joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418a60
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x48e110]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea eax, [ebp - 0x118]
mov ebx, 0x114
push eax
mov esi, ecx
mov dword [ebp - 0x118], ebx
call edi
cmp dword [ebp - 0x114], 6
jne 0x418ab0
cmp dword [ebp - 0x110], 1
jne 0x418ab0
push 0x4784e4
mov ebx, 1
jmp 0x418ada
lea ecx, [ebp - 0x118]
push ecx
mov dword [ebp - 0x118], ebx
call edi
cmp dword [ebp - 0x114], 5
jne 0x418ae3
mov ebx, 1
cmp dword [ebp - 0x110], ebx
jne 0x418ae3
push 0x4784e8
lea eax, [esi + 0x54]
push eax
call fcn.004032a0
call fcn.00403680
add esi, 0x58
mov ebx, 1
test al, al
je 0x418afb
push 0x4784e8
jmp 0x418b00
push 0x4784e4
push esi
call fcn.004032a0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045a10c
mov esp, ebp
pop ebp
ret
Function at 0x419b90
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47132c
mov eax, dword fs:[0]
push eax
sub esp, 0x25c
mov eax, dword [0x48e110]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov esi, dword [eax + 0x44]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpynW]
test esi, esi
je 0x419c21
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x419c21
mov dword [ebp - method.CAccessRight.virtual_0], vtable.CAccessRight.0
xor eax, eax
push 0x3e
push eax
lea ecx, [ebp - 0x52]
mov dword [ebp - 4], 0
push ecx
mov word [ebp - 0x54], ax
call fcn.0045c960
add esp, 0xc
push 0x20
push str.Users
lea edx, [ebp - 0x54]
push edx
call edi
push 0
lea eax, [ebp - 0x54]
push eax
push esi
call fcn.004019e0
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
push 1
push 0x23
lea ecx, [ebp - 0x25c]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea edx, [ebp - 0x260]
push edx
mov ecx, str.BaofengBFVKanDianYing_
call fcn.00403080
lea ecx, [ebp - 0x25c]
push ecx
lea edx, [ebp - 0x264]
push edx
mov ecx, eax
mov dword [ebp - 4], 1
call fcn.004240e0
add esp, 8
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x260]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x419c8a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x264]
mov esi, eax
test eax, eax
je 0x419ce6
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x419ce0
mov dword [ebp - method.CAccessRight.virtual_0], vtable.CAccessRight.0
xor ecx, ecx
push 0x3e
push ecx
lea edx, [ebp - 0x52]
mov byte [ebp - 4], 4
push edx
mov word [ebp - 0x54], cx
call fcn.0045c960
add esp, 0xc
push 0x20
push str.Users
lea eax, [ebp - 0x54]
push eax
call edi
push 0
lea ecx, [ebp - 0x54]
push ecx
push esi
call fcn.004019e0
add esp, 0xc
mov eax, dword [ebp - 0x264]
add eax, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x419d09
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0045a10c
mov esp, ebp
pop ebp
ret 4
Function at 0x41a400
Capabilities:
Check if file exists
Check os version
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x471246
mov eax, dword fs:[0]
push eax
sub esp, 0x32c
mov eax, dword [0x48e110]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 1
push 0x10
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea ecx, [ebp - 0x334]
push ecx
lea ecx, [ebp - 0x218]
call fcn.00403080
push 0xb
push 0x47860c
lea ebx, [ebp - 0x334]
mov dword [ebp - 4], 0
call fcn.00402d70
mov edx, dword [ebp - 0x334]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41a51d
mov eax, dword [ebp - 0x334]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 0x334]
push 0
push 0
push 2
push 0
push 0
push SysReAllocStringLen
push eax
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x41a4ed
lea ecx, [ebp - 0x330]
push ecx
mov dword [ebp - 0x330], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x32c], 6
jb 0x41a4e6
mov dword [ebp - method.CAccessRight.virtual_0], vtable.CAccessRight.0
mov byte [ebp - 4], 1
call fcn.00401980
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x334]
mov esi, dword [sym.imp.SHELL32.dll_SHChangeNotify]
push 0
push edx
push 0x1005
push 0x8000000
call esi
mov eax, dword [ebp - 0x334]
push 0
push eax
push 0x1005
push 0x800
call esi
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x334]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41a546
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045a10c
mov esp, ebp
pop ebp
ret

Function at 0x41a570
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 4]
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.SensApi.dll_IsNetworkAlive]
test eax, eax
jne 0x41a5b0
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x41a5b6
push 0
lea ecx, [ebp - 4]
push ecx
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
test eax, eax
je 0x41a5b6
mov al, byte [ebp - 4]
test al, 0x20
jne 0x41a5b6
test al, 7
je 0x41a5b6
push esi
call fcn.0041a8c0
cmp dword [esi + 0x64], 0
je 0x41a5c7
call fcn.00421aa0
push esi
call fcn.0041a740
mov esp, ebp
pop ebp
ret
Function at 0x41a5d0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46f8a0
mov eax, dword fs:[0]
push eax
sub esp, 0x60
push ebx
push esi
push edi
mov eax, dword [0x48e110]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
add eax, 0x44
push eax
lea ecx, [ebp - 0x14]
push ecx
mov ebx, 0x478020
call fcn.00402c10
add esp, 8
mov dword [ebp - 4], 0
mov edx, dword [section..data]
mov eax, dword [edx + 0xc]
mov ecx, section..data
call eax
add eax, 0x10
mov dword [ebp + 8], eax
mov ebx, 1
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x14]
push ecx
push str._s__installrun
lea edi, [ebp + 8]
call fcn.00413e20
mov esi, dword [ebp + 8]
add esp, 8
cmp dword [esi - 4], ebx
jle 0x41a660
mov edx, dword [esi - 0xc]
push edx
mov eax, edi
push eax
call fcn.00403180
mov esi, dword [ebp + 8]
push 0x40
lea ecx, [ebp - 0x68]
push 0
push ecx
call fcn.0045c960
add esp, 0xc
xor eax, eax
lea edx, [ebp - 0x24]
push edx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x6c]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push esi
push 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x6c], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x41a6bc
mov ecx, dword [ebp - 0x24]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call edi
mov edx, dword [ebp - 0x20]
push edx
call edi
mov eax, dword [esi - 8]
push eax
push esi
call fcn.0045ae41
add esp, 8
test eax, eax
js 0x41a734
cmp eax, dword [esi - 8]
jg 0x41a734
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
lea eax, [esi - 0x10]
mov byte [ebp - 4], cl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41a6fa
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41a720
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.00401950
int3
Function at 0x41a740
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46f8a0
mov eax, dword fs:[0]
push eax
sub esp, 0x60
push ebx
push esi
push edi
mov eax, dword [0x48e110]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
add eax, 0x44
push eax
lea ecx, [ebp - 0x14]
push ecx
mov ebx, 0x478064
call fcn.00402c10
add esp, 8
mov dword [ebp - 4], 0
mov edx, dword [section..data]
mov eax, dword [edx + 0xc]
mov ecx, section..data
call eax
add eax, 0x10
mov dword [ebp + 8], eax
push 2
mov ebx, 1
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x14]
push 0
push ecx
push str._s__Run_d__From_d
lea edi, [ebp + 8]
call fcn.00413e20
mov esi, dword [ebp + 8]
add esp, 0x10
cmp dword [esi - 4], ebx
jle 0x41a7d4
mov edx, dword [esi - 0xc]
push edx
mov eax, edi
push eax
call fcn.00403180
mov esi, dword [ebp + 8]
push 0x40
lea ecx, [ebp - 0x68]
push 0
push ecx
call fcn.0045c960
add esp, 0xc
xor eax, eax
lea edx, [ebp - 0x24]
push edx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x6c]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push esi
push 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x6c], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x41a830
mov ecx, dword [ebp - 0x24]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call edi
mov edx, dword [ebp - 0x20]
push edx
call edi
mov eax, dword [esi - 8]
push eax
push esi
call fcn.0045ae41
add esp, 8
test eax, eax
js 0x41a8a8
cmp eax, dword [esi - 8]
jg 0x41a8a8
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
lea eax, [esi - 0x10]
mov byte [ebp - 4], cl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41a86e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41a894
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.00401950
int3
Function at 0x41ef60
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x470c76
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x48e110]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 1
push 0x23
lea eax, [ebp - 0x218]
push eax
push 0
mov edi, ecx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea ecx, [ebp - 0x220]
push ecx
mov ecx, str.BaofengBFVKanDianYingProfiles
call fcn.00403080
lea edx, [ebp - 0x218]
push edx
lea ecx, [ebp - 0x21c]
push ecx
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.004240e0
add esp, 8
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x220]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41eff8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x21c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x41f018
mov edx, dword [ebp - 0x21c]
push edx
call fcn.004022d0
add esp, 4
mov ecx, dword [ebp - 0x21c]
mov edx, edi
call fcn.0041f200
mov ecx, dword [ebp - 0x21c]
call fcn.0041f0e0
mov eax, dword [edi + 0x48]
mov ecx, 1
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, 0x40
or eax, ecx
jge 0x41f052
mov eax, 0x40
lea ecx, [edi + 0x48]
call fcn.00403240
mov eax, dword [edi + 0x48]
push eax
push edi
call fcn.0041f580
mov eax, dword [edi + 0x48]
mov ecx, dword [eax - 8]
test eax, eax
je 0x41f074
push ecx
push eax
call fcn.0045ae41
add esp, 8
test eax, eax
js 0x41f0cc
mov ecx, dword [edi + 0x48]
cmp eax, dword [ecx - 8]
jg 0x41f0cc
mov dword [ecx - 0xc], eax
mov ecx, dword [edi + 0x48]
xor edx, edx
mov word [ecx + eax*2], dx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x21c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41f0b1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045a10c
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.00401950
int3
Function at 0x41f0e0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x470c38
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x48e110]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x10]
push eax
call fcn.00403080
push 0xb
push str.Config.ini
lea ebx, [ebp - 0x10]
mov dword [ebp - 4], 0
call fcn.00402d70
mov eax, dword [edi + 0x50]
mov ebx, dword [ebp - 0x10]
mov ecx, 1
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, 0x104
or eax, ecx
jge 0x41f14b
mov eax, 0x104
lea ecx, [edi + 0x50]
call fcn.00403240
mov eax, dword [edi + 0x50]
push ebx
push 0x104
push eax
push 0x476a60
push 0x479b64
push str.BFVCenter
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov eax, dword [edi + 0x50]
mov ecx, dword [eax - 8]
test eax, eax
je 0x41f182
push ecx
push eax
call fcn.0045ae41
add esp, 8
test eax, eax
js 0x41f1f3
mov ecx, dword [edi + 0x50]
cmp eax, dword [ecx - 8]
jg 0x41f1f3
mov dword [ecx - 0xc], eax
mov ecx, dword [edi + 0x50]
xor edx, edx
mov word [ecx + eax*2], dx
mov eax, dword [edi + 0x50]
cmp dword [eax - 0xc], edx
jne 0x41f1bc
push edi
call fcn.00422790
mov ecx, dword [ebp - 0x10]
mov esi, dword [edi + 0x50]
push ecx
push esi
push 0x479b64
push str.BFVCenter
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41f1e2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.00401950
int3
Function at 0x41f200
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x470bfb
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x48e110]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x21c]
push eax
mov edi, edx
call fcn.00403080
push 0xb
push str.Config.ini
lea ebx, [ebp - 0x21c]
mov dword [ebp - 4], 0
call fcn.00402d70
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x216]
push edx
mov word [ebp - 0x218], cx
call fcn.0045c960
add esp, 0xc
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x218]
push ecx
lea edx, [ebp - 0x224]
push edx
push 0x479b6c
push str.SoftwareBaofengBFVKanDianYing
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x220], 0x102
mov dword [ebp - 0x224], 1
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea eax, [ebp - 0x218]
lea esi, [edi + 0x4c]
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41f2c0
sub eax, edx
lea ecx, [ebp - 0x218]
sar eax, 1
push ecx
push esi
mov ebx, eax
call fcn.004032a0
mov eax, dword [esi]
mov ecx, dword [eax - 0xc]
test ecx, ecx
jne 0x41f382
mov ebx, dword [ebp - 0x21c]
mov ecx, 1
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, 0x104
or eax, ecx
jge 0x41f311
mov eax, 0x104
mov ecx, esi
call fcn.00403240
mov eax, dword [esi]
push ebx
push 0x104
push eax
push 0x476a60
push 0x479b6c
push str.BFVCenter
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov eax, dword [esi]
mov ecx, dword [eax - 8]
test eax, eax
je 0x41f34a
push ecx
push eax
call fcn.0045ae41
add esp, 8
test eax, eax
js 0x41f3e1
mov ecx, dword [esi]
cmp eax, dword [ecx - 8]
jg 0x41f3e1
mov dword [ecx - 0xc], eax
mov edx, dword [esi]
xor ecx, ecx
mov word [edx + eax*2], cx
mov edx, dword [esi]
cmp dword [edx - 0xc], ecx
jne 0x41f36e
mov ecx, edi
call fcn.0041f3f0
mov ebx, dword [esi]
push 0x479b6c
mov edi, str.SoftwareBaofengBFVKanDianYing
call fcn.00403460
add esp, 4
mov eax, dword [ebp - 0x21c]
mov esi, dword [esi]
push eax
push esi
push 0x479b6c
push str.BFVCenter
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x21c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41f3c5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045a10c
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.00401950
int3
Function at 0x41f580
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46f3b8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x48e110]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x4929b0]
xor edi, edi
cmp eax, edi
jne 0x41f670
cmp dword [0x4929b4], edi
jne 0x41f670
mov eax, dword [ebp + 8]
add eax, 0x44
push eax
lea ecx, [ebp - 0x10]
push ecx
mov ebx, str.BFVKanDianYing.ver
call fcn.00402c10
add esp, 8
push edi
push 0x80
push 3
push edi
push 3
mov dword [ebp - 4], edi
mov edx, dword [ebp - 0x10]
push SysReAllocStringLen
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x41f645
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 8
jbe 0x41f63e
push edi
lea eax, [ebp + 8]
push eax
push 8
push 0x4929b0
push esi
mov dword [ebp + 8], edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp ebx, edi
je 0x41f632
cmp dword [ebp + 8], 8
je 0x41f63e
mov dword [0x4929b0], edi
mov dword [0x4929b4], edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41f66b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [0x4929b0]
mov ecx, dword [ebp + 0xc]
cmp ecx, edi
je 0x41f6b6
movzx edx, ax
push edx
mov edx, dword [0x4929b4]
mov esi, edx
shrd eax, esi, 0x10
and eax, 0xffff
push eax
mov eax, edx
and edx, 0xffff
push edx
movsx edx, word [0x4929b6]
push edx
push str._d._02d._04d._04d
push 0xffffffffffffffff
push 0x40
push ecx
sar esi, 0x10
sar eax, 0x1f
call fcn.0045b47e
add esp, 0x20
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x41f6d0
Capabilities:
Delete registry key
Get common file path
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x470bbb
mov eax, dword fs:[0]
push eax
sub esp, 0xc1c
mov eax, dword [0x48e110]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push str.SoftwareBaofengBFVCenter
push SysReAllocStringLen
call ebx
mov esi, dword [sym.imp.ADVAPI32.dll_GetUserNameW]
cmp eax, 5
jne 0x41f781
lea eax, [ebp - 0xc24]
push eax
lea ecx, [ebp - 0x218]
push ecx
mov dword [ebp - 0xc24], 0x202
call esi
push str.SoftwareBaofengBFVCenter
push str.CURRENT_USER
push 0x476a00
lea edx, [ebp - 0xc20]
push 0x800
push edx
call fcn.0045ac31
add esp, 0x14
push 0xf003f
lea eax, [ebp - 0x218]
push eax
push 2
lea edi, [ebp - 0xc20]
call fcn.00403780
test eax, eax
je 0x41f781
push str.SoftwareBaofengBFVCenter
push SysReAllocStringLen
call ebx
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallBFVCenter
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
cmp eax, 5
jne 0x41f7f8
lea ecx, [ebp - 0xc24]
push ecx
lea edx, [ebp - 0x218]
push edx
mov dword [ebp - 0xc24], 0x202
call esi
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallBFVCenter
push str.MACHINE
push 0x476a00
lea eax, [ebp - 0xc20]
push 0x800
push eax
call fcn.0045ac31
add esp, 0x14
push 0xf003f
lea ecx, [ebp - 0x218]
push ecx
push 2
lea edi, [ebp - 0xc20]
call fcn.00403780
test eax, eax
je 0x41f7f8
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallBFVCenter
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
push str.SoftwareMicrosoftWindowsCurrentVersionApp_PathsBFVCenter.exe
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
cmp eax, 5
jne 0x41f86f
lea edx, [ebp - 0xc24]
push edx
lea eax, [ebp - 0x218]
push eax
mov dword [ebp - 0xc24], 0x202
call esi
push str.SoftwareMicrosoftWindowsCurrentVersionApp_PathsBFVCenter.exe
push str.MACHINE
push 0x476a00
lea ecx, [ebp - 0xc20]
push 0x800
push ecx
call fcn.0045ac31
add esp, 0x14
push 0xf003f
lea edx, [ebp - 0x218]
push edx
push 2
lea edi, [ebp - 0xc20]
call fcn.00403780
test eax, eax
je 0x41f86f
push str.SoftwareMicrosoftWindowsCurrentVersionApp_PathsBFVCenter.exe
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
push 1
push 0x23
lea eax, [ebp - 0x420]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea ecx, [ebp - 0xc28]
push ecx
lea ecx, [ebp - 0x420]
call fcn.00403080
push 0x13
push str.BaofengBFVCenter_
lea ebx, [ebp - 0xc28]
mov dword [ebp - 4], 0
call fcn.00402d70
mov edx, dword [ebp - 0xc28]
push 0
push edx
call fcn.004028a0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0xc28]
add eax, 0xfffffff0
add esp, 8
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41f8e7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045a10c
mov esp, ebp
pop ebp
ret