joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f0e50
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x539c6a
mov eax, dword fs:[0]
push eax
sub esp, 0x230
mov eax, dword [0x59a0a0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x230], edi
mov dword [ebp - 0x22c], edi
mov dword [ebp - 0x228], edi
push 0x208
lea eax, [ebp - 0x21c]
mov dword [ebp - 4], edi
push edi
push eax
call fcn.0049e130
add esp, 0xc
mov dword [ebp - 0x238], 0x56250c
lea eax, [ebp - 0x220]
mov dword [ebp - 0x234], 0x5624f4
mov dword [esi + 0x24], 0x67
mov dword [esi + 0x28], 0xcb
push eax
push 0x2001f
push edi
push 0x56246c
push reloc.WS2_32.dll_bind
mov dword [esi + 0x2c], 0x12f
mov dword [esi + 0x34], 0x193
mov dword [esi + 0x3c], 0x161
mov dword [esi + 0x30], 0x25b
mov dword [esi + 0x38], 0x1f7
mov dword [esi + 0x40], 0x387
mov dword [esi + 0xe0], 0x508e10
mov dword [esi + 0xe4], edi
mov dword [ebp - 0x220], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4f1084
mov ebx, dword [ebp - 0x220]
mov dword [ebp - 0x22c], eax
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x230], ebx
push eax
lea eax, [ebp - 0x224]
mov dword [ebp - 0x220], 0x208
push eax
push edi
push 0x56252c
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4f1079
mov eax, dword [ebp - 0x224]
cmp eax, 1
je 0x4f0f8e
cmp eax, 2
jne 0x4f1079
mov eax, dword [ebp - 0x220]
test eax, eax
je 0x4f0fb2
test al, 1
jne 0x4f1079
shr eax, 1
cmp word [ebp + eax*2 - 0x21e], 0
je 0x4f0fbb
jmp 0x4f1079
xor eax, eax
mov word [ebp - 0x21c], ax
push 2
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.00509e30
mov edi, eax
test edi, edi
je 0x4f1079
lea eax, [ebp - 0x220]
mov dword [ebp - 0x220], 0x208
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x224]
push eax
push 0
push 0x562570
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4f1079
mov eax, dword [ebp - 0x224]
cmp eax, 1
je 0x4f101b
cmp eax, 2
jne 0x4f1079
mov eax, dword [ebp - 0x220]
test eax, eax
je 0x4f1038
test al, 1
jne 0x4f1079
shr eax, 1
cmp word [ebp + eax*2 - 0x21e], 0
je 0x4f1041
jmp 0x4f1079
xor eax, eax
mov word [ebp - 0x21c], ax
lea edx, [ebp - 0x21c]
lea eax, [edx + 2]
lea ecx, [esi + 0x68]
mov dword [ebp - 0x224], eax
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x4f1053
sub edx, dword [ebp - 0x224]
lea eax, [ebp - 0x21c]
sar edx, 1
push edx
push eax
call fcn.00402d50
mov dword [esi], 1
test ebx, ebx
je 0x4f1084
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0049aa22
mov esp, ebp
pop ebp
ret 4
Function at 0x4f14d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp + 8]
push eax
lea ebx, [ecx + 0x424]
mov dword [ebp + 8], edi
lea eax, [ebp - 8]
mov ecx, ebx
push eax
mov esi, 1
call fcn.0042be10
mov eax, dword [ebp - 8]
push dword [eax + 0x60]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4f1583
lea eax, [ebp + 8]
mov dword [ebp + 8], edi
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 4], edi
push eax
mov ecx, ebx
call fcn.0042be10
lea eax, [ebp - 4]
mov ecx, ebx
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.0042be10
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x88]
test ecx, ecx
je 0x4f158e
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x68]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4f1577
test dx, dx
je 0x4f1563
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4f1577
add eax, 4
add ecx, 4
test dx, dx
jne 0x4f1541
xor eax, eax
xor ecx, ecx
test eax, eax
pop edi
cmove esi, ecx
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
sbb eax, eax
xor ecx, ecx
or eax, 1
test eax, eax
cmove esi, ecx
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.00401b40
int3
Function at 0x4f8660
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53a4c2
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x59a0a0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
call fcn.00401980
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x4f86b2
push 0x80004005
call fcn.00401b40
mov eax, dword [edx]
mov esi, dword [eax + 0xc]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x4f86c7
lock inc dword [edx + 0x14]
lea eax, [edx + 8]
jmp 0x4f86cb
mov ecx, edx
call esi
add eax, 0x10
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 1
mov eax, dword [0x59fb74]
cmp dword [eax - 0xc], 0
jne 0x4f86f1
push 0x1d
push 0x56e4d0
lea ecx, [ebp - 0x10]
call fcn.00402d50
jmp 0x4f8703
push eax
lea eax, [ebp - 0x10]
push 0x56e550
push eax
call fcn.004023f0
add esp, 0xc
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push dword [ebp - 0x10]
push reloc.WS2_32.dll_accept
call edi
test eax, eax
jne 0x4f873c
mov ebx, dword [ebp - 0x14]
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], eax
push 0xd
push str.InstallFlags
lea ecx, [ebp - 0x10]
call fcn.00402320
mov esi, dword [ebp - 0x10]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push 0
push 0xf003f
push 1
push 0
push 0
push esi
push reloc.WS2_32.dll_accept
call edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x4f87e9
xor eax, eax
test ebx, ebx
je 0x4f8785
push ebx
call edi
mov ebx, dword [ebp - 0x14]
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], 0
test eax, eax
jne 0x4f87e9
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea eax, [ebp - 0x14]
push 4
push eax
push 4
push 0
push 0x56e520
push ebx
mov dword [ebp - 0x14], 1
call edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 4
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 4
push 0
push 0x56e534
push ebx
call edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x4f87e2
push ebx
call edi
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], 0
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4f881e
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x4f881c
mov eax, dword [ecx + 4]
push 0
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x4f881e
call edx
test ebx, ebx
je 0x4f8825
push ebx
call edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4f9dc0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53a654
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x59a0a0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
xor edi, edi
mov dword [ebp - 0x228], eax
mov dword [ebp - 0x234], edi
mov dword [ebp - 0x230], ebx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 4], edi
call fcn.00401980
mov ecx, eax
xor eax, eax
test ecx, ecx
setne al
test eax, eax
jne 0x4f9e2c
push 0x80004005
call fcn.00401b40
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x4f9e41
lock inc dword [ecx + 0x14]
lea eax, [ecx + 8]
jmp 0x4f9e43
call edx
add eax, 0x10
mov dword [ebp - 0x220], eax
mov byte [ebp - 4], 1
mov eax, dword [0x59fb74]
cmp dword [eax - 0xc], 0
jne 0x4f9e6f
push 0x20
push 0x56e238
lea ecx, [ebp - 0x220]
call fcn.00402d50
jmp 0x4f9e84
push eax
lea eax, [ebp - 0x220]
push 0x56e310
push eax
call fcn.004023f0
add esp, 0xc
mov esi, dword [ebp - 0x220]
lea eax, [ebp - 0x21c]
push eax
push 0x2001f
push 0
push esi
push reloc.WS2_32.dll_bind
mov dword [ebp - 0x21c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4f9f77
mov edi, dword [ebp - 0x21c]
push 0x208
push eax
mov dword [ebp - 0x230], eax
lea eax, [ebp - 0x218]
push eax
mov dword [ebp - 0x234], edi
call fcn.0049e130
add esp, 0xc
mov dword [ebp - 0x21c], 0x208
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x224]
push eax
push 0
push 0x56e340
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4f9f77
mov eax, dword [ebp - 0x224]
cmp eax, 1
je 0x4f9f1e
cmp eax, 2
jne 0x4f9f77
mov eax, dword [ebp - 0x21c]
test eax, eax
je 0x4f9f3b
test al, 1
jne 0x4f9f77
shr eax, 1
cmp word [ebp + eax*2 - 0x21a], 0
je 0x4f9f44
jmp 0x4f9f77
xor eax, eax
mov word [ebp - 0x218], ax
lea edx, [ebp - 0x218]
lea ecx, [edx + 2]
nop dword [eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x4f9f50
sub edx, ecx
lea eax, [ebp - 0x218]
mov ecx, dword [ebp - 0x228]
sar edx, 1
push edx
push eax
call fcn.00402d50
mov ebx, 1
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4f9fac
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x4f9faa
mov eax, dword [ecx + 4]
push 0
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x4f9fac
call edx
test edi, edi
je 0x4f9fb7
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049aa22
mov esp, ebp
pop ebp
ret 4
Function at 0x4f9fe0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53a692
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x59a0a0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
xor edi, edi
mov dword [ebp - 0x228], eax
mov dword [ebp - 0x234], edi
mov dword [ebp - 0x230], ebx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 4], edi
call fcn.00401980
mov ecx, eax
xor eax, eax
test ecx, ecx
setne al
test eax, eax
jne 0x4fa04c
push 0x80004005
call fcn.00401b40
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x4fa061
lock inc dword [ecx + 0x14]
lea eax, [ecx + 8]
jmp 0x4fa063
call edx
add eax, 0x10
mov dword [ebp - 0x220], eax
mov byte [ebp - 4], 1
mov eax, dword [0x59fb74]
cmp dword [eax - 0xc], 0
jne 0x4fa08f
push 0x27
push 0x56e2a8
lea ecx, [ebp - 0x220]
call fcn.00402d50
jmp 0x4fa0a4
push eax
lea eax, [ebp - 0x220]
push 0x56e1fc
push eax
call fcn.004023f0
add esp, 0xc
mov esi, dword [ebp - 0x220]
lea eax, [ebp - 0x21c]
push eax
push 0x2001f
push 0
push esi
push reloc.WS2_32.dll_bind
mov dword [ebp - 0x21c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4fa197
mov edi, dword [ebp - 0x21c]
push 0x208
push eax
mov dword [ebp - 0x230], eax
lea eax, [ebp - 0x218]
push eax
mov dword [ebp - 0x234], edi
call fcn.0049e130
add esp, 0xc
mov dword [ebp - 0x21c], 0x208
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x224]
push eax
push 0
push 0x56e1e4
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4fa197
mov eax, dword [ebp - 0x224]
cmp eax, 1
je 0x4fa13e
cmp eax, 2
jne 0x4fa197
mov eax, dword [ebp - 0x21c]
test eax, eax
je 0x4fa15b
test al, 1
jne 0x4fa197
shr eax, 1
cmp word [ebp + eax*2 - 0x21a], 0
je 0x4fa164
jmp 0x4fa197
xor eax, eax
mov word [ebp - 0x218], ax
lea edx, [ebp - 0x218]
lea ecx, [edx + 2]
nop dword [eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x4fa170
sub edx, ecx
lea eax, [ebp - 0x218]
mov ecx, dword [ebp - 0x228]
sar edx, 1
push edx
push eax
call fcn.00402d50
mov ebx, 1
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4fa1cc
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x4fa1ca
mov eax, dword [ecx + 4]
push 0
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x4fa1cc
call edx
test edi, edi
je 0x4fa1d7
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049aa22
mov esp, ebp
pop ebp
ret 4
Function at 0x507410
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x198
mov eax, dword [0x59a0a0]
xor eax, esp
mov dword [esp + 0x194], eax
lea eax, [esp]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov ecx, dword [esp + 0x194]
neg eax
sbb eax, eax
xor ecx, esp
inc eax
call fcn.0049aa22
mov esp, ebp
pop ebp
ret

Function at 0x507450
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53b562
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x59a0a0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
xor edi, edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 4], edi
call fcn.00401980
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x5074a4
push 0x80004005
call fcn.00401b40
mov eax, dword [edx]
mov esi, dword [eax + 0xc]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x5074b9
lock inc dword [edx + 0x14]
lea eax, [edx + 8]
jmp 0x5074bd
mov ecx, edx
call esi
add eax, 0x10
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 1
mov eax, dword [0x59fb74]
cmp dword [eax - 0xc], 0
jne 0x5074e3
push 0x20
push 0x565348
lea ecx, [ebp - 0x10]
call fcn.00402d50
jmp 0x5074f5
push eax
lea eax, [ebp - 0x10]
push 0x565480
push eax
call fcn.004023f0
add esp, 0xc
mov esi, dword [ebp - 0x10]
lea eax, [ebp - 0x14]
push eax
push 0x2001f
push 0
push esi
push reloc.WS2_32.dll_bind
mov dword [ebp - 0x14], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
add ebx, 0x490
test eax, eax
jne 0x50756a
mov edi, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x14]
push eax
push ebx
lea eax, [ebp - 0x18]
mov dword [ebp - 0x24], edi
push eax
push 0
push str.StartCount
push edi
mov dword [ebp - 0x14], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x50756a
cmp dword [ebp - 0x18], 4
jne 0x50756a
test edi, edi
je 0x507561
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], 0
jmp 0x507570
mov dword [ebx], 0
push dword [ebx]
push str.EmulatorStartCount__d_
call fcn.004e78a0
push eax
call fcn.004e76a0
add esp, 0xc
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x5075ba
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x5075b8
mov eax, dword [ecx + 4]
push 0
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x5075ba
call edx
test edi, edi
je 0x5075c5
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x507d20
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x59a0a0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x22c
xor esi, esi
mov dword [ebp - 0x234], ecx
lea eax, [ebp - 0x230]
push esi
push eax
call fcn.0049e130
add esp, 0xc
push esi
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x507de8
lea eax, [ebp - 0x230]
mov dword [ebp - 0x230], 0x22c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x507dd5
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Process32NextW]
nop dword [eax]
lea eax, [ebp - 0x20c]
push str.qqpcrtp.exe
push eax
call fcn.004a689d
add esp, 8
test eax, eax
jne 0x507dab
or esi, 1
lea eax, [ebp - 0x20c]
push str.ZhuDongFangYu.exe
push eax
call fcn.004a689d
add esp, 8
test eax, eax
jne 0x507dc6
or esi, 2
lea eax, [ebp - 0x230]
push eax
push edi
call ebx
test eax, eax
jne 0x507d90
pop ebx
mov eax, dword [ebp - 0x234]
push edi
mov dword [eax + 0x498], esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0049aa22
mov esp, ebp
pop ebp
ret

Function at 0x508360
Capabilities:
Encode data using xor
Get hostname

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
mov eax, dword [0x59a0a0]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push esi
push edi
push str.GAMEDOWNLOAD_RUNNING_MAGIC_MESSAGE
mov edi, ecx
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
mov esi, eax
push esi
push 0x564fa0
push str.__s__WindowMessage__d_
call fcn.004e78a0
push eax
call fcn.004e76a0
xor eax, eax
mov dword [edi + 0x50c], esi
add esp, 0x10
mov word [esp + 0x14], ax
mov dword [esp + 0x2e], eax
xorps xmm0, xmm0
mov word [esp + 0x32], ax
lea eax, [esp + 0x10]
movups xmmword [esp + 0x16], xmm0
push eax
lea eax, [esp + 0x18]
movq qword [esp + 0x2a], xmm0
push eax
mov dword [esp + 0x18], 0xf
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [esp + 0x14]
push eax
push str.GameDownload::CMainUI::InitRunningMagicMsgId
push str.__s__ComputerName__s_
call fcn.004e78a0
push eax
call fcn.004e76a0
mov ecx, dword [esp + 0x20]
add esp, 0x10
or eax, 0xffffffff
xor esi, esi
lea ebx, [ecx + ecx]
test ebx, ebx
jle 0x508429
nop dword [eax + eax]
movsx edx, byte [esp + esi + 0x14]
inc esi
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edi + edx*4 + 0x518]
cmp esi, ebx
jl 0x508410
not eax
push eax
push 0x5650a8
push str.__s__HashComputerName_0x_08x_
mov dword [edi + 0x510], eax
call fcn.004e78a0
push eax
call fcn.004e76a0
mov ecx, dword [esp + 0x44]
add esp, 0x10
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0049aa22
mov esp, ebp
pop ebp
ret
Function at 0x508b10
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x59a0a0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x410
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.0049e130
add esp, 0xc
lea eax, [ebp - 0x414]
push 0x208
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x508b9e
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0x564e98
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x508b9e
call fcn.004cf2b0
mov dword [0x59f494], 0x508930
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049aa22
mov esp, ebp
pop ebp
ret
push 0x508930
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049aa22
mov esp, ebp
pop ebp
ret
Function at 0x50a4a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53b8b6
mov eax, dword fs:[0]
push eax
sub esp, 0x230
mov eax, dword [0x59a0a0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
xor edi, edi
mov dword [ebp - 0x230], eax
mov dword [ebp - 0x23c], edi
mov dword [ebp - 0x238], ebx
mov dword [ebp - 0x234], ebx
push 0x20a
lea eax, [ebp - 0x220]
mov dword [ebp - 4], edi
push edi
push eax
call fcn.0049e130
add esp, 0xc
call fcn.00401980
mov ecx, eax
xor eax, eax
test ecx, ecx
setne al
test eax, eax
jne 0x50a521
push 0x80004005
call fcn.00401b40
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x50a536
lock inc dword [ecx + 0x14]
lea eax, [ecx + 8]
jmp 0x50a538
call edx
add eax, 0x10
mov dword [ebp - 0x228], eax
mov byte [ebp - 4], 1
mov eax, dword [0x59fb74]
cmp dword [eax - 0xc], 0
jne 0x50a564
push 0x1d
push 0x56bf74
lea ecx, [ebp - 0x228]
call fcn.00402d50
jmp 0x50a579
push eax
lea eax, [ebp - 0x228]
push 0x56c004
push eax
call fcn.004023f0
add esp, 0xc
mov esi, dword [ebp - 0x228]
lea eax, [ebp - 0x224]
push eax
push 0x20019
push 0
push esi
push reloc.WS2_32.dll_accept
mov dword [ebp - 0x224], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x50a657
mov edi, dword [ebp - 0x224]
mov dword [ebp - 0x238], eax
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x220]
mov dword [ebp - 0x23c], edi
push eax
lea eax, [ebp - 0x22c]
mov dword [ebp - 0x224], 0x208
push eax
push 0
push 0x56c904
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x50a657
mov eax, dword [ebp - 0x22c]
cmp eax, 1
je 0x50a5fe
cmp eax, 2
jne 0x50a657
mov eax, dword [ebp - 0x224]
test eax, eax
je 0x50a61b
test al, 1
jne 0x50a657
shr eax, 1
cmp word [ebp + eax*2 - 0x222], 0
je 0x50a624
jmp 0x50a657
xor eax, eax
mov word [ebp - 0x220], ax
lea edx, [ebp - 0x220]
lea ecx, [edx + 2]
nop dword [eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x50a630
sub edx, ecx
lea eax, [ebp - 0x220]
mov ecx, dword [ebp - 0x230]
sar edx, 1
push edx
push eax
call fcn.00402d50
mov ebx, 1
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x50a68c
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x50a68a
mov eax, dword [ecx + 4]
push 0
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x50a68c
call edx
test edi, edi
je 0x50a697
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049aa22
mov esp, ebp
pop ebp
ret 4