joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40cc60
Capabilities:
Inspect load icon resource

Disassembly:
mov ecx, dword [0x447e38]
mov eax, dword [0x447c3c]
push 0
push eax
mov edx, dword [ecx + 0x72a8]
push 0
push edx
push 0x78
push 0x154
push 0
push 0
push 0x44ec0050
push str.Protocol
push str.WclassProtocol
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov ecx, dword [0x447e38]
push 0x6a
mov dword [ecx + 0x72b0], eax
mov edx, dword [0x447c3c]
push edx
call dword [sym.imp.USER32.dll_LoadIconA]
test eax, eax
je 0x40ccd2
push eax
mov eax, dword [0x447e38]
push 0
push 0x80
mov ecx, dword [eax + 0x72b0]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [0x447cb4]
test eax, eax
je 0x40ccee
mov edx, dword [0x447e38]
mov eax, dword [edx + 0x72b0]
push eax
call fcn.0040c7a0
pop ecx
ret

Function at 0x40ccf0
Capabilities:
Inspect load icon resource

Disassembly:
mov ecx, dword [0x447e38]
mov eax, dword [0x447c3c]
push 0
push eax
mov edx, dword [ecx + 0x72a8]
push 0
push edx
push 0xc8
push 0x2a8
push 0
push 0x32
push 0x44ec0050
push 0x441744
push str.WclassTrace
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov ecx, dword [0x447e38]
push 0x6c
mov dword [ecx + 0x72b4], eax
mov edx, dword [0x447c3c]
push edx
call dword [sym.imp.USER32.dll_LoadIconA]
test eax, eax
je 0x40cd65
push eax
mov eax, dword [0x447e38]
push 0
push 0x80
mov ecx, dword [eax + 0x72b4]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [0x447cb4]
test eax, eax
je 0x40cd81
mov edx, dword [0x447e38]
mov eax, dword [edx + 0x72b4]
push eax
call fcn.0040c7a0
pop ecx
ret

Function at 0x40cd90
Capabilities:
Inspect load icon resource

Disassembly:
mov ecx, dword [0x447e38]
mov eax, dword [0x447c3c]
push 0
push eax
mov edx, dword [ecx + 0x72a8]
push 0
push edx
push 0xc8
push 0x2a8
push 0
push 0x32
push 0x54fc4001
push str.Play
push str.WclassPlay
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov ecx, dword [0x447e38]
push 0x75
mov dword [ecx + 0x72bc], eax
mov edx, dword [0x447c3c]
push edx
call dword [sym.imp.USER32.dll_LoadIconA]
test eax, eax
je 0x40ce05
push eax
mov eax, dword [0x447e38]
push 0
push 0x80
mov ecx, dword [eax + 0x72bc]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [0x447cb4]
test eax, eax
je 0x40ce21
mov edx, dword [0x447e38]
mov eax, dword [edx + 0x72bc]
push eax
call fcn.0040c7a0
pop ecx
ret
Function at 0x40f200
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x11c
mov ax, word [0x440924]
mov cl, byte [0x440926]
push ebx
push ebp
push esi
push edi
mov word [esp + 0x2c], ax
mov byte [esp + 0x2e], cl
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x2f]
lea edx, [esp + 0x2e]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov edi, dword [esp + 0x134]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x2c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 0x14
jae 0x40f2ad
mov edi, 0x43a2b8
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x2c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x2c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 0x14
jb 0x40f26e
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x26]
and eax, 0xffff
and edx, 0xffff
lea ecx, [eax + eax*4]
lea ebx, [edx + ecx*2]
mov ecx, 0x64
lea eax, [ebx + ebx*4]
lea eax, [ebx + eax*2]
shl eax, 5
add eax, ebx
dec ecx
lea edx, [eax + eax*2]
lea ebx, [ebx + edx*4 + 0x1bd57f]
jne 0x40f2d6
mov esi, dword [esp + 0x130]
push ebx
push esi
mov dword [esp + 0x18], ebx
call fcn.0040f1d0
mov eax, dword [esp + 0x19]
lea ecx, [esi + 2]
push eax
push ecx
call fcn.0040f1d0
mov edx, dword [esp + 0x22]
lea eax, [esi + 4]
push edx
push eax
call fcn.0040f1d0
mov ecx, dword [esp + 0x2b]
lea edx, [esi + 6]
push ecx
push edx
call fcn.0040f1d0
lea edi, [esp + 0x4c]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x20
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea ebp, [esi + 8]
mov edi, ecx
xor esi, esi
test edi, edi
jle 0x40f373
lea eax, [ebx + ebx*4]
mov dl, byte [esp + esi + 0x2c]
lea eax, [ebx + eax*2]
shl eax, 5
add eax, ebx
lea ecx, [eax + eax*2]
lea ebx, [ebx + ecx*4 + 0x1bd57f]
xor dl, bl
push edx
push ebp
call fcn.0040f1d0
add esp, 8
add ebp, 2
inc esi
cmp esi, edi
jl 0x40f346
pop edi
mov byte [ebp], 0
pop esi
pop ebp
pop ebx
add esp, 0x11c
ret

Function at 0x411130
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword [0x447e38]
mov ecx, dword [esp + 4]
add eax, 0x73e4
push 0x200
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov edx, dword [0x447e38]
add edx, 0x73e4
push edx
call fcn.00408740
mov eax, dword [0x447e38]
add esp, 4
mov cl, byte [eax + 0x73e4]
test cl, cl
je 0x41118c
mov eax, dword [eax + 0x7280]
mov ecx, dword [0x447dc8]
push 0
push 2
push eax
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [0x447e38]
mov edx, dword [esp + 8]
add eax, 0x73e4
push eax
push edx
call dword [sym.imp.USER32.dll_SetWindowTextA]
ret
Function at 0x412cf0
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [0x447e38]
sub esp, 0x218
test eax, eax
push esi
push edi
je 0x412e7e
mov ecx, dword [eax + 0x5ebc]
test ecx, ecx
je 0x412e7e
push 0x4463c5
mov byte [0x4463c4], 0x4e
call fcn.004147d0
mov edi, 0x4463c4
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov eax, 0x200
push 0x441ad0
push str.Read_user_key
sub eax, ecx
push 0x440ae4
push eax
mov edi, 0x4463c4
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
add ecx, 0x4463c4
push ecx
call fcn.0041f19c
mov edi, 0x4463c4
or ecx, 0xffffffff
xor eax, eax
push 0x4463c4
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x4488a8
add ecx, 0x4463c4
push ecx
call fcn.00414880
mov eax, dword [0x447e38]
add esp, 0x20
mov cl, byte [eax + 0x5ec0]
lea edi, [eax + 0x5ec0]
test cl, cl
je 0x412e6a
mov ecx, dword [str.hh.mm]
mov dx, word [0x440ae0]
mov dword [esp + 0x10], ecx
or ecx, 0xffffffff
xor eax, eax
mov word [esp + 0x14], dx
mov word [esp + 0x16], 0
lea edx, [esp + 0x20]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
mov dx, word [0x4463c8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [esp + 0x10]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov cx, word [0x4463c5]
push str.time
mov word [esp + 0x18], cx
lea ecx, [esp + 0x28]
push ecx
mov word [esp + 0x1f], dx
call fcn.00417780
lea edx, [esp + 0x2c]
push 0x4409c4
push edx
call fcn.0041f85a
mov esi, eax
add esp, 0x14
test esi, esi
je 0x412e7e
push esi
push 0x4463c4
call fcn.0041f6fc
mov edi, 0x4463c4
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp byte [ecx + 0x4463c3], 0xa
je 0x412e5f
push esi
push 0x440ad0
call fcn.0041f6fc
add esp, 8
push esi
call fcn.0041f74a
add esp, 4
jmp 0x412e7e
mov eax, dword [eax + 0x72b4]
push 0x4463c4
push eax
call fcn.00408560
add esp, 8
lea ecx, [esp + 8]
mov eax, 0x100
push ecx
push 1
push 0
push str.SoftwareSAPSAPGUI_FrontSAP_Frontend_ServerCustomize
push 0x80000001
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x20], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x412f4d
mov eax, dword [0x447e38]
mov ecx, dword [esp + 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [esp + 0x18]
add eax, 0x2160
push edx
push eax
push 0
push 0
push str.GuiXT.Userkey
push ecx
call esi
mov eax, dword [esp + 8]
lea edx, [esp + 0x1c]
push edx
push str.System
push 0
push 0
push str.GuiXT.FontFacename
push eax
call esi
mov edx, dword [esp + 8]
lea ecx, [esp + 0xc]
push ecx
push 0x447cb8
push 0
push 0
push str.GuiXT.FontWidth
push edx
call esi
mov ecx, dword [esp + 8]
lea eax, [esp + 0xc]
push eax
push 0x447cbc
push 0
push 0
push str.GuiXT.FontHeight
push ecx
call esi
mov eax, dword [esp + 8]
lea edx, [esp + 0xc]
push edx
push 0x43a230
push 0
push 0
push str.GuiXT.FontWeight
push eax
call esi
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
add esp, 0x218
ret
Function at 0x4141c0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x254
push ebx
mov ebx, dword [esp + 0x25c]
push 5
push str.sapwr
push ebx
call fcn.0041f530
add esp, 0xc
test eax, eax
jne 0x4141fc
push eax
push str.SAPWR_file
push str.SAP_Web_Repository_file:_No_direct_editing_possible
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
pop ebx
add esp, 0x254
ret
mov eax, dword [str.notepad.exe]
mov ecx, dword [0x44210c]
mov edx, dword [0x442110]
mov dword [esp + 0x58], eax
mov al, byte [0x442114]
push edi
mov dword [esp + 0x60], ecx
mov byte [esp + 0x68], al
mov ecx, 0x7c
xor eax, eax
lea edi, [esp + 0x69]
mov dword [esp + 0x64], edx
rep stosd dword es:[edi], eax
mov ecx, dword [0x447c50]
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ecx + 0x704]
mov cl, byte [ecx + 0x704]
test cl, cl
je 0x41428e
push ebp
push esi
push 0x200
lea edx, [esp + 0x68]
push eax
push edx
call fcn.004166c0
mov edi, 0x43a2b8
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x64]
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
pop ebp
push 0x200
lea eax, [esp + 0x60]
push ebx
push eax
call fcn.00416770
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x24]
add esp, 0xc
rep stosd dword es:[edi], eax
xor ecx, ecx
lea edx, [esp + 8]
mov dword [esp + 8], ecx
lea eax, [esp + 0x18]
mov dword [esp + 0xc], ecx
push edx
mov dword [esp + 0x14], ecx
push eax
push ecx
push ecx
push ecx
push ecx
push ecx
mov dword [esp + 0x30], ecx
mov word [esp + 0x66], cx
push ecx
lea ecx, [esp + 0x7c]
mov dword [esp + 0x38], 0x44
push ecx
push 0
mov dword [esp + 0x6c], 1
mov word [esp + 0x70], 5
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
pop edi
pop ebx
add esp, 0x254
ret
Function at 0x414470
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [0x447e38]
sub esp, 0x200
xor ecx, ecx
mov edx, dword [eax + 0x60d8]
test edx, edx
sete cl
mov dword [eax + 0x60d8], ecx
mov edx, dword [0x447e38]
mov eax, dword [edx + 0x60d8]
test eax, eax
je 0x414560
mov eax, dword [0x447c50]
lea ecx, [esp]
add eax, 0x930
push eax
push str._sInputScript.txt
push ecx
call fcn.004200b4
lea edx, [esp + 0xc]
push edx
call fcn.00403660
lea eax, [esp + 0x10]
push eax
call fcn.00420374
add esp, 0x14
test eax, eax
je 0x414560
mov ecx, dword [0x447c50]
push 0x200
add ecx, 0x930
lea edx, [esp + 4]
push ecx
push edx
call fcn.004166c0
lea eax, [esp + 0xc]
push eax
call fcn.00403660
add esp, 0x10
lea ecx, [esp]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x414552
test al, 0x10
je 0x414552
test al, 1
je 0x414560
push 0
push str.Input_Recording_not_possible
push str._History__directory_in_GuiXT_profile_is_readonly
mov edx, dword [0x447e38]
mov eax, dword [edx + 0x72a8]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [0x447e38]
mov dword [ecx + 0x60d8], 0
add esp, 0x200
ret
push 0
push str.Input_Recording_not_possible
push str.Please_specify_valid__History__directory_in_GuiXT_profile
jmp 0x414528
call fcn.0040ce30
add esp, 0x200
ret
Function at 0x414590
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [0x447c50]
sub esp, 0x200
or ecx, 0xffffffff
lea edx, [esp]
push ebx
push esi
push edi
lea edi, [eax + 0x830]
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [0x447e38]
mov esi, 0x442264
lea edi, [ecx + 0x60c4]
mov eax, edi
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x414600
test cl, cl
je 0x4145fc
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x414600
add eax, 2
add esi, 2
test cl, cl
jne 0x4145d8
xor eax, eax
jmp 0x414605
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x414614
lea edx, [esp + 0xc]
mov edi, str.guixt_d.chm
jmp 0x41465a
mov esi, 0x442250
mov eax, edi
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x414643
test cl, cl
je 0x41463f
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x414643
add eax, 2
add esi, 2
test cl, cl
jne 0x41461b
xor eax, eax
jmp 0x414648
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
lea edx, [esp + 0xc]
mov edi, str.guixt_f.chm
je 0x41465a
mov edi, str.guixt_e.chm
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push eax
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
push eax
and ecx, 3
push 1
lea eax, [esp + 0x18]
push 0x44222c
rep movsb byte es:[edi], byte [esi]
push eax
call fcn.004072e0
add esp, 0x14
test eax, eax
pop edi
pop esi
pop ebx
jne 0x4146df
lea ecx, [esp]
lea edx, [esp + 0x100]
push ecx
push str.__s__not_found
push edx
call fcn.004200b4
mov ecx, dword [0x447e38]
add esp, 0xc
lea eax, [esp + 0x100]
mov edx, dword [ecx + 0x72a8]
push 0
push str.Please_install_GuiXT_help_file
push eax
push edx
call dword [sym.imp.USER32.dll_MessageBoxA]
add esp, 0x200
ret
push eax
call fcn.0041f74a
mov ecx, dword [0x447e38]
add esp, 4
lea eax, [esp]
mov edx, dword [ecx + 0x72a8]
push 1
push 0
push 0
push eax
push str.open
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
add esp, 0x200
ret
Function at 0x416730
Capabilities:
Create thread

Disassembly:
push ecx
mov ecx, dword [0x447e68]
xor eax, eax
cmp ecx, eax
mov dword [esp], eax
jne 0x416760
push 0x447e28
lea ecx, [esp + 4]
push eax
push ecx
push 0x4167b0
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x447e24], eax
pop ecx
ret
mov dword [0x447e68], eax
pop ecx
ret

Function at 0x416bf0
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x416c10
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.0040dd00
pop esi
ret
push 1
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.0040dd00
pop esi
ret

Function at 0x416cc0
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [0x447e38]
sub esp, 0x300
mov cl, byte [eax + 0x5ec0]
test cl, cl
jne 0x416ceb
mov eax, dword [eax + 0x72b4]
push eax
call fcn.00416bf0
add esp, 4
add esp, 0x300
ret
push esi
lea ecx, [esp + 4]
push edi
push ecx
call fcn.004147d0
mov edx, dword [0x447e38]
or ecx, 0xffffffff
xor eax, eax
mov byte [esp + 0xe], 0x2e
lea edi, [edx + 0x5ec0]
mov byte [esp + 0x11], 0
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x10c]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x10c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0xc]
push ecx
push str.time
push edx
call fcn.00417780
mov ecx, dword [0x447e38]
add esp, 0x10
lea eax, [esp + 0x108]
mov edx, dword [ecx + 0x72a8]
push 1
push 0
push 0
push eax
push str.open
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
add esp, 0x300
ret
Function at 0x416dc0
Capabilities:
Set registry value

Disassembly:
sub esp, 0x40
push edi
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
mov eax, dword [0x447e38]
mov dword [esp + 8], 0x3c
mov edi, 0x447cc0
mov ecx, dword [eax + 0x72a8]
mov eax, dword [0x447cc0]
test eax, eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x14], edi
mov dword [esp + 0x1c], 0x41
jne 0x416e41
mov ecx, 0xf
xor eax, eax
push 0x20
push str.System
rep stosd dword es:[edi], eax
push 0x447cdc
call fcn.004166c0
mov edx, dword [0x447cb8]
mov eax, dword [0x447cbc]
mov ecx, dword [0x43a230]
add esp, 0xc
mov dword [0x447cc4], edx
mov dword [0x447cc0], eax
mov dword [0x447cd0], ecx
lea edx, [esp + 8]
push edx
call dword [sym.imp.comdlg32.dll_ChooseFontA]
test eax, eax
je 0x416faf
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
push 0x100
push 0x447cdc
push str.System
mov dword [0x447cb4], eax
call fcn.004166c0
mov ecx, dword [0x447cc4]
mov edx, dword [0x447cc0]
mov eax, dword [0x447cd0]
mov dword [0x447cb8], ecx
mov ecx, dword [0x447e38]
mov dword [0x447cbc], edx
mov dword [0x43a230], eax
mov edx, dword [ecx + 0x72c4]
push edx
call fcn.0040c7a0
mov eax, dword [0x447e38]
mov ecx, dword [eax + 0x72c8]
push ecx
call fcn.0040c7a0
mov edx, dword [0x447e38]
mov eax, dword [edx + 0x72c0]
push eax
call fcn.0040c7a0
mov ecx, dword [0x447e38]
mov edx, dword [ecx + 0x72b0]
push edx
call fcn.0040c7a0
mov eax, dword [0x447e38]
mov ecx, dword [eax + 0x72b4]
push ecx
call fcn.0040c7a0
mov edx, dword [0x447e38]
mov eax, dword [edx + 0x72b8]
push eax
call fcn.0040c7a0
mov ecx, dword [0x447e38]
mov edx, dword [ecx + 0x72bc]
push edx
call fcn.0040c7a0
add esp, 0x28
lea eax, [esp + 4]
push eax
push 2
push 0
push str.SoftwareSAPSAPGUI_FrontSAP_Frontend_ServerCustomize
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x416faf
mov edi, str.System
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push ecx
mov ecx, dword [esp + 0xc]
push str.System
push 1
push eax
push str.GuiXT.FontFacename
push ecx
call esi
mov edx, dword [esp + 8]
push 4
push 0x447cb8
push 4
push 0
push str.GuiXT.FontWidth
push edx
call esi
mov eax, dword [esp + 8]
push 4
push 0x447cbc
push 4
push 0
push str.GuiXT.FontHeight
push eax
call esi
mov ecx, dword [esp + 8]
push 4
push 0x43a230
push 4
push 0
push str.GuiXT.FontWeight
push ecx
call esi
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop edi
add esp, 0x40
ret
Function at 0x4170e0
Capabilities:
Check mutex on windows

Disassembly:
mov eax, dword [0x447c60]
push ebx
xor ebx, ebx
push esi
cmp eax, ebx
push edi
jne 0x417100
push str.GuideRequestActive
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x447c60], eax
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
mov dword [edi], ebx
mov dword [esi], ebx
mov eax, dword [0x447c50]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x41713c
mov edx, dword [0x447c60]
xor esi, esi
push edx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, esi
pop edi
pop esi
pop ebx
ret
mov edx, dword [0x447c50]
mov ecx, dword [esp + 0x10]
push 0xffffffffffffffff
push ecx
mov dword [edx + 0x1034], ebx
mov eax, dword [0x447c50]
mov dword [eax + 0x1038], ebx
mov eax, dword [0x447c50]
mov edx, dword [0x447c4c]
mov ecx, dword [eax]
push edx
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [0x447c50]
mov eax, dword [ecx + 0x1034]
cmp eax, ebx
jne 0x417194
mov edx, dword [0x447c60]
xor esi, esi
push edx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, esi
pop edi
pop esi
pop ebx
ret
mov edx, dword [ecx + 0x1038]
push ebp
mov ebp, dword [esp + 0x18]
imul edx, eax
mov eax, dword [ebp]
push edx
push eax
call fcn.004203ee
add esp, 8
cmp eax, ebx
mov dword [ebp], eax
jne 0x4171bc
call dword [sym.imp.KERNEL32.dll_DebugBreak]
mov ecx, dword [0x447c50]
mov edx, dword [ecx + 0x1034]
mov dword [edi], edx
mov eax, dword [0x447c50]
mov ecx, dword [eax + 0x1038]
mov dword [esi], ecx
mov eax, dword [edi]
cmp eax, ebx
jle 0x417241
mov eax, dword [0x447c50]
jmp 0x4171e8
mov esi, dword [esp + 0x20]
mov edx, dword [esp + 0x14]
mov ecx, dword [0x447c4c]
push ebx
push edx
mov edx, dword [eax]
push ecx
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [0x447c50]
mov edi, dword [esi]
mov ecx, dword [eax + 0x103c]
lea esi, [eax + 0x1040]
imul ecx, edi
imul edi, ebx
mov eax, dword [ebp]
add edi, eax
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [0x447c50]
mov ecx, dword [esp + 0x1c]
mov esi, dword [eax + 0x103c]
mov edx, dword [ecx]
add ebx, esi
cmp ebx, edx
jl 0x4171e4
mov edx, dword [0x447c60]
pop ebp
push edx
mov esi, 1
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, esi
pop edi
pop esi
pop ebx
ret

Function at 0x4189a0
Capabilities:
Create thread

Disassembly:
mov eax, dword [0x447e2c]
test eax, eax
jne 0x4189ce
mov eax, dword [esp + 4]
push 0x447e30
and eax, 0xffff
push 0
push eax
push 0x40bb80
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x447e2c], eax
ret
Function at 0x418a70
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x648
lea eax, [esp + 0x328]
push ebx
mov ebx, dword [esp + 0x650]
push esi
push edi
and ebx, 0xffff
push 0x320
push eax
push ebx
call fcn.00408690
mov eax, dword [0x447e38]
add esp, 0xc
test eax, eax
je 0x418c23
mov ecx, dword [eax + 0x5ebc]
test ecx, ecx
je 0x418c23
push 0x4463c5
mov byte [0x4463c4], 0x4e
call fcn.004147d0
mov edi, 0x4463c4
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edx, 0x200
sub edx, ecx
mov edi, 0x4463c4
or ecx, 0xffffffff
push str.line
repne scasb al, byte es:[edi]
not ecx
dec ecx
push str.Say
push 0x440ae4
add ecx, 0x4463c4
push edx
push ecx
call fcn.0041f19c
lea eax, [esp + 0x348]
push 0x4463c4
push eax
mov edi, 0x4463c4
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
add ecx, 0x4463c4
push ecx
call fcn.00414880
mov eax, dword [0x447e38]
add esp, 0x20
mov cl, byte [eax + 0x5ec0]
lea edi, [eax + 0x5ec0]
test cl, cl
je 0x418c0f
mov ecx, dword [str.hh.mm]
mov dx, word [0x440ae0]
mov dword [esp + 0xc], ecx
or ecx, 0xffffffff
xor eax, eax
mov word [esp + 0x10], dx
mov word [esp + 0x12], 0
lea edx, [esp + 0x14]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
mov dx, word [0x4463c8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [esp + 0xc]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov cx, word [0x4463c5]
push str.time
mov word [esp + 0x14], cx
lea ecx, [esp + 0x1c]
push ecx
mov word [esp + 0x1b], dx
call fcn.00417780
lea edx, [esp + 0x20]
push 0x4409c4
push edx
call fcn.0041f85a
mov esi, eax
add esp, 0x14
test esi, esi
je 0x418c23
push esi
push 0x4463c4
call fcn.0041f6fc
mov edi, 0x4463c4
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp byte [ecx + 0x4463c3], 0xa
je 0x418c04
push esi
push 0x440ad0
call fcn.0041f6fc
add esp, 8
push esi
call fcn.0041f74a
add esp, 4
jmp 0x418c23
mov eax, dword [eax + 0x72b4]
push 0x4463c4
push eax
call fcn.00408560
add esp, 8
mov ecx, 9
mov edi, str._process
lea esi, [esp + 0x334]
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x418c6e
lea eax, [esp + 0x33d]
lea ecx, [esp + 0x14]
push eax
push str.OK:_process_s
push ecx
call fcn.004200b4
lea edx, [esp + 0x20]
push edx
call fcn.00408600
push eax
call fcn.004189a0
add esp, 0x14
pop edi
pop esi
pop ebx
add esp, 0x648
ret
cmp byte [esp + 0x334], 0x2f
je 0x418ca5
lea eax, [esp + 0x14]
push 0x320
push eax
push ebx
call fcn.00408690
add esp, 0xc
lea ecx, [esp + 0x14]
lea edx, [esp + 0x334]
push ecx
push str._text__s_
push edx
call fcn.004200b4
add esp, 0xc
mov eax, dword [0x447c50]
mov edx, dword [0x447e38]
add eax, 0x830
push 0
lea ecx, [esp + 0x338]
push eax
mov eax, dword [edx + 0x72a8]
push ecx
push str.say.exe
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
pop ebx
add esp, 0x648
ret