joyce8/EMBER2024-capa huggingface dataset:
Function at 0x534898
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd78
push ebx
xor edx, edx
mov dword [ebp - 0x288], edx
mov dword [ebp - 0x284], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040751c
lea eax, [ebp - 0x280]
mov edx, dword [0x40e290]
call fcn.00408264
xor eax, eax
push ebp
push 0x534a3f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
test eax, eax
je 0x5348fd
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x5348fd
lea eax, [ebp - 4]
mov edx, dword [ebp - 4]
call fcn.00406a48
mov ebx, eax
test ebx, ebx
je 0x534908
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 0x284]
push eax
mov ecx, 1
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00407c6c
mov eax, dword [ebp - 0x284]
mov edx, 0x534a58
call fcn.00407c04
je 0x534942
lea eax, [ebp - 8]
mov ecx, 0x534a58
mov edx, dword [ebp - 4]
call fcn.00407a00
jmp 0x53494d
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00407588
lea eax, [ebp - 0x288]
mov ecx, 0x534a68
mov edx, dword [ebp - 8]
call fcn.00407a00
mov eax, dword [ebp - 0x288]
lea ecx, [ebp - 0x280]
mov edx, 0x1ff
call fcn.00414a6c
test eax, eax
jne 0x534a03
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 0x26c]
call fcn.004137d8
mov eax, dword [ebp - 0xc]
mov edx, 0x534a7c
call fcn.00407c04
je 0x5349e9
mov eax, dword [ebp - 0xc]
mov edx, 0x534a8c
call fcn.00407c04
je 0x5349e9
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 0x26c]
mov edx, dword [ebp - 8]
call fcn.00407a00
mov eax, dword [ebp - 0x270]
test al, 0x10
je 0x5349cf
mov eax, dword [ebp - 0xc]
call fcn.00534898
jmp 0x5349e9
mov edx, eax
and edx, 0x1ff
cmp eax, edx
jne 0x5349e9
mov eax, dword [ebp - 0xc]
call fcn.004075c0
push eax
call sub.kernel32.dll_DeleteFileW
lea eax, [ebp - 0x280]
call fcn.00414abc
test eax, eax
je 0x53497e
lea eax, [ebp - 0x280]
call fcn.00414ae0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x534a46
lea eax, [ebp - 0x288]
mov edx, 2
call fcn.0040752c
lea eax, [ebp - 0x280]
mov edx, dword [0x40e290]
call fcn.0040833c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040752c
ret

Function at 0x535158
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov byte [ebp - 5], 0
mov dword [ebp - 4], 7
xor edx, edx
push ebp
push 0x53519f
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
lea eax, [ebp - 4]
push eax
call sub.wininet.dll_InternetGetConnectedState
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
pop dword fs:[0]
add esp, 8
push 0x5351a6
movzx eax, byte [ebp - 5]
ret
Function at 0x535404
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040751c
xor eax, eax
push ebp
push 0x535575
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x44]
mov eax, dword [ebp - 4]
call fcn.00413220
mov edx, dword [ebp - 0x44]
mov eax, 0x535594
call fcn.0040802c
test eax, eax
jne 0x53545d
lea eax, [ebp - 4]
mov ecx, dword [ebp - 4]
mov edx, 0x535594
call fcn.00407a00
mov eax, dword [ebp - 4]
call fcn.00535320
test al, al
jne 0x535472
mov byte [ebp - 9], 0
jmp 0x535552
xor ebx, ebx
xor esi, esi
mov byte [ebp - 9], 0
push 4
lea eax, [ebp - 8]
push eax
push 2
push ebx
call sub.wininet.dll_InternetSetOptionW
push 0
push 0
push 0
push 0
push 0x5355a4
call sub.wininet.dll_InternetOpenW
mov ebx, eax
test ebx, ebx
je 0x535552
mov dword [ebp - 0x18], 1
push 0
push 0x80000000
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004075c0
push eax
push ebx
call sub.wininet.dll_InternetOpenUrlW
mov esi, eax
test esi, esi
jne 0x5354f4
inc dword [ebp - 0x18]
call sub.kernel32.dll_GetLastError_1
mov edi, eax
cmp dword [ebp - 0x18], 5
jg 0x5354f4
cmp edi, 0x2ee2
jne 0x5354f4
cmp edi, 0x2f78
jne 0x5354f4
push 2
call sub.kernel32.dll_Sleep_1
jmp 0x5354ab
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], 0xa
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x40]
push eax
push 0x13
push esi
call sub.wininet.dll_HttpQueryInfoW
lea edi, [ebp - 0x40]
lea eax, [ebp - 0x48]
mov edx, edi
call fcn.004076f0
mov eax, dword [ebp - 0x48]
mov edx, 0x194
call fcn.00414344
add eax, 0xfffffe70
sub eax, 0x33
jae 0x53553e
mov byte [ebp - 9], 0
jmp 0x535542
mov byte [ebp - 9], 1
test esi, esi
je 0x53554c
push esi
call sub.wininet.dll_InternetCloseHandle
push ebx
call sub.wininet.dll_InternetCloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53557c
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.0040752c
lea eax, [ebp - 4]
call fcn.00407524
ret

Function at 0x535e34
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 0x535de8
call sub.user32.dll_EnumWindows
mov eax, dword [ebp - 4]
pop ecx
pop ecx
pop ebp
ret
Function at 0x536008
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov ecx, dword [eax]
mov dword [edx], ecx
lea ecx, [eax + 4]
mov ecx, dword [ecx]
mov dword [edx + 4], ecx
lea ecx, [eax + 8]
mov ecx, dword [ecx]
mov dword [edx + 8], ecx
lea ecx, [eax + 0xc]
mov ecx, dword [ecx]
mov dword [edx + 0xc], ecx
lea ecx, [eax + 0x10]
mov ecx, dword [ecx]
mov dword [edx + 0x10], ecx
add eax, 0x14
mov eax, dword [eax]
mov dword [edx + 0x14], eax
xor eax, eax
mov dword [esp], 1
mov ecx, dword [edx + eax*4 + 0x14]
mov ebx, ecx
shl ebx, 0x18
shr ecx, 8
or ebx, ecx
mov ecx, ebx
movzx ebx, cl
mov ebx, dword [ebx*4 + str.cwko0]
mov dword [esp + 4], ebx
mov ebx, ecx
shr ebx, 8
movzx ebx, bl
mov esi, dword [ebx*4 + str.cwko0]
mov ebx, ecx
shr ebx, 0x10
movzx ebx, bl
mov ebx, dword [ebx*4 + str.cwko0]
mov dword [esp + 8], ebx
shr ecx, 0x18
movzx ecx, cl
mov ecx, dword [ecx*4 + str.cwko0]
mov ebx, esi
shl ebx, 8
shr esi, 0x18
or ebx, esi
xor ebx, dword [esp + 4]
mov esi, dword [esp + 8]
shl esi, 0x10
mov edi, dword [esp + 8]
shr edi, 0x10
or esi, edi
xor ebx, esi
mov esi, ecx
shl esi, 0x18
shr ecx, 8
or esi, ecx
xor ebx, esi
xor ebx, dword [edx + eax*4]
mov ecx, dword [esp]
xor ebx, dword [ecx*4 + 0x5831c4]
mov dword [edx + eax*4 + 0x18], ebx
inc dword [esp]
mov ecx, dword [edx + eax*4 + 4]
xor ecx, dword [edx + eax*4 + 0x18]
mov dword [edx + eax*4 + 0x1c], ecx
mov ebx, dword [edx + eax*4 + 8]
xor ebx, ecx
mov dword [edx + eax*4 + 0x20], ebx
mov ecx, dword [edx + eax*4 + 0xc]
xor ecx, ebx
mov dword [edx + eax*4 + 0x24], ecx
mov ebx, dword [edx + eax*4 + 0x10]
xor ebx, ecx
mov dword [edx + eax*4 + 0x28], ebx
mov ecx, dword [edx + eax*4 + 0x14]
xor ecx, ebx
mov dword [edx + eax*4 + 0x2c], ecx
add eax, 6
cmp eax, 0x2e
jl 0x536043
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x536118
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov ecx, dword [eax]
mov dword [edx], ecx
lea ecx, [eax + 4]
mov ecx, dword [ecx]
mov dword [edx + 4], ecx
lea ecx, [eax + 8]
mov ecx, dword [ecx]
mov dword [edx + 8], ecx
lea ecx, [eax + 0xc]
mov ecx, dword [ecx]
mov dword [edx + 0xc], ecx
lea ecx, [eax + 0x10]
mov ecx, dword [ecx]
mov dword [edx + 0x10], ecx
lea ecx, [eax + 0x14]
mov ecx, dword [ecx]
mov dword [edx + 0x14], ecx
lea ecx, [eax + 0x18]
mov ecx, dword [ecx]
mov dword [edx + 0x18], ecx
add eax, 0x1c
mov eax, dword [eax]
mov dword [edx + 0x1c], eax
xor eax, eax
mov dword [esp], 1
mov ecx, dword [edx + eax*4 + 0x1c]
mov edi, ecx
shl edi, 0x18
shr ecx, 8
or edi, ecx
mov ecx, edi
movzx ecx, cl
mov ecx, dword [ecx*4 + str.cwko0]
mov dword [esp + 4], ecx
mov ecx, edi
shr ecx, 8
movzx ecx, cl
mov ecx, dword [ecx*4 + str.cwko0]
mov ebx, edi
shr ebx, 0x10
movzx ebx, bl
mov esi, dword [ebx*4 + str.cwko0]
mov ebx, edi
shr ebx, 0x18
movzx ebx, bl
mov ebx, dword [ebx*4 + str.cwko0]
mov dword [esp + 8], ebx
mov ebx, ecx
shl ebx, 8
shr ecx, 0x18
or ebx, ecx
xor ebx, dword [esp + 4]
mov ecx, esi
shl ecx, 0x10
shr esi, 0x10
or ecx, esi
xor ebx, ecx
mov ecx, dword [esp + 8]
shl ecx, 0x18
mov esi, dword [esp + 8]
shr esi, 8
or ecx, esi
xor ebx, ecx
xor ebx, dword [edx + eax*4]
mov ecx, dword [esp]
xor ebx, dword [ecx*4 + 0x5831c4]
mov dword [edx + eax*4 + 0x20], ebx
inc dword [esp]
mov ecx, dword [edx + eax*4 + 4]
xor ecx, dword [edx + eax*4 + 0x20]
mov dword [edx + eax*4 + 0x24], ecx
mov ebx, dword [edx + eax*4 + 8]
xor ebx, ecx
mov dword [edx + eax*4 + 0x28], ebx
mov edi, dword [edx + eax*4 + 0xc]
xor edi, ebx
mov dword [edx + eax*4 + 0x2c], edi
movzx ecx, byte [edx + eax*4 + 0x2c]
mov ecx, dword [ecx*4 + str.cwko0]
mov dword [esp + 4], ecx
mov ecx, edi
shr ecx, 8
movzx ecx, cl
mov ecx, dword [ecx*4 + str.cwko0]
mov ebx, edi
shr ebx, 0x10
movzx ebx, bl
mov esi, dword [ebx*4 + str.cwko0]
mov ebx, edi
shr ebx, 0x18
movzx ebx, bl
mov ebx, dword [ebx*4 + str.cwko0]
mov dword [esp + 8], ebx
mov ebx, ecx
shl ebx, 8
shr ecx, 0x18
or ebx, ecx
xor ebx, dword [esp + 4]
mov ecx, esi
shl ecx, 0x10
shr esi, 0x10
or ecx, esi
xor ebx, ecx
mov ecx, dword [esp + 8]
shl ecx, 0x18
mov esi, dword [esp + 8]
shr esi, 8
or ecx, esi
xor ebx, ecx
xor ebx, dword [edx + eax*4 + 0x10]
mov dword [edx + eax*4 + 0x30], ebx
mov ecx, dword [edx + eax*4 + 0x14]
xor ecx, dword [edx + eax*4 + 0x30]
mov dword [edx + eax*4 + 0x34], ecx
mov ebx, dword [edx + eax*4 + 0x18]
xor ebx, ecx
mov dword [edx + eax*4 + 0x38], ebx
mov ecx, dword [edx + eax*4 + 0x1c]
xor ecx, ebx
mov dword [edx + eax*4 + 0x3c], ecx
add eax, 8
cmp eax, 0x34
jl 0x536163
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x55d6f8
Capabilities:
Hide graphical window

Disassembly:
call fcn.0055d6e8
test al, al
je 0x55d726
mov eax, dword [0x585110]
mov eax, dword [eax]
cmp dword [eax + 0x44], 0
je 0x55d726
push 0
mov eax, dword [0x585110]
mov eax, dword [eax]
mov eax, dword [eax + 0x44]
call fcn.0049c770
push eax
call sub.user32.dll_ShowWindow
ret
push 0
mov eax, dword [0x585110]
mov eax, dword [eax]
mov eax, dword [eax + 0x170]
push eax
call sub.user32.dll_ShowWindow
ret

Function at 0x563f1c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdc0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x240], ebx
mov byte [ebp - 9], cl
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
call fcn.0040751c
xor eax, eax
push ebp
push 0x5640a7
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov ecx, 1
mov edx, 0x5640c4
mov eax, dword [ebp - 8]
call fcn.00572e5c
call sub.kernel32.dll_GetCurrentProcessId
mov dword [ebp - 0x10], eax
xor edx, edx
mov eax, 2
call fcn.004c58d0
mov esi, eax
test esi, esi
ja 0x563fac
xor eax, eax
push ebp
push 0x563f9b
push dword fs:[eax]
mov dword fs:[eax], esp
push esi
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x563fa5
mov bl, 1
jmp 0x564072
mov dword [ebp - 0x23c], 0x22c
lea edx, [ebp - 0x23c]
mov eax, esi
call fcn.004c58f0
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x564044
lea eax, [ebp - 0x240]
lea edx, [ebp - 0x218]
mov ecx, 0x104
call fcn.0040772c
mov eax, dword [ebp - 0x240]
mov edx, dword [ebp - 4]
call fcn.00407c04
jne 0x564031
cmp byte [ebp - 9], 0
jne 0x564017
mov eax, dword [ebp - 0x234]
cmp eax, dword [ebp - 0x10]
jne 0x564017
lea edx, [ebp - 0x23c]
mov eax, esi
call fcn.004c5910
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x564044
mov eax, dword [ebp - 0x234]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov edi, eax
push 0
push edi
call sub.kernel32.dll_TerminateProcess
lea edx, [ebp - 0x23c]
mov eax, esi
call fcn.004c5910
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x563fcb
xor eax, eax
push ebp
push 0x564066
push dword fs:[eax]
mov dword fs:[eax], esp
push esi
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x564070
mov bl, 1
push 1
mov ecx, 1
mov edx, 0x5640c4
mov eax, dword [ebp - 8]
call fcn.00572e5c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5640ae
lea eax, [ebp - 0x240]
call fcn.00407524
lea eax, [ebp - 4]
call fcn.00407524
ret
Function at 0x56f0cc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.0040751c
xor eax, eax
push ebp
push 0x56f147
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x56f127
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004075c0
push eax
push 0x56f154
mov eax, ebx
call fcn.0049c770
push eax
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x56f131
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x56f14e
lea eax, [ebp - 4]
call fcn.00407524
ret
Function at 0x56fc6c
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
xor eax, eax
push ebp
push 0x56febc
push dword fs:[eax]
mov dword fs:[eax], esp
test dl, dl
je 0x56fdac
xor eax, eax
push ebp
push 0x56fd9d
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x20006
mov dl, 1
mov eax, dword [0x44e278]
call fcn.0044fa20
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x18], 0x20006
mov edx, 0x80000002
mov eax, dword [ebp - 4]
call fcn.0044fac4
xor eax, eax
push ebp
push 0x56fcf2
push dword fs:[eax]
mov dword fs:[eax], esp
mov cl, 1
mov edx, 0x56fed8
mov eax, dword [ebp - 4]
call fcn.0044fc0c
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x56fcfe
test bl, bl
je 0x56fd88
mov edx, 0x56ff40
mov eax, dword [ebp - 4]
call fcn.00450f50
test al, al
jne 0x56fd5e
xor eax, eax
push ebp
push 0x56fd52
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov ecx, 0x56ff60
mov edx, dword [0x5849cc]
call fcn.00407a00
mov ecx, dword [ebp - 8]
mov edx, 0x56ff40
mov eax, dword [ebp - 4]
call fcn.00450524
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x56fd80
xor eax, eax
push ebp
push 0x56fd76
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x56fd80
mov eax, dword [ebp - 4]
call fcn.0044fa94
mov eax, dword [ebp - 4]
call fcn.0040557c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x56fea6
xor eax, eax
push ebp
push 0x56fe9c
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x20006
mov dl, 1
mov eax, dword [0x44e278]
call fcn.0044fa20
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x18], 0x20006
mov edx, 0x80000002
mov eax, dword [ebp - 4]
call fcn.0044fac4
xor eax, eax
push ebp
push 0x56fe0e
push dword fs:[eax]
mov dword fs:[eax], esp
mov cl, 1
mov edx, 0x56fed8
mov eax, dword [ebp - 4]
call fcn.0044fc0c
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x56fe1a
test bl, bl
je 0x56fe8a
mov edx, 0x56ff40
mov eax, dword [ebp - 4]
call fcn.00450f50
test al, al
jne 0x56fe53
xor eax, eax
push ebp
push 0x56fe47
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x56fe82
xor eax, eax
push ebp
push 0x56fe78
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x56ff40
mov eax, dword [ebp - 4]
call fcn.0044ff28
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x56fe82
mov eax, dword [ebp - 4]
call fcn.0044fa94
mov eax, dword [ebp - 4]
call fcn.0040557c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x56fea6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x56fec3
lea eax, [ebp - 8]
call fcn.00407524
ret
Function at 0x5736d0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x5738d5
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x57387a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x585110]
mov eax, dword [eax]
mov dword [eax + 0xf4], ebx
mov dword [eax + 0xf0], 0x5639f0
mov byte [ebx + 0x47b], 0
mov byte [ebx + 0x47c], 0
mov byte [ebx + 0x478], 0
lea edx, [ebp - 8]
xor eax, eax
call fcn.004045ec
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.00414c78
mov edx, dword [ebp - 4]
mov eax, 0x58b69c
call fcn.00407534
call fcn.00417984
fstp qword [ebx + 0x480]
wait
call fcn.0040458c
mov edi, eax
test edi, edi
jle 0x57378a
mov esi, 1
lea edx, [ebp - 0xc]
mov eax, esi
call fcn.004045ec
cmp dword [ebp - 0xc], 0
je 0x573786
lea edx, [ebx + 0x448]
mov eax, esi
call fcn.004045ec
jmp 0x57378a
inc esi
dec edi
jne 0x573767
cmp dword [ebx + 0x448], 0
jne 0x5737ea
mov eax, ebx
call fcn.005730cc
mov byte [ebx + 0x29c], 1
mov eax, dword [ebx + 0x41c]
xor edx, edx
call fcn.00492e64
mov eax, dword [ebx + 0x41c]
xor edx, edx
call fcn.00492e98
mov dword [ebx + 0x454], 1
lea eax, [ebp - 0x14]
call fcn.00535d4c
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
mov edx, 0x5738f0
call fcn.00407a00
mov eax, dword [ebp - 0x10]
call fcn.004c5b1c
jmp 0x573870
mov eax, dword [0x585110]
mov eax, dword [eax]
mov byte [eax + 0x5b], 0
mov eax, dword [ebx + 0x3a8]
mov dl, 5
call fcn.00492acc
mov eax, dword [ebx + 0x3ac]
mov dl, 5
call fcn.00492acc
mov eax, dword [ebx + 0x3b0]
mov dl, 5
call fcn.00492acc
xor edx, edx
mov eax, ebx
call fcn.004ba9a8
xor edx, edx
mov eax, ebx
call fcn.00492e64
xor edx, edx
mov eax, ebx
call fcn.00492e98
push 0xffffffffffffffec
mov eax, ebx
call fcn.0049c770
push eax
call sub.user32.dll_GetWindowLongW
mov esi, eax
and esi, 0xfffbffff
push esi
push 0xffffffffffffffec
mov eax, ebx
call fcn.0049c770
push eax
call sub.user32.dll_SetWindowLongW
push 0
mov eax, dword [0x58b694]
call fcn.0049c770
push eax
call sub.user32.dll_ShowWindow
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5738ba
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5738dc
lea eax, [ebp - 0x1c]
mov edx, 7
call fcn.0040752c
ret
Function at 0x574a90
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa0
push ebx
xor ebx, ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.0040751c
mov eax, dword [ebp - 8]
call fcn.0040751c
xor eax, eax
push ebp
push 0x574b5d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x5c]
xor ecx, ecx
mov edx, 0x10
call fcn.00404c0c
lea eax, [ebp - 0x4c]
xor ecx, ecx
mov edx, 0x44
call fcn.00404c0c
mov dword [ebp - 0x4c], 0x44
mov dword [ebp - 0x20], 1
mov word [ebp - 0x1c], 1
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x4c]
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
lea eax, [ebp - 0x60]
mov ecx, dword [ebp - 8]
mov edx, 0x574b78
call fcn.00407a00
mov eax, dword [ebp - 0x60]
call fcn.004075c0
push eax
mov eax, dword [ebp - 4]
call fcn.004075c0
push eax
call sub.kernel32.dll_CreateProcessW
test eax, eax
je 0x574b3a
mov eax, dword [ebp - 0x5c]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x574b64
lea eax, [ebp - 0x60]
call fcn.00407524
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040752c
ret
Function at 0x436960
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 0xffffffffffffffff
push 0x5c1290
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push ebp
push esi
push edi
mov eax, dword [0x63727c]
xor eax, esp
push eax
lea eax, [esp + 0x3c]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x248]
push eax
call fcn.00488c30
lea eax, [esi + 0xa70]
add esp, 4
push eax
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 1
push 0xffffffffffffffff
lea ebp, [esi + 4]
xor edi, edi
push 0x5d3350
mov ecx, ebp
mov dword [esp + 0x50], edi
call dword [sym.imp.soui.dll_public:_class_SOUI::SWindow____thiscall_SOUI::SWindow::FindChildByName_wchar_t_const___int_]
push eax
lea ecx, [esp + 0x20]
call fcn.00431390
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov byte [esp + 0x44], 1
call ebx
push edi
push edi
push edi
lea ecx, [esp + 0x2c]
push ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x436a52
test edi, edi
jne 0x436a01
call ebx
sub eax, dword [esp + 0x14]
cmp eax, 0x2710
ja 0x436a52
lea edx, [esp + 0x20]
push edx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
mov eax, dword [esi + 0xb6c]
test eax, eax
je 0x436a31
push eax
mov edi, 1
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x436a48
push 0
push 0
push 0
lea ecx, [esp + 0x2c]
push ecx
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jne 0x4369f0
jmp 0x436a52
mov dword [esi + 0xb6c], 0
lea ecx, [esi + 0x23c]
call dword [sym.imp.soui.dll_public:_int___thiscall_SOUI::CSimpleWnd::IsWindowEnabled_void_const]
test eax, eax
jne 0x436a7d
mov edx, dword [esi + 0x248]
push 1
push edx
call dword [sym.imp.USER32.dll_EnableWindow]
push 1
push 1
mov ecx, ebp
call dword [sym.imp.soui.dll_public:_void___thiscall_SOUI::SWindow::EnableWindow_int__int_]
mov ecx, dword [esp + 0x18]
mov byte [esp + 0x44], 0
mov dword [0x638fc4], 0
test ecx, ecx
je 0x436a9e
push 1
push 0
call dword [sym.imp.soui.dll_public:_void___thiscall_SOUI::SWindow::SetVisible_int__int_]
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x34
ret 8
Function at 0x450230
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x5c3021
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x63727c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov ebp, dword [sym.imp.soui.dll_public:_class_SOUI::SWindow____thiscall_SOUI::SWindow::FindChildByName_wchar_t_const___int_]
push 0xffffffffffffffff
lea edi, [esi + 4]
push 0x5d3458
mov ecx, edi
call ebp
lea ecx, [esp + 0x20]
push ecx
mov ecx, eax
call dword [sym.imp.soui.dll_public:_class_SOUI::CRect___thiscall_SOUI::SWindow::GetWindowRect_void_]
lea edx, [esp + 0x20]
push edx
lea ecx, [esi + 0x23c]
call dword [sym.imp.soui.dll_public:_int___thiscall_SOUI::CSimpleWnd::ClientToScreen_struct_tagRECT__const]
lea ecx, [esp + 0x18]
call dword [sym.imp.soui.dll_public:_void___thiscall_SOUI::SMenu::constructor_void_]
push str.SMENU
push str.XML_MENU_MAIN_SCAN
lea ecx, [esp + 0x20]
mov dword [esp + 0x40], 0
call dword [sym.imp.soui.dll_public:_int___thiscall_SOUI::SMenu::LoadMenuW_wchar_t_const___wchar_t_const__]
mov eax, dword [esi + 0x248]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x20]
push 0x64
push 0
push eax
push ecx
push edx
push 0x100
lea ecx, [esp + 0x30]
call dword [sym.imp.soui.dll_public:_unsigned_int___thiscall_SOUI::SMenu::TrackPopupMenu_unsigned_int__int__int__struct_HWND_____struct_tagRECT_const___int_]
push 1
push 0xffffffffffffffff
push 0x5d3350
mov ecx, edi
mov ebx, eax
mov dword [esi + 0x3b4], 0
call ebp
push eax
lea ecx, [esp + 0x1c]
call fcn.00431390
mov eax, ebx
sub eax, 1
mov byte [esp + 0x38], 1
je 0x45032b
sub eax, 1
jne 0x45033c
call fcn.00483d90
test eax, eax
je 0x45031f
push 0
mov ecx, esi
call fcn.0043e990
test eax, eax
jne 0x45033c
mov dword [esi + 0x5a0], 1
jmp 0x450335
mov dword [esi + 0x5a0], 0
mov ecx, esi
call fcn.0044fca0
mov ecx, dword [esp + 0x14]
mov byte [esp + 0x38], 0
mov dword [0x638fc4], 0
test ecx, ecx
je 0x45035d
push 1
push 0
call dword [sym.imp.soui.dll_public:_void___thiscall_SOUI::SWindow::SetVisible_int__int_]
lea ecx, [esp + 0x18]
mov dword [esp + 0x38], 0xffffffff
call dword [sym.imp.soui.dll_public:_void___thiscall_SOUI::SMenu::destructor_void_]
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret