joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402a08
Capabilities:
Set registry value

Disassembly:
mov eax, 0x4e74ee
call fcn.004e6580
push ecx
mov ecx, dword [ebp + 8]
push edi
lea eax, [ebp - 0x10]
xor edi, edi
push eax
mov dword [ebp - 0x10], edi
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::operator_class_ATL::CSimpleStringT_]
push eax
push reloc.BugReportU.dll_Ordinal_2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
cmp eax, edi
jne 0x402a8f
cmp dword [ebp - 0x10], edi
je 0x402a8c
push esi
mov dword [ebp + 8], edi
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 4], edi
call dword [sym.imp.MFC71U.DLL_CRecordset::AllocStatusArrays]
push eax
lea ecx, [ebp + 8]
call fcn.004d3519
mov esi, dword [ebp + 8]
cmp esi, edi
jne 0x402a5f
xor eax, eax
jmp 0x402a66
push esi
call dword [sym.imp.OLEAUT32.dll_SysAllocStringByteLen]
mov ecx, dword [ebp + 0xc]
push eax
push esi
push 1
push edi
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::operator_class_ATL::CSimpleStringT_]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push esi
mov edi, eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, edi
pop esi
jmp 0x402a8f
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
leave
ret 0xc

Function at 0x402a9e
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x4e7501
call fcn.004e6580
sub esp, 0x808
push esi
xor esi, esi
mov dword [ebp - 0x14], esi
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x10], esi
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::operator_class_ATL::CSimpleStringT_]
push eax
push reloc.BugReportU.dll_Ordinal_2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x402b47
cmp dword [ebp - 0x10], esi
je 0x402b47
push edi
mov word [ebp - 0x814], si
mov ecx, 0x1ff
lea edi, [ebp - 0x812]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp + 0x10]
stosw word es:[edi], ax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x814]
push eax
push esi
push esi
mov dword [ebp - 0x14], 0x400
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::operator_class_ATL::CSimpleStringT_]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, esi
pop edi
jne 0x402b47
lea eax, [ebp - 0x814]
push eax
lea ecx, [ebp + 0xc]
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::CStringT_8]
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
mov dword [ebp - 4], esi
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::CStringT_7]
lea ecx, [ebp + 0xc]
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::CSimpleStringT]
jmp 0x402b55
mov ecx, dword [ebp + 8]
push 0x4feb50
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::CStringT_8]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop esi
mov dword fs:[0], ecx
leave
ret 0xc
Function at 0x4057b9
Capabilities:
Set global application hook

Disassembly:
cmp dword [0x54f4ec], 0
mov dword [0x54f4f0], ecx
jne 0x4057e3
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0
push 0x405051
push 3
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [0x54f4ec], eax
ret
Function at 0x40979c
Capabilities:
Terminate process

Disassembly:
mov eax, 0x4e80e3
call fcn.004e6580
sub esp, 0x238
push ebx
push esi
push edi
lea ecx, [ebp - 0x18]
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::CStringT_9]
xor ebx, ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov esi, eax
push esi
lea eax, [ebp - 0x18]
push str.CThunderApp::KillThunder_GetCurrentProcessId__d
push eax
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::Format_1]
or dword [ebp - 0x10], 0xffffffff
add esp, 0xc
push ebx
push 2
lea ecx, [ebp - 0x10]
call fcn.004089d5
xor eax, eax
mov dword [ebp - 0x244], 0x22c
mov ecx, 0x8a
lea edi, [ebp - 0x240]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x244]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.004090b0
cmp eax, ebx
je 0x40986f
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x14]
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::CStringT_8]
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call dword [sym.imp.MFC71U.DLL_CDC::LPtoHIMETRIC]
push ebx
push 0x4ffc74
lea ecx, [ebp - 0x14]
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::Find]
test eax, eax
jl 0x40984f
cmp esi, dword [ebp - 0x23c]
jne 0x409898
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::CSimpleStringT]
lea eax, [ebp - 0x244]
push eax
lea ecx, [ebp - 0x10]
call fcn.00408a0d
test eax, eax
jne 0x409817
cmp dword [ebp - 0x10], 0xffffffff
je 0x40987e
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x18]
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::CSimpleStringT]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov eax, ebx
pop ebx
mov dword fs:[0], ecx
leave
ret
push dword [ebp - 0x23c]
push ebx
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, ebx
je 0x409925
push 0x1388
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, eax
push edi
lea eax, [ebp - 0x18]
push str.CThunderApp::KillThunder_TerminateProcess_WaitForSingleObject:__d
push eax
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::Format_1]
add esp, 0xc
cmp edi, ebx
je 0x4098f8
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x4098f8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x18]
push str.CThunderApp::KillThunder_TerminateProcess_faile_Err:__d
push eax
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::Format_1]
add esp, 0xc
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x14]
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::CSimpleStringT]
cmp dword [ebp - 0x10], 0xffffffff
je 0x40991d
push dword [ebp - 0x10]
call esi
xor ebx, ebx
inc ebx
jmp 0x40987e
lea ecx, [ebp - 0x14]
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::CSimpleStringT]
or ebx, 0xffffffff
cmp dword [ebp - 0x10], ebx
jmp 0x409873
Function at 0x40a159
Capabilities:
Terminate process

Disassembly:
mov eax, 0x4e8233
call fcn.004e6580
push ecx
push esi
push 0x552804
mov esi, ecx
call dword [sym.imp.ATL71.DLL_Ordinal_20_1]
mov eax, dword [esi + 0xb4]
test eax, eax
je 0x40a182
mov ecx, dword [eax]
push eax
call dword [ecx + 0x70]
call fcn.0049751c
mov ecx, eax
call fcn.00496ec5
and dword [ebp - 0x10], 0
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
push 0x515c90
call fcn.00409158
mov ecx, eax
call sub.MFC71U.DLL_CCmdTarget::ExternalDisconnect
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x20]
call fcn.00499c92
mov ecx, esi
call fcn.00409778
call dword [sym.imp.BugReportU.dll_Ordinal_3]
add esi, 0xb0
mov eax, dword [esi]
test eax, eax
je 0x40a1e4
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [esi], 0
call fcn.00408888
call fcn.00405f06
call dword [sym.imp.ole32.dll_CoUninitialize]
call dword [sym.imp.MSVCR71.dll__flushall]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [ebp - 0x10]
or dword [ebp - 4], 0xffffffff
test eax, eax
pop esi
je 0x40a21b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0xc]
xor eax, eax
mov dword fs:[0], ecx
leave
ret
Function at 0x40bc90
Capabilities:
Check mutex on windows
Print debug messages
Read file via mapping

Disassembly:
push ecx
push ecx
push ebx
push str.thunder5_shell_mutex
push 1
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
cmp eax, ebx
je 0x40bcaf
or eax, 0xffffffff
jmp 0x40bdff
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateMutexW]
push edi
push str.Global_thunder5_app_mutex
push 1
push ebx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x10], eax
call edi
push str.thunder6_app_mutex
push 1
push ebx
mov dword [esp + 0x20], eax
call esi
mov ebp, eax
cmp ebp, ebx
jne 0x40bcf2
push str.CThunderApp::InitInstance_hThunder6__NULL
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x40bdf9
call edi
mov ecx, 0xb7
cmp eax, ecx
je 0x40bd0a
cmp dword [esp + 0x14], ecx
je 0x40bd0a
xor eax, eax
jmp 0x40bdfc
push str.Thunder_Shell_Stop_Delay
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov esi, eax
cmp esi, ebx
je 0x40bd48
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [esp + 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_ReleaseMutex]
call edi
push ebp
call edi
push dword [esp + 0x10]
call esi
jmp 0x40bdf0
push str.Thunder_App_Info
push ebx
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov edi, eax
cmp edi, ebx
je 0x40bdf9
push 0x24
push ebx
push ebx
push 4
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
cmp dword [esi], 0x24
jne 0x40bdd2
cmp dword [esi + 4], ebx
je 0x40bdd2
cmp dword [esi + 8], ebx
jne 0x40bdd2
mov eax, dword [esi + 0xc]
cmp eax, ebx
je 0x40bd8a
cmp eax, 1
jne 0x40bdd2
push dword [esi + 0x10]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x40bdd2
push 0x4fef28
mov dword [esp + 0x18], ebx
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
lea ecx, [esp + 0x14]
push ecx
push 0x3e8
push 2
push ebx
push ebx
push eax
push dword [esi + 0x10]
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
test eax, eax
je 0x40bdd2
cmp dword [esp + 0x14], 0xffffffff
je 0x40bdd2
push dword [esi + 0x10]
call fcn.004a35f0
pop ecx
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call esi
push dword [esp + 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_ReleaseMutex]
call edi
push dword [esp + 0x10]
call esi
push ebp
call edi
push ebp
call esi
push ebx
call edi
push ebx
call esi
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
Function at 0x40c9cf
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4e867d
call fcn.004e6580
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esi + 4], edi
mov dword [ebp - 0x10], esi
mov dword [esi + 8], edi
mov dword [ebp - 4], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
lea eax, [esi + 0x78]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov dword [esi + 0x88], edi
lea ecx, [esi + 0x98]
call fcn.0040be7a
lea ecx, [esi + 0xc0]
call fcn.0040be9b
mov dword [esi + 0xe4], edi
mov dword [esi + 0xe8], edi
mov dword [esi + 0xec], edi
mov dword [esi + 0xf0], edi
mov dword [esi + 0xf4], edi
mov dword [esi + 0xf8], edi
mov dword [esi + 0xfc], edi
mov dword [esi + 0x100], edi
mov dword [esi + 0x104], edi
mov dword [esi + 0x108], edi
mov dword [esi + 0x10c], edi
push edi
lea ecx, [esi + 0x110]
mov byte [ebp - 4], 0x1f
call fcn.00450240
mov eax, esi
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x40c9da
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4e867d
call fcn.004e6580
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esi + 4], edi
mov dword [ebp - 0x10], esi
mov dword [esi + 8], edi
mov dword [ebp - 4], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
lea eax, [esi + 0x78]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov dword [esi + 0x88], edi
lea ecx, [esi + 0x98]
call fcn.0040be7a
lea ecx, [esi + 0xc0]
call fcn.0040be9b
mov dword [esi + 0xe4], edi
mov dword [esi + 0xe8], edi
mov dword [esi + 0xec], edi
mov dword [esi + 0xf0], edi
mov dword [esi + 0xf4], edi
mov dword [esi + 0xf8], edi
mov dword [esi + 0xfc], edi
mov dword [esi + 0x100], edi
mov dword [esi + 0x104], edi
mov dword [esi + 0x108], edi
mov dword [esi + 0x10c], edi
push edi
lea ecx, [esi + 0x110]
mov byte [ebp - 4], 0x1f
call fcn.00450240
mov eax, esi
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x40d043
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4e867d
call fcn.004e6580
push ecx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0x110]
mov dword [ebp - 4], 0x1f
call fcn.0045026c
mov eax, dword [esi + 0x10c]
test eax, eax
mov byte [ebp - 4], 0x1e
je 0x40c791
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esi + 0x108]
test eax, eax
mov byte [ebp - 4], 0x1d
je 0x40c7a5
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esi + 0x104]
test eax, eax
mov byte [ebp - 4], 0x1c
je 0x40c7b9
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esi + 0x100]
test eax, eax
mov byte [ebp - 4], 0x1b
je 0x40c7cd
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esi + 0xfc]
test eax, eax
mov byte [ebp - 4], 0x1a
je 0x40c7e1
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esi + 0xf8]
test eax, eax
mov byte [ebp - 4], 0x19
je 0x40c7f5
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esi + 0xf4]
test eax, eax
mov byte [ebp - 4], 0x18
je 0x40c809
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esi + 0xf0]
test eax, eax
mov byte [ebp - 4], 0x17
je 0x40c81d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esi + 0xec]
test eax, eax
mov byte [ebp - 4], 0x16
je 0x40c831
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esi + 0xe8]
test eax, eax
mov byte [ebp - 4], 0x15
je 0x40c845
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esi + 0xe4]
test eax, eax
mov byte [ebp - 4], 0x14
je 0x40c859
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea ecx, [esi + 0xc0]
mov dword [ecx], 0x5003cc
call fcn.0044c54e
lea ecx, [esi + 0x98]
mov dword [ecx], 0x5003c8
call fcn.0044c54e
mov eax, dword [esi + 0x88]
test eax, eax
mov byte [ebp - 4], 0x11
je 0x40c88f
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea eax, [esi + 0x78]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
push dword [esi + 0x48]
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
call edi
push dword [esi + 0x44]
call edi
push dword [esi + 0x40]
call edi
push dword [esi + 0x3c]
call edi
push dword [esi + 0x38]
call edi
push dword [esi + 0x34]
call edi
push dword [esi + 0x30]
call edi
push dword [esi + 0x2c]
call edi
push dword [esi + 0x28]
call edi
push dword [esi + 0x24]
call edi
push dword [esi + 0x20]
call edi
push dword [esi + 0x1c]
call edi
push dword [esi + 0x18]
call edi
push dword [esi + 0x14]
call edi
push dword [esi + 0x10]
call edi
push dword [esi + 0xc]
call edi
push dword [esi + 8]
call edi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
push esi
mov esi, ecx
mov dword [esi], 0x500600
mov dword [esi + 4], 0xc0000001
mov ecx, dword [0x54f4b8]
mov eax, dword [ecx]
call dword [eax + 8]
mov ecx, esi
pop esi
jmp 0x40c759
Function at 0x40d1ba
Capabilities:
Print debug messages

Disassembly:
mov eax, 0x4e8719
call fcn.004e6580
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
call fcn.004e628b
push eax
lea ecx, [ebp - 0x20]
call sub.MFC71U.DLL_AFX_EXCEPTION_LINK::AFX_EXCEPTION_LINK
xor ebx, ebx
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], ebx
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::CStringT_9]
lea ecx, [ebp - 0x10]
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::CStringT_9]
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 2
call fcn.0049f070
pop ecx
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 3
call dword [0x4fc954]
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 2
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::CSimpleStringT]
push dword [ebp - 0x14]
lea eax, [ebp - 0x10]
push str._sProgramXLGUIPlatform.dll
push eax
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::Format_1]
add esp, 0xc
lea esi, [edi + 0x2c]
push esi
push 0x4fe3c4
push 0x4fe804
lea ecx, [ebp - 0x10]
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::operator_class_ATL::CSimpleStringT_]
push eax
call fcn.0049dbf0
mov eax, dword [esi]
mov ecx, dword [eax]
add esp, 0x10
push eax
call dword [ecx + 0x18]
mov eax, dword [esi]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [esi]
mov ecx, dword [eax]
push 2
push eax
call dword [ecx + 0x10]
cmp dword [esi], ebx
jne 0x40d277
mov ebx, 0x80004005
jmp 0x40d304
call fcn.004010c5
push ebx
push ecx
mov eax, esp
mov dword [ebp - 0x18], esp
push ebx
push ebx
push str.THUNDER6_JHFKKHOSTSITE
push ecx
mov dword [eax], ebx
mov eax, esp
mov dword [ebp - 0x18], esp
push ebx
lea ecx, [edi + 4]
mov dword [eax], ebx
call fcn.0040cc40
push str.CXLGPHostSite::FinalConstruct___after_THUNDER6_JHFKKHOSTSITE
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [esi]
mov edx, dword [eax]
lea ecx, [edi + 0x38]
push ecx
push 0xffffffffffffffff
push eax
call dword [edx + 0x20]
mov eax, dword [edi + 0x38]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
cmp eax, ebx
jge 0x40d2c7
mov ebx, eax
jmp 0x40d304
mov eax, dword [esi]
mov ecx, dword [eax]
lea edx, [edi + 0x30]
push edx
push 0xffffffffffffffff
push eax
call dword [ecx + 0x24]
mov eax, dword [esi]
mov ecx, dword [eax]
lea edx, [edi + 0x34]
push edx
push eax
call dword [ecx + 0x2c]
push ebx
push 0x1f4
push 1
push dword [edi + 8]
call dword [sym.imp.USER32.dll_SetTimer]
lea eax, [edi + 0x64]
push eax
push 0x4fe7a4
push edi
push dword [esi]
call dword [sym.imp.ATL71.DLL_Ordinal_10]
lea ecx, [ebp - 0x10]
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::CSimpleStringT]
lea ecx, [ebp - 0x14]
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::CSimpleStringT]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
mov dword [eax + 4], ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov eax, ebx
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x41000d
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4e8c72
call fcn.004e6580
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
lea ecx, [esi + 0x14]
mov dword [ebp - 0x10], esi
mov dword [esi + 0x10], ebx
call fcn.00408942
lea ecx, [esi + 0x34]
mov dword [ebp - 4], ebx
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
lea ecx, [esi + 0x50]
mov byte [ebp - 4], 1
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
mov dword [esi + 0x6c], ebx
lea ecx, [esi + 0x74]
mov byte [ebp - 4], 3
call fcn.00407a29
lea ecx, [esi + 0x80]
mov byte [ebp - 4], 4
call fcn.0040ed16
lea ecx, [esi + 0x8c]
mov byte [ebp - 4], 5
call fcn.004bdec0
lea ecx, [esi + 0xe4]
mov byte [ebp - 4], 6
call fcn.004c1da0
lea ecx, [esi + 0xf4]
mov byte [ebp - 4], 7
call fcn.004c0e20
lea ecx, [esi + 0x128]
mov byte [ebp - 4], 8
call fcn.0040fe78
lea ecx, [esi + 0x150]
mov byte [ebp - 4], 9
call fcn.0040f01f
lea eax, [esi + 0x160]
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
push str.Xunlei.Thunder.AddinManager
mov byte [esi + 0x30], bl
mov dword [esi + 0x70], ebx
mov byte [esi + 0x15c], bl
call dword [sym.imp.XLLuaRuntime.dll__XLLRT_CreateEventContainer_4]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x2c], eax
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x413840
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4e92a2
call fcn.004e6580
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
lea ecx, [esi + 0x10]
mov dword [ebp - 0x10], esi
mov dword [esi + 0xc], edi
call fcn.00416813
lea ecx, [esi + 0x1c]
mov dword [ebp - 4], edi
call fcn.00416813
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
lea ecx, [esi + 0x34]
mov byte [ebp - 4], 4
call fcn.00421872
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x40], edi
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x417d51
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x4e97d5
call fcn.004e6580
sub esp, 0x38
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
cmp edi, ebx
je 0x417ec8
cmp dword [ebp + 0xc], ebx
je 0x417ec8
cmp dword [ebp + 0x10], ebx
je 0x417ec8
mov esi, dword [sym.imp.MSVCR71.dll__stricmp]
push str.HKEY_CURRENT_USER
push edi
call esi
test eax, eax
pop ecx
pop ecx
jne 0x417d9b
mov esi, reloc.BugReportU.dll_Ordinal_1
jmp 0x417ddc
push str.HKEY_CLASSES_ROOT
push edi
call esi
test eax, eax
pop ecx
pop ecx
jne 0x417db0
mov esi, SysReAllocStringLen
jmp 0x417ddc
push str.HKEY_LOCAL_MACHINE
push edi
call esi
test eax, eax
pop ecx
pop ecx
jne 0x417dc5
mov esi, reloc.BugReportU.dll_Ordinal_2
jmp 0x417ddc
push str.HKEY_USERS
push edi
call esi
test eax, eax
pop ecx
pop ecx
jne 0x417ec8
mov esi, reloc.BugReportU.dll_Ordinal_3
lea ecx, [ebp - 0x44]
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], ebx
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
lea eax, [ebp - 0x44]
push eax
push dword [ebp + 0xc]
mov byte [ebp - 4], 1
call sub.MSVCR71.dll_strlen
pop ecx
push eax
push dword [ebp + 0xc]
call fcn.00417303
add esp, 0xc
lea eax, [ebp - 0x28]
push eax
push dword [ebp + 0x10]
call sub.MSVCR71.dll_strlen
pop ecx
push eax
push dword [ebp + 0x10]
call fcn.00417303
mov eax, dword [ebp - 0x40]
add esp, 0xc
cmp dword [ebp - 0x2c], 8
jae 0x417e33
lea eax, [ebp - 0x40]
lea ecx, [ebp + 8]
push ecx
push 0x20019
push ebx
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x417ea8
cmp dword [ebp - 0x10], 8
mov eax, dword [ebp - 0x24]
jae 0x417e55
lea eax, [ebp - 0x24]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [ebp + 0xc]
push ecx
push ebx
push ebx
push ebx
push eax
push dword [ebp + 8]
call esi
test eax, eax
jne 0x417ea8
mov eax, dword [ebp + 0xc]
lea eax, [eax + eax + 2]
push eax
call sub.MFC71U.DLL_SerializeElements
cmp dword [ebp - 0x10], 8
mov edi, eax
mov eax, dword [ebp - 0x24]
pop ecx
jae 0x417e88
lea eax, [ebp - 0x24]
lea ecx, [ebp + 0xc]
push ecx
push edi
push ebx
push ebx
push eax
push dword [ebp + 8]
call esi
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push edi
call fcn.00417cdc
add esp, 0xc
xor esi, esi
jmp 0x417eab
xor esi, esi
inc esi
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x44]
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov eax, esi
jmp 0x417ecb
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x10