joyce8/EMBER2024-capa huggingface dataset:
Function at 0x420590
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push 0
mov dword [ebp - 8], edx
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4205cd
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push edi
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
je 0x42060c
test esi, esi
je 0x42060c
push 0x4ae319
push esi
mov dword [ebp - 4], 0
call fcn.0047e296
mov edi, eax
add esp, 8
test edi, edi
jne 0x42061c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0040ac00
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push 0
push edi
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [ebp - 4]
push 0
push eax
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x420640
cmp dword [ebp - 4], esi
je 0x42064e
push edi
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete___void__]
add esp, 4
xor edi, edi
xor esi, esi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
mov dword [eax], edi
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x420670
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4aa0cc]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4206aa
test al, 0x10
je 0x4206aa
mov eax, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047db8e
mov esp, ebp
pop ebp
ret
push esi
mov esi, edi
test edi, edi
jne 0x4206c3
pop esi
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047db8e
mov esp, ebp
pop ebp
ret
push ebx
push 0x5c
push esi
call dword [sym.imp.MSVCR120.dll_wcschr]
mov esi, eax
add esp, 8
test esi, esi
je 0x420764
cmp word [esi - 2], 0x3a
je 0x420759
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4206e6
sub eax, edx
mov edx, esi
sar eax, 1
lea ebx, [edx + 2]
lea ebx, [ebx]
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x420700
sub edx, ebx
sar edx, 1
sub eax, edx
cmp eax, 0x7ffffffe
jbe 0x420723
xor eax, eax
mov word [ebp - 0x20c], ax
jmp 0x420731
push eax
push edi
push ecx
lea ecx, [ebp - 0x20c]
call fcn.00420850
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x420759
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x42077a
add esi, 2
test esi, esi
jne 0x4206c4
pop ebx
pop esi
mov eax, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047db8e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop ebx
pop esi
xor ecx, ebp
pop edi
call fcn.0047db8e
mov esp, ebp
pop ebp
ret
Function at 0x420790
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, ecx
mov dword [ebp - 8], edx
test esi, esi
je 0x420839
cmp word [esi], 0
je 0x420839
push edi
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4207e4
pop edi
mov eax, 0x80004005
pop esi
mov esp, ebp
pop ebp
ret 4
push 0
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push 0
push eax
push esi
push dword [ebp - 8]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x420823
cmp dword [ebp - 4], esi
jne 0x420823
push edi
xor esi, esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
push edi
mov esi, 0x80004005
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, 0x80070057
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x421860
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4841c1
mov eax, dword fs:[0]
push eax
sub esp, 0x850
mov eax, dword [0x4aa0cc]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
mov ebx, dword [ebp + 8]
push 0
call fcn.00401f60
push 0
mov ecx, edi
call fcn.00401f60
push 0
mov ecx, ebx
call fcn.00401f60
mov ecx, 0x4af074
call fcn.00403490
test al, al
jne 0x421abe
xorps xmm0, xmm0
mov dword [ebp - 0x81c], 0
movq qword [ebp - 0x824], xmm0
mov dword [ebp - 0x824], 0
mov dword [ebp - 0x820], 0
mov dword [ebp - 0x81c], 0
push ecx
mov ecx, 0x4af074
mov dword [ebp - 4], 0
call fcn.00403470
push eax
push ecx
lea ecx, [ebp - 0x824]
call fcn.004203d0
test eax, eax
je 0x42192a
mov eax, dword [ebp - 0x824]
test eax, eax
je 0x421abe
push eax
jmp 0x421ab8
lea eax, [ebp - 0x818]
mov dword [ebp - 0x818], 0x400
push eax
lea eax, [ebp - 0x814]
push eax
push str.XProxyServer
lea ecx, [ebp - 0x824]
call fcn.00420440
test eax, eax
jne 0x421916
push 0xfde9
lea edx, [ebp - 0x814]
lea ecx, [ebp - 0x840]
call fcn.00423780
add esp, 4
mov ecx, esi
push eax
call fcn.0040ea40
lea ecx, [ebp - 0x840]
call fcn.00401e40
lea eax, [ebp - 0x818]
mov dword [ebp - 0x818], 0x400
push eax
lea eax, [ebp - 0x814]
push eax
push str.XProxyUserName
lea ecx, [ebp - 0x824]
call fcn.00420440
mov esi, dword [ebp - 0x824]
test eax, eax
jne 0x421ab3
push 0xfde9
lea edx, [ebp - 0x814]
lea ecx, [ebp - 0x840]
call fcn.00423780
add esp, 4
mov ecx, edi
push eax
call fcn.0040ea40
lea ecx, [ebp - 0x840]
call fcn.00401e40
lea eax, [ebp - 0x818]
mov dword [ebp - 0x818], 0x800
push eax
lea eax, [ebp - 0x814]
push eax
lea eax, [ebp - 0x828]
push eax
push 0
push str.XProxyPassword
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x421ab3
cmp dword [ebp - 0x828], 3
jne 0x421ab3
mov eax, dword [ebp - 0x818]
and eax, 0xfffffffe
cmp eax, 0x800
jae 0x421ada
xor ecx, ecx
push ecx
sub esp, 0x18
mov word [ebp + eax - 0x814], cx
mov ecx, esp
mov dword [ebp - 0x828], esp
push str.encrypt_B192E67D_8E42_4382_A359_E65945D1ED48
call fcn.004058b0
sub esp, 0x18
mov byte [ebp - 4], 1
lea eax, [ebp - 0x814]
mov ecx, esp
push eax
call fcn.004058b0
lea ecx, [ebp - 0x85c]
mov byte [ebp - 4], 0
call fcn.00455f30
add esp, 0x30
mov edx, eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x840]
call fcn.00423600
add esp, 4
mov ecx, ebx
push eax
call fcn.0040ea40
lea ecx, [ebp - 0x840]
call fcn.00401e40
lea ecx, [ebp - 0x85c]
call fcn.004033b0
test esi, esi
je 0x421abe
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0047db8e
mov esp, ebp
pop ebp
ret
call fcn.0047e1ba
int3
Function at 0x4222a0
Capabilities:
Create thread

Disassembly:
push ecx
push esi
push edi
mov esi, ecx
call fcn.00422310
push 0
push 0
push esi
push 0x421300
push 0
push 0
call dword [sym.imp.MSVCR120.dll__beginthreadex]
mov ecx, dword [esi + 0x54]
add esp, 0x18
mov edi, eax
test ecx, ecx
je 0x4222d1
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x54], edi
test edi, edi
jne 0x422302
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CHttpManager::Start_return_error:_u
push edi
push str.HttpManager.cpp
call fcn.0040e580
add esp, 0x10
mov ecx, esi
call fcn.00422310
mov eax, 0x80004005
pop edi
pop esi
pop ecx
ret
pop edi
xor eax, eax
pop esi
pop ecx
ret
Function at 0x4265e0
Capabilities:
Get proxy
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x484968
mov eax, dword fs:[0]
push eax
sub esp, 0x840
mov eax, dword [0x4aa0cc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x83c]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionInternet_Settings
mov dword [ebp - 0x840], 0
push SysReAllocString
mov dword [ebp - 0x848], edi
mov dword [ebp - 0x83c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x42665d
push 0x493d3d
mov ecx, edi
call fcn.00401e00
jmp 0x426804
sub esp, 0x18
xorps xmm0, xmm0
mov esi, esp
movdqu xmmword [ebp - 0x838], xmm0
movdqu xmmword [ebp - 0x828], xmm0
mov dword [esi + 0x10], 0
push esi
push 0xc
mov dword [ebp - 4], 1
call fcn.004027e0
add esp, 8
test eax, eax
je 0x4266a3
lea ecx, [ebp - 0x83c]
mov dword [eax], vtable.._AV___Func_impl_U___Callable_obj_V_lambda_96dfe1787354200c493a3f9af176861c____0A__std__V__allocator_V___Func_class_X___V_std___2_X___V_std__.0
mov dword [eax + 4], ecx
jmp 0x4266a5
xor eax, eax
lea ecx, [ebp - 0x838]
mov dword [esi + 0x10], eax
mov byte [ebp - 4], 0
call fcn.00423c90
lea eax, [ebp - 0x814]
mov dword [ebp - 4], 2
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push eax
lea eax, [ebp - 0x810]
mov dword [ebp - 0x818], 0
push eax
lea eax, [ebp - 0x818]
mov dword [ebp - 0x814], 0x7fe
push eax
push 0
push str.ProxyEnable
push dword [ebp - 0x83c]
call esi
test eax, eax
jne 0x4267df
cmp dword [ebp - 0x814], 4
jne 0x4267df
cmp dword [ebp - 0x818], 4
jne 0x4267df
cmp dword [ebp - 0x810], eax
je 0x4267df
lea eax, [ebp - 0x814]
mov dword [ebp - 0x814], 0x7fe
push eax
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x818]
push eax
push 0
push str.ProxyServer
push dword [ebp - 0x83c]
call esi
test eax, eax
jne 0x4267df
mov eax, dword [ebp - 0x814]
cmp eax, 0x800
jae 0x4267da
cmp dword [ebp + 0xc], 0
mov byte [ebp + eax - 0x810], 0
lea eax, [ebp - 0x810]
je 0x426798
push str.https
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
mov esi, eax
test esi, esi
je 0x4267d1
add esi, 5
jmp 0x4267ad
push str.http
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
mov esi, eax
test esi, esi
je 0x4267d1
add esi, 4
test esi, esi
je 0x4267d1
mov al, byte [esi]
cmp al, 0x20
je 0x4267bb
cmp al, 0x3d
jne 0x4267be
inc esi
jmp 0x4267b1
push 0x3b
push esi
call dword [sym.imp.SHLWAPI.dll_StrChrA]
test eax, eax
je 0x4267ce
mov byte [eax], 0
push esi
jmp 0x4267e4
lea eax, [ebp - 0x810]
push eax
jmp 0x4267e4
call fcn.0047e1ba
push 0x493d3d
mov ecx, edi
call fcn.00401e00
lea ecx, [ebp - 0x838]
mov dword [ebp - 0x840], 1
mov byte [ebp - 4], 0
call fcn.00423bf0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047db8e
mov esp, ebp
pop ebp
ret 8
Function at 0x4276f0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x484a83
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x4aa0cc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x18], esi
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0xd]
push eax
mov ecx, ebx
call fcn.00402120
lea eax, [ebp + 0xb]
mov ecx, esi
push eax
call fcn.00402100
push 0
push 0
mov ecx, esi
call fcn.00402050
push 0xffffffffffffffff
push 0
push ebx
mov ecx, esi
call fcn.00401e80
lea eax, [ebp - 0xe]
mov dword [ebp - 4], 0
lea edi, [ebx + 0x18]
add esi, 0x18
push eax
mov ecx, edi
call fcn.00402120
lea eax, [ebp - 0xf]
mov ecx, esi
push eax
call fcn.00402100
push 0
push 0
mov ecx, esi
call fcn.00402050
push 0xffffffffffffffff
push 0
push edi
mov ecx, esi
call fcn.00401e80
lea edi, [ebx + 0x30]
mov byte [ebp - 4], 1
mov ebx, dword [ebp - 0x18]
lea eax, [ebp - 0x10]
push eax
mov ecx, edi
call fcn.00402120
lea eax, [ebp - 0x11]
push eax
lea ecx, [ebx + 0x30]
call fcn.00402100
push 0
push 0
lea ecx, [ebx + 0x30]
call fcn.00402050
push 0xffffffffffffffff
push 0
push edi
lea ecx, [ebx + 0x30]
call fcn.00401e80
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4298a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x484ce4
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x4aa0cc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x54], ebx
lea ecx, [ebx + 0x64]
call fcn.00403470
push eax
push str.ReadReportFile_report_file__s
push 0
push str.Report.cpp
call fcn.0040e7d0
add esp, 0x10
lea ecx, [ebx + 0x64]
call fcn.00403470
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x42991c
push str.ReadReportFile_report_file_not_exsted
push 0
push str.Report.cpp
call fcn.0040e7d0
add esp, 0xc
xor eax, eax
jmp 0x429a61
lea ecx, [ebx + 0x64]
mov dword [ebp - 0x44], 0
call fcn.00403470
lea edx, [ebp - 0x44]
mov ecx, eax
call fcn.00420590
mov esi, dword [ebp - 0x44]
mov edi, eax
test esi, esi
je 0x429a5c
cmp byte [esi], 0
je 0x429a5c
test edi, edi
jle 0x429a5c
lea ecx, [ebp - 0x28]
call fcn.004057f0
lea eax, [ebx + 0x1c]
mov dword [ebp - 4], 0
push eax
lea eax, [ebx + 4]
mov edx, edi
push eax
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
call fcn.004181b0
add esp, 0xc
test eax, eax
je 0x429a54
push 0xfde9
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x40]
call fcn.00416340
add esp, 4
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 1
call fcn.00403470
push eax
push str.ReadReportFile_report_file_strDataW:_s
push 0
push str.Report.cpp
call fcn.0040e7d0
add esp, 0x10
lea ecx, [ebp - 0x50]
call fcn.00410130
mov dword [ebp - 0x50], vtable.CReportData.0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x4c]
push eax
call fcn.004145b0
test al, al
je 0x429a30
lea ecx, [ebp - 0x50]
call fcn.00411130
mov edi, eax
xor esi, esi
test edi, edi
jle 0x429a44
mov ebx, dword [sym.imp.MSVCR120.dll_void____cdecl_operator_new_unsigned_int_]
nop
push 0xc
call ebx
add esp, 4
mov dword [ebp - 0x44], eax
mov byte [ebp - 4], 3
test eax, eax
je 0x429a0e
push esi
push eax
lea ecx, [ebp - 0x50]
call fcn.00410f40
jmp 0x429a10
xor eax, eax
mov ecx, dword [ebp - 0x54]
mov byte [ebp - 4], 2
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x44]
push eax
lea ecx, [ecx + 0x84]
call fcn.0042aa10
inc esi
cmp esi, edi
jl 0x4299f0
jmp 0x429a44
push str.ReadReportFile_parse_json_failed
push 0
push str.Report.cpp
call fcn.0040e7d0
add esp, 0xc
lea ecx, [ebp - 0x50]
call fcn.00410240
lea ecx, [ebp - 0x40]
call fcn.004033b0
lea ecx, [ebp - 0x28]
call fcn.00401e40
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047db8e
mov esp, ebp
pop ebp
ret
Function at 0x42b2c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x484fed
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x4aa0cc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x220], esi
mov dword [ebp - 0x21c], 0
call fcn.00403380
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push 0
push eax
mov dword [ebp - 0x21c], 1
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [ebp - 0x218]
push 1
push 0x23
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x42b3ae
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x238]
call fcn.004058b0
push eax
mov ecx, esi
mov dword [ebp - 4], 1
call fcn.004060c0
lea ecx, [ebp - 0x238]
mov byte [ebp - 4], 0
call fcn.004033b0
push 0x493b4c
mov ecx, esi
call fcn.00408710
push str.LightRegulate
mov ecx, esi
call fcn.00408710
push str.Common
mov ecx, esi
call fcn.00408710
mov ecx, esi
call fcn.0042aeb0
test al, al
jne 0x42b3ae
mov ecx, esi
call fcn.0042afc0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047db8e
mov esp, ebp
pop ebp
ret

Function at 0x42b3d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x484fed
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x4aa0cc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x220], esi
mov dword [ebp - 0x21c], 0
call fcn.00403380
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push 0
push eax
mov dword [ebp - 0x21c], 1
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [ebp - 0x218]
push 1
push 0x23
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x42b4be
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x238]
call fcn.004058b0
push eax
mov ecx, esi
mov dword [ebp - 4], 1
call fcn.004060c0
lea ecx, [ebp - 0x238]
mov byte [ebp - 4], 0
call fcn.004033b0
push 0x493b4c
mov ecx, esi
call fcn.00408710
push str.LightRegulate
mov ecx, esi
call fcn.00408710
push str._bugreport
mov ecx, esi
call fcn.00408710
mov ecx, esi
call fcn.0042aeb0
test al, al
jne 0x42b4be
mov ecx, esi
call fcn.0042afc0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047db8e
mov esp, ebp
pop ebp
ret
Function at 0x42b610
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x485030
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x4aa0cc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x28]
call fcn.0042b2c0
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], 0
call fcn.00429390
push 0x493b4c
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.00405940
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.004068b0
push 0x495568
lea ecx, [ebp - 0x28]
call fcn.00405940
lea ecx, [ebp - 0x28]
call fcn.00403470
push eax
push str.IsCheckProxyByFile_path:__s
push 0
push str.Light_pub.cpp
call fcn.0040e7d0
add esp, 0x10
lea ecx, [ebp - 0x28]
call fcn.00403470
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ebx, ebx
cmp eax, 0xffffffff
setne bl
push ebx
push str.IsFileExist_path:__d
push 0
push str.Light_pub.cpp
call fcn.0040e7d0
add esp, 0x10
lea ecx, [ebp - 0x40]
call fcn.004033b0
lea ecx, [ebp - 0x28]
call fcn.004033b0
xor eax, eax
test ebx, ebx
sete al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047db8e
mov esp, ebp
pop ebp
ret
Function at 0x42c040
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x485353
mov eax, dword fs:[0]
push eax
sub esp, 0x84
mov eax, dword [0x4aa0cc]
xor eax, esp
mov dword [esp + 0x7c], eax
push esi
push edi
mov eax, dword [0x4aa0cc]
xor eax, esp
push eax
lea eax, [esp + 0x90]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
test edi, edi
je 0x42c26d
lea ecx, [esp + 0x58]
call fcn.00415ad0
push str.LightRegulate
lea ecx, [esp + 0x5c]
mov dword [esp + 0x9c], 0
call fcn.00408710
lea edx, [esp + 0x58]
lea ecx, [esp + 0x10]
call fcn.00415800
push eax
lea ecx, [esp + 0x5c]
call fcn.0040d5d0
lea ecx, [esp + 0x10]
call fcn.004033b0
lea ecx, [esp + 0x58]
call fcn.00403470
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x42c0e3
test al, 0x10
jne 0x42c0f3
lea ecx, [esp + 0x58]
call fcn.00403470
mov ecx, eax
call fcn.00420670
push str.report.db
lea eax, [esp + 0x5c]
push eax
lea eax, [esp + 0x78]
push eax
call fcn.00408470
add esp, 0xc
lea eax, [esp + 0xf]
mov byte [esp + 0x98], 1
push eax
mov ecx, esi
call fcn.00402120
lea eax, [esp + 0xe]
push eax
lea ecx, [esp + 0x44]
call fcn.00402100
push 0
push 0
lea ecx, [esp + 0x48]
call fcn.00402050
push 0xffffffffffffffff
push 0
push esi
lea ecx, [esp + 0x4c]
call fcn.00401e80
lea ecx, [esp + 0x40]
mov byte [esp + 0x98], 2
call fcn.00403490
test al, al
je 0x42c1db
push str.api.win_13.com:8008_v1_report
lea ecx, [esp + 0x2c]
call fcn.00401e00
lea edx, [esp + 0x28]
mov byte [esp + 0x98], 3
lea ecx, [esp + 0x10]
call fcn.0042bfb0
mov esi, eax
lea eax, [esp + 0x40]
cmp eax, esi
je 0x42c1c1
push 0
push 1
mov ecx, eax
call fcn.00402050
lea eax, [esp + 0xc]
mov ecx, esi
push eax
call fcn.00402120
lea eax, [esp + 0xd]
push eax
lea ecx, [esp + 0x44]
call fcn.00402120
push esi
call fcn.004026a0
add esp, 4
lea ecx, [esp + 0x40]
push eax
call fcn.00405fc0
lea ecx, [esp + 0x10]
call fcn.00401e40
lea ecx, [esp + 0x28]
mov byte [esp + 0x98], 2
call fcn.00401e40
lea ecx, [esp + 0x40]
call fcn.00405870
push eax
push str.InitReport_strUrlInit:_s
push 0
push str.Light_pub.cpp
call fcn.0040e580
add esp, 0x10
lea ecx, [esp + 0x10]
push str.LIGHT20248787878
call fcn.00401e00
push str.Lightr_Aes_20240
lea ecx, [esp + 0x2c]
mov byte [esp + 0x9c], 4
call fcn.00401e00
lea eax, [esp + 0x10]
mov byte [esp + 0x98], 5
push eax
lea eax, [esp + 0x2c]
mov ecx, edi
push eax
lea eax, [esp + 0x78]
push eax
lea eax, [esp + 0x4c]
push eax
call fcn.004295f0
lea ecx, [esp + 0x28]
call fcn.00401e40
lea ecx, [esp + 0x10]
call fcn.00401e40
lea ecx, [esp + 0x40]
call fcn.00401e40
lea ecx, [esp + 0x70]
call fcn.004033b0
lea ecx, [esp + 0x58]
call fcn.004033b0
mov ecx, dword [esp + 0x90]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x7c]
xor ecx, esp
call fcn.0047db8e
mov esp, ebp
pop ebp
ret
Function at 0x42e240
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x485800
mov eax, dword fs:[0]
push eax
sub esp, 0x70
mov eax, dword [0x4aa0cc]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp + 0x10]
push 0x4af394
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x3c], vtable.Base::lock::scoped_lock_class_Base::lock::critical_section_.0
mov dword [ebp - 0x38], 0x4af390
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor dl, dl
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x54]
xor bl, bl
call fcn.0042e420
push 0
push 0
push 2
push 0
push 0
push 0x40000000
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 1
call fcn.00403470
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push eax
call esi
mov edi, eax
cmp edi, 0xffffffff
jne 0x42e30b
mov dl, 1
lea ecx, [ebp - 0x6c]
call fcn.0042e420
push 0
push 0
push 2
push 0
push 0
push 0x40000000
lea ecx, [ebp - 0x6c]
call fcn.00403470
push eax
call esi
lea ecx, [ebp - 0x6c]
mov edi, eax
call fcn.004033b0
cmp edi, 0xffffffff
je 0x42e3e1
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [ebp - 0x38]
push 0
push eax
push 4
push 0x495d9c
push edi
call esi
test eax, eax
je 0x42e3da
cmp dword [ebp - 0x38], 4
jne 0x42e3da
push 0
lea eax, [ebp - 0x38]
push eax
push 0x10
push dword [ebp - 0x78]
push edi
call esi
test eax, eax
je 0x42e3da
cmp dword [ebp - 0x38], 0x10
jne 0x42e3da
mov eax, dword [ebp - 0x74]
lea ecx, [ebp - 0x24]
xorps xmm0, xmm0
push ecx
mov ecx, eax
mov esi, dword [eax + 0x10]
movdqu xmmword [ebp - 0x24], xmm0
call fcn.00405870
mov edx, esi
mov ecx, eax
call fcn.0042d540
push 0
lea eax, [ebp - 0x38]
push eax
push 0x10
lea eax, [ebp - 0x24]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x42e3da
cmp dword [ebp - 0x38], 0x10
jne 0x42e3da
mov eax, dword [ebp - 0x70]
lea ecx, [ebp - 0x34]
xorps xmm0, xmm0
push ecx
mov ecx, eax
mov esi, dword [eax + 0x10]
movdqu xmmword [ebp - 0x34], xmm0
call fcn.00405870
mov edx, esi
mov ecx, eax
call fcn.0042d540
push 0
lea eax, [ebp - 0x38]
push eax
push 0x10
lea eax, [ebp - 0x34]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x42e3da
cmp dword [ebp - 0x38], 0x10
mov eax, 1
movzx ebx, bl
cmove ebx, eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x54]
call fcn.004033b0
push 0x4af394
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0047db8e
mov esp, ebp
pop ebp
ret 0xc