joyce8/EMBER2024-capa huggingface dataset:
Function at 0x65999d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x6623a8
cmp edx, dword [eax]
je 0x6599bf
add eax, 8
inc ecx
cmp eax, 0x662438
jl 0x6599b0
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x6623a8]
jne 0x659aed
mov eax, dword [0xa5dd0c]
cmp eax, 1
je 0x659ac7
test eax, eax
jne fcn.006599f0
cmp dword [0x6622d4], 1
je 0x659ac7
lea eax, [ebp + 8]
lea esi, [esi + 0x6623ac]
push 0
push eax
push dword [esi]
call fcn.0065a810
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
Function at 0x401700
Capabilities:
Terminate process
Terminate thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0xdc]
test eax, eax
je 0x401720
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [esi + 0xdc], 0
mov al, byte [esi + 0xd5]
test al, al
je 0x401756
mov eax, dword [esi + 0xd8]
test eax, eax
je 0x401756
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
push str.CCExpertApp::KillListenThread:_x
mov dword [esi + 0xd8], 0
call fcn.00401770
add esp, 8
mov eax, 1
pop esi
ret

Function at 0x401bf0
Capabilities:
Get session user name

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
push 0x416de8
mov ecx, ebp
mov edi, 1
call fcn.0040a0ca
push 0x208
mov dword [esp + 0x18], 0x104
call sub.MFC42u.DLL_operatornew
mov ebx, dword [sym.imp.ADVAPI32.dll_GetUserNameW]
add esp, 4
mov esi, eax
lea eax, [esp + 0x14]
push eax
push esi
call ebx
test eax, eax
jne 0x401c54
push esi
call sub.MFC42u.DLL_operatordelete
mov ecx, dword [esp + 0x18]
lea edx, [ecx + ecx]
push edx
call sub.MFC42u.DLL_operatornew
add esp, 8
mov esi, eax
lea eax, [esp + 0x14]
push eax
push esi
call ebx
mov edi, eax
push esi
mov ecx, ebp
call fcn.0040a0ca
push esi
call sub.MFC42u.DLL_operatordelete
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x401c70
Capabilities:
Get common file path
Timestomp file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40b8f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x23c
push ebx
push esi
push edi
lea eax, [ebp - 0x248]
mov dword [ebp - 0x10], esp
xor ebx, ebx
push 0x104
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea ecx, [ebp - 0x248]
push ecx
lea ecx, [ebp - 0x14]
call sub.MFC42u.DLL_CString::CString_1
push 0x4128dc
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call sub.MFC42u.DLL_CString::operator
lea ecx, [ebp - 0x18]
call fcn.00409f2c
mov al, byte [ebp + 8]
mov byte [ebp - 4], 2
cmp al, bl
je 0x401ce5
push 0x4128d8
jmp 0x401cea
push 0x41286c
lea ecx, [ebp - 0x18]
call fcn.0040a0ca
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push edx
push eax
push str.NormalExit
push str.ClientParameter
call esi
mov ecx, dword [ebp - 0x14]
push ecx
push 0x4128d8
push str.IsUpdate
push 0x412870
call esi
lea ecx, [ebp - 0x40]
call sub.MFC42u.DLL_CFile::CFile
mov edx, dword [ebp - 0x14]
push ebx
push 2
push edx
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 3
call sub.MFC42u.DLL_CFile::Open
cmp eax, ebx
jne 0x401d76
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 2
call fcn.00409f26
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call sub.MFC42u.DLL_CString::CString
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], bl
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x20]
lea ecx, [ebp - 0x30]
push eax
push ecx
mov word [ebp - 0x30], 0x7d5
mov word [ebp - 0x2e], 8
mov word [ebp - 0x2a], 1
mov word [ebp - 0x28], 0xa
mov word [ebp - 0x26], 0x14
mov word [ebp - 0x24], bx
mov word [ebp - 0x22], bx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea edx, [ebp - 0x20]
lea eax, [ebp - 0x20]
push edx
mov edx, dword [ebp - 0x3c]
lea ecx, [ebp - 0x20]
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SetFileTime]
lea ecx, [ebp - 0x40]
call sub.MFC42u.DLL_CFile::Close
jmp 0x401d40

Function at 0x401de0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x40b91b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
lea eax, [esp + 4]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea ecx, [esp + 4]
push ecx
lea ecx, [esp + 4]
call sub.MFC42u.DLL_CString::CString_1
push 0x4128dc
lea ecx, [esp + 4]
mov dword [esp + 0x218], 0
call sub.MFC42u.DLL_CString::operator
mov edx, dword [esp]
push edx
push 0x4128d8
push str.OnlineFlag
push str.ClientParameter
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea ecx, [esp]
mov dword [esp + 0x214], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x20c]
mov dword fs:[0], ecx
add esp, 0x218
ret
Function at 0x402670
Capabilities:
Enumerate processes

Disassembly:
push 0xffffffffffffffff
push 0x40ba0e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x238
push ebp
push esi
lea eax, [esp + 0x250]
xor ebp, ebp
push eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x24c], ebp
call sub.MFC42u.DLL_CString::CString_2
push ebp
push 2
mov byte [esp + 0x250], 1
mov dword [esp + 0x18], ebp
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x40277d
push edi
mov ecx, 0x8b
xor eax, eax
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], 0x22c
push ecx
push esi
call sub.KERNEL32.dll_Process32FirstW
cmp eax, ebp
je 0x402775
mov ebp, dword [sym.imp.MSVCRT.dll_wcscmp]
lea edx, [esp + 0x3c]
lea ecx, [esp + 0xc]
push edx
call sub.MFC42u.DLL_CString::CString_1
lea ecx, [esp + 0xc]
mov byte [esp + 0x24c], 2
call sub.MFC42u.DLL_CString::MakeUpper
lea ecx, [esp + 0x10]
call sub.MFC42u.DLL_CString::MakeUpper
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push eax
push ecx
call ebp
add esp, 8
test eax, eax
je 0x40275c
lea edx, [esp + 0x18]
mov dword [esp + 0x18], 0x22c
push edx
push esi
call sub.KERNEL32.dll_Process32NextW
lea ecx, [esp + 0xc]
mov edi, eax
mov byte [esp + 0x24c], 1
call sub.MFC42u.DLL_CString::CString
test edi, edi
jne 0x4026f5
jmp 0x402775
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0xc]
mov dword [esp + 0x14], eax
mov byte [esp + 0x24c], 1
call sub.MFC42u.DLL_CString::CString
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
lea ecx, [esp + 0xc]
mov byte [esp + 0x248], 0
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x250]
mov dword [esp + 0x248], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x240]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x244
ret
Function at 0x4027c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40ba40
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x224
push ebx
push esi
push edi
lea eax, [ebp - 0x230]
mov dword [ebp - 0x10], esp
push 0x104
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea ecx, [ebp - 0x18]
call fcn.00409f2c
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.00409f2c
lea ecx, [ebp - 0x230]
lea edx, [ebp - 0x18]
push ecx
push str._smsreslocal.ini
push edx
mov byte [ebp - 4], 2
call sub.MFC42u.DLL_CString::Format
add esp, 0xc
lea ecx, [ebp - 0x28]
call fcn.004073c0
mov eax, dword [ebp - 0x18]
mov bl, 3
push eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call fcn.004074d0
lea ecx, [ebp - 0x14]
push ecx
push str.version
push str.YTSTATUS
lea ecx, [ebp - 0x28]
call fcn.00407440
mov edx, dword [ebp - 0x14]
push edx
push str.BeginUpdateVersion___szVersionInfo:__s___Begin
call fcn.00401770
add esp, 4
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.UpdateC.exe
call fcn.0040a0e8
call fcn.00402670
add esp, 4
test eax, eax
jg 0x4028be
push str.BeginUpdateVersion___UpdateC.exe
call fcn.00401770
add esp, 4
lea ecx, [ebp - 0x20]
call fcn.00408e50
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 4
call fcn.00409c50
lea ecx, [ebp - 0x20]
call fcn.00408f70
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], bl
call fcn.00408f60
jmp 0x4028cc
push eax
push 0x413130
call fcn.00401770
add esp, 8
push str.BeginUpdateVersion_____End
call fcn.00401770
add esp, 4
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.00407400
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call sub.MFC42u.DLL_CString::CString
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402930
Capabilities:
Get common file path
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x40ba66
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x238
push ebx
push edi
lea eax, [esp + 0x38]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea ecx, [esp + 0x38]
push ecx
lea ecx, [esp + 0xc]
call sub.MFC42u.DLL_CString::CString_1
xor ebx, ebx
push 0x4128dc
lea ecx, [esp + 0xc]
mov dword [esp + 0x24c], ebx
call sub.MFC42u.DLL_CString::operator
mov ecx, 9
xor eax, eax
lea edi, [esp + 0x12]
mov edx, dword [esp + 8]
mov word [esp + 0x10], bx
push edx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x14]
push 0x28
push eax
push 0x4128d8
push str.NormalExit
push str.ClientParameter
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x10]
call sub.MFC42u.DLL_CString::CString_1
mov edx, dword [esp + 0xc]
push 0x4128d8
push edx
call dword [sym.imp.MSVCRT.dll__wcsicmp]
add esp, 8
cmp eax, ebx
je 0x402a30
mov eax, dword [esp + 0xc]
push 0x416de8
push eax
call dword [sym.imp.MSVCRT.dll_wcscmp]
add esp, 8
cmp eax, ebx
je 0x402a30
lea ecx, [esp + 0xc]
mov byte [esp + 0x248], bl
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 8]
mov dword [esp + 0x248], 0xffffffff
call sub.MFC42u.DLL_CString::CString
pop edi
mov al, 1
pop ebx
mov ecx, dword [esp + 0x238]
mov dword fs:[0], ecx
add esp, 0x244
ret
lea ecx, [esp + 0xc]
mov byte [esp + 0x248], bl
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 8]
mov dword [esp + 0x248], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x240]
pop edi
xor al, al
pop ebx
mov dword fs:[0], ecx
add esp, 0x244
ret
Function at 0x404020
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x1c
lea eax, [esp]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x30]
push 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x404096
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
mov esi, dword [esp + 0x14]
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x404096
mov eax, dword [esi + 0x3c]
xor ecx, ecx
add eax, esi
sub edi, esi
xor ebp, ebp
mov cx, word [eax + 0x14]
lea edx, [ecx + eax + 0x18]
xor ecx, ecx
mov cx, word [eax + 6]
test ecx, ecx
jbe 0x404096
lea eax, [edx + 0x10]
mov edx, dword [eax]
mov esi, dword [eax - 8]
mov ebx, dword [eax - 4]
cmp edx, esi
ja 0x404084
mov edx, esi
cmp edi, ebx
jb 0x40408e
add edx, ebx
cmp edi, edx
jbe 0x4040a0
inc ebp
add eax, 0x28
cmp ebp, ecx
jb 0x404076
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1c
ret
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x40]
inc ebp
sub edi, ebx
mov dword [edx], ebp
mov dword [eax], edi
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x1c
ret

Function at 0x404880
Capabilities:
Write file on windows

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x404
lea eax, [esp + 0x40c]
lea edx, [esp + 4]
push esi
push eax
push ecx
push edx
call dword [sym.imp.MSVCRT.dll_vsprintf]
mov edx, dword [0x416df4]
add esp, 0xc
mov esi, eax
lea eax, [esp + 4]
push 0
push eax
lea ecx, [esp + 0x10]
push esi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, esi
pop esi
add esp, 0x404
ret

Function at 0x404bc0
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x40bc48
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov eax, dword [esp + 0x18]
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
push eax
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x404c5d
push edi
push 0x1000
call sub.MFC42u.DLL_operatornew
add esp, 4
lea ecx, [esp + 8]
mov edi, eax
push 0
push ecx
push 0x1000
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call sub.MFC42u.DLL_operatordelete
add esp, 4
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], 0xffffffff
call sub.MFC42u.DLL_CString::CString
pop edi
mov al, 1
pop esi
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 4
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 8]
mov al, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x4058b0
Capabilities:
Inspect load icon resource

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x3a8
cmp eax, 2
push esi
push edi
mov edi, ecx
jne 0x4058d6
call sub.MFC42u.DLL_AfxGetModuleState
mov eax, dword [eax + 4]
push 0x82
mov eax, dword [eax + 0x6c]
push eax
jmp 0x4058e7
call sub.MFC42u.DLL_AfxGetModuleState
mov eax, dword [eax + 4]
push 0x82
mov ecx, dword [eax + 0x6c]
push ecx
call dword [sym.imp.USER32.dll_LoadIconW]
mov edx, dword [edi + 0x20]
mov esi, eax
push 2
lea eax, [esp + 0x24]
push 0x416de8
push eax
mov dword [esp + 0x14], 0x3a8
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], 0x3e8
mov dword [esp + 0x24], 0xbd3
mov dword [esp + 0x20], 7
mov dword [esp + 0x28], esi
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
lea ecx, [esp + 8]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
test esi, esi
mov edi, eax
je 0x405946
push esi
call dword [sym.imp.USER32.dll_DestroyIcon]
xor eax, eax
test edi, edi
pop edi
pop esi
setne al
add esp, 0x3a8
ret 4

Function at 0x405b70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x40bd90
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
mov esi, ecx
push 0x4164e4
lea ecx, [esp + 0xc]
call sub.MFC42u.DLL_CString::CString_2
xor ebx, ebx
push str.SysData.DAT
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], ebx
call sub.MFC42u.DLL_CString::operator
lea ecx, [esp + 0xc]
call sub.MFC42u.DLL_CFile::CFile
mov eax, dword [esp + 8]
push ebx
push 2
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], 1
call sub.MFC42u.DLL_CFile::Open
test eax, eax
jne 0x405c09
mov ecx, dword [esp + 8]
push ebx
push 0x3002
push ecx
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CFile::Open
test eax, eax
je 0x405c55
mov edx, dword [esi + 0x20]
push 0x260
mov dword [esi + 0xe8], edx
add esi, 0xc8
push esi
lea ecx, [esp + 0x14]
call sub.MFC42u.DLL_CFile::Write
jmp 0x405c4c
lea ecx, [esp + 0xc]
call sub.MFC42u.DLL_CFile::GetLength
cmp eax, 0x260
je 0x405c2e
lea ecx, [esp + 0xc]
call sub.MFC42u.DLL_CFile::Close
mov eax, dword [esp + 8]
push eax
call sub.MFC42u.DLL_CFile::Remove
jmp 0x405c55
lea ecx, [esi + 0xc8]
push 0x260
push ecx
lea ecx, [esp + 0x14]
call sub.MFC42u.DLL_CFile::Read
mov edx, dword [esi + 0x20]
mov dword [esi + 0xe8], edx
lea ecx, [esp + 0xc]
call sub.MFC42u.DLL_CFile::Close
lea ecx, [esp + 0xc]
mov byte [esp + 0x24], bl
call fcn.00409f26
lea ecx, [esp + 8]
mov dword [esp + 0x24], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x1c]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret
Function at 0x407440
Capabilities:
Read .ini file

Disassembly:
sub esp, 0xc8
push ebx
mov ebx, dword [esp + 0xd8]
push esi
mov esi, ecx
push edi
push 0x416de8
mov ecx, ebx
call fcn.0040a0ca
mov ecx, 0x31
xor eax, eax
lea edi, [esp + 0xe]
mov esi, dword [esi + 4]
mov word [esp + 0xc], 0
mov edx, dword [esp + 0xd8]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0xdc]
push esi
stosw word es:[edi], ax
lea eax, [esp + 0x10]
push 0xc8
push eax
push 0x416de8
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
jbe 0x4074bb
lea eax, [esp + 0xc]
mov ecx, ebx
push eax
call fcn.0040a0ca
pop edi
pop esi
mov al, 1
pop ebx
add esp, 0xc8
ret 0xc
pop edi
pop esi
xor al, al
pop ebx
add esp, 0xc8
ret 0xc

Function at 0x407500
Capabilities:
Get common file path

Disassembly:
sub esp, 0x208
lea eax, [esp]
push esi
push 0x104
mov esi, ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea ecx, [esp + 4]
add esi, 4
push ecx
push str._smsresYTSysConfig.ytf
push esi
call sub.MFC42u.DLL_CString::Format
add esp, 0xc
pop esi
add esp, 0x208
ret

Function at 0x407660
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x18]
test eax, eax
je 0x407670
xor eax, eax
pop esi
ret 8
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
lea ecx, [esp + 0xc]
push 4
push ecx
mov dword [esp + 0x14], eax
mov eax, dword [esi + 0x10]
push 4
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor ecx, ecx
mov dword [esi + 4], eax
test eax, eax
sete cl
mov dword [esi + 0xc], 4
mov dword [esi + 8], 4
mov eax, ecx
pop esi
ret 8

Function at 0x4076b0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push esi
mov esi, ecx
mov eax, dword [esi + 0x10]
test eax, eax
je 0x407711
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x407711
lea edx, [esp + 0x10]
mov dword [esp + 0x10], 4
push edx
lea edx, [esp + 0xc]
push edx
lea edx, [esp + 0xc]
push edx
push 0
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [esp + 4]
mov edx, dword [esp + 0x10]
test eax, eax
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
jne 0x407711
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 8]
pop esi
mov dword [eax], ecx
mov eax, 1
add esp, 8
ret 8
xor eax, eax
pop esi
add esp, 8
ret 8
Function at 0x408e50
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x40c414
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x214
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x14], esi
lea ebp, [esi + 4]
mov ecx, ebp
call fcn.00409f2c
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x1a]
mov word [esp + 0x18], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x18]
push 0x104
rep stosd dword es:[edi], eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x22c], 0
push eax
mov dword [esi], 0x40e6e0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x10]
call sub.MFC42u.DLL_CString::CString_1
lea edx, [esp + 0xc]
push str.Setupmsback1
lea eax, [esp + 0x14]
push edx
push eax
mov byte [esp + 0x234], 1
call sub.MFC42u.DLL_operator
push eax
mov ecx, ebp
mov byte [esp + 0x22c], 2
call sub.MFC42u.DLL_CString::operator_2
lea ecx, [esp + 0x10]
mov byte [esp + 0x228], 1
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0xc]
mov byte [esp + 0x228], 0
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x220]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x220
ret
Function at 0x409c50
Capabilities:
Create process on windows
Delete file
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x40c5c6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x6d8
push ebx
push edi
lea ecx, [esp + 0xc]
call fcn.00409f2c
xor ebx, ebx
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x66]
mov word [esp + 0x64], bx
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x68]
mov dword [esp + 0x6ec], ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea ecx, [esp + 8]
call fcn.00409f2c
lea ecx, [esp + 0x64]
lea edx, [esp + 8]
push ecx
push str._smsresUpdateClientUpdateC.exe
push edx
mov byte [esp + 0x6f4], 1
call sub.MFC42u.DLL_CString::Format
mov ecx, dword [esp + 0x14]
add esp, 0xc
lea eax, [esp + 0x4c4]
push eax
push ecx
call sub.MFC42u.DLL_CFile::GetStatus
test eax, eax
jne 0x409cf0
mov edx, dword [esp + 8]
push edx
push str.CheckHaveUpdateC___2018.5.30____
jmp 0x409ddb
mov eax, dword [esp + 8]
push esi
push eax
push str.CheckHaveUpdateC___2018.5.30_____
call fcn.00401770
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x2c]
add esp, 8
rep stosd dword es:[edi], eax
xor ecx, ecx
lea edi, [esp + 0x270]
mov dword [esp + 0x14], ecx
lea edx, [esp + 0x270]
mov dword [esp + 0x18], ecx
push 0x12c
mov dword [esp + 0x20], ecx
push edx
mov dword [esp + 0x28], ecx
mov ecx, 0x4b
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x2c], 0x44
push eax
mov word [esp + 0x60], bx
mov dword [esp + 0x5c], 1
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
lea ecx, [esp + 0x14]
lea edx, [esp + 0x24]
push ecx
push edx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [esp + 0x290]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea ecx, [esp + 0x270]
push eax
push ecx
push esi
push str.CheckHaveUpdateC___Begin___bRet:_d__szUpdateExe:_s__pid:_d
call fcn.00401770
mov edx, dword [esp + 0x24]
add esp, 0x10
push 0x927c0
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, ebx
pop esi
jne 0x409dd5
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.CheckHaveUpdateC___End__
call fcn.00401770
mov eax, dword [esp + 0xc]
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x409de3
push eax
push 0x415a30
call fcn.00401770
add esp, 8
lea ecx, [esp + 8]
mov byte [esp + 0x6e8], bl
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0xc]
mov dword [esp + 0x6e8], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x6e0]
pop edi
pop ebx
mov dword fs:[0], ecx
add esp, 0x6e4
ret
Function at 0x40a8c0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x40c616
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x278
lea ecx, [esp]
call fcn.00409f2c
lea eax, [esp + 4]
mov dword [esp + 0x280], 0
push eax
call fcn.0040aa30
mov ecx, dword [esp + 0x28c]
mov edx, dword [eax]
push ecx
push edx
lea eax, [esp + 0xc]
push str._s_s
push eax
mov byte [esp + 0x294], 1
call sub.MFC42u.DLL_CString::Format
add esp, 0x14
lea ecx, [esp + 4]
mov byte [esp + 0x280], 0
call sub.MFC42u.DLL_CString::CString
mov eax, dword [esp + 0x28c]
test eax, eax
je 0x40a944
push eax
lea ecx, [esp + 4]
call fcn.0040a0ca
mov edx, dword [esp]
lea ecx, [esp + 0x5c]
push ecx
push edx
call sub.MFC42u.DLL_CFile::GetStatus
test eax, eax
je 0x40a9b6
push edi
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x1c]
rep stosd dword es:[edi], eax
lea eax, [esp + 0xc]
lea ecx, [esp + 0x1c]
mov edx, dword [esp + 4]
push eax
push ecx
push 0
push 0
push 0x20
push 0
push 0
push 0
push 0
push edx
mov dword [esp + 0x4c], str.winsta0default
mov dword [esp + 0x44], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
pop edi
jne 0x40a9e3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [esp + 4]
push eax
push str.CreateProcessOnDefault___
call fcn.0040b440
add esp, 0xc
lea ecx, [esp]
mov dword [esp + 0x280], 0xffffffff
call sub.MFC42u.DLL_CString::CString
xor al, al
mov ecx, dword [esp + 0x278]
mov dword fs:[0], ecx
add esp, 0x284
ret 8
mov ecx, dword [esp + 0xc]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [esp + 0xc]
push edx
call esi
lea ecx, [esp + 4]
mov dword [esp + 0x284], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x27c]
mov al, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x284
ret 8