joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10042ff7
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1004305a
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax], 2
jmp 0x10043027
mov eax, dword [ebp - 8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jl 0x10043058
mov dword [ebp - 4], 0
mov dword [ebp - 4], 2
jmp 0x10043046
mov eax, dword [ebp - 4]
dec eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jl 0x10043056
cmp dword [ebp - 4], 0
je 0x10043054
jmp 0x10043056
jmp 0x1004303f
jmp 0x1004301c
jmp 0x1004307a
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x1004307a
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov esp, ebp
pop ebp
ret

Function at 0x100432b3
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x100432ea
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x10]
add eax, dword [ecx]
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
jmp 0x1004330d
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x1004330d
push 0x976
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov esp, ebp
pop ebp
ret

Function at 0x10043445
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1004348c
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x14]
add eax, dword [ecx]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ecx]
mov byte [ecx + eax], 0
jmp 0x100434a6
push 0x1057
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov esp, ebp
pop ebp
ret
Function at 0x1005ffb0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
call fcn.10060030
movzx eax, al
test eax, eax
je 0x1005ffe1
push 0x1000191c
push 0x10674570
call fcn.1004ab90
add esp, 8
push 0
call fcn.1006c173
mov ecx, dword [ebp - 4]
call fcn.100602d0
mov ecx, dword [eax]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 4]
call fcn.10060100
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x1007fff9
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10088330]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.1006e72a
mov dword [ebp - 0x14], eax
cmp dword [0x106755d0], esi
jne 0x100800ec
push 0x800
push esi
push 0x10007ebc
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x10080079
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x100801cc
push esi
push esi
push 0x10007ebc
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x100801cc
push 0x10007ed4
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100801cc
push eax
call ebx
push 0x10007ee0
push edi
mov dword [0x106755d0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007ef0
push edi
mov dword [0x106755d4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007f04
push edi
mov dword [0x106755d8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x106755e0], eax
test eax, eax
je 0x100800e9
push 0x10007f20
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x106755dc], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x10080111
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x10080104
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x10080126
push 4
pop eax
jmp 0x100801ce
cmp dword [ebp - 0x14], esi
je 0x10080126
push dword [0x106755d0]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x1008010b
mov eax, dword [0x106755dc]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x10080184
cmp dword [0x106755e0], edi
je 0x10080184
push eax
call ebx
push dword [0x106755e0]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x10080184
test eax, eax
je 0x10080184
call ecx
test eax, eax
je 0x10080179
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x10080179
test byte [ebp - 8], 1
jne 0x10080184
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x100801b4
mov eax, dword [0x106755d4]
cmp eax, edi
je 0x100801b1
push eax
call ebx
test eax, eax
je 0x100801b1
call eax
mov esi, eax
test esi, esi
je 0x100801b1
mov eax, dword [0x106755d8]
cmp eax, edi
je 0x100801b1
push eax
call ebx
test eax, eax
je 0x100801b1
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x106755d0]
call ebx
test eax, eax
je 0x100801cc
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x100801ce
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1006a3ee
mov esp, ebp
pop ebp
ret
Function at 0x4064f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x4e5728]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x406577
test ebx, ebx
je 0x406577
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x406577
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x406577
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 0x40
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x406571
push esi
push ebx
push edi
call fcn.00472400
add esp, 0xc
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x406571
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00467bb3
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00467bb3
mov esp, ebp
pop ebp
ret

Function at 0x406590
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4065e9
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4065e9
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x4065da
cmp esi, edx
jae 0x4065e9
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x4065c8
cmp esi, edx
jae 0x4065e9
cmp word [esi], 0
je 0x4065e9
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret
Function at 0x409270
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4af0a8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x4e5728]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.004678bf
mov edi, eax
add esp, 4
test edi, edi
je 0x409313
xorps xmm0, xmm0
movq qword [edi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.004324de
add esp, 4
mov dword [edi + 4], eax
jmp 0x409315
xor edi, edi
mov eax, dword [ebp + 8]
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 0
mov ecx, dword [edi + 4]
mov dword [ebp - 4], 1
mov dword [ebp - 0x10], ecx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 2
push eax
call fcn.00403510
add esp, 4
mov ecx, eax
mov edx, dword [eax]
push 0x20
call dword [edx + 0x30]
movzx edi, ax
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 4], 3
test ecx, ecx
je 0x409375
mov eax, dword [ecx]
call dword [eax + 8]
test eax, eax
je 0x409375
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [esi + 0x38], 0
mov dword [ebp - 4], 0xffffffff
mov word [esi + 0x40], di
jne 0x409399
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
and eax, 0x13
or eax, 4
mov dword [esi + 0xc], eax
and ecx, eax
jne 0x4093bb
cmp byte [ebp + 0xc], 0
je 0x4093a8
push esi
call fcn.00432a05
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
test cl, 4
je 0x4093c7
mov esi, str.ios_base::badbit_set
jmp 0x4093d7
test cl, 2
mov esi, str.ios_base::failbit_set
mov eax, str.ios_base::eofbit_set
cmove esi, eax
lea eax, [ebp - 0x1c]
push 1
push eax
call fcn.00409400
add esp, 8
lea ecx, [ebp - 0x30]
push eax
push esi
call fcn.004041b0
push 0x4d6468
lea eax, [ebp - 0x30]
push eax
call fcn.00471fdf
int3
Function at 0x40bd20
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x1c], 8
push ebx
mov ebx, dword [eax + 0x18]
push esi
lea esi, [eax + 8]
mov dword [ebp - 4], ecx
push edi
jb 0x40bd43
mov esi, dword [esi]
xor edx, edx
mov edi, 0x811c9dc5
add ebx, ebx
je 0x40bd61
nop
movzx ecx, byte [edx + esi]
inc edx
xor ecx, edi
imul edi, ecx, 0x1000193
cmp edx, ebx
jb 0x40bd50
mov ebx, dword [ebp - 4]
mov ecx, dword [ebx + 0x18]
mov edx, dword [ebx + 0xc]
and ecx, edi
lea esi, [ecx*8]
mov ecx, dword [edx + esi]
add edx, esi
cmp dword [edx + 4], eax
jne 0x40bd9a
cmp ecx, eax
jne 0x40bd92
mov ecx, dword [ebx + 4]
mov dword [edx], ecx
mov edx, dword [ebx + 0xc]
mov ecx, dword [ebx + 4]
mov dword [esi + edx + 4], ecx
jmp 0x40bda2
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
jmp 0x40bda2
cmp ecx, eax
jne 0x40bda2
mov ecx, dword [eax]
mov dword [edx], ecx
mov edx, dword [eax + 4]
lea ecx, [ebx + 4]
mov edi, dword [eax]
push eax
mov dword [edx], edi
mov esi, dword [eax]
mov edx, dword [eax + 4]
mov dword [esi + 4], edx
dec dword [ecx + 4]
call fcn.0041a2b0
mov eax, dword [ebp - 8]
mov dword [eax], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x40da80
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4af538
mov eax, dword fs:[0]
push eax
sub esp, 0x244
mov eax, dword [0x4e5728]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x238], esi
mov dword [ebp - 0x234], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x250]
push 3
push eax
mov dword [ebp - 0x234], 1
call fcn.0040f1d0
add esp, 8
push 0xe
push str.debug_url.set
mov ecx, eax
mov dword [ebp - 4], 1
call fcn.00408120
mov dword [ebp - 0x220], 0
xor ecx, ecx
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x234], 3
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x230], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x220], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov edx, dword [ebp - 0x23c]
mov byte [ebp - 4], 3
cmp edx, 8
jb 0x40db91
mov ecx, dword [ebp - 0x250]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40db87
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40dc9a
push edx
push ecx
call fcn.004678ef
add esp, 8
xor eax, eax
mov dword [ebp - 0x240], 0
cmp dword [ebp - 0x21c], 8
mov word [ebp - 0x250], ax
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
mov dword [ebp - 0x23c], 7
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40dc40
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00472f00
add esp, 0xc
lea eax, [ebp - 0x230]
cmp dword [ebp - 0x21c], 8
cmovae eax, dword [ebp - 0x230]
push eax
push 0x104
lea eax, [ebp - 0x218]
push eax
push 0x4ba76c
push str.test_url
push str.DebugUrl
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40dc22
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.004083b0
mov edx, dword [ebp - 0x21c]
cmp edx, 8
jb 0x40dc7c
mov ecx, dword [ebp - 0x230]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40dc72
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40dc9f
push edx
push ecx
call fcn.004678ef
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00467bb3
mov esp, ebp
pop ebp
ret 4
call fcn.00476379
call fcn.00476379
int3
Function at 0x41dd10
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b1158
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
mov eax, dword [0x4e5728]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 0x10], esi
call fcn.004208c0
add esp, 4
push 0xd
push str.multi_wechat
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.00408120
push eax
mov ecx, esi
call fcn.0040bdd0
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x41dd9b
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41dd91
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41ddc2
push edx
push ecx
call fcn.004678ef
add esp, 8
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x41dda5
mov eax, dword [esi]
push 0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
call fcn.00476379
int3
Function at 0x41e450
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c8
mov eax, dword [0x4e5728]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x4bc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
push 0x3e8
push 0
push eax
mov dword [ebp - 0x4c4], esi
mov dword [ebp - 0x4c0], ebx
call fcn.00472f00
push 0xc8
lea eax, [ebp - 0xd4]
push 0
push eax
call fcn.00472f00
add esp, 0x18
test esi, esi
je 0x41e550
test ebx, ebx
je 0x41e550
lea eax, [ebp - 0x4bc]
push eax
push 0x1f4
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x41e550
mov ax, word [ebp - 0x4bc]
xor esi, esi
test ax, ax
je 0x41e550
xor ecx, ecx
movzx edx, ax
mov ax, word [ebp + ecx - 0x4ba]
mov word [ebp - 0xa], ax
xor eax, eax
mov word [ebp - 8], ax
lea eax, [ebp - 0xd4]
push 0x64
push eax
lea eax, [ebp - 0xc]
mov word [ebp - 0xc], dx
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x41e53b
lea eax, [ebp - 0xd4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
mov dword [ebp - 0x4c8], eax
lea eax, [ebp - 0xd4]
push eax
push dword [ebp - 0x4c4]
call fcn.0047952e
add esp, 0xc
test eax, eax
je 0x41e563
add esi, 4
lea ecx, [esi + esi]
movzx eax, word [ebp + ecx - 0x4bc]
mov edx, eax
test ax, ax
jne 0x41e4e1
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00467bb3
mov esp, ebp
pop ebp
ret
test edi, edi
je 0x41e5b9
cmp edi, 0x7fffffff
ja 0x41e5b0
mov ecx, ebx
mov esi, 0x7ffffffe
lea ebx, [ebp - 0xc]
sub esi, edi
mov edx, edi
sub ebx, ecx
nop
lea eax, [esi + edx]
test eax, eax
je 0x41e59b
movzx eax, word [ebx + ecx]
test ax, ax
je 0x41e59b
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x41e580
mov ebx, dword [ebp - 0x4c0]
lea eax, [ecx - 2]
test edx, edx
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
jmp 0x41e5b9
test edi, edi
je 0x41e5b9
xor eax, eax
mov word [ebx], ax
xor ecx, ecx
test edi, edi
je 0x41e5c7
cmp edi, 0x7fffffff
jbe 0x41e5cc
mov ecx, 0x80070057
test ecx, ecx
js 0x41e5fe
mov esi, edi
mov eax, ebx
test edi, edi
je 0x41e5e6
cmp word [eax], 0
je 0x41e5e6
add eax, 2
sub esi, 1
jne 0x41e5d8
xor eax, eax
mov ecx, 0x80070057
test esi, esi
cmovne ecx, eax
mov eax, edi
sub eax, esi
neg esi
sbb esi, esi
and esi, eax
jmp 0x41e600
xor esi, esi
test ecx, ecx
js 0x41e656
mov edx, edi
lea ecx, [ebx + esi*2]
sub edx, esi
je 0x41e649
mov eax, edx
sub eax, edi
mov edi, dword [ebp - 0x4c4]
add eax, 0x7ffffffe
add esi, eax
mov eax, dword [ebp - 0x4c8]
add eax, eax
sub eax, ecx
add edi, eax
nop word [eax + eax]
test esi, esi
je 0x41e649
movzx eax, word [edi + ecx]
test ax, ax
je 0x41e649
mov word [ecx], ax
dec esi
add ecx, 2
sub edx, 1
jne 0x41e630
test edx, edx
lea eax, [ecx - 2]
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00467bb3
mov esp, ebp
pop ebp
ret
Function at 0x41e670
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b1219
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x4e5728]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 0x4bdc44
mov dword [ebp - 0x18], 1
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
js 0x41e71f
mov edx, dword [ebp - 0x14]
mov ecx, edx
lea edi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41e6f0
sub ecx, edi
sar ecx, 1
push ecx
push edx
mov ecx, esi
call fcn.004083b0
push 0xe
push str.WeChat_Files_
mov ecx, esi
call fcn.00408120
push dword [ebp - 0x14]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00467bb3
mov esp, ebp
pop ebp
ret
Function at 0x41f7a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b14ad
mov eax, dword fs:[0]
push eax
sub esp, 0x220
mov eax, dword [0x4e5728]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor edx, edx
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0x22c], esi
mov dword [ebp - 0x228], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], dx
xorps xmm0, xmm0
mov dword [ebp - 0x21c], edx
movq qword [ebp - 0x224], xmm0
mov dword [ebp - 0x228], 1
mov dword [ebp - 0x224], edx
mov dword [ebp - 0x220], edx
mov dword [ebp - 0x21c], edx
push dword [ebp + 0x18]
lea edx, [ebp - 0x224]
mov dword [ebp - 4], 1
push edx
push eax
push ecx
call fcn.0041ffd0
add esp, 0x10
test eax, eax
je 0x41f85c
mov eax, dword [ebp - 0x224]
test eax, eax
je 0x41f919
push eax
jmp 0x41f913
push 0x200
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.00472f00
add esp, 0xc
cmp dword [edi + 0x14], 8
jb 0x41f87a
mov edi, dword [edi]
lea eax, [ebp - 0x218]
mov dword [ebp - 0x218], 0x200
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push edi
mov edi, dword [ebp - 0x224]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41f90e
mov eax, dword [ebp - 0x214]
cmp eax, 1
je 0x41f8bd
cmp eax, 2
jne 0x41f90e
mov eax, dword [ebp - 0x218]
test eax, eax
je 0x41f8da
test al, 1
jne 0x41f90e
shr eax, 1
cmp word [ebp + eax*2 - 0x212], 0
je 0x41f8e3
jmp 0x41f90e
xor eax, eax
mov word [ebp - 0x210], ax
lea ecx, [ebp - 0x210]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41f8f0
sub ecx, edx
lea eax, [ebp - 0x210]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.004083b0
test edi, edi
je 0x41f919
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00467bb3
mov esp, ebp
pop ebp
ret
Function at 0x41f940
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b14f0
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push esi
mov eax, dword [0x4e5728]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x40]
push eax
mov dword [ebp - 0x28], esi
call fcn.004208c0
add esp, 4
push 0xd
push str.multi_wechat
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.00408120
push eax
lea ecx, [ebp - 0x24]
call fcn.0040bdd0
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
cmp edx, 8
jb 0x41f9d7
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41f9cd
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41fa7c
push edx
push ecx
call fcn.004678ef
add esp, 8
xor eax, eax
mov dword [ebp - 0x30], 0
cmp dword [ebp - 0x10], 8
mov word [ebp - 0x40], ax
lea eax, [ebp - 0x24]
cmovae eax, dword [ebp - 0x24]
push 0
push eax
push 0
mov dword [ebp - 0x2c], 7
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
push 5
push str.icon
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 1
call fcn.00408120
push eax
mov ecx, esi
call fcn.0040bdd0
mov edx, dword [ebp - 0x10]
cmp edx, 8
jb 0x41fa55
mov ecx, dword [ebp - 0x24]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41fa4b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41fa81
push edx
push ecx
call fcn.004678ef
add esp, 8
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x41fa5f
mov eax, dword [esi]
push 0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
call fcn.00476379
call fcn.00476379
int3