joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10070df
Capabilities:
Terminate process

Disassembly:
push 0x58
push 0x10088f0
call fcn.010075d4
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, 0x100aab4
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x1006e96
cmp eax, esi
jne 0x1006e89
xor esi, esi
inc esi
mov ebx, esi
jmp 0x1006e99
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1006e70
xor esi, esi
inc esi
mov eax, dword [0x100aab0]
cmp eax, esi
jne 0x1006eac
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x1006edb
mov eax, dword [0x100aab0]
test eax, eax
jne 0x1006ed5
mov dword [0x100aab0], esi
push 0x1001258
push 0x100124c
call fcn.01006dd5
pop ecx
pop ecx
test eax, eax
je 0x1006edb
jmp 0x1007003
mov dword [0x100a354], esi
mov eax, dword [0x100aab0]
cmp eax, esi
jne 0x1006eff
push 0x1001248
push 0x1001240
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x100aab0], 2
test ebx, ebx
jne 0x1006f0b
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x100aabc], 0
je 0x1006f2f
push 0x100aabc
call fcn.01007549
pop ecx
test eax, eax
je 0x1006f2f
push 0
push 2
push 0
call dword [0x100aabc]
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x1006f8b
test al, al
je 0x1006f49
cmp dword [ebp - 0x1c], 0
jne 0x1006f8b
mov al, byte [esi]
test al, al
je 0x1006f59
cmp al, 0x20
ja 0x1006f59
inc esi
mov dword [ebp - 0x20], esi
jmp 0x1006f49
test byte [ebp - 0x3c], 1
je 0x1006f65
movzx eax, word [ebp - 0x38]
jmp 0x1006f68
push 0xa
pop eax
push eax
push esi
push 0
push 0x1000000
call main
mov dword [0x100a350], eax
cmp dword [0x100a344], 0
jne 0x1006fdf
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp al, 0x22
jne 0x1006f9a
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.msvcrt.dll__ismbblead]
pop ecx
test eax, eax
je 0x1006fad
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x1006f36
cmp dword [0x100a354], 0
jne 0x1006fee
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x100a350]
jmp 0x100700f
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.01007619
ret
call fcn.01007721
jmp 0x1006e36
Function at 0x1008302
Capabilities:
Read file via mapping

Disassembly:
mov edi, edi
push ebx
push esi
push 0x100378c
push dword [0x100a31c]
mov esi, ecx
call fcn.01008041
xor ebx, ebx
pop ecx
pop ecx
cmp dword [esi], ebx
jne 0x10083c3
cmp dword [esi + 4], ebx
jne 0x10083c3
push edi
push 0x1003618
push ebx
push 6
xor edi, edi
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov dword [esi], eax
cmp eax, ebx
jne 0x1008354
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push edi
push 0x1003710
jmp 0x10083a0
push 0x4588
push ebx
push ebx
push 6
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 4], eax
cmp eax, ebx
jne 0x100837a
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x6e
mov dword [esi], ebx
pop edi
jmp 0x10083b2
push 0x10035e8
push ebx
push 0xe0000000
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov dword [esi + 0xc], eax
cmp eax, ebx
jne 0x10083be
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push edi
push 0x10036a0
push dword [0x100a31c]
call fcn.01008041
add esp, 0xc
cmp edi, ebx
jle 0x10083be
and edi, 0xffff
or edi, 0x80070000
mov eax, edi
pop edi
jmp 0x10083da
push 0x1003648
push dword [0x100a31c]
call fcn.01008041
pop ecx
pop ecx
mov eax, 0x80070005
pop esi
pop ebx
ret
Function at 0x40148a
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x124
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x1000
call sym._OpenProcess_12
sub esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x401537
mov dword [ebp - 0x10], 0x104
mov eax, dword [ebp - 0x10]
mov dword [esp + 8], eax
lea eax, [ebp - 0x116]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._GetProcessImageFileNameA_12
sub esp, 0xc
test eax, eax
setne al
test al, al
je 0x401529
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
lea eax, [ebp - 0x12]
mov ecx, eax
call fcn.00402388
lea eax, [ebp - 0x12]
mov dword [esp + 4], eax
lea eax, [ebp - 0x116]
mov dword [esp], eax
mov ecx, dword [ebp + 8]
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_char_const__std::allocator_char__const_
sub esp, 8
lea eax, [ebp - 0x12]
mov ecx, eax
call sym.std::allocator_char_::allocator__
jmp 0x401592
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
lea eax, [ebp - 0x11]
mov ecx, eax
call fcn.00402388
lea eax, [ebp - 0x11]
mov dword [esp + 4], eax
mov dword [esp], 0x406065
mov ecx, dword [ebp + 8]
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_char_const__std::allocator_char__const_
sub esp, 8
lea eax, [ebp - 0x11]
mov ecx, eax
call sym.std::allocator_char_::allocator__
jmp 0x401592
mov eax, dword [ebp + 8]
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x40159a
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], 8
call sym._CreateToolhelp32Snapshot_8
sub esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x4015cc
mov eax, 0
jmp 0x401659
mov dword [ebp - 0x234], 0x224
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0x234]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._Module32First_8
sub esp, 8
test eax, eax
setne al
test al, al
je 0x401648
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
lea eax, [ebp - 0x234]
add eax, 0x20
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x401625
mov eax, dword [ebp - 0x218]
mov dword [ebp - 0xc], eax
jmp 0x401648
lea eax, [ebp - 0x234]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._Module32Next_8
sub esp, 8
test eax, eax
setne al
test al, al
je 0x401648
jmp 0x4015fe
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov eax, dword [ebp - 0xc]
leave
ret
Function at 0x40165b
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
mov dword [esp + 4], 0
mov dword [esp], 2
call sym._CreateToolhelp32Snapshot_8
sub esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x40168e
mov eax, 0
jmp 0x401721
mov dword [ebp - 0x134], 0x128
lea eax, [ebp - 0x134]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._Process32First_8
sub esp, 8
test eax, eax
setne al
test al, al
je 0x40170e
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
lea eax, [ebp - 0x134]
add eax, 0x24
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x4016eb
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov eax, dword [ebp - 0x12c]
jmp 0x401721
lea eax, [ebp - 0x134]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._Process32Next_8
sub esp, 8
test eax, eax
setne al
test al, al
je 0x40170e
jmp 0x4016b9
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov eax, 0
leave
ret

Function at 0x401b8f
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
call sym._MH_Uninitialize_0
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], eax
mov dword [esp], sym.imp.libstdc_6.dll_std::cout
call sym.std::basic_ostream_char__std::char_traits_char____std::operator____char__std::char_traits_char___std::allocator_char____std::basic_ostream_char__std::char_traits_char_____std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
mov dword [esp], sym.std::basic_ostream_char__std::char_traits_char____std::endl_char__std::char_traits_char____std::basic_ostream_char__std::char_traits_char____
mov ecx, eax
call sym.std::ostream::operator___std::ostream____std::ostream__
sub esp, 4
mov dword [esp], 0x3e8
call sym._Sleep_4
sub esp, 4
call sym._FreeConsole_0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], sym.__Z11EjectThreadPv_4
mov dword [esp + 4], 0
mov dword [esp], 0
call sym._CreateThread_24
sub esp, 0x18
mov dword [esp + 0xc], 0x8000
mov dword [esp + 8], 0
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._VirtualFreeEx_16
sub esp, 0x10
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
nop
leave
ret
Function at 0x4029e0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x408078
call sym._EnterCriticalSection_4
mov ebx, dword [0x408070]
sub esp, 4
test ebx, ebx
je 0x402a2b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x402a24
test esi, esi
je 0x402a24
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x402a00
mov dword [esp], 0x408078
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x402c10
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x402c60
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x402d38
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x402c9e
cmp eax, 4
jne 0x402cc0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x402cae
cmp edx, 4
je 0x402cae
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00402c10
Function at 0x4011e0
Capabilities:
Hide graphical window

Disassembly:
push esi
push edi
push 0
push dword [0x41a000]
mov edi, dword [sym.imp.USER32.dll_CreateWindowExW]
mov esi, ecx
push 0
push dword [esi + 4]
lea eax, [esi + 0xc]
push 0x13a
push 0x1f1
push 0
push 0
push 0x40000000
push 0x4156d4
push eax
push 0x10000
call edi
mov dword [esi], eax
test eax, eax
jne 0x401225
pop edi
pop esi
ret 4
push 0
push dword [0x41a000]
push 0
push eax
push 0x14
push 0x1f7
push 0x3a
push 0
push 0x50000010
push 0x4156d4
push str.Static
push 0
call edi
mov ecx, esi
call fcn.00401120
push 0
push dword [0x41a000]
push 0x9c6
push dword [esi]
push 0x28
push 0x1a4
push 0x4d
push 0x28
push 0x50000000
push 0x4156d4
push str.Static
push 0
call edi
mov edi, eax
test edi, edi
je 0x4012a7
push 1
push dword [0x41a004]
push 0x30
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [esi + 0x264]
push eax
push edi
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov ecx, esi
call fcn.004014f0
push 0
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi]
call dword [sym.imp.USER32.dll_UpdateWindow]
pop edi
mov eax, 1
pop esi
ret 4
Function at 0x401650
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
test edx, edx
je 0x4017b2
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x4017b2
mov eax, dword [ebp + 0x10]
cmp eax, 1
jb 0x4017b2
push esi
xor esi, esi
test eax, eax
je 0x4017a7
dec eax
push ebx
mov bl, byte [ebp + 0xa]
shr eax, 2
inc eax
push edi
lea edi, [ecx + 2]
mov dword [ebp + 0xc], eax
mov dl, byte [edi - 2]
cmp dl, 0x2b
jne 0x40169c
mov dl, 0x3e
jmp 0x4016ca
cmp dl, 0x2f
jne 0x4016a5
mov dl, 0x3f
jmp 0x4016ca
cmp dl, 0x39
jg 0x4016af
add dl, 4
jmp 0x4016ca
cmp dl, 0x3d
je 0x4016c8
cmp dl, 0x5a
jg 0x4016be
sub dl, 0x41
jmp 0x4016ca
cmp dl, 0x7a
jg 0x4016c8
sub dl, 0x47
jmp 0x4016ca
mov dl, 0x40
mov cl, byte [edi - 1]
cmp cl, 0x2b
jne 0x4016d6
mov cl, 0x3e
jmp 0x401704
cmp cl, 0x2f
jne 0x4016df
mov cl, 0x3f
jmp 0x401704
cmp cl, 0x39
jg 0x4016e9
add cl, 4
jmp 0x401704
cmp cl, 0x3d
je 0x401702
cmp cl, 0x5a
jg 0x4016f8
sub cl, 0x41
jmp 0x401704
cmp cl, 0x7a
jg 0x401702
sub cl, 0x47
jmp 0x401704
mov cl, 0x40
mov al, cl
shl dl, 2
shr al, 4
add al, dl
mov edx, dword [ebp + 8]
mov byte [esi + edx], al
inc esi
mov al, byte [edi]
cmp al, 0x3d
je 0x40175d
mov bl, al
cmp bl, 0x2b
jne 0x401726
mov bl, 0x3e
jmp 0x40174f
cmp bl, 0x2f
jne 0x40172f
mov bl, 0x3f
jmp 0x40174f
cmp bl, 0x39
jg 0x401739
add bl, 4
jmp 0x40174f
cmp bl, 0x5a
jg 0x401743
sub bl, 0x41
jmp 0x40174f
cmp bl, 0x7a
jg 0x40174d
sub bl, 0x47
jmp 0x40174f
mov bl, 0x40
mov al, bl
shl cl, 4
shr al, 2
add al, cl
mov byte [esi + edx], al
inc esi
mov al, byte [edi + 1]
cmp al, 0x3d
je 0x401799
cmp al, 0x2b
jne 0x40176c
mov al, 0x3e
jmp 0x40178e
cmp al, 0x2f
jne 0x401774
mov al, 0x3f
jmp 0x40178e
cmp al, 0x39
jg 0x40177c
add al, 4
jmp 0x40178e
cmp al, 0x5a
jg 0x401784
sub al, 0x41
jmp 0x40178e
cmp al, 0x7a
jg 0x40178c
sub al, 0x47
jmp 0x40178e
mov al, 0x40
mov cl, bl
shl cl, 6
add cl, al
mov byte [esi + edx], cl
inc esi
add edi, 4
dec dword [ebp + 0xc]
jne 0x401690
pop edi
pop ebx
mov byte [esi + edx], 0
mov eax, esi
pop esi
pop ebp
ret 0xc
xor eax, eax
pop ebp
ret 0xc
Function at 0x401da0
Capabilities:
Hide graphical window
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x1b4], 0
je 0x401dcf
push 0
push 0x41575c
push 0x415764
push dword [edi]
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea esi, [edi + 0x1b0]
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov eax, dword [esi]
cmp eax, 1
jne 0x401e05
mov eax, dword [edi + 0x194]
push 0
push dword [eax]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, edi
call fcn.00401da0
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp eax, 2
jne 0x401e20
mov ecx, dword [edi + 0x19c]
call fcn.00403c30
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp eax, 3
jne 0x401e4b
mov eax, dword [edi + 0x19c]
push 0
push dword [eax]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [edi + 0x1a0]
call fcn.00402500
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp eax, 4
jne 0x401e58
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x401e70
Capabilities:
Hide graphical window

Disassembly:
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0x1b0], 0
push edi
lea edi, [esi + 0x1b0]
jle 0x401e8b
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
mov eax, dword [edi]
test eax, eax
jne 0x401ea5
mov ecx, dword [esi + 0x194]
call fcn.004056c0
mov eax, 1
pop edi
pop esi
pop ecx
ret
cmp eax, 1
jne 0x401eca
mov eax, dword [esi + 0x19c]
push 0
push dword [eax]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, esi
call fcn.00401e70
mov eax, 1
pop edi
pop esi
pop ecx
ret
cmp eax, 2
jne 0x401eea
mov eax, dword [esi + 0x1a0]
push 0
push dword [eax]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esi + 0x19c]
call fcn.00403c30
pop edi
mov eax, 1
pop esi
pop ecx
ret

Function at 0x402010
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
lea eax, [ebp - 4]
mov dword [ebp - 8], 0x104
push eax
push 0x20219
push 0
push str.SOFTWAREwenguanjia
push 0x80000002
xor bl, bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40206e
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x14]
lea eax, [ebp - 0xc]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
test eax, eax
movzx ebx, bl
mov ecx, 1
cmove ebx, ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x402340
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
push 0
push dword [0x41a000]
mov esi, ecx
push 0
push dword [esi + 4]
lea eax, [esi + 0x14]
push 0x13a
push 0x1f1
push 0
push 0
push 0x40000000
push 0x4156d4
push eax
push 0x10000
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [esi], eax
test eax, eax
jne 0x402385
pop esi
pop ebp
ret 4
push 0
push dword [0x41a000]
push 0
push eax
push 0x14
push 0x1f7
push 0x3a
push 0
push 0x50000010
push 0x4156d4
push str.Static
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov ecx, esi
call fcn.00402210
mov ecx, esi
call fcn.004022d0
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi]
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, 1
pop esi
pop ebp
ret 4

Function at 0x402500
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
push edi
mov ebx, ecx
push 0xffffffffffffffeb
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
je 0x402568
mov ecx, dword [eax + 0x1a4]
mov esi, dword [eax + 0x1a8]
mov eax, dword [eax + 0x1ac]
mov dword [ebp - 4], eax
test ecx, ecx
je 0x40253e
push 0
push ecx
call edi
test esi, esi
je 0x40255c
push 1
push esi
call dword [sym.imp.USER32.dll_EnableWindow]
push 0x4158d8
push esi
call dword [sym.imp.USER32.dll_SetWindowTextW]
push 5
push esi
call edi
mov eax, dword [ebp - 4]
test eax, eax
je 0x402568
push 0
push eax
call edi
mov eax, dword [ebx]
test eax, eax
jne 0x4025d5
push 0x30
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.00408ec0
mov eax, dword [0x41a000]
add esp, 0xc
mov dword [ebp - 0x34], 0x30
mov dword [ebp - 0x30], 3
mov dword [ebp - 0x2c], 0x4023e0
push 5
mov dword [ebp - 0x20], eax
call dword [sym.imp.USER32.dll_GetSysColorBrush]
mov dword [ebp - 0x14], eax
lea eax, [ebx + 0x14]
push 0x7f00
push 0
mov dword [ebp - 0xc], eax
call dword [sym.imp.USER32.dll_LoadCursorW]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExW]
push 5
mov ecx, ebx
call fcn.00402340
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 5
push eax
call edi
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402b00
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 8]
test eax, eax
je 0x402b2b
push 0x4158fc
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov edi, dword [edi + 4]
test edi, edi
je 0x402b5a
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x408
push edi
call esi
inc eax
mov ecx, 0x64
cmp eax, ecx
push 0
cmovg eax, ecx
push eax
push 0x402
push edi
call esi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.00408ec0
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push eax
call fcn.00408ec0
add esp, 0x18
lea eax, [ebp - 0x20c]
push 0
push 0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x20c]
push 0x415910
push eax
call ebx
mov esi, dword [0x419ff8]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
test eax, eax
jne 0x402bdd
push 0x415dd8
push dword [esi + 8]
call edi
push dword [esi + 8]
lea eax, [ebp - 0x20c]
push eax
call ebx
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
call edi
push 0x415914
lea eax, [ebp - 0x20c]
push eax
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x20c]
push eax
call esi
mov eax, dword [0x419ff8]
cmp dword [eax + 0x28], 0
jne 0x402c38
push 0x415920
lea eax, [ebp - 0x414]
push eax
call ebx
lea eax, [ebp - 0x414]
push eax
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004057df
mov esp, ebp
pop ebp
ret
Function at 0x403110
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x214
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 8]
test eax, eax
je 0x403142
push 0x415bc4
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov ebx, dword [edi + 4]
test ebx, ebx
je 0x403171
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x408
push ebx
call esi
inc eax
mov ecx, 0x64
cmp eax, ecx
push 0
cmovg eax, ecx
push eax
push 0x402
push ebx
call esi
push dword [edi + 8]
mov eax, dword [0x419ff8]
push dword [edi + 4]
push dword [eax]
push ecx
call fcn.00404a20
xor eax, eax
push 0x206
push eax
mov word [esp + 0x18], ax
lea eax, [esp + 0x1a]
push eax
call fcn.00408ec0
add esp, 0xc
lea eax, [esp + 0x10]
push 0
push 0x23
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [esp + 0x10]
push 0x415910
push eax
call ebx
mov esi, dword [0x419ff8]
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x4031e7
push str.wenguanjia
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push dword [esi + 0xc]
lea eax, [esp + 0x14]
push eax
call ebx
push str._Data_
lea eax, [esp + 0x14]
push eax
call ebx
push dword [edi + 8]
mov ecx, dword [0x41a00c]
lea eax, [esp + 0x14]
push dword [edi + 4]
push eax
call fcn.00404730
mov ecx, dword [esp + 0x21c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004057df
mov esp, ebp
pop ebp
ret