joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c0c30
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 4], 0
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx ecx, word [ebp - 0x2c]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0xa
ja case.0x4c0c5b.4
mov edx, dword [ebp - 8]
jmp dword [edx*4 + 0x4c0d48]
push str.IA32
mov ecx, dword [ebp + 8]
call fcn.004763c0
mov eax, dword [ebp - 4]
or eax, 1
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
jmp 0x4c0d41
push str.MIPS
mov ecx, dword [ebp + 8]
call fcn.004763c0
mov ecx, dword [ebp - 4]
or ecx, 1
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 8]
jmp 0x4c0d41
push str.ALPHA
mov ecx, dword [ebp + 8]
call fcn.004763c0
mov edx, dword [ebp - 4]
or edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp + 8]
jmp 0x4c0d41
push 0x5039f4
mov ecx, dword [ebp + 8]
call fcn.004763c0
mov eax, dword [ebp - 4]
or eax, 1
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
jmp 0x4c0d41
push str.IA64
mov ecx, dword [ebp + 8]
call fcn.004763c0
mov ecx, dword [ebp - 4]
or ecx, 1
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 8]
jmp 0x4c0d41
push str.IA64_32
mov ecx, dword [ebp + 8]
call fcn.004763c0
mov edx, dword [ebp - 4]
or edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp + 8]
jmp 0x4c0d41
push str.AMD64
mov ecx, dword [ebp + 8]
call fcn.004763c0
mov eax, dword [ebp - 4]
or eax, 1
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
jmp 0x4c0d41
push str.Unknown
mov ecx, dword [ebp + 8]
call fcn.004763c0
mov ecx, dword [ebp - 4]
or ecx, 1
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret

Function at 0x4c0d80
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fd4bf
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x84
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x64]
push ecx
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x4c0e07
push str.Cannot_get_computer_name
lea ecx, [ebp - 0x44]
call fcn.004763c0
mov dword [ebp - 4], 0
push 0
lea edx, [ebp - 0x44]
push edx
lea ecx, [ebp - 0x90]
call fcn.004a5010
push 0x548710
lea eax, [ebp - 0x90]
push eax
call fcn.004d0a2b
mov dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x44]
call fcn.004769f0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
push 0
push 0
lea ecx, [ebp - 0x2c]
call fcn.004769f0
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x2c]
push ecx
lea edx, [ebp - 0x64]
push edx
call fcn.004b5c40
add esp, 8
mov eax, dword [ebp + 8]
mov dword [eax + 0x10], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x14], 0
push 0
push 0
mov ecx, dword [ebp + 8]
call fcn.004769f0
lea edx, [ebp - 0x2c]
push edx
mov ecx, dword [ebp + 8]
call fcn.00475b10
mov eax, dword [ebp - 0x10]
or eax, 1
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.004769f0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x4c0ea0
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
xor eax, eax
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov word [ecx + 4], ax
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0x288
mov edx, dword [ebp - 0x10]
push edx
call fcn.004a012a
add esp, 4
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call sub.IPHLPAPI.DLL_GetAdaptersInfo
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x6f
jne 0x4c0f13
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.004ce339
add esp, 4
mov edx, dword [ebp - 0x10]
push edx
call fcn.004a012a
add esp, 4
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xc], eax
jmp 0x4c0f1e
cmp dword [ebp - 0x14], 0
je 0x4c0f1e
jmp 0x4c0f9e
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call sub.IPHLPAPI.DLL_GetAdaptersInfo
test eax, eax
jne 0x4c0f8c
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov byte [ebp - 1], 0
cmp dword [ebp - 8], 0
je 0x4c0f8c
movzx ecx, byte [ebp - 1]
test ecx, ecx
jne 0x4c0f8c
mov edx, dword [ebp - 8]
cmp dword [edx + 0x1a0], 6
jne 0x4c0f82
mov eax, dword [ebp - 8]
cmp dword [eax + 0x190], 6
jne 0x4c0f82
mov byte [ebp - 1], 1
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x190]
push edx
mov eax, dword [ebp - 8]
add eax, 0x194
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004d0350
add esp, 0xc
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov dword [ebp - 8], eax
jmp 0x4c0f39
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x24]
push edx
call fcn.004ce339
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x4c75c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fdb38
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
call fcn.004717d0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
mov dword [eax], vtable.Poco::BasicBufferedStreamBuf_char__struct_std::char_traits_char___class_Poco::BufferAllocator_char__.0
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
mov dword [ecx + 0x38], edx
mov eax, dword [ebp + 0xc]
mov dword [ecx + 0x3c], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x38]
mov dword [ebp - 0x30], edx
mov eax, dword [ecx + 0x3c]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x30]
push ecx
call fcn.004a012a
add esp, 4
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
mov dword [edx + 0x40], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 0x10]
mov dword [ecx + 0x44], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x40]
add ecx, 4
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x40]
add eax, 4
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x40]
add edx, 4
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 0x20]
mov dword [ecx], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x1c]
mov edx, dword [ebp - 0x18]
mov dword [ecx], edx
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x2c]
mov dword [edx], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x38]
sub ecx, 1
mov edx, dword [eax + 0x3c]
sbb edx, 0
mov eax, dword [ebp - 0x10]
add ecx, dword [eax + 0x40]
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x40]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x10]
mov edx, dword [ebp - 0x14]
mov dword [ecx], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x20]
mov edx, dword [ebp - 0x14]
mov dword [ecx], edx
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x30]
mov dword [edx], eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4c95b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fdd72
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x7c
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
call fcn.004f0b10
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x504dfc
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 8], 0
mov edx, dword [ebp - 0x10]
add edx, 0xc
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x10], 0
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x14], 0
push 0
push 0
mov ecx, dword [ebp - 0x14]
call fcn.004769f0
mov edx, dword [0x5319c8]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x14]
call fcn.00475f50
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x24
call fcn.00499b10
mov byte [ebp - 4], 2
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.00499b10
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x10]
add ecx, 0x3c
call fcn.004cb700
mov byte [ebp - 4], 4
call fcn.004c5dd0
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 0x10
jb 0x4c9685
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov dword [ebp - 0x18], eax
jmp 0x4c968b
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
push edx
call fcn.00402960
add esp, 4
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 8], eax
mov edx, dword [ebp - 0x10]
cmp dword [edx + 8], 0
jne 0x4c9730
mov eax, dword [ebp + 8]
push eax
push str.Cipher
lea ecx, [ebp - 0x5c]
push ecx
call fcn.004c9f50
add esp, 0xc
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x20], edx
mov byte [ebp - 4], 5
push str._was_not_found
mov eax, dword [ebp - 0x20]
push eax
lea ecx, [ebp - 0x44]
push ecx
call fcn.0048b950
add esp, 0xc
mov dword [ebp - 0x24], eax
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x28], edx
mov byte [ebp - 4], 6
push 0
mov eax, dword [ebp - 0x28]
push eax
lea ecx, [ebp - 0x88]
call fcn.004a49e0
push 0x542e78
lea ecx, [ebp - 0x88]
push ecx
call fcn.004d0a2b
mov byte [ebp - 4], 5
push 0
push 1
lea ecx, [ebp - 0x44]
call fcn.004769f0
mov byte [ebp - 4], 4
push 0
push 1
lea ecx, [ebp - 0x5c]
call fcn.004769f0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4cc0e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fe078
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
call fcn.004f0b10
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x504f50
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 8], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.004cb700
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.00406c50
add esp, 4
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
push edx
call fcn.00405cb0
add esp, 4
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x4eb61f
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x54a800]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.004d38a8
mov dword [ebp - 0x14], eax
cmp dword [0x55deb8], esi
jne 0x4eb712
push 0x800
push esi
push 0x50ac50
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x4eb69f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4eb7f2
push esi
push esi
push 0x50ac50
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x4eb7f2
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4eb7f2
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x55deb8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x55debc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x50ac98
push edi
mov dword [0x55dec0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x55dec8], eax
test eax, eax
je 0x4eb70f
push 0x50acb4
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x55dec4], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x4eb737
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4eb72a
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x4eb74c
push 4
pop eax
jmp 0x4eb7f4
cmp dword [ebp - 0x14], esi
je 0x4eb74c
push dword [0x55deb8]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x4eb731
mov eax, dword [0x55dec4]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x4eb7aa
cmp dword [0x55dec8], edi
je 0x4eb7aa
push eax
call ebx
push dword [0x55dec8]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x4eb7aa
test eax, eax
je 0x4eb7aa
call ecx
test eax, eax
je 0x4eb79f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x4eb79f
test byte [ebp - 8], 1
jne 0x4eb7aa
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x4eb7da
mov eax, dword [0x55debc]
cmp eax, edi
je 0x4eb7d7
push eax
call ebx
test eax, eax
je 0x4eb7d7
call eax
mov esi, eax
test esi, esi
je 0x4eb7d7
mov eax, dword [0x55dec0]
cmp eax, edi
je 0x4eb7d7
push eax
call ebx
test eax, eax
je 0x4eb7d7
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x55deb8]
call ebx
test eax, eax
je 0x4eb7f2
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x4eb7f4
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004cd571
mov esp, ebp
pop ebp
ret
Function at 0x4f3590
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fe56e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x90
mov dword [ebp - 0x10], ecx
lea eax, [ebp - 0x14]
push eax
push 0
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x18]
push ecx
push 0
call fcn.004f6bb4
add esp, 0x18
mov edx, dword [ebp - 0x10]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 0x10], ecx
mov edx, dword [ebp - 0x10]
cmp dword [edx + 0xc], 0
jne 0x4f362b
push str.cannot_create_thread
lea ecx, [ebp - 0x2c]
call fcn.004763c0
mov dword [ebp - 4], 0
push 0
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x70]
call fcn.004a5010
push 0x548710
lea ecx, [ebp - 0x70]
push ecx
call fcn.004d0a2b
mov dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.004769f0
mov edx, dword [ebp - 0x10]
cmp dword [edx + 0x14], 0
je 0x4f3695
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x14]
push ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
test eax, eax
jne 0x4f3695
push str.cannot_set_thread_priority
lea ecx, [ebp - 0x44]
call fcn.004763c0
mov dword [ebp - 4], 1
push 0
lea ecx, [ebp - 0x44]
push ecx
lea ecx, [ebp - 0x9c]
call fcn.004a5010
push 0x548710
lea edx, [ebp - 0x9c]
push edx
call fcn.004d0a2b
mov dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x44]
call fcn.004769f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8

Function at 0x4f3ff0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fe648
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x48
mov dword [ebp - 0x10], ecx
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov ecx, dword [ebp - 0x10]
mov dword [ecx], eax
mov edx, dword [ebp - 0x10]
cmp dword [edx], 0xffffffff
jne 0x4f4064
push str.cannot_allocate_thread_context_key
lea ecx, [ebp - 0x28]
call fcn.004763c0
mov dword [ebp - 4], 0
push 0
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x54]
call fcn.004a5010
push 0x548710
lea ecx, [ebp - 0x54]
push ecx
call fcn.004d0a2b
mov dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.004769f0
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x401bd0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x7ab5c8
push 0x104
lea eax, [ebp - 0x20c]
xor esi, esi
push eax
push 0x422700
push str.TName
push str.config
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [ebp - 0x20c], si
jne 0x401c26
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00409948
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 0x210]
push eax
push 0x41d2a0
push 1
push 0
push 0x41d2c0
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x401c76
mov eax, dword [ebp - 0x210]
lea edx, [ebp - 0x20c]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
test eax, eax
mov ecx, 1
cmovns esi, ecx
mov ecx, dword [ebp - 0x210]
push ecx
mov edx, dword [ecx]
call dword [edx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00409948
mov esp, ebp
pop ebp
ret

Function at 0x401c90
Capabilities:
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.0040be50
add esp, 0xc
lea eax, [ebp - 0x210]
push 0
push 0x1a
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x4226fc
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.00409a21
add esp, 0xc
lea eax, [ebp - 0x210]
push str.7k7kLegend_
push 0x104
push eax
call fcn.00409a21
add esp, 0xc
lea eax, [ebp - 0x210]
push str.WeiDuanN_
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x7ab7d0
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jg 0x401d50
push 0x7ab5c8
push 0x104
push 0x7ab7d0
push 0x422700
push str.StartMenuPath
push str.config
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ecx, 0x7ab7d0
call fcn.004019a0
call fcn.00401bd0
lea ecx, [ebp - 0x210]
call fcn.004019a0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00409948
mov esp, ebp
pop ebp
ret
Function at 0x406c10
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push 0x340
call fcn.0040a24e
mov edi, eax
add esp, 4
test edi, edi
je 0x406c42
mov dword [edi], 0
mov dword [edi + 4], 0xffffffff
mov dword [edi + 0x134], 0xffffffff
jmp 0x406c44
xor edi, edi
cmp dword [edi], 0
jne 0x406c9a
cmp dword [edi + 4], 0xffffffff
jne 0x406c9a
lea esi, [edi + 0x138]
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0x4226fc
push 0x104
push esi
call fcn.00409a21
add esp, 0xc
lea eax, [ebp - 4]
push eax
push ecx
call fcn.004053c0
add esp, 8
test eax, eax
jne 0x406c8a
mov eax, dword [ebp - 4]
jmp 0x406c9f
mov ecx, eax
call fcn.00405780
mov dword [edi], eax
mov eax, dword [0x7ab9e0]
jmp 0x406c9f
mov eax, 0x1000000
mov dword [0x7ab9dc], eax
test eax, eax
je 0x406cb9
push edi
call fcn.00409943
add esp, 4
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 8
call fcn.0040a24e
add esp, 4
mov dword [eax + 4], edi
pop edi
mov dword [eax], 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x406e00
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
je 0x406f4f
push ebx
mov bl, byte [ebp + 0xa]
push esi
push edi
xor edi, edi
xor esi, esi
jmp 0x406e20
mov dl, byte [esi + str.aWtsaXQ]
cmp dl, 0x2b
jne 0x406e2f
mov dl, 0x3e
jmp 0x406e5d
cmp dl, 0x2f
jne 0x406e38
mov dl, 0x3f
jmp 0x406e5d
cmp dl, 0x39
jg 0x406e42
add dl, 4
jmp 0x406e5d
cmp dl, 0x3d
je 0x406e5b
cmp dl, 0x5a
jg 0x406e51
sub dl, 0x41
jmp 0x406e5d
cmp dl, 0x7a
jg 0x406e5b
sub dl, 0x47
jmp 0x406e5d
mov dl, 0x40
mov cl, byte [esi + 0x4228b1]
cmp cl, 0x2b
jne 0x406e6c
mov cl, 0x3e
jmp 0x406e9a
cmp cl, 0x2f
jne 0x406e75
mov cl, 0x3f
jmp 0x406e9a
cmp cl, 0x39
jg 0x406e7f
add cl, 4
jmp 0x406e9a
cmp cl, 0x3d
je 0x406e98
cmp cl, 0x5a
jg 0x406e8e
sub cl, 0x41
jmp 0x406e9a
cmp cl, 0x7a
jg 0x406e98
sub cl, 0x47
jmp 0x406e9a
mov cl, 0x40
mov al, cl
shl dl, 2
shr al, 4
add al, dl
mov edx, dword [ebp + 8]
mov byte [edi + edx], al
inc edi
mov al, byte [esi + 0x4228b2]
cmp al, 0x3d
je 0x406ef7
mov bl, al
cmp bl, 0x2b
jne 0x406ec0
mov bl, 0x3e
jmp 0x406ee9
cmp bl, 0x2f
jne 0x406ec9
mov bl, 0x3f
jmp 0x406ee9
cmp bl, 0x39
jg 0x406ed3
add bl, 4
jmp 0x406ee9
cmp bl, 0x5a
jg 0x406edd
sub bl, 0x41
jmp 0x406ee9
cmp bl, 0x7a
jg 0x406ee7
sub bl, 0x47
jmp 0x406ee9
mov bl, 0x40
mov al, bl
shl cl, 4
shr al, 2
add al, cl
mov byte [edi + edx], al
inc edi
mov al, byte [esi + 0x4228b3]
cmp al, 0x3d
je 0x406f36
cmp al, 0x2b
jne 0x406f09
mov al, 0x3e
jmp 0x406f2b
cmp al, 0x2f
jne 0x406f11
mov al, 0x3f
jmp 0x406f2b
cmp al, 0x39
jg 0x406f19
add al, 4
jmp 0x406f2b
cmp al, 0x5a
jg 0x406f21
sub al, 0x41
jmp 0x406f2b
cmp al, 0x7a
jg 0x406f29
sub al, 0x47
jmp 0x406f2b
mov al, 0x40
mov cl, bl
shl cl, 6
add cl, al
mov byte [edi + edx], cl
inc edi
add esi, 4
cmp esi, 8
jb 0x406e20
mov byte [edi + edx], 0
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
xor eax, eax
pop ebp
ret 0xc
Function at 0x4078a0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push 0x10b8
call fcn.0040a24e
mov edi, eax
add esp, 4
test edi, edi
je 0x4079bd
push str.http:__tj.wudiyou.com:8800_
push 0x824
push edi
call fcn.00409a8d
add esp, 0xc
lea eax, [edi + 0x104c]
push str.7k7k_REPORT
push 0x32
push eax
call fcn.00409a8d
add esp, 0xc
mov dword [edi + 0x10b0], 0x1b
call fcn.004079d0
push 1
mov dword [edi + 0x10b4], eax
call fcn.0040a24e
add esp, 4
mov dword [0x7ab9e4], eax
mov ecx, edi
call fcn.00407e50
push 0x7ab5c8
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
jne 0x4079bd
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.0040be50
add esp, 0xc
lea eax, [ebp - 0x210]
push dword [edi + 0x1048]
push 0x424784
push eax
call fcn.004086e0
add esp, 0xc
lea eax, [ebp - 0x210]
push 0x7ab5c8
push eax
push str.Service_Value
push str.config
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push dword [edi + 0x10b4]
lea eax, [ebp - 0x210]
push 0x424784
push eax
call fcn.004086e0
add esp, 0xc
lea eax, [ebp - 0x210]
push 0x7ab5c8
push eax
push str.InstallID
push str.config
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.00409948
mov esp, ebp
pop ebp
ret

Function at 0x407bc0
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2888
call fcn.00415880
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x407c9d
lea eax, [ebp - 0x2888]
mov dword [ebp - 0x2888], 0x2880
push eax
lea eax, [ebp - 0x2884]
push eax
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
jne 0x407c9d
lea eax, [ebp - 0x2884]
nop
cmp byte [eax + 0x194], 0
jne 0x407c5d
cmp byte [eax + 0x195], 0
jne 0x407c5d
cmp byte [eax + 0x196], 0
jne 0x407c5d
cmp byte [eax + 0x197], 0
jne 0x407c5d
cmp byte [eax + 0x198], 0
jne 0x407c5d
cmp byte [eax + 0x199], 0
jne 0x407c5d
mov eax, dword [eax]
test eax, eax
jne 0x407c10
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00409948
mov esp, ebp
pop ebp
ret 4
movzx ecx, byte [eax + 0x199]
push ecx
movzx ecx, byte [eax + 0x198]
push ecx
movzx ecx, byte [eax + 0x197]
push ecx
movzx ecx, byte [eax + 0x196]
push ecx
movzx ecx, byte [eax + 0x195]
movzx eax, byte [eax + 0x194]
push ecx
push eax
push str._02X__02X__02X__02X__02X__02X
push 0x32
push esi
call fcn.0040b1c1
add esp, 0x24
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00409948
mov esp, ebp
pop ebp
ret 4
Function at 0x408e60
Capabilities:
Hash data with md5

Disassembly:
push esi
push 0x40
mov esi, ecx
mov dword [0x7aba14], 1
mov byte [0x7ab9e8], 0
call fcn.00409957
add esp, 4
mov dword [0x7aba0c], eax
test eax, eax
je 0x408ebc
mov ecx, esi
mov dword [0x7aba10], eax
mov dword [0x7aba20], 0x67452301
mov dword [0x7aba24], 0xefcdab89
mov dword [0x7aba28], 0x98badcfe
mov dword [0x7aba2c], 0x10325476
pop esi
jmp fcn.00409710
pop esi
ret