joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4474e0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54e129
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x5c5244]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov edi, 1
push 0x208
push 0
lea eax, [ebp - 0x21c]
push eax
call fcn.004f39e0
add esp, 0xc
push dword [esi + 0x10]
push 0x104
lea eax, [ebp - 0x21c]
push eax
push 0x56c9a8
push str.jump_url_time
push str.Lockhp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov dword [ebp - 4], 0
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x228], 0
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x220]
push eax
push 0x572284
lea eax, [ebp - 0x21c]
push eax
call fcn.00437f30
add esp, 0x14
cmp eax, 3
jne 0x4476be
mov edx, dword [ebp - 0x220]
mov eax, 0x76c
cmp edx, eax
cmovl edx, eax
mov dword [ebp - 0x220], edx
mov ecx, dword [ebp - 0x224]
cmp ecx, edi
jl 0x4475ce
cmp ecx, 0xc
jle 0x4475d9
mov ecx, 1
mov dword [ebp - 0x224], ecx
mov eax, dword [ebp - 0x228]
cmp eax, 1
jl 0x4475e9
cmp eax, 0x1f
jle 0x4475f4
mov eax, 1
mov dword [ebp - 0x228], eax
push 0xffffffffffffffff
push 0
push 0
push 0
push eax
push ecx
push edx
lea ecx, [ebp - 0x230]
call fcn.00442e40
push 0
call fcn.00522deb
add esp, 4
sub eax, dword [ebp - 0x230]
sbb edx, dword [ebp - 0x22c]
mov dword [ebp - 0x230], eax
mov dword [ebp - 0x22c], edx
mov eax, dword [0x5cc38c]
test al, 1
jne 0x447657
or eax, 1
mov dword [0x5cc38c], eax
mov byte [ebp - 4], 1
push 0
push 0
push 0
push 2
mov ecx, 0x5cc384
call fcn.00442ef0
mov byte [ebp - 4], 0
push str._Dday_Hh_Mm_Ss
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x230]
call fcn.00444bb0
mov byte [ebp - 4], 2
push dword [ebp - 0x234]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push str.__tid:_d__PopHomePageLock_span:_s
call fcn.00492250
add esp, 0xc
push dword [0x5cc388]
push dword [0x5cc384]
lea ecx, [ebp - 0x230]
call fcn.004438f0
xor ecx, ecx
test al, al
cmovne edi, ecx
mov dword [ebp - 0x238], edi
mov byte [ebp - 4], cl
lea ecx, [ebp - 0x234]
call fcn.00427700
mov dword [ebp - 4], 0xffffffff
mov eax, edi
jmp 0x4476e6
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004da3bd
mov esp, ebp
pop ebp
ret
Function at 0x447f30
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54e239
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x5c5244]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov edi, 1
push 0x208
push 0
lea eax, [ebp - 0x21c]
push eax
call fcn.004f39e0
add esp, 0xc
push dword [esi + 0x10]
push 0x104
lea eax, [ebp - 0x21c]
push eax
push 0x56c9a8
push str.pop_hp_check_time
push str.general
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov dword [ebp - 4], 0
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x228], 0
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x220]
push eax
push 0x572284
lea eax, [ebp - 0x21c]
push eax
call fcn.00437f30
add esp, 0x14
cmp eax, 3
jne 0x44810e
mov edx, dword [ebp - 0x220]
mov eax, 0x76c
cmp edx, eax
cmovl edx, eax
mov dword [ebp - 0x220], edx
mov ecx, dword [ebp - 0x224]
cmp ecx, edi
jl 0x44801e
cmp ecx, 0xc
jle 0x448029
mov ecx, 1
mov dword [ebp - 0x224], ecx
mov eax, dword [ebp - 0x228]
cmp eax, 1
jl 0x448039
cmp eax, 0x1f
jle 0x448044
mov eax, 1
mov dword [ebp - 0x228], eax
push 0xffffffffffffffff
push 0
push 0
push 0
push eax
push ecx
push edx
lea ecx, [ebp - 0x230]
call fcn.00442e40
push 0
call fcn.00522deb
add esp, 4
sub eax, dword [ebp - 0x230]
sbb edx, dword [ebp - 0x22c]
mov dword [ebp - 0x230], eax
mov dword [ebp - 0x22c], edx
mov eax, dword [0x5cc368]
test al, 1
jne 0x4480a7
or eax, 1
mov dword [0x5cc368], eax
mov byte [ebp - 4], 1
push 0
push 0
push 0
push 1
mov ecx, 0x5cc360
call fcn.00442ef0
mov byte [ebp - 4], 0
push str._Dday_Hh_Mm_Ss
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x230]
call fcn.00444bb0
mov byte [ebp - 4], 2
push dword [ebp - 0x234]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push str.__tid:_d__PopHomePageLock_span:_s
call fcn.00492250
add esp, 0xc
push dword [0x5cc364]
push dword [0x5cc360]
lea ecx, [ebp - 0x230]
call fcn.004438f0
xor ecx, ecx
test al, al
cmovne edi, ecx
mov dword [ebp - 0x238], edi
mov byte [ebp - 4], cl
lea ecx, [ebp - 0x234]
call fcn.00427700
mov dword [ebp - 4], 0xffffffff
mov eax, edi
jmp 0x448136
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004da3bd
mov esp, ebp
pop ebp
ret
Function at 0x4483d0
Capabilities:
Read .ini file

Disassembly:
push esi
push edi
mov esi, ecx
call fcn.00449750
push dword [esi + 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 1
push str.WarnningWhenTempHigher
push str.Sensor
call edi
push dword [esi + 0x10]
xor ecx, ecx
cmp ecx, eax
push ecx
sbb eax, eax
push str.PowerSaveStarting
neg eax
push str.PowerSave
mov dword [esi + 0x2c], eax
call edi
test eax, eax
je 0x44842b
push dword [esi + 0x10]
push 0
push str.SchemeIndex
push str.PowerSave
call edi
test eax, eax
je 0x44842b
mov eax, 1
jmp 0x44842d
xor eax, eax
push dword [esi + 0x10]
mov dword [esi + 0x1c], eax
push 0
push str.SchemeIndex
push str.PowerSave
call edi
push dword [esi + 0x10]
mov dword [esi + 0x20], eax
push 0
push str.WallPaper
push str.PowerSave
call edi
push dword [esi + 0x10]
mov dword [esi + 0x48], eax
push 1
push str.ScreenSaver
push str.PowerSave
call edi
push dword [esi + 0x10]
mov dword [esi + 0x4c], eax
push 0xfffffffffffffffe
push str.MonitorBright
push str.PowerSave
call edi
neg eax
sbb eax, eax
dec eax
mov dword [esi + 0x50], eax
push dword [esi + 0x10]
push 0xfffffffffffffffe
push str.Standby
push str.PowerSave
call edi
push dword [esi + 0x10]
mov dword [esi + 0x54], eax
push 0xfffffffffffffffe
push str.ScreenOff
push str.PowerSave
call edi
push dword [esi + 0x10]
mov dword [esi + 0x58], eax
push 0xffffffffffffffff
push str.ShowMonitor
push str.General
call edi
mov ecx, eax
cmp ecx, 0xffffffff
jne 0x4484d3
call fcn.00445d30
dec eax
neg eax
sbb eax, eax
neg eax
jmp 0x4484da
xor eax, eax
test ecx, ecx
setg al
mov dword [esi + 0x24], eax
push dword [esi + 0x10]
push 1
push str.ShowBand
push str.General
call edi
push dword [esi + 0x10]
xor ecx, ecx
cmp ecx, eax
push 1
sbb eax, eax
push str.AutoStart2
neg eax
push str.General
mov dword [esi + 0x28], eax
call edi
push dword [esi + 0x10]
xor ecx, ecx
cmp ecx, eax
push 5
sbb eax, eax
push str.Delay
neg eax
push 0x572318
mov dword [esi + 0x44], eax
call edi
cmp eax, 1
mov ecx, 5
pop edi
cmovl eax, ecx
mov dword [esi + 0x5c], eax
pop esi
ret

Function at 0x448690
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54e330
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x5c5244]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov eax, dword [esi]
cmp dword [eax - 0xc], 0
je 0x448711
lea eax, [ebp + 8]
push eax
call fcn.00494bf0
add esp, 4
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0xc]
add ecx, ecx
push ecx
push eax
push 1
push dword [esi]
push str.SOFTWAREQiLu_Inc.Mobile
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x448711
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x448b80
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54e468
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5c5244]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push dword [esi + 0x10]
push 0x64
push str.BandShowItem
push str.General
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, 0x6e
cmp eax, ecx
cmovl ecx, eax
mov eax, 0x64
cmp ecx, eax
cmovl ecx, eax
cmp dword [ebp + 8], ecx
je 0x448c3b
call fcn.004287b0
mov ecx, eax
test ecx, ecx
je 0x448c4d
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 1
lea eax, [ebp - 0x10]
push dword [ebp + 8]
push 0x57184c
push eax
call fcn.0042de00
add esp, 0xc
push dword [esi + 0x10]
mov esi, dword [ebp - 0x10]
push esi
push str.BandShowItem
push str.General
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x448c3b
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.004225f0
int3

Function at 0x449750
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, ecx
push ebx
push esi
push edi
lea esi, [eax + 8]
mov dword [ebp - 0x18], eax
mov dword [ebp - 8], esi
mov edi, 0x5c4470
mov ebx, 4
nop
push dword [eax + 0x10]
push dword [edi + 8]
push dword [edi + 4]
push str.Sensor
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov esi, dword [esi]
mov dword [ebp - 0x14], eax
mov eax, esi
mov ecx, dword [esi + 4]
cmp byte [ecx + 0xd], 0
jne 0x4497aa
mov edx, dword [edi]
cmp dword [ecx + 0x10], edx
jge 0x4497a0
mov ecx, dword [ecx + 8]
jmp 0x4497a4
mov esi, ecx
mov ecx, dword [ecx]
cmp byte [ecx + 0xd], 0
je 0x449796
cmp esi, eax
je 0x4497b5
mov eax, dword [edi]
cmp eax, dword [esi + 0x10]
jge 0x4497e2
mov ecx, dword [ebp - 8]
lea eax, [ebp - 1]
push eax
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], edi
push eax
push 0x57162e
call fcn.00441e10
mov ecx, dword [ebp - 8]
push eax
add eax, 0x10
push eax
push esi
lea eax, [ebp - 0x10]
push eax
call fcn.004422e0
mov esi, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
add edi, 0xc
mov dword [esi + 0x14], eax
mov esi, dword [ebp - 8]
mov eax, dword [ebp - 0x18]
sub ebx, 1
jne 0x449770
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44b030
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x5c5244]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x18]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x44b0a8
push esi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], 1
push eax
push 0x572b20
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push 0
push 0
push 0x10
lea eax, [ebp - 0x14]
mov dword [ebp - 8], 2
push eax
push 0
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push dword [ebp - 0x18]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004da3bd
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.004da3bd
mov esp, ebp
pop ebp
ret

Function at 0x44b1b0
Capabilities:
Enumerate processes
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x5a7318
push 0x4f3b80
mov eax, dword fs:[0]
push eax
sub esp, 0x2c0
mov eax, dword [0x5c5244]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
call fcn.0044b030
jmp 0x44b200
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 0x9c], 0x40
push 0x3c
push 0
lea eax, [ebp - 0x98]
push eax
call fcn.004f39e0
add esp, 0xc
lea eax, [ebp - 0x9c]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
xor esi, esi
mov dword [ebp - 0x2cc], esi
push esi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
je 0x44b27f
push 0x228
push esi
lea eax, [ebp - 0x2c4]
push eax
call fcn.004f39e0
add esp, 0xc
mov dword [ebp - 0x2c8], 0x22c
lea eax, [ebp - 0x2c8]
push eax
push edi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x44b29f
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
xor edx, edx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.004da3bd
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x2d0], eax
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x2c0]
cmp eax, ecx
je 0x44b2eb
push ecx
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x44b2e5
push esi
call sub.PSAPI.DLL_EmptyWorkingSet
push esi
call ebx
mov esi, 1
mov dword [ebp - 0x2cc], esi
jmp 0x44b2eb
mov esi, dword [ebp - 0x2cc]
lea eax, [ebp - 0x2c8]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
mov eax, dword [ebp - 0x2d0]
jne 0x44b2b1
push edi
call ebx
test esi, esi
je 0x44b27f
mov dword [ebp - 0x5c], 0x40
push 0x3c
push 0
lea eax, [ebp - 0x58]
push eax
call fcn.004f39e0
add esp, 0xc
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov eax, dword [ebp - 0x4c]
sub eax, dword [ebp - 0x8c]
mov edx, dword [ebp - 0x48]
sbb edx, dword [ebp - 0x88]
jmp 0x44b283
Function at 0x450fb0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54fb3d
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x5c5244]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x218]
push 0x208
push 0
mov dword [ebp - 0x220], edi
push eax
mov dword [ebp - 0x21c], 0
call fcn.004f39e0
add esp, 0xc
lea eax, [ebp - 0x218]
push dword [esi + 0x1c]
push 0x104
push eax
push 0x56c9a8
push 0x572ebc
push str.HardwareInfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
call fcn.00430a50
mov ecx, eax
test ecx, ecx
je 0x4510be
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov dword [ebp - 4], 1
lea eax, [ebp - 0x218]
test eax, 0xffff0000
jne 0x451066
movzx eax, ax
mov ecx, edi
push eax
call fcn.004301d0
jmp 0x45108e
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x451070
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
mov ecx, edi
call fcn.00429710
mov dword [ebp - 4], 0
mov dword [ebp - 0x21c], 1
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004da3bd
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.004225f0
int3
Function at 0x452010
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x18], 0
je 0x45201d
xor eax, eax
pop esi
ret
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push esi
push 0
push esi
push 0x4522b0
push 0
push 0
mov dword [esi + 0x18], eax
call fcn.00510ce2
xor ecx, ecx
mov dword [esi + 8], eax
add esp, 0x18
test eax, eax
setne cl
mov eax, ecx
pop esi
ret

Function at 0x452060
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x14], 0
je 0x45206d
xor eax, eax
pop esi
ret
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ecx, dword [esi + 4]
mov dword [esi + 0x14], eax
test ecx, ecx
jne 0x45209c
push esi
push ecx
push esi
push 0x452290
push ecx
push ecx
call fcn.00510ce2
mov ecx, eax
add esp, 0x18
mov dword [esi + 4], ecx
xor eax, eax
test ecx, ecx
pop esi
setne al
ret
Function at 0x4526b0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54febd
mov eax, dword fs:[0]
push eax
sub esp, 0x14c
mov eax, dword [0x5c5244]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x134], esi
mov dword [ebp - 0x130], 0
cmp word [0x5cc3a8], 0
jne 0x452805
push 0x104
push 0x5cc3a8
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x5cc3a8
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov eax, dword [0x5c44c0]
test eax, eax
js 0x45272f
xor ecx, ecx
test eax, eax
setne cl
jmp 0x4527ea
push 0x11c
xorps xmm0, xmm0
mov dword [0x5c44c0], 0
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x138], 0
push 0
push eax
movups xmmword [ebp - 0x158], xmm0
movups xmmword [ebp - 0x148], xmm0
call fcn.004f39e0
add esp, 0xc
mov dword [ebp - 0x12c], 0x11c
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x4527a0
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x12c], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4527e8
push str.GetNativeSystemInfo
push 0x56ef78
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4527e8
lea ecx, [ebp - 0x158]
push ecx
call eax
mov ax, word [ebp - 0x158]
cmp ax, 9
je 0x4527d7
cmp ax, 6
jne 0x4527e8
mov dword [0x5c44c0], 1
mov ecx, 1
jmp 0x4527ea
xor ecx, ecx
test ecx, ecx
mov edx, str.HardwareProtect.sys
mov eax, str.HardwareProtect_x64.sys
cmove eax, edx
push eax
push 0x5cc3a8
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
call fcn.004287b0
mov ecx, eax
test ecx, ecx
je 0x452899
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [esi], eax
mov dword [ebp - 4], 1
mov eax, 0x5cc3a8
test eax, 0xffff0000
jne 0x452840
movzx eax, ax
mov ecx, esi
push eax
call fcn.004301d0
jmp 0x45286c
mov ecx, 0x5cc3a8
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x452850
sub ecx, edx
sar ecx, 1
push ecx
push 0x5cc3a8
mov ecx, esi
call fcn.00429710
mov dword [ebp - 4], 0
mov dword [ebp - 0x130], 1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004da3bd
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.004225f0
int3
Function at 0x4563d0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x5c5244]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x118
lea eax, [ebp - 0x11c]
mov edi, ecx
push 0
push eax
call fcn.004f39e0
add esp, 0xc
mov dword [ebp - 0x120], 0x11c
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 6
jb 0x456441
push 0
call dword [sym.imp.USER32.dll_GetDC]
push edi
push 0x456190
mov esi, eax
push 0
push esi
call dword [sym.imp.GDI32.dll_EnumFontFamiliesW]
push esi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
jmp 0x456445
or dword [edi + 0xc], 8
mov eax, dword [edi + 0xc]
test al, 0x20
je 0x45645c
push str.Tahoma
lea ecx, [edi + 8]
call fcn.004310a0
mov eax, dword [edi + 0xc]
test al, 0x10
je 0x456470
push 0x573bec
lea ecx, [edi + 8]
call fcn.004310a0
mov eax, dword [edi + 0xc]
test al, 8
je 0x456484
push 0x573be4
lea ecx, [edi + 8]
call fcn.004310a0
mov eax, dword [edi + 0xc]
test al, 4
je 0x456498
push str.Microsoft_YaHei_UI
lea ecx, [edi + 8]
call fcn.004310a0
mov eax, dword [edi + 0xc]
test al, 2
je 0x4564ac
push str.Microsoft_YaHei
lea ecx, [edi + 8]
call fcn.004310a0
mov eax, dword [edi + 0xc]
test al, 1
je 0x4564bd
push 0x573b90
lea ecx, [edi + 8]
call fcn.004310a0
push dword [edi + 8]
push 0x20
push 0
push 0
push 0
push 0x86
push 0
push 0
push 0
push 0x190
push 0
push 0
push 0
push 0xfffffffffffffff4
call dword [sym.imp.GDI32.dll_CreateFontW]
mov ecx, dword [ebp - 4]
mov dword [edi + 4], eax
xor ecx, ebp
pop edi
pop esi
call fcn.004da3bd
mov esp, ebp
pop ebp
ret
Function at 0x4571a0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x550feb
mov eax, dword fs:[0]
push eax
sub esp, 0x418
mov eax, dword [0x5c5244]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
lea esi, [ebx + 0x20]
push esi
mov dword [ebp - 0x424], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 4], 0
cmp dword [ebx + 0x1c], 0
jne 0x4572fc
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.004f39e0
add esp, 0xc
lea eax, [ebp - 0x420]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004f39e0
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.00521a1c
add esp, 0x18
lea eax, [ebp - 0x218]
push str.DrvMgr360NetUL.dll
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push eax
call fcn.004cf4a0
add esp, 4
test eax, eax
jne 0x457290
mov dword [ebp - 4], 0xffffffff
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
jmp 0x45733d
mov dword [ebx + 0x1c], 1
cmp dword [ebx], 0
jne 0x4572fc
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebx], eax
test eax, eax
je 0x4572fc
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.HttpInit
push eax
call edi
push str.HttpUninit
push dword [ebx]
mov dword [ebx + 4], eax
call edi
push str.zlib_uncompress
push dword [ebx]
mov dword [ebx + 8], eax
call edi
push str.zlib_compress
push dword [ebx]
mov dword [ebx + 0x10], eax
call edi
push str.zlib_compressBound
push dword [ebx]
mov dword [ebx + 0x14], eax
call edi
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 4]
test eax, eax
je 0x4572fc
call eax
mov dword [ebx + 0xc], eax
mov dword [ebp - 4], 0xffffffff
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebx + 0xc]
test ecx, ecx
je 0x457339
mov eax, dword [ecx]
call dword [eax]
mov esi, eax
test esi, esi
je 0x45733b
mov eax, dword [esi]
mov ecx, esi
push 0
push str.ungzip
call dword [eax + 0x30]
mov eax, dword [esi]
mov ecx, esi
push 0
push str.gzip
call dword [eax + 0x30]
jmp 0x45733b
xor esi, esi
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004da3bd
mov esp, ebp
pop ebp
ret