joyce8/EMBER2024-capa huggingface dataset:
Function at 0x420b50
Capabilities:
Check if file exists
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54d088
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x5a7464]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0x73c], 8
lea esi, [edi + 0x728]
jb 0x420b90
mov ebx, dword [esi]
jmp 0x420b92
mov ebx, esi
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareHuDunSoftSwift_AI_Writing
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x420be6
mov ecx, ebx
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x420bc0
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
push ebx
push 1
push 0
push str.InstallPath
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [edi + 0x720], 0
jne 0x420c57
xor eax, eax
mov dword [ebp - 0x18], 7
push 0xffffffffffffffff
push eax
push esi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], ax
call fcn.004068d0
push 0xa
push str.uninst.ep
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0
call fcn.004069f0
lea ecx, [edi + 0x710]
cmp ecx, eax
je 0x420c42
push 0xffffffffffffffff
push 0
push eax
call fcn.004068d0
mov eax, dword [ebp - 0x18]
cmp eax, 8
jb 0x420c57
inc eax
lea ecx, [ebp - 0x2c]
push eax
push dword [ebp - 0x2c]
call fcn.00406f30
cmp dword [edi + 0x724], 8
lea esi, [edi + 0x710]
jb 0x420c6a
mov eax, dword [esi]
jmp 0x420c6c
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x420c8e
cmp dword [esi + 0x14], 8
jb 0x420c7f
mov esi, dword [esi]
push esi
push ecx
push str.UnInstallEp
call fcn.0044f8c0
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00506c20
mov esp, ebp
pop ebp
ret

Function at 0x420fe0
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x780]
test eax, eax
je 0x421018
cmp eax, 5
jbe 0x421018
cmp dword [edi + 0x784], 8
lea eax, [edi + 0x770]
jb 0x421004
mov eax, dword [eax]
push 3
push 0
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp dword [edi + 0x70c], 8
lea esi, [edi + 0x6f8]
jb 0x421029
mov esi, dword [esi]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x421056
mov ecx, edi
call fcn.00467550
mov ecx, eax
call fcn.0044a7d0
push 1
push 0
push 0
push esi
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop edi
pop esi
ret
Function at 0x425240
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x5a7464]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x10], eax
mov eax, dword [edx + 0x14]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 0x1c], eax
push edi
mov edi, dword [edx + 0x10]
cmp eax, 0x10
jb 0x425274
mov ebx, dword [edx]
jmp 0x425276
mov ebx, edx
xor ecx, ecx
mov esi, 0x811c9dc5
test edi, edi
je 0x425292
movzx eax, byte [ebx + ecx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edi
jb 0x425281
mov ebx, dword [ebp - 0xc]
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0xc]
and eax, esi
mov ebx, dword [ebx + 4]
mov dword [ebp - 0xc], ebx
mov esi, dword [ecx + eax*8]
add eax, eax
mov edx, dword [ecx + eax*4]
inc eax
mov dword [ebp - 0x14], edx
lea eax, [ecx + eax*4]
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 8]
cmp dword [ebp - 0x14], ebx
jne 0x4252c1
mov eax, ebx
jmp 0x4252c5
mov eax, dword [eax]
mov eax, dword [eax]
cmp esi, eax
je 0x42535d
cmp dword [edx + 0x14], 0x10
lea ecx, [esi + 8]
jb 0x4252d8
mov edx, dword [edx]
cmp dword [ecx + 0x14], 0x10
lea ebx, [ecx + 0x10]
jb 0x4252e3
mov ecx, dword [ecx]
mov ebx, dword [ebx]
mov eax, edi
cmp ebx, edi
cmovb eax, ebx
push eax
push edx
push ecx
call fcn.0040a3c0
add esp, 0xc
test eax, eax
jne 0x425301
cmp ebx, edi
jb 0x425301
jbe 0x42530b
mov esi, dword [esi]
mov ebx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
jmp 0x4252b5
cmp dword [esi + 0x1c], 0x10
lea edx, [esi + 8]
lea ebx, [edx + 0x10]
jb 0x425319
mov edx, dword [edx]
cmp dword [ebp - 0x1c], 0x10
mov ecx, dword [ebp - 8]
jb 0x425324
mov ecx, dword [ecx]
mov ebx, dword [ebx]
cmp edi, ebx
mov eax, ebx
cmovb eax, edi
push eax
push edx
push ecx
call fcn.0040a3c0
add esp, 0xc
test eax, eax
jne 0x425342
cmp edi, ebx
jb 0x425342
jbe 0x425345
mov esi, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00506c20
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov dword [eax], ebx
xor ecx, ebp
pop ebx
call fcn.00506c20
mov esp, ebp
pop ebp
ret 8
Function at 0x425f70
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x5a7464]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
cmp dword [edi + 0x1c], 0x10
lea edx, [edi + 8]
mov ebx, dword [edx + 0x10]
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], eax
jb 0x425f9d
mov edx, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
test ebx, ebx
je 0x425fb9
movzx eax, byte [edx + ecx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, ebx
jb 0x425fa8
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x18]
mov ecx, dword [edx + 0xc]
and eax, esi
lea esi, [eax*8]
add ecx, esi
cmp dword [ecx + 4], edi
jne 0x425fef
cmp dword [ecx], edi
jne 0x425fe7
mov eax, dword [edx + 4]
mov dword [ecx], eax
mov ecx, dword [edx + 0xc]
mov eax, dword [edx + 4]
mov dword [esi + ecx + 4], eax
jmp 0x425ff7
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x425ff7
cmp dword [ecx], edi
jne 0x425ffa
mov eax, dword [edi]
mov dword [ecx], eax
mov edi, dword [ebp + 0xc]
mov eax, dword [edi + 4]
mov esi, dword [edi]
mov dword [eax], esi
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
lea ecx, [edi + 8]
dec dword [edx + 8]
call fcn.00426140
push edi
call fcn.00506ca0
mov eax, dword [ebp - 0xc]
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
mov dword [eax], esi
pop esi
pop ebx
call fcn.00506c20
mov esp, ebp
pop ebp
ret 8
Function at 0x429c40
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54dc80
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5a7464]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov dword [ecx], vtable.hudun::sensors::SensorsTrackerImpl.0
lea edx, [ecx + 0x1c]
mov dword [ecx + 0x18], 0xf
lea esi, [ecx + 0x4c]
mov dword [ecx + 0x14], 0
lea ebx, [ecx + 0x64]
mov byte [ecx + 4], 0
lea edi, [ecx + 0x7c]
mov dword [edx + 0x14], 0xf
mov dword [edx + 0x10], 0
mov byte [edx], 0
mov dword [ecx + 0x48], 0xf
mov dword [ecx + 0x44], 0
mov byte [ecx + 0x34], 0
mov ecx, dword [ebp + 8]
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov byte [esi], 0
mov dword [ebx + 0x14], 0xf
mov dword [ebx + 0x10], 0
mov byte [ebx], 0
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], 0
mov byte [edi], 0
call fcn.00429410
mov ecx, dword [ebp + 8]
mov edx, esi
lea ecx, [ecx + 0x30]
call fcn.00429410
mov esi, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
lea ecx, [esi + 0x18]
lea edx, [edx + 0x34]
call fcn.00429410
lea ecx, [esi + 0x48]
mov edx, ebx
call fcn.00429410
lea ecx, [esi + 0x60]
mov edx, edi
call fcn.00429410
mov ebx, dword [ebp - 0x10]
lea ecx, [esi + 0xac]
mov eax, dword [esi + 0xa8]
lea edx, [ebx + 4]
mov dword [ebx + 0x9c], eax
call fcn.00429410
push 0x330
mov dword [ebx + 0x94], 0
call fcn.00506c62
add esp, 4
mov ecx, eax
call fcn.00429700
mov edx, dword [ebp + 8]
mov esi, eax
push ecx
mov ecx, esi
lea edx, [edx + 0x90]
call fcn.00429630
add esp, 4
mov dword [ebx + 0xa0], esi
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x432970
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54ed80
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x5a7464]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov esi, ecx
push 0x5aea74
call fcn.004f331b
add esp, 4
test eax, eax
je 0x4329b8
push eax
call fcn.004f2d91
add esp, 4
mov al, byte [0x5ad9a8]
push 0x5aea74
mov byte [ebp - 0x19], al
call fcn.004f3378
add esp, 4
test eax, eax
je 0x4329da
push eax
call fcn.004f2d91
add esp, 4
cmp byte [ebp - 0x19], 0
je 0x432a05
push ebx
push esi
call fcn.00432850
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00506c20
mov esp, ebp
pop ebp
ret
push str._Sensors__Sending_messages_asynchronously
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea edx, [ebp - 0x2c]
mov dword [ebp - 0x2c], fcn.00432850
lea ecx, [ebp - 0x20]
mov byte [ebp - 0x28], bl
mov dword [ebp - 0x24], esi
call fcn.00435bb0
mov edx, eax
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.00435bf0
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x432a4b
push 0xc
push eax
call fcn.00506c54
add esp, 8
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 1
call fcn.0040e470
cmp dword [ebp - 0x14], 0
je 0x4329ea
call fcn.00527db8
int3

Function at 0x433480
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x5a7464]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x104
lea eax, [ebp - 0x108]
mov dword [ebp - 0x21c], 0
mov esi, ecx
push 0
push eax
mov dword [ebp - 0x214], esi
call fcn.004b1e50
push 0x104
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.004b1e50
lea eax, [ebp - 0x220]
mov dword [ebp - 0x210], 0
push eax
lea edx, [ebp - 0x214]
lea ecx, [ebp - 0x218]
call fcn.004333c0
add esp, 0x1c
test al, al
je 0x433516
mov eax, dword [ebp - 0x218]
cmp eax, 6
ja 0x43350b
jne 0x433516
cmp dword [ebp - 0x214], 1
jb 0x433516
lea eax, [ebp - 0x210]
push eax
push 0x1c
jmp 0x43351f
lea eax, [ebp - 0x210]
push eax
push 0x2e
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov eax, dword [ebp - 0x210]
test eax, eax
je 0x43355c
lea ecx, [ebp - 0x20c]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
test eax, eax
je 0x43355c
push 0x104
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov byte [esi], 0
cmp byte [ebp - 0x108], 0
jne 0x43357a
xor ecx, ecx
jmp 0x43358c
lea ecx, [ebp - 0x108]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x433583
sub ecx, edx
push ecx
lea eax, [ebp - 0x108]
mov ecx, esi
push eax
call fcn.00406b80
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00506c20
mov esp, ebp
pop ebp
ret
Function at 0x4337c0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54eee6
mov eax, dword fs:[0]
push eax
sub esp, 0xbc
mov eax, dword [0x5a7464]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0xc4], esi
lea ecx, [ebp - 0xa8]
mov dword [ebp - 0xc8], 0
call fcn.004335b0
mov dword [ebp - 4], 0
lea eax, [ebp - 0xa8]
cmp dword [ebp - 0x94], 0x10
push 0
cmovae eax, dword [ebp - 0xa8]
push eax
call fcn.00528451
add esp, 8
cmp eax, 0xffffffff
jne 0x433869
push 0
mov dword [esi + 0x14], 0xf
mov ecx, esi
mov dword [esi + 0x10], 0
push 0x58a5ec
mov byte [esi], 0
call fcn.00406b80
mov ecx, dword [ebp - 0x94]
cmp ecx, 0x10
jb 0x43397a
inc ecx
push ecx
jmp 0x433969
push 0x80
lea eax, [ebp - 0x90]
push 0
push eax
call fcn.004b1e50
add esp, 0xc
lea eax, [ebp - 0xa8]
cmp dword [ebp - 0x94], 0x10
cmovae eax, dword [ebp - 0xa8]
push eax
push 0x80
lea eax, [ebp - 0x90]
push eax
push 0x58a5ec
push str.HDSensorsAnalyticsIni
push str.Install
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [ebp - 0x90], 0
mov dword [ebp - 0xac], 0xf
mov dword [ebp - 0xb0], 0
mov byte [ebp - 0xc0], 0
jne 0x4338dd
xor ecx, ecx
jmp 0x4338ef
lea ecx, [ebp - 0x90]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4338e6
sub ecx, edx
push ecx
lea eax, [ebp - 0x90]
push eax
lea ecx, [ebp - 0xc0]
call fcn.00406b80
push ecx
lea ecx, [ebp - 0xc0]
mov byte [ebp - 4], 1
call fcn.004294b0
add esp, 4
lea eax, [ebp - 0xc0]
mov ecx, esi
push eax
call fcn.0040b5e0
mov eax, dword [ebp - 0xac]
cmp eax, 0x10
jb 0x433941
inc eax
lea ecx, [ebp - 0xc0]
push eax
push dword [ebp - 0xc0]
call fcn.00406f90
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0xac], 0xf
mov dword [ebp - 0xb0], 0
mov byte [ebp - 0xc0], 0
cmp eax, 0x10
jb 0x43397a
inc eax
push eax
push dword [ebp - 0xa8]
lea ecx, [ebp - 0xa8]
call fcn.00406f90
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00506c20
mov esp, ebp
pop ebp
ret
Function at 0x433d10
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54ef7e
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x5a7464]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x38], ecx
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x24]
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
xorps xmm0, xmm0
push 0x10
push eax
push 0x59
push 0x400
movups xmmword [ebp - 0x24], xmm0
movups xmmword [ebp - 0x34], xmm0
call esi
push 0x10
mov ebx, eax
lea eax, [ebp - 0x34]
push eax
push 0x5a
push 0x400
call esi
test eax, eax
je 0x433e7a
test ebx, ebx
je 0x433e7a
cmp byte [ebp - 0x24], 0
jne 0x433d8f
xor ecx, ecx
jmp 0x433d9e
lea ecx, [ebp - 0x24]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x433d95
sub ecx, edx
mov esi, dword [ebp - 0x38]
lea eax, [ebp - 0x24]
push ecx
push eax
mov ecx, esi
call fcn.00406b80
cmp byte [ebp - 0x34], 0
jne 0x433db7
xor ecx, ecx
jmp 0x433dc9
lea ecx, [ebp - 0x34]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x433dc0
sub ecx, edx
mov ebx, dword [ebp - 0x3c]
lea eax, [ebp - 0x34]
push ecx
push eax
mov ecx, ebx
call fcn.00406b80
push 0x5ae0b4
mov edx, esi
lea ecx, [ebp - 0x6c]
call fcn.004359a0
push ebx
mov edx, eax
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x54]
call fcn.0040d800
add esp, 8
mov esi, eax
cmp edi, esi
je 0x433e3a
mov eax, dword [edi + 0x14]
cmp eax, 0x10
jb 0x433e15
inc eax
mov ecx, edi
push eax
push dword [edi]
call fcn.00406f90
mov dword [edi + 0x14], 0xf
cmp dword [edi + 0x14], 0x10
mov dword [edi + 0x10], 0
jb 0x433e2d
mov eax, dword [edi]
jmp 0x433e2f
mov eax, edi
push esi
mov ecx, edi
mov byte [eax], 0
call fcn.00406db0
mov eax, dword [ebp - 0x40]
cmp eax, 0x10
jb 0x433e4f
inc eax
lea ecx, [ebp - 0x54]
push eax
push dword [ebp - 0x54]
call fcn.00406f90
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x40], 0xf
mov dword [ebp - 0x44], 0
mov byte [ebp - 0x54], 0
cmp eax, 0x10
jb 0x433e76
inc eax
lea ecx, [ebp - 0x6c]
push eax
push dword [ebp - 0x6c]
call fcn.00406f90
mov al, 1
jmp 0x433e7c
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00506c20
mov esp, ebp
pop ebp
ret
Function at 0x433ff0
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54f009
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x5a7464]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x48], esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x44], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x14], 0xf
cmp dword [esi + 0x14], 0x10
mov dword [ebp - 0x4c], esi
mov dword [esi + 0x10], 0
jb 0x434056
mov eax, dword [esi]
jmp 0x434058
mov eax, esi
push 0xc
push str.Mozilla_5.0_
mov byte [eax], 0
call fcn.00406b80
mov dword [ebp - 0x44], 1
mov dword [ebp - 0x2c], 0xf
mov dword [ebp - 0x30], 0
mov byte [ebp - 0x40], 0
mov dword [ebp - 4], 1
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
lea edx, [ebp - 0x28]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x40]
call fcn.004339a0
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x40]
mov ecx, esi
push eax
call fcn.0040c870
push 1
push 0x58e150
mov ecx, esi
call fcn.0040c740
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
call fcn.0040c870
push 5
push str.__Win
mov ecx, esi
call fcn.0040c740
call fcn.00433330
test eax, eax
mov edx, str.64__
mov ecx, str.32__
cmove edx, ecx
cmp byte [edx], 0
jne 0x4340ff
xor ecx, ecx
jmp 0x43410d
mov ecx, edx
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x434104
sub ecx, edi
push ecx
push edx
mov ecx, esi
call fcn.0040c740
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x43412b
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00406f90
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
cmp ecx, 0x10
jb 0x434152
inc ecx
push ecx
push dword [ebp - 0x40]
lea ecx, [ebp - 0x40]
call fcn.00406f90
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00506c20
mov esp, ebp
pop ebp
ret
Function at 0x434e10
Capabilities:
Get geographical location
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [0x5a7464]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
cmp dword [ebx + 0xac], 0x10
push esi
lea esi, [ebx + 0x98]
jb 0x434e38
mov esi, dword [esi]
push 0
push esi
call fcn.00528451
add esp, 8
cmp eax, 0xffffffff
je 0x435073
push edi
lea ecx, [ebx + 0x2b8]
call fcn.0043cc20
test al, al
jne 0x435072
push 0x80
lea eax, [ebp - 0x84]
push 0
push eax
call fcn.004b1e50
add esp, 0xc
lea eax, [ebp - 0x84]
push esi
push 0x80
push eax
push 0x58a5ec
push str.AssistIP
push str.Local
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [ebp - 0x84], 0
jne 0x434ea5
xor ecx, ecx
jmp 0x434eb9
lea ecx, [ebp - 0x84]
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x434eb0
sub ecx, edx
push ecx
lea eax, [ebp - 0x84]
push eax
lea ecx, [ebx + 0x2b8]
call fcn.00406b80
push 0x80
lea eax, [ebp - 0x84]
push 0
push eax
call fcn.004b1e50
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x84]
add esp, 0xc
push esi
push 0x80
push eax
push 0x58a5ec
push str.country
push str.Local
call edi
cmp byte [ebp - 0x84], 0
jne 0x434f13
xor ecx, ecx
jmp 0x434f29
lea ecx, [ebp - 0x84]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x434f20
sub ecx, edx
push ecx
lea eax, [ebp - 0x84]
push eax
lea ecx, [ebx + 0x2d0]
call fcn.00406b80
push 0x80
lea eax, [ebp - 0x84]
push 0
push eax
call fcn.004b1e50
add esp, 0xc
lea eax, [ebp - 0x84]
push esi
push 0x80
push eax
push 0x58a5ec
push str.countryCode
push str.Local
call edi
cmp byte [ebp - 0x84], 0
jne 0x434f7d
xor ecx, ecx
jmp 0x434f8f
lea ecx, [ebp - 0x84]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x434f86
sub ecx, edx
push ecx
lea eax, [ebp - 0x84]
push eax
lea ecx, [ebx + 0x2e8]
call fcn.00406b80
push 0x80
lea eax, [ebp - 0x84]
push 0
push eax
call fcn.004b1e50
add esp, 0xc
lea eax, [ebp - 0x84]
push esi
push 0x80
push eax
push 0x58a5ec
push str.province
push str.Local
call edi
cmp byte [ebp - 0x84], 0
jne 0x434fe3
xor ecx, ecx
jmp 0x434ff9
lea ecx, [ebp - 0x84]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x434ff0
sub ecx, edx
push ecx
lea eax, [ebp - 0x84]
push eax
lea ecx, [ebx + 0x300]
call fcn.00406b80
push 0x80
lea eax, [ebp - 0x84]
push 0
push eax
call fcn.004b1e50
add esp, 0xc
lea eax, [ebp - 0x84]
push esi
push 0x80
push eax
push 0x58a5ec
push str.City
push str.Local
call edi
cmp byte [ebp - 0x84], 0
jne 0x43504d
xor ecx, ecx
jmp 0x43505f
lea ecx, [ebp - 0x84]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x435056
sub ecx, edx
push ecx
lea eax, [ebp - 0x84]
push eax
lea ecx, [ebx + 0x318]
call fcn.00406b80
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00506c20
mov esp, ebp
pop ebp
ret
Function at 0x435090
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0xac], 0x10
lea esi, [edi + 0x98]
jb 0x4350ac
mov esi, dword [esi]
cmp dword [edi + 0x30], 0x10
lea eax, [edi + 0x1c]
jb 0x4350b7
mov eax, dword [eax]
mov ebx, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push esi
push eax
push str.DistinctId
push str.Base
call ebx
cmp dword [edi + 0x48], 0x10
lea eax, [edi + 0x34]
jb 0x4350d6
mov eax, dword [eax]
push esi
push eax
push str.PrimaryDistinctId
push str.Base
call ebx
cmp dword [edi + 0x18], 0x10
lea eax, [edi + 4]
jb 0x4350ef
mov eax, dword [eax]
push esi
push eax
push str.UserId
push str.Base
call ebx
mov edx, dword [edi + 0x4c]
lea ecx, [ebp - 0x18]
call fcn.0040b1b0
cmp dword [eax + 0x14], 0x10
jb 0x435110
mov eax, dword [eax]
push esi
push eax
push str.UserVipLevel
push str.Base
call ebx
mov eax, dword [ebp - 4]
cmp eax, 0x10
jb 0x435133
inc eax
lea ecx, [ebp - 0x18]
push eax
push dword [ebp - 0x18]
call fcn.00406f90
cmp dword [edi + 0xc4], 0x10
lea eax, [edi + 0xb0]
jb 0x435144
mov eax, dword [eax]
push esi
push eax
push 0x58e20c
push str.Base
call ebx
cmp byte [edi], 0
mov ecx, 0x58e208
push esi
mov eax, 0x58e204
cmove eax, ecx
push eax
push str.isLogined
push str.Base
call ebx
cmp byte [edi + 1], 0
jne 0x435225
lea ecx, [edi + 0x2b8]
call fcn.0043cc20
test al, al
je 0x435225
cmp dword [edi + 0x2cc], 0x10
lea eax, [edi + 0x2b8]
jb 0x43519e
mov eax, dword [eax]
push esi
push eax
push str.AssistIP
push str.Local
call ebx
cmp dword [edi + 0x2e4], 0x10
lea eax, [edi + 0x2d0]
jb 0x4351bd
mov eax, dword [eax]
push esi
push eax
push str.country
push str.Local
call ebx
cmp dword [edi + 0x2fc], 0x10
lea eax, [edi + 0x2e8]
jb 0x4351dc
mov eax, dword [eax]
push esi
push eax
push str.countryCode
push str.Local
call ebx
cmp dword [edi + 0x314], 0x10
lea eax, [edi + 0x300]
jb 0x4351fb
mov eax, dword [eax]
push esi
push eax
push str.province
push str.Local
call ebx
add edi, 0x318
cmp dword [edi + 0x14], 0x10
jb 0x435217
mov edi, dword [edi]
push esi
push edi
push str.City
push str.Local
call ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x435360
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov dword [0x5aee54], 0x1571
mov edx, 0x1571
mov eax, 1
mov ecx, edx
shr ecx, 0x1e
xor ecx, edx
imul edx, ecx, 0x6c078965
add edx, eax
mov dword [eax*4 + 0x5aee54], edx
inc eax
cmp eax, 0x270
jl 0x435374
mov dword [0x5aee50], 0x270
ret 8

Function at 0x435fb0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
lea eax, [ecx + 8]
mov esi, 0x270
nop dword [eax]
mov edx, dword [eax - 4]
lea eax, [eax + 4]
xor edx, dword [eax - 4]
and edx, 0x7fffffff
xor edx, dword [eax - 8]
mov ecx, edx
and cl, 1
movzx ecx, cl
neg ecx
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [eax + 0x62c]
xor ecx, edx
mov dword [eax + 0x9b8], ecx
sub esi, 1
jne 0x435fc0
pop esi
ret