joyce8/EMBER2024-capa huggingface dataset:
Function at 0x425640
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov esi, eax
mov edi, ecx
xor eax, eax
test edi, edi
lea edx, [eax + 1]
je 0x425682
push ebx
push ebp
mov ebx, dword [esp + 0x14]
movzx ebx, word [ebx + edx*2]
mov ecx, esi
and ecx, 1
mov ebp, ecx
neg ebp
sar ebp, 4
and ebp, 0x7f
shr ebx, 4
xor ebx, ebp
mov ebp, dword [esp + 0x18]
add eax, dword [ebp + ebx*4]
add edx, edx
shr esi, 1
or edx, ecx
sub edi, 1
jne 0x425651
pop ebp
pop ebx
pop edi
pop esi
ret

Function at 0x4257d0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
movzx eax, word [ebx]
mov ecx, eax
shr ecx, 4
mov edx, dword [esi + ecx*4]
movzx ecx, word [ebx + 2]
mov dword [esp], edx
mov edx, ecx
xor eax, 0x7f0
xor ecx, 0x7f0
shr edx, 4
mov edx, dword [esi + edx*4]
shr eax, 4
mov eax, dword [esi + eax*4]
shr ecx, 4
mov ecx, dword [esi + ecx*4]
add edx, eax
add ecx, eax
push ebp
mov dword [esp + 8], edx
mov dword [esp + 0xc], ecx
xor edx, edx
push edi
cmp edx, dword [esp + 0x1c]
jae 0x425947
mov eax, edx
or eax, 8
xor edi, edi
cmp eax, 1
je 0x42585a
lea ebx, [ebx]
mov ebp, dword [esp + 0x18]
mov ecx, eax
shr ecx, 1
and eax, 1
lea ebp, [ecx + ebp*8]
movzx ebp, word [ebx + ebp*2 + 4]
neg eax
sar eax, 4
and eax, 0x7f
shr ebp, 4
xor ebp, eax
add edi, dword [esi + ebp*4]
mov eax, ecx
cmp eax, 1
jne 0x425830
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x20]
add edi, eax
mov dword [ecx + edx*4], edi
add edx, 1
cmp edx, 8
jb 0x425814
cmp edx, 0x10
jae 0x4258e1
lea eax, [edx - 8]
mov dword [esp + 8], eax
jmp 0x425880
cmp edx, dword [esp + 0x1c]
jae 0x425947
or eax, 8
xor edi, edi
cmp eax, 1
je 0x4258c1
mov ebp, dword [esp + 0x18]
mov ecx, eax
shr ecx, 1
and eax, 1
lea ebp, [ecx + ebp*8]
movzx ebp, word [ebx + ebp*2 + 0x104]
neg eax
sar eax, 4
and eax, 0x7f
shr ebp, 4
xor ebp, eax
add edi, dword [esi + ebp*4]
mov eax, ecx
cmp eax, 1
jne 0x425894
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x20]
add edi, eax
mov eax, dword [esp + 8]
mov dword [ecx + edx*4], edi
add edx, 1
add eax, 1
cmp edx, 0x10
mov dword [esp + 8], eax
jb 0x425880
cmp edx, dword [esp + 0x1c]
jae 0x425947
lea eax, [edx - 0x10]
mov dword [esp + 8], eax
mov edi, edi
or eax, 0x100
xor edi, edi
cmp eax, 1
je 0x425926
lea esp, [esp]
mov ecx, eax
and eax, 1
shr ecx, 1
movzx ebp, word [ebx + ecx*2 + 0x204]
neg eax
sar eax, 4
and eax, 0x7f
shr ebp, 4
xor ebp, eax
add edi, dword [esi + ebp*4]
mov eax, ecx
cmp eax, 1
jne 0x425900
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
add edi, eax
mov eax, dword [esp + 8]
mov dword [ecx + edx*4], edi
add edx, 1
add eax, 1
cmp edx, dword [esp + 0x1c]
mov dword [esp + 8], eax
jb 0x4258f0
pop edi
pop ebp
add esp, 0xc
ret
Function at 0x4274b0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
xor esi, esi
lea eax, [edi + 0x32550]
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], eax
jmp 0x4274d0
xor edx, edx
lea ecx, [edx + 1]
mov dword [esp + 0xc], 4
lea ecx, [ecx]
movzx ebx, word [edi + ecx*2 + 0x32bf4]
mov eax, esi
and eax, 1
mov ebp, eax
neg ebp
sar ebp, 4
shr ebx, 4
and ebp, 0x7f
xor ebx, ebp
add edx, dword [edi + ebx*4 + 0x30ea0]
add ecx, ecx
shr esi, 1
or ecx, eax
sub dword [esp + 0xc], 1
jne 0x4274e0
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
add esi, 1
mov dword [eax], edx
add eax, 4
cmp esi, 0x10
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], eax
jb 0x4274d0
pop esi
pop ebp
mov dword [edi + 0x32590], 0
pop ebx
add esp, 0xc
ret

Function at 0x427540
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x210
push ebx
push ebp
push edi
mov edi, 4
lea ebp, [esi + 0x30ea0]
movzx ebx, byte [esi + edi + 0x306a0]
mov ecx, ebx
mov edx, ebx
and edx, 1
shr ecx, 1
or edx, 2
sub ecx, 1
shl edx, cl
mov eax, edi
push ebp
sub eax, edx
sub edx, ebx
lea edx, [esi + edx*2 + 0x32b0e]
push edx
call fcn.00425640
mov dword [esp + edi*4 + 0x24], eax
add edi, 1
add esp, 8
cmp edi, 0x80
jb 0x427554
lea ebp, [esp + 0x1c]
sub ebp, esi
lea eax, [esi + 0x32910]
lea ecx, [esi + 0x31d58]
sub ebp, 0x31d50
lea edi, [esi + 0x31950]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], 4
jmp 0x4275d4
mov ecx, dword [esp + 0xc]
xor ebx, ebx
cmp dword [esi + 0x32594], ebx
jbe 0x427631
mov edi, edi
mov eax, ebx
or eax, 0x40
xor edx, edx
cmp eax, 1
je 0x427623
lea esp, [esp]
mov ebp, dword [esp + 0x10]
mov ecx, eax
and eax, 1
shr ecx, 1
movzx ebp, word [ebp + ecx*2]
neg eax
sar eax, 4
and eax, 0x7f
shr ebp, 4
xor ebp, eax
add edx, dword [esi + ebp*4 + 0x30ea0]
mov eax, ecx
cmp eax, 1
jne 0x4275f0
mov ebp, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
mov dword [edi + ebx*4], edx
add ebx, 1
cmp ebx, dword [esi + 0x32594]
jb 0x4275e0
mov eax, 0xe
cmp dword [esi + 0x32594], eax
jbe 0x427658
mov edi, edi
mov edx, eax
shr edx, 1
sub edx, 5
shl edx, 4
add dword [edi + eax*4], edx
add eax, 1
cmp eax, dword [esi + 0x32594]
jb 0x427640
mov eax, dword [edi]
mov dword [ecx - 8], eax
mov edx, dword [edi + 4]
mov dword [ecx - 4], edx
mov eax, dword [edi + 8]
mov dword [ecx], eax
mov edx, dword [edi + 0xc]
mov dword [ecx + 4], edx
mov eax, 4
add ecx, 8
jmp 0x427680
movzx edx, byte [esi + eax + 0x306a0]
mov edx, dword [edi + edx*4]
add edx, dword [ecx + ebp]
add eax, 1
mov dword [ecx], edx
add ecx, 4
cmp eax, 0x80
jb 0x427680
add dword [esp + 0x10], 0x80
add dword [esp + 0xc], 0x200
sub ebp, 0x200
add edi, 0x100
sub dword [esp + 0x18], 1
mov dword [esp + 0x14], ebp
jne 0x4275d0
pop edi
pop ebp
mov dword [esi + 0x3bcf8], 0
pop ebx
add esp, 0x210
ret
Function at 0x428610
Capabilities:
Create thread

Disassembly:
push ecx
lea eax, [esp]
push eax
push 0
push ecx
push edx
push 0
push 0
call fcn.004a32a5
mov ecx, dword [esp + 0x20]
add esp, 0x18
test eax, eax
mov dword [ecx], eax
je 0x428633
xor eax, eax
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x428642
mov eax, 1
pop ecx
ret
Function at 0x42d5e0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4d60a5
push eax
mov dword fs:[0], esp
push esi
xor eax, eax
push edi
mov edi, dword [esp + 0x18]
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], 4
mov dword [edi], vtable.CObjectVector_struct_NArchive::N7z::CMethodFull_.0
mov dword [esp + 0x10], eax
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], eax
mov dword [edi + 0x20], eax
mov dword [edi + 0x24], 0x10
mov dword [edi + 0x14], vtable.CRecordVector_struct_NArchive::N7z::CBind_.0
mov ecx, 1
mov byte [esp + 0x10], cl
lea esi, [edi + 0x30]
mov dword [edi + 0x28], ecx
mov byte [edi + 0x2c], al
push 4
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
call fcn.004197d0
mov ecx, dword [esp + 8]
mov eax, edi
pop edi
mov dword fs:[0], ecx
pop esi
add esp, 0xc
ret 4
Function at 0x42ecb0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4d60a5
push eax
mov dword fs:[0], esp
push ebx
push esi
push edi
mov edi, dword [esp + 0x1c]
mov dword [esp + 0x14], 1
mov eax, dword [edi + 0x30]
push eax
call fcn.0049f9d0
xor ebx, ebx
lea esi, [edi + 0x14]
mov byte [esp + 0x18], bl
mov eax, dword [esi + 8]
add esp, 4
push eax
push ebx
mov ecx, esi
mov dword [esi], vtable.CBaseRecordVector.0
call dword [0x4eaef8]
mov eax, dword [esi + 0xc]
push eax
call fcn.0049f9d0
add esp, 4
push edi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esp + 0x18], 0xffffffff
call fcn.0042f600
mov ecx, dword [esp + 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret 4
Function at 0x435190
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d8cf8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edx, dword [edi + 0x248]
mov eax, dword [edi + 0x240]
mov eax, dword [eax + 4]
lea ecx, [edi + 0x240]
mov dword [ebp - 0x10], esp
push edx
push ebx
call eax
lea esi, [edi + 0xc]
call fcn.0041f530
lea ecx, [ebp - 0x50]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [ebp - 0x3c]
or eax, 0xffffffff
mov dword [esi + 0x48], edx
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x44], ebx
mov dword [esi + 4], 4
xor esi, esi
nop
cmp esi, dword [ebp + 0x14]
jge 0x435355
mov eax, dword [ebp + 0xc]
mov ebx, dword [eax + esi*4]
lea eax, [ebp - 0x1c]
call fcn.0041b460
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.USER32.dll_CharUpperW]
mov edx, dword [ebp - 0x18]
xor ebx, ebx
cmp edx, ebx
jne 0x435255
mov byte [ebp - 4], bl
mov edx, dword [ebp - 0x1c]
push edx
call fcn.0049f9d0
add esp, 4
mov eax, 0x80070057
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp - 0x1c]
mov eax, esi
shl eax, 4
add eax, dword [ebp + 0x10]
cmp word [ecx], 0x42
jne 0x43530a
mov edi, 1
cmp edx, edi
jge 0x435279
cmp edx, ebx
mov edi, edx
jle 0x435290
sub edx, edi
lea eax, [edx + edx + 2]
push eax
lea edx, [ecx + edi*2]
push edx
push ecx
call fcn.004a2d20
add esp, 0xc
sub dword [ebp - 0x18], edi
lea ebx, [ebp - 0x2c]
lea edi, [ebp - 0x1c]
call fcn.00435120
mov edi, eax
xor ebx, ebx
cmp edi, ebx
je 0x4352c7
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x1c]
push eax
call fcn.0049f9d0
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x28]
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [ebp - 0x24]
mov dword [eax + 4], edx
mov edx, dword [ebp - 0x20]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
mov eax, dword [ebp + 8]
add eax, 0x240
call fcn.0042ff70
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x1c]
push eax
call fcn.0049f9d0
mov edi, dword [ebp + 8]
add esp, 4
add esi, 1
jmp 0x435200
push eax
add edi, 0xc
push edi
call fcn.0041f590
mov edi, eax
cmp edi, ebx
mov byte [ebp - 4], bl
je 0x43533e
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.0049f9d0
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov edx, dword [ebp - 0x1c]
push edx
call fcn.0049f9d0
mov edi, dword [ebp + 8]
add esp, 4
add esi, 1
jmp 0x435200
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x442920
Capabilities:
Delete file

Disassembly:
sub esp, 0x14
mov eax, dword [esp + 0x1c]
push ebx
push ebp
push esi
push edi
xor esi, esi
push esi
push 0x80
push 2
push esi
push 1
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
mov dword [esp + 0x18], ebx
jne 0x442961
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 8
mov edi, dword [esp + 0x28]
mov ecx, dword [edi + 4]
push 0
push ecx
push 0
push 4
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
test ebx, ebx
mov ebp, eax
mov dword [esp + 0x1c], ebp
jne 0x44298d
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x442a61
mov edx, dword [edi + 4]
push edx
push 0
push 0
push 2
push ebp
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
mov dword [esp + 0x14], eax
jne 0x4429b1
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x442a61
mov dword [esp + 0x10], eax
mov eax, dword [edi + 0xc]
mov eax, dword [eax]
lea ebx, [edi + 8]
mov ebp, eax
nop
test ebx, ebx
mov esi, dword [edi + 0xc]
lea eax, [edi + 8]
je 0x4429ce
cmp ebx, eax
je 0x4429d3
call fcn.004a089d
cmp ebp, esi
je 0x442a49
test ebx, ebx
jne 0x4429e0
call fcn.004a089d
cmp ebp, dword [ebx + 4]
jne 0x4429ea
call fcn.004a089d
mov esi, dword [ebp + 8]
mov eax, dword [esi + 4]
test eax, eax
jne 0x4429f8
xor edi, edi
jmp 0x4429fd
mov edi, dword [esi + 8]
sub edi, eax
test eax, eax
je 0x442a08
mov ecx, dword [esi + 8]
sub ecx, eax
jne 0x442a0d
call fcn.004a089d
mov edx, dword [esi + 4]
mov eax, dword [esp + 0x10]
push edi
push edx
push eax
call fcn.004a49a0
mov eax, dword [esi + 4]
add esp, 0xc
test eax, eax
jne 0x442a2a
xor esi, esi
jmp 0x442a2f
mov esi, dword [esi + 8]
sub esi, eax
add dword [esp + 0x10], esi
cmp ebp, dword [ebx + 4]
jne 0x442a3d
call fcn.004a089d
mov ebp, dword [ebp]
mov edi, dword [esp + 0x28]
jmp 0x4429c0
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x1c]
mov esi, 1
test ebp, ebp
je 0x442a6c
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x442a91
mov ebx, dword [esp + 0x2c]
mov eax, ebx
mov ecx, edi
call fcn.00442aa0
mov esi, eax
test esi, esi
jne 0x442a91
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 8
Function at 0x442aa0
Capabilities:
Read file via mapping

Disassembly:
sub esp, 0x24
push ebx
push ebp
push esi
push edi
xor edi, edi
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocString
push eax
mov esi, ecx
mov dword [esp + 0x3c], edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
cmp ebp, 0xffffffff
mov dword [esp + 0x1c], ebp
jne 0x442ae1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
mov ecx, dword [esi + 4]
push 0
push ecx
push 0
push 2
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
test ebp, ebp
mov ebx, eax
mov dword [esp + 0x24], ebx
jne 0x442b09
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x442c5d
mov edx, dword [esi + 4]
push edx
push 0
push 0
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
test ebx, ebx
mov dword [esp + 0x18], ebx
jne 0x442b2f
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x442c4e
mov eax, dword [esi + 0xc]
mov eax, dword [eax]
mov dword [esp + 0x14], ebx
lea ebx, [esi + 8]
mov dword [esp + 0x28], ebx
mov edi, ebx
mov ebp, eax
test edi, edi
mov esi, dword [ebx + 4]
mov dword [esp + 0x30], ebp
je 0x442b52
cmp edi, ebx
je 0x442b57
call fcn.004a089d
cmp ebp, esi
je 0x442c3b
test edi, edi
jne 0x442b68
call fcn.004a089d
cmp ebp, dword [edi + 4]
jne 0x442b72
call fcn.004a089d
mov edi, dword [ebp + 8]
mov eax, dword [edi + 4]
test eax, eax
jne 0x442b80
xor esi, esi
jmp 0x442b85
mov esi, dword [edi + 8]
sub esi, eax
test eax, eax
je 0x442b90
mov ecx, dword [edi + 8]
sub ecx, eax
jne 0x442b95
call fcn.004a089d
cmp esi, 4
mov edx, dword [edi + 4]
mov ecx, dword [esp + 0x14]
mov eax, edx
jb 0x442bbb
mov ebp, dword [ecx]
cmp ebp, dword [eax]
jne 0x442bbf
sub esi, 4
add eax, 4
add ecx, 4
cmp esi, 4
jae 0x442ba3
mov ebp, dword [esp + 0x30]
test esi, esi
je 0x442c16
movzx ebx, byte [ecx]
movzx ebp, byte [eax]
sub ebx, ebp
jne 0x442c42
sub esi, 1
add eax, 1
add ecx, 1
test esi, esi
je 0x442c0e
movzx ebx, byte [ecx]
movzx ebp, byte [eax]
sub ebx, ebp
jne 0x442c42
sub esi, 1
add eax, 1
add ecx, 1
test esi, esi
je 0x442c0e
movzx ebx, byte [ecx]
movzx ebp, byte [eax]
sub ebx, ebp
jne 0x442c42
sub esi, 1
add eax, 1
add ecx, 1
test esi, esi
je 0x442c0e
movzx ecx, byte [ecx]
movzx eax, byte [eax]
sub ecx, eax
jne 0x442c42
mov ebp, dword [esp + 0x30]
mov ebx, dword [esp + 0x28]
test edx, edx
jne 0x442c1e
xor eax, eax
jmp 0x442c23
mov eax, dword [edi + 8]
sub eax, edx
add dword [esp + 0x14], eax
mov edi, ebx
cmp ebp, dword [edi + 4]
jne 0x442c33
call fcn.004a089d
mov ebp, dword [ebp]
jmp 0x442b43
mov edi, 1
jmp 0x442c46
mov edi, dword [esp + 0x20]
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x1c]
test ebx, ebx
je 0x442c59
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ebx, dword [esp + 0x24]
test ebx, ebx
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x442c6a
push ebx
call esi
push ebp
call esi
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
Function at 0x442d20
Capabilities:
Create directory
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x4d9418
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, dword [esp + 0x1c]
lea eax, [esp + 8]
push eax
mov ecx, esi
call fcn.004034e0
push esi
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or ebp, 0xffffffff
cmp eax, ebp
je 0x442d95
mov dword [esp + 0x14], ebp
mov eax, dword [esp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], ebp
dec ebp
test ebp, ebp
jg 0x442d7f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
pop esi
mov eax, 1
pop ebp
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0
push esi
call edi
test eax, eax
jne 0x442e05
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
cmp eax, 0xb7
je 0x442e05
lea ecx, [esp + 0x10]
call fcn.0040bd50
mov eax, dword [esp + 0x10]
cmp dword [eax - 0xc], 0
je 0x442de7
push eax
call fcn.00442d20
add esp, 4
test eax, eax
je 0x442de7
push 0
push esi
call edi
test eax, eax
jne 0x442e05
call ebx
cmp eax, 0xb7
je 0x442e05
lea ecx, [esp + 0x10]
call fcn.00403580
pop edi
pop ebx
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
mov dword [esp + 0x1c], ebp
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], ebp
dec ebp
test ebp, ebp
jg 0x442e26
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x14]
pop edi
pop ebx
pop esi
mov eax, 1
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x442f90
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, 1
test byte [0x509d2c], al
mov dword [esp], 0
jne 0x442fd4
or dword [0x509d2c], eax
mov eax, dword [0x507fec]
mov edx, dword [eax + 0xc]
mov ecx, 0x507fec
call edx
add eax, 0x10
push 0x4db180
mov dword [0x509d28], eax
call fcn.0049f796
add esp, 4
mov eax, dword [0x509d28]
cmp dword [eax - 0xc], 0
jne 0x44301c
push 0x104
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x443017
push edi
lea edx, [esp + 8]
mov edi, 0x509d28
call fcn.004035b0
mov eax, edi
call fcn.00442c80
push 8
push str.drivers_
push edi
call fcn.004038e0
pop edi
mov eax, dword [0x509d28]
add eax, 0xfffffff0
call fcn.00403c80
add eax, 0x10
mov dword [esi], eax
mov eax, esi
add esp, 0x20c
ret

Function at 0x4453f0
Capabilities:
Delete file
Set file attributes

Disassembly:
cmp byte [edi], 0
jne 0x4453f8
mov al, 1
ret
push esi
mov esi, dword [edi + 4]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x44541d
xor al, al
test al, al
sete al
xor ecx, ecx
test al, al
sete cl
mov byte [edi], al
mov al, cl
pop esi
ret
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne al
test al, al
sete al
xor ecx, ecx
test al, al
sete cl
mov byte [edi], al
mov al, cl
pop esi
ret
Function at 0x4459c0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x4d7400
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov eax, dword [0x507fec]
mov edx, dword [eax + 0xc]
push ebp
push esi
push edi
mov ecx, 0x507fec
mov dword [esp + 0x14], 0
call edx
add eax, 0x10
mov dword [esp + 0xc], eax
xor esi, esi
mov dword [esp + 0x20], 0
mov dword [esp + 0x10], esi
mov byte [esp + 0x20], 1
mov eax, dword [0x509b8c]
push eax
push str.SoftwareKingsoftKVip_d
lea edi, [esp + 0x14]
call fcn.00404190
mov edi, dword [esp + 0x14]
add esp, 8
lea ecx, [esp + 0x10]
push ecx
push 1
push esi
push edi
push SysReAllocString
mov dword [esp + 0x24], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x445a6c
mov esi, dword [esp + 0x10]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x14]
push ecx
push 0
push str.Proxy_Mode
push esi
mov dword [esp + 0x28], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test esi, esi
mov ebp, dword [esp + 0x14]
je 0x445a7b
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [edi - 0x10]
mov dword [esp + 0x20], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x445a9f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x18]
pop edi
pop esi
mov eax, ebp
pop ebp
mov dword fs:[0], ecx
add esp, 0x18
ret

Function at 0x445ac0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x4d7400
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov eax, dword [0x507fec]
mov edx, dword [eax + 0xc]
push ebx
push edi
mov ecx, 0x507fec
mov dword [esp + 0x10], 0x50
call edx
add eax, 0x10
mov dword [esp + 8], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0xc], 0
mov byte [esp + 0x1c], 1
mov eax, dword [0x509b8c]
push eax
push str.SoftwareKingsoftKVip_d
lea edi, [esp + 0x10]
call fcn.00404190
mov ebx, dword [esp + 0x10]
add esp, 8
lea ecx, [esp + 0xc]
push ecx
push 1
push 0
push ebx
push SysReAllocString
mov dword [esp + 0x20], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x445b92
mov edi, dword [esp + 0xc]
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
push ecx
push 0
push str.Proxy_Port
push edi
mov dword [esp + 0x20], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x445b87
cmp dword [esp + 0xc], 4
jne 0x445b87
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x24]
mov dword [eax], edx
test edi, edi
je 0x445b92
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebx - 0x10]
mov dword [esp + 0x1c], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
pop edi
pop ebx
jg 0x445bb8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret 4
Function at 0x445d00
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x4d73c6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x428
push ebx
push ebp
push esi
push edi
xor ebx, ebx
push 0x206
lea eax, [esp + 0x2e]
push ebx
push eax
mov dword [esp + 0x24], ebx
mov word [esp + 0x34], bx
call fcn.004a4620
push 0x206
lea ecx, [esp + 0x242]
push ebx
push ecx
mov word [esp + 0x248], bx
call fcn.004a4620
mov edx, dword [0x507fec]
mov eax, dword [edx + 0xc]
add esp, 0x18
mov ecx, 0x507fec
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
xor ebp, ebp
mov dword [esp + 0x440], ebx
mov dword [esp + 0x1c], ebp
mov byte [esp + 0x440], 1
mov ecx, dword [0x509b8c]
push ecx
push str.SoftwareKingsoftKVip_d
lea edi, [esp + 0x1c]
call fcn.00404190
mov eax, dword [esp + 0x1c]
add esp, 8
lea edx, [esp + 0x10]
push edx
push 1
push ebx
push eax
push SysReAllocString
mov dword [esp + 0x24], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x445e57
mov ebp, dword [esp + 0x10]
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x2c]
push eax
push ebx
push str.Proxy_Authorization
push ebp
mov dword [esp + 0x34], ebp
mov dword [esp + 0x38], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [esp + 0x18], ebx
je 0x445e57
push str.Proxy_User
lea ecx, [esp + 0x20]
push ecx
lea edi, [esp + 0x18]
lea esi, [esp + 0x30]
mov dword [esp + 0x18], 0x104
call fcn.0040fe90
test eax, eax
jne 0x445e23
mov edi, dword [esp + 0x448]
mov edx, esi
call fcn.004035b0
push str.Proxy_Password
lea edx, [esp + 0x20]
push edx
lea edi, [esp + 0x18]
lea esi, [esp + 0x238]
mov dword [esp + 0x18], 0x104
call fcn.0040fe90
cmp eax, ebx
jne 0x445e57
mov edi, dword [esp + 0x44c]
mov edx, esi
call fcn.004035b0
cmp ebp, ebx
mov esi, dword [esp + 0x18]
je 0x445e66
push ebp
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x440], 0xffffffff
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x445e91
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x438]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x434
ret 8