joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43d9d0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x46a413
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.0045de3a
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], vtable.CBrush.0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], method.CEdit.virtual_0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov ecx, edi
call fcn.004634d2
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.004649ee
test eax, eax
je 0x43daec
mov ecx, dword [esp + 0x3c]
call fcn.004634ff
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x43dab0
push edi
mov ecx, esi
call fcn.00460b6a
mov ecx, esi
call fcn.0043dc50
cmp dword [esp + 0x38], 1
jne 0x43dae5
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.00460ca5
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28
Function at 0x440510
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x440543
push esi
call fcn.00443620
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x44053c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x4405c9
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x4405b2
mov eax, dword [esi + 8]
test eax, eax
je 0x440567
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x4405ae
cmp eax, 2
je 0x4405b2
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x44055a
cmp eax, 3
je 0x44058d
cmp eax, 1
jne 0x44055a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x44055a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x44055a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.004405f0
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x4405d8
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.004405f0
add esp, 4
pop esi
ret

Function at 0x45ec2f
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x45ec67
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0045ccbc
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0045cc94
jmp 0x45ec73
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x460324
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x460366
call fcn.00465dd4
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x460366
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x46035d
xor eax, eax
jmp 0x46036e
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00460374
pop edi
pop esi
pop ebx
ret 4

Function at 0x466304
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x466332
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x466350
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0046626a
jmp 0x466350
mov eax, dword [esi + 0x14]
test eax, eax
je 0x466350
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0046626a
test edi, edi
mov eax, edi
jne 0x46633a
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x10072c3
Capabilities:
Encode data using xor

Disassembly:
rcr byte [0x39851417], cl
sbb byte [0x8a6a9820], ah
popal
pop ebp
add eax, dword [ebx - 0x393035f0]
sbb al, 0x50
add dword [esp + ecx*4 - 0x5dd9d6dc], 0x70
sal byte [ebp + 0x1c], 0xd3
in al, 0xc4
rcr dword [0x9e0afd70], cl
pop ss
push eax
stosd dword es:[edi], eax
xor eax, 0x265a5a58
xchg ebx, eax
sbb dword [ecx + 0x1c], ebp
shr ebp, cl
jne 0x10072d6
invalid
fcomp st(0)
pushal
arpl word [ebx + 0x27], ax
out dx, eax
in al, dx
in eax, dx
in eax, dx
shr ebx, 1
imul eax
invalid
Function at 0x10160385
Capabilities:
Encode data using xor

Disassembly:
push 0x14fec8
jmp 0x10160408
push word [esp + 2]
jmp 0x101603c0
ja 0x101603d6
mov byte [esp + 2], ah
lea esp, [esp + 2]
jmp 0x101603fe
mov byte [esp + 2], ah
lea esp, [esp + 2]
mov dword [esp + 0x28], edi
lea esp, [esp + 0x28]
pushfd
jmp 0x1015cef5
mov dword [esp + 0x28], edi
lea esp, [esp + 0x28]
jmp 0x101603e6
mov ah, byte [esp]
jmp 0x10160836
sbb al, 0x7c
jns 0x101607b8
jl 0x101607ce
bound ebx, qword [0x1c143d7c]
sbb eax, 0x1c143d7c
jl 0x1016077e
xchg esi, eax
sbb al, 0x7c
xchg ebp, eax
out 0x1b, al
jl 0x101607bd
jmp 0x10160788
sub dword [esi], ebx
jl 0x10160752
mov dh, 0x1c
jl 0x101607be
and dword [esp + edi*2], ebx
test al, 0x50
push ds
jl 0x101607a2
push esp
pop ds
jl 0x10160798
push eax
sbb al, 0x7c
and ebp, eax
sbb al, 0x7c
pushal
and byte [edx + edx*8 - 8], bh
and al, 0x7c
ret
push edx
sbb dword [esp + edi*2], 0x7c1dd306
mul ebp
rcr dword [0x1be5f77c], cl
in eax, 0x1b
sbb edi, dword [esp + ecx*8 - 0x67]
jl 0x10160771
cdq
sbb eax, 0x1cb5ad7c
lodsd eax, dword [esi]
mov ch, 0x1c
jl 0x101607cd
sub eax, 0xb42c7c1c
push ds
jl 0x10160824
sub esp, dword [ebx]
jl 0x101607b8
call edx
push ds
rcr byte [esi], cl
jl 0x10160753
mov esp, 0x41617c1c
sbb al, 0x7c
popal
inc ecx
sbb edi, dword [edx - 0x23]
and eax, 0x1be5f77c
jl 0x101607be
or eax, 0x486a7c1c
sbb al, 0x7c
push 0x48
push ds
jl 0x10160818
lea ebx, [ebx]
jl 0x10160782
lea esp, [ecx]
jl 0x101607a8
call [esi]
jl 0x101607a1
test al, 0x1c
jl 0x10160779
mov esi, 0xe57c7c22
sbb eax, 0x1e61ac7c
jl 0x1016079d
dec esi
push ds
jl 0x10160830
invalid
push ds
jl 0x101607a1
xor byte [ebx], bl
jl 0x1016087f
fsub dword [edx]
jl 0x1016080e
cmc
dec ebp
and dword [esp + edx - 0x79], edi
cmp dword cs:[esi - 0x77], esp
cmp al, 0x24
mov word [esp], di
cpuid
call fcn.10160846
std
jns 0x10160817
mov byte [ebx - 0x64], bh
pushfd
fdivr dword [ebx]
adc cl, byte [ebp + 0x66fa8b1c]
mov edx, 0x2c8b55e4
and al, 0x8b
jl 0x10160866
mov edi, edx
mov dx, 0x55e4
mov ebp, dword [esp]
mov edi, dword [esp + 0x2c]
pushfd
sub al, 0x9c
jmp 0x10160820
insb byte es:[edi], dx
and al, 4
lea eax, [esp + ebx]
call fcn.10160c95
arpl sp, sp
not dword [bp + si - 0x239f]
sbb dh, byte [ebp + 0x64]
mov ch, 0x8e
lea eax, [eax + 0x3a]
mov ch, byte [esp]
xchg bh, cl
cmp cl, byte [edx - 0x3079dbd4]
setnp ch
lea ebx, [esp + eax]
jmp 0x10160cd1
xchg dword [esp], eax
setge ah
lea ebx, [esi + 0xe6]
push dword [esp]
ret 4
Function at 0x101624f0
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
pop dword [esp + 0xc]
jmp 0x10162bf0
mov dword [esp + 4], esp
pop dword [esp + 0xa]
mov dword [esp + 0x14], eax
pushfd
mov dword [esp], esp
call fcn.10162bda
sbb bl, byte [edi + 0x4f996a0f]
jb 0x10162c7a
jl 0x10162c5e
add esp, 9
xchg ch, dh
lea esp, [esp + 2]
push dword [esp + 0x20]
ret 0x24
imul eax, dword [edx + 0x6650663d], 0xffffff89
cmp al, 0x24
jmp 0x10162cf1
push ss
cpuid
mov edi, dword [esp]
mov dh, ch
xchg dword [esp], ebp
jmp 0x10162c9e
dec ebp
cpuid
lea ebp, [0xbd3d0239]
mov edi, 0x9e92d0ed
push dword [esp]
ret 4
bsf bx, ax
mov dl, 0x63
shl dl, 5
lea esi, [esp]
neg bx
jge 0x10162ea2
jl 0x10162d62
int1
je 0x10162cd2
lea edi, [edi + ecx*8 - 0x1f]
and byte [ebx - 0x66], ah
cmc
in al, 0x66
mov eax, edi
mov ax, di
xchg byte [esp], ah
lea esp, [esp + 2]
mov ebp, dword [esp + 0x2c]
cmc
jmp 0x10162d1c
shl dl, 5
jmp 0x10162cd7
jnp 0x10162cce
bsf bx, ax
mov dl, 0x63
jmp 0x10162d02
sub esp, 0xc0
jmp 0x10162e49
not ebx
mov al, byte [esp]
rdtsc
jmp 0x10162ea9
mov dx, 0x930d
xchg cl, dl
mov edx, ebp
mov cx, 0x75e8
call fcn.10162da4
jge 0x10162d7b
and eax, 0x7d000000
cli
push 0x5b4bfa0f
mov dl, 0xba
fisttp dword [edx + edx - 0x721f140b]
dec esi
mov bx, word gs:[esp]
mov edx, 0xf5128cdb
jmp 0x10162d6e
cmc
ja 0x10162dbc
setne bh
jmp 0x10162e03
lea eax, [ecx + 0x76360d75]
stc
pushfd
jmp 0x10162dd7
setne bh
jmp 0x10162da6
bswap ebx
xchg bx, ax
mov ah, byte [esp]
lea ecx, [esp + edx]
jmp 0x10162dea
lea esp, [esp + 4]
sub ebp, 0x76103397
mov al, cl
bswap ecx
mov bh, byte [esp]
jmp 0x10162dc1
rol ebp, 0
rol ecx, 0x15
jne 0x10162e23
setge ch
mov cl, bl
mov bx, 0xf7dd
pushal
push esi
jmp 0x10162e29
lea eax, [ecx + 0x76360d75]
stc
pushfd
jmp 0x10162dd7
mov cl, bl
mov bx, 0xf7dd
pushal
jmp 0x10162e28
setge ch
jmp 0x10162e0d
push esi
lea esp, [esp + 0x24]
add ebp, 0x5dcf1da5
lea eax, [eax*4]
jmp 0x10162e7a
mov edi, esp
rcr ch, 3
jg 0x10162d87
mov edx, 0xf5128cdb
mov dx, 0x930d
xchg cl, dl
jmp 0x10162d74
jmp 0x10162ecb
mov ecx, edx
mov cx, word [esp]
pushal
pushfd
push word [esp + 0x1f]
jl 0x10162e64
lea esp, [esp + 2]
jmp 0x10162ecf
not ebx
mov al, byte [esp]
rdtsc
jmp 0x10162d4c
bswap ebx
mov ecx, ebp
xchg ebx, ecx
seto bl
bswap ebx
setno cl
jmp 0x10162f73
lea esp, [esp + 2]
rol ebp, 0
jb 0x10162eae
jae 0x10162f4a
bsf bx, ax
call fcn.10162ef3
invalid
seto bl
bswap ebx
call fcn.10162eec
loop 0x10162f32
invalid
enter 0xffffffffffff898d, 0xffffffffffffff98
invalid
cmp ebp, ecx
out 0, eax
add byte [eax], al
sbb ebx, dword [ebp + 0x17a7540d]
imul ebp, esi, 0x7c
sbb esi, esi
inc ebp
jg 0x10162f8c
int1
ljmp 0xcb87
bswap ebx
mov ecx, ebp
xchg ebx, ecx
jmp 0x10162f17
not ch
add ebp, dword [esi]
lea eax, [ecx + ebp]
btc eax, edx
jnp 0x10162fe2
mov eax, dword [esp]
xchg cx, bx
jmp fcn.10162f83
lea esp, [esp + 0x24]
neg ebp
mov bx, 0xe2b0
pushal
xchg bx, cx
jmp 0x10162f52
sub bl, bl
daa
mov ecx, 0x3acfa83a
rcr byte [ebx - 0x7403120e], cl
add al, 0x24
mov eax, dword [esp]
xchg cx, bx
jmp fcn.10162f83
jmp 0x10162f99
Function at 0x101896f9
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
pop esi
jmp 0x10189605
stc
push esi
mov esi, ecx
mov dword [esi], eax
jmp 0x101895d1
mov edi, dword [ecx + 4]
jmp 0x10189650
mov eax, dword [edx + 4]
mov dword [edx], edi
bsr di, cx
mov edi, 0xa27851a5
jmp 0x101895ef
mov dword [ecx + 4], eax
call 0x1018962b
mov eax, dword [ebp - 8]
jmp 0x10150b40
mov word [esp], cx
mov dword [edx - 4], edi
lea edi, [esp + eax]
mov edi, dword [ecx]
jmp 0x101895e7
jmp 0x10189690

Function at 0x10189729
Capabilities:
Encrypt data using aes

Disassembly:
jmp 0x10189790
pushal
mov al, 0xa1
mov edx, 0xe5553e2e
clc
mov dword [esp + 4], ebx
jmp 0x1018975a
add esp, 0
lea esp, [esp + 4]
movzx ebx, byte [esi + 2]
push esi
jmp 0x10189770

Function at 0x10189a68
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
pushfd
add esp, 1
lea esp, [esp + 3]
jmp 0x10189ad6
mov dword [esi + 8], edi
push ax
xchg word [esp], di
mov word [esp], si
jmp 0x10189aba
clc
lea esp, [esp + 4]
xor edi, dword [edx*4 + 0x1015baf8]
mov edx, dword [esi + 0xc]
jmp 0x10189a93
mov edi, 0xefd9b864
lea esp, [esp + 2]
jmp 0x10189b0b
mov edx, dword [edx*4 + 0x1015aaf8]
sub esp, 1
lea esp, [esp + 1]
and edx, ecx
jmp 0x10189aa9
sub esp, 0x11
mov word [esp + 6], ax
lea esp, [esp + 1]
jmp 0x10189b66
mov ebx, dword [ebx*4 + 0x1015aaf8]
call 0x10189ae8
mov bh, byte [esp]
xchg ebx, ebp
mov cx, 0x5043
lea ebp, [esi + ebp]
mov dword [esp], edx
popal
jmp 0x10189af2
mov edi, dword [edi*4 + 0x1015aaf8]
cmc
clc
jmp 0x10189c27
shr edi, 0x18
pushal
lea esp, [esp + 0x1a]
lea esp, [esp + 2]
jmp 0x10189b50
movzx ebx, byte [esi + 0xe]
call fcn.10189bf3
mov dword [0xf017e49d], ecx
sbb dword [esi + 0x17a66b0c], ebx
outsd dx, dword [esi]
lea esp, [esp + 0x18]
xor edi, dword [ebx*4 + 0x1015b6f8]
mov bx, 0x1e9f
bsr bx, si
jmp 0x10189b93
and edi, ecx
mov edi, dword [edi*4 + 0x1015aef8]
and ebx, ecx
jmp 0x10189ba9

Function at 0x10189bbe
Capabilities:
Encrypt data using aes

Disassembly:
mov ebx, dword [ebx*4 + 0x1015aaf8]
jmp 0x10189bd9

Function at 0x10189bd4
Capabilities:
Encrypt data using aes

Disassembly:
call fcn.10189bbe
and edx, ecx
mov edx, dword [edx*4 + 0x1015aaf8]
jmp 0x10189c0e
and ebx, ecx
lea esp, [esp + 0xc]
xor edi, dword [ebx*4 + 0x1015b2f8]
call fcn.10189bf8
mov esp, 0x45b6d343
mov esp, 0x8bcf2186
cmp al, 0xbd
clc
scasb al, byte es:[edi]
adc eax, 0xe9cb2110
jb 0x10189c34
invalid
invalid
Function at 0x102c6873
Capabilities:
Check for peb beingdebugged flag
Packed with generic packer
Parse pe header

Disassembly:
call fcn.102bf126
mov esi, eax
jmp 0x102c682f
mov eax, dword [eax + 0xc]
push esi
jmp 0x102c67a8
mov word [esp], bx
lea esp, [esp + 2]
lea esp, [esp + 2]
mov dword [esp], edi
mov eax, dword fs:[0x30]
jmp 0x102c67be
mov eax, dword [eax + 8]
push eax
jmp 0x102bf121
lea esi, [esi + 0x1c]
mov eax, dword [esi]
pop esi
mov eax, dword [eax]
jmp 0x102c6804
mov dword [esp + 4], esi
pushfd
jmp 0x102c67d7

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x41b72f
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x667470
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x703034]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebp + 8]
lea edi, [ebx + 4]
lea esi, [ebp + 0xc]
mov dword [ebx], eax
movsd dword es:[edi], dword [esi]
lea ecx, [ebx + 0x18]
push 0x6c28e0
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
and dword [ebx + 0x10], 0
and dword [ebx + 0x14], 0
call fcn.00429293
push 0x6ccdaf
lea ecx, [ebx + 0x30]
call fcn.00429293
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x41c763
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x41c7be
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x41c7af
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [ebp + 8]
lea ecx, [esi + eax]
and edx, 0xf
jbe 0x41c7ab
cmp esi, ecx
jae 0x41c7af
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edx, 1
jne 0x41c799
cmp esi, ecx
jb 0x41c7b3
xor eax, eax
jmp 0x41c7bd
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4246e3
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x703034]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov edx, dword [ebp + 8]
xor ebx, ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
add eax, eax
mov dword [edi], ebx
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 8]
push eax
push ebx
push edx
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x42475a
cmp dword [ebp - 8], 1
je 0x424732
cmp dword [ebp - 8], 2
je 0x424732
push 0xd
pop eax
jmp 0x42475a
mov ecx, dword [ebp - 0xc]
test esi, esi
je 0x424754
test ecx, ecx
je 0x42474f
test cl, 1
jne 0x42472d
mov eax, ecx
shr eax, 1
cmp word [esi + eax*2 - 2], bx
je 0x424754
jmp 0x42472d
xor eax, eax
mov word [esi], ax
shr ecx, 1
xor eax, eax
mov dword [edi], ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00620181
mov esp, ebp
pop ebp
ret 0xc
Function at 0x45c26f
Capabilities:
Get common file path

Disassembly:
push 0x234
mov eax, 0x66d902
call fcn.00621369
mov bl, dl
mov esi, ecx
mov dword [ebp - 0x23c], esi
xor edx, edx
mov dword [ebp - 0x240], esi
mov dword [ebp - 0x238], edx
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], edx
jb 0x45c2aa
mov eax, dword [esi]
jmp 0x45c2ac
mov eax, esi
xor ecx, ecx
mov word [eax], cx
push 0x208
xor edi, edi
mov dword [ebp - 4], edx
push edx
lea eax, [ebp - 0x21c]
inc edi
push eax
mov dword [ebp - 0x238], edi
call fcn.00638f20
add esp, 0xc
test bl, bl
push edi
push 0x23
pop eax
push 0x1a
pop ecx
cmovne eax, ecx
xor edi, edi
push eax
lea eax, [ebp - 0x21c]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x45c3a9
xor eax, eax
mov dword [ebp - 0x220], 7
mov dword [ebp - 0x224], edi
mov word [ebp - 0x234], ax
cmp word [ebp - 0x21c], ax
je 0x45c326
lea eax, [ebp - 0x21c]
push eax
call fcn.0063dcb8
pop ecx
push eax
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x234]
call fcn.004284c0
push 0xffffffffffffffff
push edi
lea eax, [ebp - 0x234]
mov dword [ebp - 4], 1
push eax
mov ecx, esi
call fcn.004253a9
push 0
push 1
lea ecx, [ebp - 0x234]
mov byte [ebp - 4], 0
call fcn.00428e92
mov edi, str.TencentDeskUpdate
test bl, bl
jne 0x45c372
mov edi, str.TencentDesktop
push edi
call fcn.0063dcb8
pop ecx
push eax
push edi
mov ecx, esi
call fcn.00425448
mov ecx, esi
call fcn.0045c3b1
test al, al
jne 0x45c394
mov ecx, esi
call fcn.0045c47b
mov edi, str.Global.db
push edi
call fcn.0063dcb8
pop ecx
push eax
push edi
mov ecx, esi
call fcn.00425448
mov eax, esi
call fcn.00621313
ret
Function at 0x45d8d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2aa4
call fcn.00620f90
mov eax, dword [0x703034]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x208
lea eax, [ebp - 0x20c]
mov edi, ecx
push 0
push eax
call fcn.00638f20
add esp, 0xc
lea eax, [ebp - 0x20c]
mov esi, 0x104
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str.iphlpapi.dll
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.0064b6b2
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x2aa4], eax
test eax, eax
jne 0x45d947
xor al, al
jmp 0x45da68
push str.GetAdaptersInfo
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x45da3b
lea ecx, [ebp - 0x2aa0]
mov dword [ebp - 0x2aa0], 0x2880
push ecx
lea ecx, [ebp - 0x2a8c]
push ecx
call eax
test eax, eax
jne 0x45da3b
push ebx
push 3
pop eax
mov dword [ebp - 0x2a9c], eax
lea esi, [ebp - 0x2a8c]
mov ebx, edi
lea eax, [ebp - 0x2a94]
sub ebx, eax
lea ecx, [esi + 8]
call fcn.0045da78
push 6
mov dword [ebp - 0x2a98], eax
lea eax, [ebp - 0x2a94]
push 0
push eax
call fcn.00638f20
add esp, 0xc
xor edx, edx
lea ecx, [ebp - 0x2a94]
add ecx, edx
mov al, byte [ebx + ecx]
cmp al, byte [ecx]
jne 0x45d9d7
inc edx
cmp edx, 6
jb 0x45d9ba
mov ecx, dword [ebp - 0x2a98]
jmp 0x45d9f5
mov eax, dword [esi + 0x1a0]
cmp eax, 6
je 0x45d9e7
cmp eax, 0x17
jne 0x45da30
mov ecx, dword [ebp - 0x2a98]
cmp dword [ebp - 0x2a9c], ecx
jle 0x45da30
mov al, byte [esi + 0x194]
mov byte [edi], al
mov al, byte [esi + 0x195]
mov byte [edi + 1], al
mov al, byte [esi + 0x196]
mov byte [edi + 2], al
mov al, byte [esi + 0x197]
mov byte [edi + 3], al
mov al, byte [esi + 0x198]
mov byte [edi + 4], al
mov al, byte [esi + 0x199]
mov byte [edi + 5], al
mov dword [ebp - 0x2a9c], ecx
mov esi, dword [esi]
test esi, esi
jne 0x45d997
pop ebx
push dword [ebp - 0x2aa4]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 6
lea eax, [ebp - 0x2a94]
push 0
push eax
call fcn.00638f20
add esp, 0xc
lea eax, [ebp - 0x2a94]
mov ecx, edi
push eax
call fcn.0045d744
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00620181
mov esp, ebp
pop ebp
ret
Function at 0x45da78
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x703034]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
xor eax, eax
push 3
pop esi
inc eax
mov dword [ebp - 0x10c], 0x104
mov dword [ebp - 0x110], eax
mov ebx, ecx
lea eax, [ebp - 0x11c]
xor ecx, ecx
push eax
push 0x20019
push ecx
push str.SystemCurrentControlSetControlNetwork4D36E972_E325_11CE_BFC1_08002BE10318
push closesocket
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x118], ecx
mov dword [ebp - 0x114], ecx
call edi
test eax, eax
jne 0x45dc33
push ebx
push str._sConnection
push 0xffffffffffffffff
lea eax, [ebp - 0x108]
push 0x103
push eax
call fcn.0045aeaa
add esp, 0x14
lea eax, [ebp - 0x118]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x11c]
call edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x45dc2b
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 4
pop eax
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x10c], eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x110]
push eax
push 0
push str.MediaSubType
push dword [ebp - 0x118]
call ebx
test eax, eax
jne 0x45dc23
push 0x104
push eax
lea eax, [ebp - 0x108]
mov dword [ebp - 0x110], 1
push eax
mov dword [ebp - 0x10c], 0x103
call fcn.00638f20
add esp, 0xc
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x110]
push eax
push 0
push str.PnpInstanceID
push dword [ebp - 0x118]
call ebx
test eax, eax
jne 0x45dc23
mov eax, dword [ebp - 0x114]
cmp eax, 1
jne 0x45dc1a
mov ebx, 0x6d2af8
push ebx
call fcn.0063c700
push eax
lea eax, [ebp - 0x108]
push ebx
push eax
call fcn.0064e650
add esp, 0x10
test eax, eax
jne 0x45dbe9
xor esi, esi
jmp 0x45dc23
mov eax, dword [ebp - 0x114]
cmp eax, 1
jne 0x45dc1a
push ebx
call fcn.0063c700
push eax
lea eax, [ebp - 0x108]
push ebx
push eax
call fcn.0064e650
add esp, 0x10
test eax, eax
je 0x45dc14
push 2
pop esi
jmp 0x45dc23
mov eax, dword [ebp - 0x114]
cmp eax, 2
push 1
pop eax
cmove esi, eax
push dword [ebp - 0x118]
call edi
push dword [ebp - 0x11c]
call edi
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00620181
mov esp, ebp
pop ebp
ret