joyce8/EMBER2024-capa huggingface dataset:
Function at 0x422bc0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push 0
mov dword [ebp - 8], edx
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x422bfd
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push edi
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
je 0x422c3c
test esi, esi
je 0x422c3c
push 0x4b1539
push esi
mov dword [ebp - 4], 0
call fcn.00480ea6
mov edi, eax
add esp, 8
test edi, edi
jne 0x422c4c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0040acb0
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push 0
push edi
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [ebp - 4]
push 0
push eax
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x422c70
cmp dword [ebp - 4], esi
je 0x422c7e
push edi
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete___void__]
add esp, 4
xor edi, edi
xor esi, esi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
mov dword [eax], edi
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x422ca0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4ad0cc]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x422cda
test al, 0x10
je 0x422cda
mov eax, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048079e
mov esp, ebp
pop ebp
ret
push esi
mov esi, edi
test edi, edi
jne 0x422cf3
pop esi
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048079e
mov esp, ebp
pop ebp
ret
push ebx
push 0x5c
push esi
call dword [sym.imp.MSVCR120.dll_wcschr]
mov esi, eax
add esp, 8
test esi, esi
je 0x422d94
cmp word [esi - 2], 0x3a
je 0x422d89
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x422d16
sub eax, edx
mov edx, esi
sar eax, 1
lea ebx, [edx + 2]
lea ebx, [ebx]
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x422d30
sub edx, ebx
sar edx, 1
sub eax, edx
cmp eax, 0x7ffffffe
jbe 0x422d53
xor eax, eax
mov word [ebp - 0x20c], ax
jmp 0x422d61
push eax
push edi
push ecx
lea ecx, [ebp - 0x20c]
call fcn.00422e80
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x422d89
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x422daa
add esi, 2
test esi, esi
jne 0x422cf4
pop ebx
pop esi
mov eax, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048079e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop ebx
pop esi
xor ecx, ebp
pop edi
call fcn.0048079e
mov esp, ebp
pop ebp
ret
Function at 0x422dc0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, ecx
mov dword [ebp - 8], edx
test esi, esi
je 0x422e69
cmp word [esi], 0
je 0x422e69
push edi
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x422e14
pop edi
mov eax, 0x80004005
pop esi
mov esp, ebp
pop ebp
ret 4
push 0
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push 0
push eax
push esi
push dword [ebp - 8]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x422e53
cmp dword [ebp - 4], esi
jne 0x422e53
push edi
xor esi, esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
push edi
mov esi, 0x80004005
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, 0x80070057
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x423e90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x487121
mov eax, dword fs:[0]
push eax
sub esp, 0x850
mov eax, dword [0x4ad0cc]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
mov ebx, dword [ebp + 8]
push 0
call fcn.00401f70
push 0
mov ecx, edi
call fcn.00401f70
push 0
mov ecx, ebx
call fcn.00401f70
mov ecx, 0x4b2294
call fcn.004034a0
test al, al
jne 0x4240ee
xorps xmm0, xmm0
mov dword [ebp - 0x81c], 0
movq qword [ebp - 0x824], xmm0
mov dword [ebp - 0x824], 0
mov dword [ebp - 0x820], 0
mov dword [ebp - 0x81c], 0
push ecx
mov ecx, 0x4b2294
mov dword [ebp - 4], 0
call fcn.00403480
push eax
push ecx
lea ecx, [ebp - 0x824]
call fcn.00422a00
test eax, eax
je 0x423f5a
mov eax, dword [ebp - 0x824]
test eax, eax
je 0x4240ee
push eax
jmp 0x4240e8
lea eax, [ebp - 0x818]
mov dword [ebp - 0x818], 0x400
push eax
lea eax, [ebp - 0x814]
push eax
push str.XProxyServer
lea ecx, [ebp - 0x824]
call fcn.00422a70
test eax, eax
jne 0x423f46
push 0xfde9
lea edx, [ebp - 0x814]
lea ecx, [ebp - 0x840]
call fcn.00425db0
add esp, 4
mov ecx, esi
push eax
call fcn.00410c50
lea ecx, [ebp - 0x840]
call fcn.00401e50
lea eax, [ebp - 0x818]
mov dword [ebp - 0x818], 0x400
push eax
lea eax, [ebp - 0x814]
push eax
push str.XProxyUserName
lea ecx, [ebp - 0x824]
call fcn.00422a70
mov esi, dword [ebp - 0x824]
test eax, eax
jne 0x4240e3
push 0xfde9
lea edx, [ebp - 0x814]
lea ecx, [ebp - 0x840]
call fcn.00425db0
add esp, 4
mov ecx, edi
push eax
call fcn.00410c50
lea ecx, [ebp - 0x840]
call fcn.00401e50
lea eax, [ebp - 0x818]
mov dword [ebp - 0x818], 0x800
push eax
lea eax, [ebp - 0x814]
push eax
lea eax, [ebp - 0x828]
push eax
push 0
push str.XProxyPassword
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4240e3
cmp dword [ebp - 0x828], 3
jne 0x4240e3
mov eax, dword [ebp - 0x818]
and eax, 0xfffffffe
cmp eax, 0x800
jae 0x42410a
xor ecx, ecx
push ecx
sub esp, 0x18
mov word [ebp + eax - 0x814], cx
mov ecx, esp
mov dword [ebp - 0x828], esp
push str.encrypt_B192E67D_8E42_4382_A359_E65945D1ED48
call fcn.00405950
sub esp, 0x18
mov byte [ebp - 4], 1
lea eax, [ebp - 0x814]
mov ecx, esp
push eax
call fcn.00405950
lea ecx, [ebp - 0x85c]
mov byte [ebp - 4], 0
call fcn.00458c00
add esp, 0x30
mov edx, eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x840]
call fcn.00425c30
add esp, 4
mov ecx, ebx
push eax
call fcn.00410c50
lea ecx, [ebp - 0x840]
call fcn.00401e50
lea ecx, [ebp - 0x85c]
call fcn.004033c0
test esi, esi
je 0x4240ee
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0048079e
mov esp, ebp
pop ebp
ret
call fcn.00480dca
int3
Function at 0x4248d0
Capabilities:
Create thread

Disassembly:
push ecx
push esi
push edi
mov esi, ecx
call fcn.00424940
push 0
push 0
push esi
push 0x423930
push 0
push 0
call dword [sym.imp.MSVCR120.dll__beginthreadex]
mov ecx, dword [esi + 0x54]
add esp, 0x18
mov edi, eax
test ecx, ecx
je 0x424901
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x54], edi
test edi, edi
jne 0x424932
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CHttpManager::Start_return_error:_u
push edi
push str.HttpManager.cpp
call fcn.00410720
add esp, 0x10
mov ecx, esi
call fcn.00424940
mov eax, 0x80004005
pop edi
pop esi
pop ecx
ret
pop edi
xor eax, eax
pop esi
pop ecx
ret
Function at 0x428c10
Capabilities:
Get proxy
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4878c8
mov eax, dword fs:[0]
push eax
sub esp, 0x840
mov eax, dword [0x4ad0cc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x83c]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionInternet_Settings
mov dword [ebp - 0x840], 0
push SysReAllocString
mov dword [ebp - 0x848], edi
mov dword [ebp - 0x83c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x428c8d
push 0x496e6d
mov ecx, edi
call fcn.00401e10
jmp 0x428e34
sub esp, 0x18
xorps xmm0, xmm0
mov esi, esp
movdqu xmmword [ebp - 0x838], xmm0
movdqu xmmword [ebp - 0x828], xmm0
mov dword [esi + 0x10], 0
push esi
push 0xc
mov dword [ebp - 4], 1
call fcn.004027f0
add esp, 8
test eax, eax
je 0x428cd3
lea ecx, [ebp - 0x83c]
mov dword [eax], vtable.._AV___Func_impl_U___Callable_obj_V_lambda_96dfe1787354200c493a3f9af176861c____0A__std__V__allocator_V___Func_class_X___V_std___2_X___V_std__.0
mov dword [eax + 4], ecx
jmp 0x428cd5
xor eax, eax
lea ecx, [ebp - 0x838]
mov dword [esi + 0x10], eax
mov byte [ebp - 4], 0
call fcn.004262c0
lea eax, [ebp - 0x814]
mov dword [ebp - 4], 2
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push eax
lea eax, [ebp - 0x810]
mov dword [ebp - 0x818], 0
push eax
lea eax, [ebp - 0x818]
mov dword [ebp - 0x814], 0x7fe
push eax
push 0
push str.ProxyEnable
push dword [ebp - 0x83c]
call esi
test eax, eax
jne 0x428e0f
cmp dword [ebp - 0x814], 4
jne 0x428e0f
cmp dword [ebp - 0x818], 4
jne 0x428e0f
cmp dword [ebp - 0x810], eax
je 0x428e0f
lea eax, [ebp - 0x814]
mov dword [ebp - 0x814], 0x7fe
push eax
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x818]
push eax
push 0
push str.ProxyServer
push dword [ebp - 0x83c]
call esi
test eax, eax
jne 0x428e0f
mov eax, dword [ebp - 0x814]
cmp eax, 0x800
jae 0x428e0a
cmp dword [ebp + 0xc], 0
mov byte [ebp + eax - 0x810], 0
lea eax, [ebp - 0x810]
je 0x428dc8
push str.https
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
mov esi, eax
test esi, esi
je 0x428e01
add esi, 5
jmp 0x428ddd
push str.http
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
mov esi, eax
test esi, esi
je 0x428e01
add esi, 4
test esi, esi
je 0x428e01
mov al, byte [esi]
cmp al, 0x20
je 0x428deb
cmp al, 0x3d
jne 0x428dee
inc esi
jmp 0x428de1
push 0x3b
push esi
call dword [sym.imp.SHLWAPI.dll_StrChrA]
test eax, eax
je 0x428dfe
mov byte [eax], 0
push esi
jmp 0x428e14
lea eax, [ebp - 0x810]
push eax
jmp 0x428e14
call fcn.00480dca
push 0x496e6d
mov ecx, edi
call fcn.00401e10
lea ecx, [ebp - 0x838]
mov dword [ebp - 0x840], 1
mov byte [ebp - 4], 0
call fcn.00426220
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048079e
mov esp, ebp
pop ebp
ret 8
Function at 0x429d20
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4879e3
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x4ad0cc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x18], esi
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0xd]
push eax
mov ecx, ebx
call fcn.00402130
lea eax, [ebp + 0xb]
mov ecx, esi
push eax
call fcn.00402110
push 0
push 0
mov ecx, esi
call fcn.00402060
push 0xffffffffffffffff
push 0
push ebx
mov ecx, esi
call fcn.00401e90
lea eax, [ebp - 0xe]
mov dword [ebp - 4], 0
lea edi, [ebx + 0x18]
add esi, 0x18
push eax
mov ecx, edi
call fcn.00402130
lea eax, [ebp - 0xf]
mov ecx, esi
push eax
call fcn.00402110
push 0
push 0
mov ecx, esi
call fcn.00402060
push 0xffffffffffffffff
push 0
push edi
mov ecx, esi
call fcn.00401e90
lea edi, [ebx + 0x30]
mov byte [ebp - 4], 1
mov ebx, dword [ebp - 0x18]
lea eax, [ebp - 0x10]
push eax
mov ecx, edi
call fcn.00402130
lea eax, [ebp - 0x11]
push eax
lea ecx, [ebx + 0x30]
call fcn.00402110
push 0
push 0
lea ecx, [ebx + 0x30]
call fcn.00402060
push 0xffffffffffffffff
push 0
push edi
lea ecx, [ebx + 0x30]
call fcn.00401e90
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x42bee0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x487c44
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x4ad0cc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x54], ebx
lea ecx, [ebx + 0x64]
call fcn.00403480
push eax
push str.ReadReportFile_report_file__s
push 0
push str.Report.cpp
call fcn.00410970
add esp, 0x10
lea ecx, [ebx + 0x64]
call fcn.00403480
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x42bf5c
push str.ReadReportFile_report_file_not_exsted
push 0
push str.Report.cpp
call fcn.00410970
add esp, 0xc
xor eax, eax
jmp 0x42c0a1
lea ecx, [ebx + 0x64]
mov dword [ebp - 0x44], 0
call fcn.00403480
lea edx, [ebp - 0x44]
mov ecx, eax
call fcn.00422bc0
mov esi, dword [ebp - 0x44]
mov edi, eax
test esi, esi
je 0x42c09c
cmp byte [esi], 0
je 0x42c09c
test edi, edi
jle 0x42c09c
lea ecx, [ebp - 0x28]
call fcn.00405890
lea eax, [ebx + 0x1c]
mov dword [ebp - 4], 0
push eax
lea eax, [ebx + 4]
mov edx, edi
push eax
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
call fcn.0041a6b0
add esp, 0xc
test eax, eax
je 0x42c094
push 0xfde9
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x40]
call fcn.00418820
add esp, 4
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 1
call fcn.00403480
push eax
push str.ReadReportFile_report_file_strDataW:_s
push 0
push str.Report.cpp
call fcn.00410970
add esp, 0x10
lea ecx, [ebp - 0x50]
call fcn.00412340
mov dword [ebp - 0x50], vtable.CReportData.0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x4c]
push eax
call fcn.004169d0
test al, al
je 0x42c070
lea ecx, [ebp - 0x50]
call fcn.00413420
mov edi, eax
xor esi, esi
test edi, edi
jle 0x42c084
mov ebx, dword [sym.imp.MSVCR120.dll_void____cdecl_operator_new_unsigned_int_]
nop
push 0xc
call ebx
add esp, 4
mov dword [ebp - 0x44], eax
mov byte [ebp - 4], 3
test eax, eax
je 0x42c04e
push esi
push eax
lea ecx, [ebp - 0x50]
call fcn.00413230
jmp 0x42c050
xor eax, eax
mov ecx, dword [ebp - 0x54]
mov byte [ebp - 4], 2
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x44]
push eax
lea ecx, [ecx + 0x84]
call fcn.0042d050
inc esi
cmp esi, edi
jl 0x42c030
jmp 0x42c084
push str.ReadReportFile_parse_json_failed
push 0
push str.Report.cpp
call fcn.00410970
add esp, 0xc
lea ecx, [ebp - 0x50]
call fcn.00412450
lea ecx, [ebp - 0x40]
call fcn.004033c0
lea ecx, [ebp - 0x28]
call fcn.00401e50
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048079e
mov esp, ebp
pop ebp
ret
Function at 0x42d930
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x487f5d
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x4ad0cc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x220], esi
mov dword [ebp - 0x21c], 0
call fcn.00403390
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push 0
push eax
mov dword [ebp - 0x21c], 1
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [ebp - 0x218]
push 1
push 0x23
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x42da1e
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x238]
call fcn.00405950
push eax
mov ecx, esi
mov dword [ebp - 4], 1
call fcn.00406160
lea ecx, [ebp - 0x238]
mov byte [ebp - 4], 0
call fcn.004033c0
push 0x496c7c
mov ecx, esi
call fcn.004087b0
push 0x4984e4
mov ecx, esi
call fcn.004087b0
push str.Common
mov ecx, esi
call fcn.004087b0
mov ecx, esi
call fcn.0042d4f0
test al, al
jne 0x42da1e
mov ecx, esi
call fcn.0042d610
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048079e
mov esp, ebp
pop ebp
ret

Function at 0x42da40
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x487f5d
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x4ad0cc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x220], esi
mov dword [ebp - 0x21c], 0
call fcn.00403390
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push 0
push eax
mov dword [ebp - 0x21c], 1
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [ebp - 0x218]
push 1
push 0x23
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x42db2e
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x238]
call fcn.00405950
push eax
mov ecx, esi
mov dword [ebp - 4], 1
call fcn.00406160
lea ecx, [ebp - 0x238]
mov byte [ebp - 4], 0
call fcn.004033c0
push 0x496c7c
mov ecx, esi
call fcn.004087b0
push 0x4984e4
mov ecx, esi
call fcn.004087b0
push str._bugreport
mov ecx, esi
call fcn.004087b0
mov ecx, esi
call fcn.0042d4f0
test al, al
jne 0x42db2e
mov ecx, esi
call fcn.0042d610
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048079e
mov esp, ebp
pop ebp
ret
Function at 0x42dc80
Capabilities:
Access peb ldr_data
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x487fa0
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x4ad0cc]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
mov eax, dword [0x4ad0cc]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
lea ecx, [esp + 8]
call fcn.0042d930
lea ecx, [esp + 0x20]
mov dword [esp + 0x48], 0
call fcn.0042b9d0
push 0x496c7c
lea ecx, [esp + 0xc]
mov byte [esp + 0x4c], 1
call fcn.004059e0
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0xc]
call fcn.00406950
push 0x498684
lea ecx, [esp + 0xc]
call fcn.004059e0
lea ecx, [esp + 8]
call fcn.00403480
push eax
push str.IsCheckProxyByFile_path:__s
push 0
push str.Wisdom_pub.cpp
call fcn.00410970
add esp, 0x10
lea ecx, [esp + 8]
call fcn.00403480
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ebx, ebx
cmp eax, 0xffffffff
setne bl
push ebx
push str.IsFileExist_path:__d
push 0
push str.Wisdom_pub.cpp
call fcn.00410970
add esp, 0x10
lea ecx, [esp + 0x20]
call fcn.004033c0
lea ecx, [esp + 8]
call fcn.004033c0
xor eax, eax
test ebx, ebx
sete al
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.0048079e
mov esp, ebp
pop ebp
ret
Function at 0x42e6d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4882d3
mov eax, dword fs:[0]
push eax
sub esp, 0x84
mov eax, dword [0x4ad0cc]
xor eax, esp
mov dword [esp + 0x7c], eax
push esi
push edi
mov eax, dword [0x4ad0cc]
xor eax, esp
push eax
lea eax, [esp + 0x90]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
test edi, edi
je 0x42e8fd
lea ecx, [esp + 0x58]
call fcn.00417f10
push 0x4984e4
lea ecx, [esp + 0x5c]
mov dword [esp + 0x9c], 0
call fcn.004087b0
lea edx, [esp + 0x58]
lea ecx, [esp + 0x10]
call fcn.00417c40
push eax
lea ecx, [esp + 0x5c]
call fcn.0040f770
lea ecx, [esp + 0x10]
call fcn.004033c0
lea ecx, [esp + 0x58]
call fcn.00403480
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x42e773
test al, 0x10
jne 0x42e783
lea ecx, [esp + 0x58]
call fcn.00403480
mov ecx, eax
call fcn.00422ca0
push str.report.db
lea eax, [esp + 0x5c]
push eax
lea eax, [esp + 0x78]
push eax
call fcn.00408510
add esp, 0xc
lea eax, [esp + 0xf]
mov byte [esp + 0x98], 1
push eax
mov ecx, esi
call fcn.00402130
lea eax, [esp + 0xe]
push eax
lea ecx, [esp + 0x44]
call fcn.00402110
push 0
push 0
lea ecx, [esp + 0x48]
call fcn.00402060
push 0xffffffffffffffff
push 0
push esi
lea ecx, [esp + 0x4c]
call fcn.00401e90
lea ecx, [esp + 0x40]
mov byte [esp + 0x98], 2
call fcn.004034a0
test al, al
je 0x42e86b
push str.api.win_12.com:8008_v1_report
lea ecx, [esp + 0x2c]
call fcn.00401e10
lea edx, [esp + 0x28]
mov byte [esp + 0x98], 3
lea ecx, [esp + 0x10]
call fcn.0042e500
mov esi, eax
lea eax, [esp + 0x40]
cmp eax, esi
je 0x42e851
push 0
push 1
mov ecx, eax
call fcn.00402060
lea eax, [esp + 0xc]
mov ecx, esi
push eax
call fcn.00402130
lea eax, [esp + 0xd]
push eax
lea ecx, [esp + 0x44]
call fcn.00402130
push esi
call fcn.004026b0
add esp, 4
lea ecx, [esp + 0x40]
push eax
call fcn.00406060
lea ecx, [esp + 0x10]
call fcn.00401e50
lea ecx, [esp + 0x28]
mov byte [esp + 0x98], 2
call fcn.00401e50
lea ecx, [esp + 0x40]
call fcn.00405910
push eax
push str.InitReport_strUrlInit:_s
push 0
push str.Wisdom_pub.cpp
call fcn.00410720
add esp, 0x10
lea ecx, [esp + 0x10]
push str.WISDOM2023787878
call fcn.00401e10
push str.Wisdom_Aes_20230
lea ecx, [esp + 0x2c]
mov byte [esp + 0x9c], 4
call fcn.00401e10
lea eax, [esp + 0x10]
mov byte [esp + 0x98], 5
push eax
lea eax, [esp + 0x2c]
mov ecx, edi
push eax
lea eax, [esp + 0x78]
push eax
lea eax, [esp + 0x4c]
push eax
call fcn.0042bc30
lea ecx, [esp + 0x28]
call fcn.00401e50
lea ecx, [esp + 0x10]
call fcn.00401e50
lea ecx, [esp + 0x40]
call fcn.00401e50
lea ecx, [esp + 0x70]
call fcn.004033c0
lea ecx, [esp + 0x58]
call fcn.004033c0
mov ecx, dword [esp + 0x90]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x7c]
xor ecx, esp
call fcn.0048079e
mov esp, ebp
pop ebp
ret
Function at 0x430ac0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4887a0
mov eax, dword fs:[0]
push eax
sub esp, 0x70
mov eax, dword [0x4ad0cc]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp + 0x10]
push 0x4b25b4
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x3c], vtable.Base::lock::scoped_lock_class_Base::lock::critical_section_.0
mov dword [ebp - 0x38], 0x4b25b0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor dl, dl
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x54]
xor bl, bl
call fcn.00430ca0
push 0
push 0
push 2
push 0
push 0
push 0x40000000
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 1
call fcn.00403480
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push eax
call esi
mov edi, eax
cmp edi, 0xffffffff
jne 0x430b8b
mov dl, 1
lea ecx, [ebp - 0x6c]
call fcn.00430ca0
push 0
push 0
push 2
push 0
push 0
push 0x40000000
lea ecx, [ebp - 0x6c]
call fcn.00403480
push eax
call esi
lea ecx, [ebp - 0x6c]
mov edi, eax
call fcn.004033c0
cmp edi, 0xffffffff
je 0x430c61
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [ebp - 0x38]
push 0
push eax
push 4
push 0x498eb4
push edi
call esi
test eax, eax
je 0x430c5a
cmp dword [ebp - 0x38], 4
jne 0x430c5a
push 0
lea eax, [ebp - 0x38]
push eax
push 0x10
push dword [ebp - 0x78]
push edi
call esi
test eax, eax
je 0x430c5a
cmp dword [ebp - 0x38], 0x10
jne 0x430c5a
mov eax, dword [ebp - 0x74]
lea ecx, [ebp - 0x24]
xorps xmm0, xmm0
push ecx
mov ecx, eax
mov esi, dword [eax + 0x10]
movdqu xmmword [ebp - 0x24], xmm0
call fcn.00405910
mov edx, esi
mov ecx, eax
call fcn.0042fd00
push 0
lea eax, [ebp - 0x38]
push eax
push 0x10
lea eax, [ebp - 0x24]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x430c5a
cmp dword [ebp - 0x38], 0x10
jne 0x430c5a
mov eax, dword [ebp - 0x70]
lea ecx, [ebp - 0x34]
xorps xmm0, xmm0
push ecx
mov ecx, eax
mov esi, dword [eax + 0x10]
movdqu xmmword [ebp - 0x34], xmm0
call fcn.00405910
mov edx, esi
mov ecx, eax
call fcn.0042fd00
push 0
lea eax, [ebp - 0x38]
push eax
push 0x10
lea eax, [ebp - 0x34]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x430c5a
cmp dword [ebp - 0x38], 0x10
mov eax, 1
movzx ebx, bl
cmove ebx, eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x54]
call fcn.004033c0
push 0x4b25b4
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0048079e
mov esp, ebp
pop ebp
ret 0xc