joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e1840
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x2c]
xor ecx, ecx
mov eax, dword [edi]
mov cx, word [eax + 0x14]
lea esi, [ecx + eax + 0x18]
mov ecx, dword [edi + 0x3c]
push ecx
mov eax, dword [esi + 8]
push eax
mov dword [esp + 0x1c], eax
call fcn.004e1990
push esi
push edi
mov dword [esp + 0x28], eax
call fcn.004e19a0
mov ecx, dword [edi]
mov dword [esp + 0x2c], eax
mov edx, dword [esi + 0x24]
mov eax, 1
add esp, 0x10
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], 0
add esi, 0x28
cmp word [ecx + 6], ax
mov dword [esp + 0x10], eax
jbe 0x4e195b
mov ecx, dword [edi + 0x3c]
mov eax, dword [esi + 8]
push ecx
push eax
mov dword [esp + 0x34], eax
call fcn.004e1990
push esi
push edi
mov ebx, eax
call fcn.004e19a0
mov edx, dword [esp + 0x24]
mov ebp, eax
mov eax, dword [esp + 0x28]
add esp, 0x10
cmp eax, ebx
je 0x4e1905
mov eax, dword [esp + 0x1c]
add eax, edx
cmp eax, ebx
ja 0x4e1905
lea ecx, [esp + 0x14]
push ecx
push edi
call fcn.004e19d0
add esp, 8
test eax, eax
je 0x4e197b
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], edx
mov dword [esp + 0x1c], ebp
mov eax, dword [esi + 0x24]
mov dword [esp + 0x20], eax
jmp 0x4e193a
mov eax, dword [esi + 0x24]
mov ecx, dword [esp + 0x20]
test eax, 0x2000000
je 0x4e1923
test ecx, 0x2000000
je 0x4e1923
or ecx, eax
mov dword [esp + 0x20], ecx
jmp 0x4e192e
or eax, ecx
and eax, 0xfdffffff
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x2c]
sub ebp, edx
add ebp, eax
mov dword [esp + 0x1c], ebp
mov ecx, dword [edi]
mov eax, dword [esp + 0x10]
xor edx, edx
inc eax
mov dx, word [ecx + 6]
add esi, 0x28
cmp eax, edx
mov dword [esp + 0x10], eax
jl 0x4e18a1
mov eax, 1
mov dword [esp + 0x24], eax
lea eax, [esp + 0x14]
push eax
push edi
call fcn.004e19d0
add esp, 8
neg eax
pop edi
pop esi
sbb eax, eax
pop ebp
neg eax
pop ebx
add esp, 0x18
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret
Function at 0x4e83e0
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0xa4]
test eax, eax
je 0x4e8427
mov edi, dword [esp + 0x10]
push edi
call fcn.00517699
mov ecx, dword [esp + 0x10]
mov dword [ecx], eax
mov dword [esi + 0xa8], eax
mov eax, dword [esi + 0xa4]
mov ecx, dword [ecx]
push eax
push edi
push 1
push ecx
call fcn.00500571
sub eax, edi
add esp, 0x14
neg eax
sbb eax, eax
pop edi
and eax, 0x21
pop esi
ret 0xc
mov ecx, dword [esi + 0x2c]
test ecx, ecx
je 0x4e845b
mov eax, dword [esi + 0x18]
test eax, eax
je 0x4e845b
mov edx, dword [ecx]
call dword [edx + 0x40]
test al, al
je 0x4e8445
mov eax, dword [esi + 0x7c]
test eax, eax
jg 0x4e845b
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push eax
push ecx
mov ecx, esi
call fcn.004e8520
pop edi
pop esi
ret 0xc
mov ecx, dword [esi + 0x18]
push ebx
mov edx, dword [ecx]
call dword [edx + 0x18]
mov ecx, dword [esi + 0x14]
mov edi, eax
mov eax, dword [ecx]
call dword [eax + 0x18]
mov ebx, eax
cmp ebx, 0x5a
jle 0x4e848e
cmp edi, 0x5a
jle 0x4e848e
mov ecx, dword [esi + 0x2c]
mov edx, dword [ecx]
call dword [edx + 0x44]
test al, al
je 0x4e848e
mov ecx, dword [esi + 0x18]
mov eax, dword [ecx]
call dword [eax + 0x14]
mov eax, dword [esi + 0x7c]
imul eax, dword [esi + 0x3c]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
and edx, 0x1fff
add eax, edx
mov edi, eax
mov eax, dword [esi + 0x40]
sar edi, 0xd
cmp edi, eax
jbe 0x4e84bd
cdq
sub eax, edx
mov edi, eax
sar edi, 1
mov al, byte [esp + 0x18]
test al, al
je 0x4e8503
cmp ebx, 1
jge 0x4e8503
mov ecx, dword [esi + 0x18]
mov edx, edi
shr edx, 1
cmp dword [ecx + 0xc], edx
jae 0x4e8503
mov al, byte [esi + 0x1d]
test al, al
jne 0x4e8503
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x3e8
call ebx
mov ecx, dword [esi + 0x18]
cmp dword [ecx + 0xc], edi
jae 0x4e8503
mov eax, dword [ecx]
call dword [eax + 0x18]
cmp eax, 0x5a
jg 0x4e8503
mov al, byte [esi + 0x1d]
test al, al
je 0x4e84e3
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push ecx
push edx
mov ecx, esi
call fcn.004e8520
pop ebx
pop edi
pop esi
ret 0xc

Function at 0x4e96e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, ecx
mov al, byte [ebp + 0x24]
test al, al
jne 0x4e9707
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push eax
push ecx
push 1
push edx
call fcn.00500571
add esp, 0x10
pop ebp
ret 0xc
push ebx
push esi
mov esi, dword [esp + 0x18]
push edi
push esi
call fcn.00500b92
mov ebx, dword [esp + 0x18]
mov edi, eax
mov eax, dword [esp + 0x1c]
push esi
push eax
push 1
push ebx
call fcn.00500571
mov esi, eax
add esp, 0x14
test esi, esi
jbe 0x4e973b
push esi
push ebx
push edi
mov ecx, ebp
call fcn.004e9810
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x4e9750
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x102ccdc]
xor edx, edx
cmp eax, edx
jne 0x4e9776
xor eax, eax
mov byte [eax + 0x102cbdc], al
inc eax
cmp eax, 0x100
jl 0x4e975e
mov dword [0x102ccdc], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x102cbdc
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x4e9807
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x4e97da
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x4e97a8
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x4f01a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5260be
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.004f0ac0
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0xfee6fc
call fcn.00517699
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x4f0233
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00517699
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x4f022c
push 0
mov ecx, eax
call fcn.004e7380
mov dword [esi + 0xc], eax
jmp 0x4f0235
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x4f0235
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x510b82
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x101b190]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.0050538f
mov dword [ebp - 0x14], eax
cmp dword [0x103f87c], edi
jne 0x510c73
push 0x800
push edi
push 0xff66f8
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x510c00
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x510d53
push 0xff66f8
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x510d53
push 0xff6710
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x510d53
push eax
call ebx
push 0xff671c
push esi
mov dword [0x103f87c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0xff672c
push esi
mov dword [0x103f880], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0xff6740
push esi
mov dword [0x103f884], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x103f88c], eax
test eax, eax
je 0x510c70
push 0xff675c
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x103f888], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x510c98
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x510c8b
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x510cad
push 4
pop eax
jmp 0x510d55
cmp dword [ebp - 0x14], edi
je 0x510cad
push dword [0x103f87c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x510c92
mov eax, dword [0x103f888]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x510d0b
cmp dword [0x103f88c], esi
je 0x510d0b
push eax
call ebx
push dword [0x103f88c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x510d0b
test eax, eax
je 0x510d0b
call ecx
test eax, eax
je 0x510d00
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x510d00
test byte [ebp - 8], 1
jne 0x510d0b
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x510d3b
mov eax, dword [0x103f880]
cmp eax, esi
je 0x510d38
push eax
call ebx
test eax, eax
je 0x510d38
call eax
mov edi, eax
test edi, edi
je 0x510d38
mov eax, dword [0x103f884]
cmp eax, esi
je 0x510d38
push eax
call ebx
test eax, eax
je 0x510d38
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x103f87c]
call ebx
test eax, eax
je 0x510d53
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x510d55
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005016d5
leave
ret
Function at 0x519d25
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x519d5d
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00517db3
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00517d8b
jmp 0x519d69
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x51b419
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x51b45b
call fcn.00520e99
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x51b45b
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x51b452
xor eax, eax
jmp 0x51b463
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0051b469
pop edi
pop esi
pop ebx
ret 4
Function at 0x403a40
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x549118
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x5ac7dc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 0x10
push 0
cmovae eax, dword [ebp + 8]
push eax
call fcn.004ef912
add esp, 8
cmp eax, 0xffffffff
je 0x403b99
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
mov byte [ebp - 4], 1
push 0xffffffffffffffff
push 0
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x28]
call fcn.004080e0
push 4
push str..old
lea ecx, [ebp - 0x28]
call fcn.004082e0
lea ecx, [ebp - 0x40]
call fcn.00403890
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.00408410
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x2c]
cmp eax, 0x10
jb 0x403b27
mov ecx, dword [ebp - 0x40]
inc eax
cmp eax, 0x1000
jb 0x403b1e
test cl, 0x1f
jne 0x403bb3
mov eax, dword [ecx - 4]
cmp eax, ecx
jae 0x403bb3
sub ecx, eax
cmp ecx, 4
jb 0x403bb3
cmp ecx, 0x23
ja 0x403bb3
mov ecx, eax
push ecx
call fcn.004ae222
add esp, 4
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.004ef912
add esp, 8
test eax, eax
je 0x403aa5
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x28]
lea eax, [ebp + 8]
cmovae ecx, dword [ebp - 0x28]
cmp dword [ebp + 0x1c], 0x10
push ecx
cmovae eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
je 0x403b8d
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push 4
cmovae eax, dword [ebp - 0x28]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
je 0x403b8d
lea ecx, [ebp - 0x28]
mov bl, 1
call fcn.00406ce0
jmp 0x403b9b
lea ecx, [ebp - 0x28]
xor bl, bl
call fcn.00406ce0
jmp 0x403b9b
mov bl, 1
mov eax, dword [ebp + 0x1c]
cmp eax, 0x10
jb 0x403be5
mov ecx, dword [ebp + 8]
inc eax
cmp eax, 0x1000
jb 0x403bdc
test cl, 0x1f
je 0x403bb8
call fcn.004ef829
mov eax, dword [ecx - 4]
cmp eax, ecx
jb 0x403bc4
call fcn.004ef829
sub ecx, eax
cmp ecx, 4
jae 0x403bd0
call fcn.004ef829
cmp ecx, 0x23
jbe 0x403bda
call fcn.004ef829
mov ecx, eax
push ecx
call fcn.004ae222
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ae22e
mov esp, ebp
pop ebp
ret
Function at 0x403c90
Capabilities:
Delete service
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x5ac7dc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
jne 0x403cd2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenSCManager___Faild__d____n
call fcn.004016a0
add esp, 8
xor esi, esi
jmp 0x403d62
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
push 0xf01ff
cmovae eax, dword [ebp + 8]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x403d0d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenService___Faild__d____n
call fcn.004016a0
add esp, 8
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x403d5d
lea eax, [ebp - 0x20]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x403d32
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x58442c
call fcn.004016a0
add esp, 8
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x403d51
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x584460
call fcn.004016a0
add esp, 8
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
mov esi, 1
mov eax, dword [ebp + 0x1c]
cmp eax, 0x10
jb 0x403d98
mov ecx, dword [ebp + 8]
inc eax
cmp eax, 0x1000
jb 0x403d8f
test cl, 0x1f
jne 0x403daa
mov eax, dword [ecx - 4]
cmp eax, ecx
jae 0x403daf
sub ecx, eax
cmp ecx, 4
jb 0x403db4
cmp ecx, 0x23
ja 0x403db9
mov ecx, eax
push ecx
call fcn.004ae222
add esp, 4
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.004ae22e
mov esp, ebp
pop ebp
ret
call fcn.004ef829
call fcn.004ef829
call fcn.004ef829
call fcn.004ef829
int3
Function at 0x4057b0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
mov eax, dword [0x5ac7dc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
lea eax, [ebp - 0x434]
mov dword [ebp - 0x438], 0
push eax
push 0x20019
xor esi, esi
push esi
push 0x5847e0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov eax, dword [0x584884]
movq xmm0, qword [str.ComponentId]
push esi
push esi
mov dword [ebp - 8], eax
mov al, byte [0x584898]
push esi
push esi
mov byte [ebp - 0x14], al
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x124]
movq qword [ebp - 0x10], xmm0
movups xmm0, xmmword [str.NetCfgInstanceId]
push eax
push esi
push dword [ebp - 0x434]
movups xmmword [ebp - 0x24], xmm0
mov dword [ebp - 0x428], 0x100
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, 0x103
je 0x4059d5
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
nop word [eax + eax]
lea eax, [ebp - 0x124]
push eax
push str.SYSTEMCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002BE10318
push str._s_s
lea eax, [ebp - 0x224]
push 0x100
push eax
call fcn.00401870
add esp, 0x14
lea eax, [ebp - 0x430]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x224]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x405967
lea eax, [ebp - 0x428]
mov dword [ebp - 0x428], 0x100
push eax
lea eax, [ebp - 0x324]
push eax
lea eax, [ebp - 0x42c]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x430]
call edi
test eax, eax
jne 0x40595f
cmp dword [ebp - 0x42c], 1
jne 0x40595f
lea eax, [ebp - 0x428]
mov dword [ebp - 0x428], 0x100
push eax
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x42c]
push eax
push 0
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x430]
call edi
test eax, eax
jne 0x40595f
cmp dword [ebp - 0x42c], 1
jne 0x40595f
mov eax, str.bmnadapter
lea ecx, [ebp - 0x324]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x405950
test dl, dl
je 0x40594c
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x405950
add ecx, 2
add eax, 2
test dl, dl
jne 0x405930
xor eax, eax
jmp 0x405955
sbb eax, eax
or eax, 1
test eax, eax
mov eax, 1
cmove esi, eax
push dword [ebp - 0x430]
call ebx
mov eax, dword [0x584884]
mov ecx, dword [ebp - 0x438]
movq xmm0, qword [str.ComponentId]
inc ecx
push 0
push 0
mov dword [ebp - 8], eax
mov al, byte [0x584898]
push 0
push 0
mov byte [ebp - 0x14], al
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x124]
movq qword [ebp - 0x10], xmm0
movups xmm0, xmmword [str.NetCfgInstanceId]
push eax
push ecx
push dword [ebp - 0x434]
mov dword [ebp - 0x438], ecx
movups xmmword [ebp - 0x24], xmm0
mov dword [ebp - 0x428], 0x100
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp eax, 0x103
jne 0x405860
pop edi
push dword [ebp - 0x434]
call ebx
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.004ae22e
mov esp, ebp
pop ebp
ret
Function at 0x40a530
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push esi
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00420a22
mov esi, eax
test esi, esi
je 0x40a5a6
mov ecx, dword [esi]
mov eax, dword [ecx + 4]
cmp ecx, vtable.CMainDlg.3.0
jne 0x40a6ca
mov ecx, str.text
mov eax, str.hostwnd
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40a586
test dx, dx
je 0x40a582
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40a586
add eax, 4
add ecx, 4
test dx, dx
jne 0x40a560
xor eax, eax
jmp 0x40a58b
sbb eax, eax
or eax, 1
test eax, eax
je 0x40a59f
push str.text
mov ecx, esi
call fcn.00402a60
test eax, eax
je 0x40a5a6
mov eax, esi
pop esi
pop ebp
ret 8
mov ecx, dword [0x5b3e68]
test ecx, ecx
je 0x40a5b9
call fcn.004181d9
mov esi, eax
jmp 0x40a5bb
xor esi, esi
push ebx
push edi
push 0x2800
call fcn.004efd18
push 0x5000
mov edi, eax
call fcn.004efd18
push 0xffffffffffffffff
push dword [ebp + 8]
mov ebx, eax
push str.text
push str.FindChildByName2_Failed__no_window_of_class___s__with_name_of___s__was_found_within___d__levels
push 0xffffffffffffffff
push 0x2800
push ebx
call fcn.00401580
add esp, 0x24
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp eax, 0x2800
jae 0x40a623
push 0
push 0
push eax
push edi
push 0xffffffffffffffff
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
call fcn.004efd13
add esp, 4
test esi, esi
je 0x40a677
mov eax, dword [esi]
mov ecx, esi
push 1
push 0
mov eax, dword [eax + 0x2c]
call eax
test al, al
je 0x40a677
mov eax, dword [ebp + 4]
mov ecx, esi
mov edx, dword [esi]
push eax
push str.SOUI::SWindow::FindChildByName2
push 0x20e
push str.d:jenkinsworkspace_soui_souiincludecoreSWnd.h
push edi
push str.soui
push 1
push 0
call dword [edx + 0x34]
push edi
call fcn.004efd13
add esp, 4
xor eax, eax
pop edi
pop ebx
pop esi
pop ebp
ret 8
push 0x2800
call fcn.004efd18
push 0x20e
push str.d:jenkinsworkspace_soui_souiincludecoreSWnd.h
push str.SOUI::SWindow::FindChildByName2
push edi
push str._s__s__s:_d_n
push 0xffffffffffffffff
mov esi, eax
push 0x2800
push esi
call fcn.004018b0
add esp, 0x24
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push esi
call fcn.004efd13
add esp, 4
push edi
call fcn.004efd13
add esp, 4
xor eax, eax
pop edi
pop ebx
pop esi
pop ebp
ret 8
push str.text
mov ecx, esi
call eax
jmp 0x40a59b
Function at 0x40a6e0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push esi
push 0xffffffffffffffff
push 0x584348
call fcn.00420a22
mov esi, eax
test esi, esi
je 0x40a757
mov ecx, dword [esi]
mov eax, dword [ecx + 4]
cmp ecx, vtable.CMainDlg.3.0
jne 0x40a87d
mov ecx, str.button
mov eax, str.hostwnd
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40a737
test dx, dx
je 0x40a733
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40a737
add eax, 4
add ecx, 4
test dx, dx
jne 0x40a711
xor eax, eax
jmp 0x40a73c
sbb eax, eax
or eax, 1
test eax, eax
je 0x40a750
push str.button
mov ecx, esi
call fcn.00402a60
test eax, eax
je 0x40a757
mov eax, esi
pop esi
pop ebp
ret 8
mov ecx, dword [0x5b3e68]
test ecx, ecx
je 0x40a76a
call fcn.004181d9
mov esi, eax
jmp 0x40a76c
xor esi, esi
push ebx
push edi
push 0x2800
call fcn.004efd18
push 0x5000
mov edi, eax
call fcn.004efd18
push 0xffffffffffffffff
push 0x584348
push str.button
push str.FindChildByName2_Failed__no_window_of_class___s__with_name_of___s__was_found_within___d__levels
push 0xffffffffffffffff
mov ebx, eax
push 0x2800
push ebx
call fcn.00401580
add esp, 0x24
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp eax, 0x2800
jae 0x40a7d6
push 0
push 0
push eax
push edi
push 0xffffffffffffffff
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
call fcn.004efd13
add esp, 4
test esi, esi
je 0x40a82a
mov eax, dword [esi]
mov ecx, esi
push 1
push 0
mov eax, dword [eax + 0x2c]
call eax
test al, al
je 0x40a82a
mov eax, dword [ebp + 4]
mov ecx, esi
mov edx, dword [esi]
push eax
push str.SOUI::SWindow::FindChildByName2
push 0x20e
push str.d:jenkinsworkspace_soui_souiincludecoreSWnd.h
push edi
push str.soui
push 1
push 0
call dword [edx + 0x34]
push edi
call fcn.004efd13
add esp, 4
xor eax, eax
pop edi
pop ebx
pop esi
pop ebp
ret 8
push 0x2800
call fcn.004efd18
push 0x20e
push str.d:jenkinsworkspace_soui_souiincludecoreSWnd.h
push str.SOUI::SWindow::FindChildByName2
push edi
push str._s__s__s:_d_n
push 0xffffffffffffffff
mov esi, eax
push 0x2800
push esi
call fcn.004018b0
add esp, 0x24
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push esi
call fcn.004efd13
add esp, 4
push edi
call fcn.004efd13
add esp, 4
xor eax, eax
pop edi
pop ebx
pop esi
pop ebp
ret 8
push str.button
mov ecx, esi
call eax
jmp 0x40a74c