf5d2
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xfc]
test al, al
je 0x4bf5c6
push 0
mov eax, dword [ebx + 0x84]
call fcn.0047c8d0
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.0047384c
jmp 0x4bf5d2
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.004bf39c
pop esi
pop ebx
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408f6c
mov ecx, 0x4cc0715b
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e3d0
nop
mov ecx, 0x13cd15f7
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
jl 0x42e030
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x42e01e
nop
popal
nop
nop
nop
nop
nop
jmp loc.00401219

Function at 0x10001000
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10004048]
push edi
mov edi, dword [ebp + 0xc]
lea eax, [eax + 0x10004058]
mov dword [ebp - 4], eax
test edi, edi
jle 0x100010b5
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetPriorityClass]
push esi
mov esi, dword [ebp + 8]
mov ecx, eax
sub esi, eax
nop
movzx eax, byte [section..data]
and eax, 0x38
mov byte [section..data], al
movzx eax, byte [section..data]
and eax, 0x8e
mov byte [section..data], al
movzx eax, byte [section..data]
sub eax, 0xe1
mov byte [section..data], al
movzx eax, byte [section..data]
and eax, 0x36
mov byte [section..data], al
mov al, byte [section..data]
or al, 0x8c
mov byte [section..data], al
mov al, byte [section..data]
or al, 0xe0
mov byte [section..data], al
mov al, byte [section..data]
inc dword [0x10004048]
or al, 0x3c
mov byte [section..data], al
movzx eax, byte [esi + ecx]
sub al, dl
xor al, 0x3f
add al, dl
mov byte [ecx], al
inc ecx
dec edi
mov dword [ebp - 8], ebx
jne 0x10001030
mov eax, dword [ebp - 4]
mov edi, dword [ebp + 0xc]
pop esi
pop ebx
mov ecx, 0x26f2
mov word [ebp + 0xc], cx
movzx edx, word [ebp + 0xc]
or edx, 0x7e42
mov word [ebp + 0xc], dx
movzx ecx, byte [0x10004001]
xor ecx, 0x38
mov byte [0x10004001], cl
movzx edx, byte [0x10004001]
and edx, 0x8b
mov byte [0x10004001], dl
mov cl, byte [0x10004001]
or cl, 0xe5
mov byte [0x10004001], cl
movzx edx, byte [0x10004001]
xor edx, 0x3e
mov byte [0x10004001], dl
movzx ecx, byte [0x10004001]
mov edx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
add ecx, 0x98
mov byte [0x10004001], cl
mov byte [eax + edi], 0
mov dword [ebp + 0xc], str.PQXYdejnstu1289GHMNVWXcdk
mov dword [ebp + 0xc], edx
movzx ecx, byte [0x10004002]
and ecx, 0x60
mov byte [0x10004002], cl
movzx edx, byte [0x10004002]
xor edx, 0xb8
mov byte [0x10004002], dl
movzx ecx, byte [0x10004002]
sub ecx, 0x13
mov byte [0x10004002], cl
movzx edx, byte [0x10004002]
and edx, 0x6c
mov byte [0x10004002], dl
mov cl, byte [0x10004002]
or cl, 0xc6
mov byte [0x10004002], cl
mov dl, byte [0x10004002]
inc dword [0x10004048]
or dl, 0x20
mov byte [0x10004002], dl
movzx ecx, byte [0x10004003]
xor ecx, 0x70
mov byte [0x10004003], cl
mov dword [ebp + 0xc], str.ijlqtyz48DEJKNTUZchinqwxy56
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x401730
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ebx
mov ebx, 0xffffffff
push ecx
sub esp, 0x10
mov eax, dword [ecx]
lock xadd dword [eax + 8], ebx
dec ebx
je 0x401760
lea esp, [ebp - 8]
mov eax, ebx
pop ecx
pop ebx
pop ebp
lea esp, [ecx - 4]
ret 4
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, ebx
sub esp, 0xc
lea esp, [ebp - 8]
pop ecx
pop ebx
pop ebp
lea esp, [ecx - 4]
ret 4

Function at 0x401940
Capabilities:
Enumerate files on windows
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x26c
cmp word [eax], 0
je 0x401961
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x401958
sub eax, ebx
mov ecx, 0x2a
sar eax, 1
mov edx, eax
mov eax, 0x418854
jmp 0x40197c
movzx ecx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x401978
sub eax, 0x418854
mov dword [esp + 4], 0
sar eax, 1
lea eax, [edx + eax + 1]
add eax, eax
mov dword [esp + 8], eax
mov ecx, dword fs:[0x18]
mov eax, dword [ecx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov esi, eax
test eax, eax
je 0x401a6c
xor eax, eax
lea esi, [esi]
movzx edx, word [ebx + eax]
mov word [esi + eax], dx
add eax, 2
test dx, dx
jne 0x4019c8
mov dword [esp + 4], 0x418854
mov dword [esp], esi
call sym._lstrcatW_8
lea eax, [ebp - 0x268]
sub esp, 8
mov dword [esp + 4], eax
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_FindFirstFileW]
sub esp, 8
mov edi, eax
cmp eax, 0xffffffff
je 0x401a48
lea esi, [esi]
nop
mov ecx, 0xffffffff
lea edx, [ebp - 0x23c]
mov eax, ebx
call sym._add_launcher
lea eax, [ebp - 0x268]
mov dword [esp], edi
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_FindNextFileW]
sub esp, 8
test eax, eax
jne 0x401a10
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_FindClose]
sub esp, 4
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4022a0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, eax
push ebx
mov eax, dword fs:[0x18]
sub esp, 0x30
mov dword [esp + 8], 0x18
mov dword [esp + 4], 0
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
test eax, eax
je 0x40235d
mov dword [eax + 8], esi
mov ebx, eax
mov eax, dword [0x412664]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], esi
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x4000000b
mov dword [esp + 8], 0
mov dword [esp + 4], str.Button
mov dword [esp], 0
call dword [sym.imp.user32.dll_CreateWindowExW]
mov dword [ebx], 0x412644
mov dword [ebx + 0xc], eax
mov eax, dword [0x412648]
sub esp, 0x30
mov dword [ebx + 4], eax
mov dword [eax], ebx
mov dword [0x412648], ebx
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x402c10
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, ecx
push ebx
sub esp, 0x2c
cmp word [eax], 0
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], edx
je 0x402cf8
mov ebx, eax
lea esi, [esi]
add ebx, 2
cmp word [ebx], 0
jne 0x402c30
sub ebx, dword [ebp - 0x1c]
mov eax, ebx
sar eax, 1
cmp esi, 0xffffffff
je 0x402cd0
add eax, esi
lea eax, [eax + eax + 4]
mov dword [esp + 4], 0
mov edx, eax
mov dword [esp + 8], edx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 0x24], edx
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov edi, eax
test eax, eax
je 0x402cbd
mov ecx, dword [ebp - 0x1c]
mov dword [esp + 8], ebx
add esi, esi
mov dword [esp], eax
mov dword [esp + 4], ecx
call sym._memcpy
mov ecx, dword [ebp - 0x20]
mov eax, 0x5c
mov dword [esp + 8], esi
mov word [edi + ebx], ax
lea eax, [edi + ebx + 2]
mov dword [esp + 4], ecx
mov dword [esp], eax
call sym._memcpy
mov edx, dword [ebp - 0x24]
xor ecx, ecx
mov word [edi + edx - 2], cx
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
mov esi, dword [ebp - 0x20]
cmp word [esi], 0
je 0x402d01
lea esi, [esi]
add esi, 2
cmp word [esi], 0
jne 0x402ce0
sub esi, dword [ebp - 0x20]
sar esi, 1
jmp 0x402c49
xor eax, eax
xor ebx, ebx
jmp 0x402c40
xor esi, esi
jmp 0x402c4b
Function at 0x4048f0
Capabilities:
Query environment variable

Disassembly:
push ebp
xor edx, edx
mov ebp, esp
push edi
push esi
lea esi, [ebp - 0x630]
push ebx
mov ebx, eax
sub esp, 0x64c
mov eax, dword [eax]
mov word [ebp - 0x630], dx
lea edx, [ebp - 0x634]
mov dword [esp + 0xc], edx
mov dword [ebp - 0x638], 0
mov dword [esp + 8], 0x104
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [eax + 0x40]
lea edx, [ebp - 0x428]
mov edi, dword [sym.imp.kernel32.dll_ExpandEnvironmentStringsW]
sub esp, 0x10
mov dword [esp + 8], 0x104
mov dword [esp + 4], edx
mov dword [esp], esi
call edi
sub esp, 0xc
cmp word [ebp - 0x428], 0
jne 0x404978
mov eax, dword [ebp - 0x638]
test eax, eax
je 0x4049b8
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [ebp - 0x638]
lea edx, [ebp - 0x428]
mov dword [esp + 0x10], 1
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x634]
mov dword [esp + 0xc], 0
mov dword [esp + 4], eax
mov dword [esp], edx
call dword [0x41c5c4]
mov eax, dword [ebp - 0x638]
sub esp, 0x14
test eax, eax
jne 0x40496c
xor eax, eax
mov word [ebp - 0x630], ax
mov eax, dword [ebx]
mov dword [esp + 4], esi
mov dword [esp], ebx
lea ebx, [ebp - 0x220]
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x104
call dword [eax + 0xc]
sub esp, 0x14
mov dword [esp + 4], ebx
mov dword [esp], esi
mov dword [esp + 8], 0x104
call edi
lea eax, [ebp - 0x638]
sub esp, 0xc
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x634]
mov dword [esp], ebx
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0
mov dword [esp + 4], eax
call dword [0x41c5c4]
mov eax, dword [ebp - 0x638]
sub esp, 0x14
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x405280
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x4052db
cmp byte [esi + ebx - 1], 0xa
je 0x4052af
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x4124c8], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret

Function at 0x4053a0
Capabilities:
Check if process is running under wine
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
xor edi, edi
push esi
mov esi, ecx
push ebx
mov ebx, edx
sub esp, 0xcc
mov dword [ebp - 0xac], eax
lea eax, [ebp - 0xa0]
mov dword [edx], 0x320
mov dword [ebp - 0x9c], pe_nt_image_headers32
mov dword [ecx], 0x258
mov dword [esp + 8], eax
mov dword [esp + 4], str.SoftwareWineExplorerDesktops
mov dword [esp], 0x80000001
call dword [sym.imp.advapi32.dll_RegOpenKeyW]
sub esp, 0xc
test eax, eax
je 0x4053fe
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
mov edi, eax
lea eax, [ebp - 0x9c]
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x98]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0xac]
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xa0]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
sub esp, 0x18
test eax, eax
je 0x405456
mov eax, dword [ebp - 0xa0]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
push eax
jmp 0x4053f4
mov ecx, esi
mov edx, ebx
lea eax, [ebp - 0x98]
mov edi, 1
call sym._parse_size
test eax, eax
jne 0x405444
mov dword [esi], 0
mov dword [ebx], 0
jmp 0x405444
Function at 0x4056c0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x20
movzx eax, word [ebp + 0xc]
mov ebx, dword [ebp + 8]
cmp eax, 1
je 0x405710
cmp eax, 2
jne 0x405701
mov eax, dword [0x412644]
cmp eax, 0x412644
je 0x4056fa
lea esi, [esi]
mov edx, dword [eax + 8]
mov esi, eax
mov eax, dword [eax]
cmp ebx, edx
je 0x405758
cmp eax, 0x412644
jne 0x4056e8
mov eax, ebx
call sym._cleanup_systray_window
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
jmp sym._sync_taskbar_buttons
mov eax, dword [0x4123c8]
test eax, eax
jne 0x405701
test ebx, ebx
je 0x405742
lea eax, [ebp - 0xc]
mov dword [esp], ebx
mov dword [esp + 4], eax
call dword [sym.imp.user32.dll_GetWindowThreadProcessId]
sub esp, 8
test eax, eax
je 0x405701
mov ecx, dword [ebp - 0xc]
mov eax, dword fs:[0x18]
cmp dword [eax + 0x20], ecx
je 0x405701
mov eax, ebx
call sym._add_taskbar_button.part.0
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
jmp sym._sync_taskbar_buttons
mov edx, dword [esi + 4]
mov dword [eax + 4], edx
mov eax, dword [esi]
mov dword [edx], eax
mov eax, dword [esi + 0xc]
mov dword [esp], eax
call dword [sym.imp.user32.dll_DestroyWindow]
sub esp, 4
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, ebx
sub esp, 0xc
call sym._cleanup_systray_window
jmp 0x405701

Function at 0x405840
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, eax
push ebx
sub esp, 0x20
test byte [0x412114], 8
jne 0x4058f0
mov ebx, dword [esi + 0x20]
cmp ebx, 0xffffffff
je 0x40592e
mov edx, dword [0x4124ac]
test edx, edx
je 0x405938
dec edx
cmp ebx, edx
jae 0x4058b0
lea esi, [esi]
lea esi, [esi]
mov ecx, dword [0x4123b0]
lea edx, [ebx*4]
lea eax, [ecx + edx]
mov edx, dword [ecx + edx + 4]
mov dword [eax], edx
mov dword [edx + 0x20], ebx
mov eax, dword [eax]
inc ebx
call sym._update_tooltip_position
mov eax, dword [0x4124ac]
lea edx, [eax - 1]
cmp edx, ebx
ja 0x405880
mov ebx, dword [esi + 0x20]
mov eax, ebx
mov dword [0x4124ac], edx
call sym._invalidate_icons
mov eax, dword [0x4123b4]
or eax, dword [0x4124ac]
mov dword [esi + 0x20], 0xffffffff
je 0x405968
mov eax, esi
call sym._update_balloon
lea esp, [ebp - 8]
mov eax, esi
pop ebx
pop esi
pop ebp
jmp sym._update_tooltip_position
mov eax, dword [eax + 0xc]
mov dword [esp + 0xc], str.id0x_x__hwnd_p_n
mov dword [esp + 8], str.hide_icon
mov dword [esp + 0x14], eax
mov eax, dword [esi + 0x18]
mov dword [esp + 4], 0x412114
mov dword [esp + 0x10], eax
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_4
mov ebx, dword [esi + 0x20]
cmp ebx, 0xffffffff
jne 0x405863
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
mov dword [esp + 8], 0x167
mov dword [esp + 4], str..._src_wine_programs_explorer_systray.c
mov dword [esp], str.nb_displayed
call dword [sym.imp.ucrtbase.dll__assert]
mov ebx, dword [esi + 0x20]
mov edx, dword [0x4124ac]
jmp 0x405871
mov eax, dword [0x412664]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.user32.dll_ShowWindow]
sub esp, 8
jmp 0x4058d5