joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41d1c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
test edi, edi
jne 0x41d1cf
push 0x80004005
call fcn.00404c70
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push edi
push esi
lea eax, [esp + 8]
push eax
mov eax, dword [edx]
push 0
push ecx
push eax
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test esi, esi
je 0x41d247
mov ecx, dword [edi]
test ecx, ecx
jbe 0x41d242
mov edx, dword [esp]
test edx, edx
jbe 0x41d23d
cmp edx, 2
jbe 0x41d22e
cmp edx, 7
jne 0x41d23d
test cl, 1
jne 0x41d23d
shr ecx, 1
cmp ecx, 1
jb 0x41d23d
cmp word [esi + ecx*2 - 2], 0
jne 0x41d23d
cmp ecx, 1
jbe 0x41d247
cmp word [esi + ecx*2 - 4], 0
jmp 0x41d23b
test cl, 1
jne 0x41d23d
shr ecx, 1
cmp word [esi + ecx*2 - 2], 0
je 0x41d247
mov eax, 0xd
mov word [esi], 0
pop ecx
ret 8

Function at 0x41d2d0
Capabilities:
Check os version

Disassembly:
sub esp, 0x120
mov eax, dword [0x485300]
xor eax, esp
mov dword [esp + 0x11c], eax
push esi
push 0x11c
lea eax, [esp + 8]
push 0
push eax
call fcn.00447890
mov esi, dword [sym.imp.KERNEL32.DLL_GetVersionExW]
add esp, 0xc
lea ecx, [esp + 4]
push ecx
mov dword [esp + 8], 0x11c
call esi
test eax, eax
jne 0x41d325
lea edx, [esp + 4]
push edx
mov dword [esp + 8], 0x114
call esi
test eax, eax
je 0x41d34e
cmp dword [esp + 8], 6
jne 0x41d34e
cmp dword [esp + 0xc], 0
jne 0x41d34e
mov eax, 1
pop esi
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.0044266a
add esp, 0x120
ret
mov ecx, dword [esp + 0x120]
pop esi
xor ecx, esp
xor eax, eax
call fcn.0044266a
add esp, 0x120
ret

Function at 0x41d370
Capabilities:
Check os version

Disassembly:
sub esp, 0x120
mov eax, dword [0x485300]
xor eax, esp
mov dword [esp + 0x11c], eax
push esi
push 0x11c
lea eax, [esp + 8]
push 0
push eax
call fcn.00447890
mov esi, dword [sym.imp.KERNEL32.DLL_GetVersionExW]
add esp, 0xc
lea ecx, [esp + 4]
push ecx
mov dword [esp + 8], 0x11c
call esi
test eax, eax
jne 0x41d3c5
lea edx, [esp + 4]
push edx
mov dword [esp + 8], 0x114
call esi
test eax, eax
je 0x41d3d7
cmp dword [esp + 8], 6
jne 0x41d3d7
mov eax, 1
cmp dword [esp + 0xc], eax
jae 0x41d3d9
xor eax, eax
mov ecx, dword [esp + 0x120]
pop esi
xor ecx, esp
call fcn.0044266a
add esp, 0x120
ret
Function at 0x41dbd0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x214
mov eax, dword [0x485300]
xor eax, esp
mov dword [esp + 0x210], eax
test esi, esi
mov eax, dword [esp + 0x218]
jne 0x41dc06
xor eax, eax
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.0044266a
add esp, 0x214
ret
push ebx
lea ecx, [esp + 4]
push ecx
push 0x20019
push 0
push eax
push closesocket
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41dcb5
mov ebx, dword [esp + 4]
test ebx, ebx
je 0x41dcb5
push 0x206
push eax
lea edx, [esp + 0x16]
push edx
mov word [esp + 0x18], ax
call fcn.00447890
add esp, 0xc
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x10]
push ecx
push 0
push 0
push edi
push ebx
mov dword [esp + 0x20], 0x207
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41dcaa
push 0x103
lea edx, [esp + 0x10]
push edx
push esi
call fcn.00443086
mov eax, dword [esp + 0x10]
add esp, 0xc
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.0044266a
add esp, 0x214
ret
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x214]
pop ebx
xor ecx, esp
xor eax, eax
call fcn.0044266a
add esp, 0x214
ret
Function at 0x41df80
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push esi
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0xc]
push edx
xor esi, esi
push esi
push eax
push ecx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [esp + 4], 4
jne 0x41dfbc
cmp eax, esi
lea eax, [esi + 1]
je 0x41dfbe
mov eax, esi
pop esi
add esp, 8
ret
Function at 0x41e000
Capabilities:
Delete registry value

Disassembly:
push 0xffffffffffffffff
push 0x466828
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x485300]
xor eax, esp
mov dword [esp + 0x40], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x485300]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x60], ebx
call fcn.0041d2d0
test eax, eax
jne 0x41e0b1
call fcn.0041d370
test eax, eax
jne 0x41e0b1
lea eax, [esp + 0x14]
push eax
push 0x2001f
push ebx
push str.SOFTWARETencentQQPinyin
push closesocket
mov dword [esp + 0x28], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x41e1de
mov esi, dword [esp + 0x14]
push str.SnapShotSaveMBlogPath
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp esi, ebx
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, eax
je 0x41e096
push esi
call ebp
xor esi, esi
xor ecx, ecx
cmp edi, ebx
sete cl
cmp esi, ebx
mov edi, ecx
je 0x41e1c3
push esi
call ebp
mov eax, edi
jmp 0x41e1e0
mov dword [esp + 0x50], 7
mov dword [esp + 0x4c], ebx
mov word [esp + 0x3c], bx
lea ecx, [esp + 0x1c]
mov byte [esp + 0x60], 1
call fcn.0041d3f0
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x40]
mov byte [esp + 0x68], 2
call fcn.00403b80
mov esi, 8
mov byte [esp + 0x60], 1
cmp dword [esp + 0x34], esi
jb 0x41e0fe
mov edx, dword [esp + 0x20]
push edx
call fcn.00442665
add esp, 4
push 1
push 0x46aecc
lea ecx, [esp + 0x40]
call fcn.00408230
mov eax, str.SOFTWARETencentQQPinyin
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x41e116
sub eax, edx
sar eax, 1
push eax
push str.SOFTWARETencentQQPinyin
lea ecx, [esp + 0x40]
call fcn.00408230
cmp dword [esp + 0x50], esi
mov eax, dword [esp + 0x3c]
jae 0x41e142
lea eax, [esp + 0x3c]
lea ecx, [esp + 0x14]
push ecx
push 0x2001f
push ebx
push eax
push reloc.WS2_32.dll_closesocket
mov dword [esp + 0x28], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x41e1c7
mov esi, dword [esp + 0x14]
push str.SnapShotSaveMBlogPath
push esi
mov dword [esp + 0x20], esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp esi, ebx
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, eax
je 0x41e18a
push esi
call ebp
xor esi, esi
mov dword [esp + 0x18], esi
xor edx, edx
cmp edi, ebx
sete dl
mov byte [esp + 0x60], bl
cmp dword [esp + 0x50], 8
mov edi, edx
jb 0x41e1ab
mov eax, dword [esp + 0x3c]
push eax
call fcn.00442665
add esp, 4
cmp esi, ebx
mov dword [esp + 0x50], 7
mov dword [esp + 0x4c], ebx
mov word [esp + 0x3c], bx
je 0x41e1c3
push esi
call ebp
mov eax, edi
jmp 0x41e1e0
mov byte [esp + 0x60], bl
cmp dword [esp + 0x50], esi
jb 0x41e1de
mov ecx, dword [esp + 0x3c]
push ecx
call fcn.00442665
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x40]
xor ecx, esp
call fcn.0044266a
add esp, 0x50
ret
Function at 0x41e570
Capabilities:
Check if file exists
Create directory
Get common file path

Disassembly:
sub esp, 0x214
mov eax, dword [0x485300]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
mov ebx, 1
test byte [0x4898d0], bl
mov dword [esp + 4], 0
jne 0x41e5c4
mov eax, dword [0x4874f4]
mov edx, dword [eax + 0xc]
or dword [0x4898d0], ebx
mov ecx, 0x4874f4
call edx
add eax, 0x10
push 0x467260
mov dword [0x4898cc], eax
call fcn.00442e97
add esp, 4
mov eax, dword [0x4898cc]
cmp dword [eax - 0xc], 0
jne 0x41e666
push 0x20a
lea ecx, [esp + 0xe]
push 0
push ecx
mov word [esp + 0x14], 0
call fcn.00447890
add esp, 0xc
push ebx
push 0x1a
lea edx, [esp + 0x10]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [esp + 8]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41e605
sub eax, edx
sar eax, 1
lea ecx, [esp + 8]
mov ebx, eax
push ecx
mov eax, 0x4898cc
call fcn.00405730
mov edx, dword [0x4898cc]
cmp dword [edx - 0xc], 0
jle 0x41e666
call fcn.0041d250
push 0x11
push str.TencentQQPinyin_
push 0x4898cc
call fcn.0040b130
mov eax, dword [0x4898cc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x41e666
mov ecx, dword [0x4898cc]
push eax
push ecx
push eax
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov eax, dword [0x4898cc]
add eax, 0xfffffff0
call fcn.00405820
mov ecx, dword [esp + 0x214]
add eax, 0x10
pop ebx
mov dword [edi], eax
xor ecx, esp
mov eax, edi
call fcn.0044266a
add esp, 0x214
ret

Function at 0x41e900
Capabilities:
Check mutex on windows

Disassembly:
push esi
push str.Tencent_Snapshot_Mutex_CD24F4FE_67E8_4d6e_95BA_2366F731DBB1
push 0
push 0x1f0001
mov esi, eax
call dword [sym.imp.KERNEL32.DLL_OpenMutexW]
test eax, eax
mov dword [esi + 4], eax
jne 0x41e961
push str.Tencent_Snapshot_Mutex_CD24F4FE_67E8_4d6e_95BA_2366F731DBB1
push 1
push eax
call dword [sym.imp.KERNEL32.DLL_CreateMutexW]
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0xb7
je 0x41e961
mov esi, dword [esi + 4]
test esi, esi
je 0x41e961
push 0x10100001
mov eax, esi
call fcn.004283a0
add esp, 4
test eax, eax
jne 0x41e95d
push esi
call fcn.00428470
add esp, 4
xor eax, eax
pop esi
ret
mov eax, 1
pop esi
ret
Function at 0x420b80
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x464f4b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x485300]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.004608b7
push 4
mov dword [esp + 0x20], 0
call fcn.004428f2
mov edi, eax
add esp, 4
test edi, edi
je 0x420c00
call fcn.004606b3
mov dword [edi], eax
call fcn.004604e7
push 0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.00460884
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x420bf5
add eax, 1
mov dword [ebx + 4], eax
lea ecx, [esp + 0x10]
call fcn.004608a5
jmp 0x420c02
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x4223b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x465b68
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
mov eax, dword [0x485300]
xor eax, esp
mov dword [esp + 0x64], eax
push esi
push edi
mov eax, dword [0x485300]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x2c]
mov esi, ecx
mov ecx, dword [ebp + 0x28]
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 0x24]
lea edi, [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x14], 0
call fcn.00416500
lea ecx, [esp + 0x14]
push ecx
push ecx
push eax
lea edx, [ebp + 0x18]
push edx
lea eax, [ebp + 0xc]
push eax
lea edx, [esp + 0x48]
mov ecx, esi
mov dword [esp + 0x94], 0
call fcn.00423100
add esp, 0x10
push eax
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x40]
push edx
call fcn.0046124e
fstp qword [esp + 0x3c]
mov dword [esp + 0x90], 0xffffffff
mov edi, dword [esp + 0x34]
add esp, 0x10
test edi, edi
je 0x4224a2
push 0
lea ecx, [esp + 0x2c]
call fcn.00460884
mov eax, dword [edi + 4]
test eax, eax
jbe 0x422480
cmp eax, 0xffffffff
jae 0x422480
add eax, 0xffffffff
mov dword [edi + 4], eax
mov esi, dword [edi + 4]
neg esi
sbb esi, esi
not esi
lea ecx, [esp + 0x28]
and esi, edi
call fcn.004608a5
test esi, esi
je 0x4224a2
mov eax, dword [esi]
mov edx, dword [eax]
push 1
mov ecx, esi
call edx
cmp byte [ebp + 0x14], 0
mov edi, dword [ebp + 0x10]
jne 0x4224e7
test edi, edi
je 0x4224e1
mov eax, dword [edi + 0x20]
cmp dword [eax], 0
je 0x4224c6
mov ecx, dword [edi + 0x30]
cmp dword [ecx], 0
jle 0x4224c6
mov edx, dword [eax]
movzx eax, word [edx]
jmp 0x4224d2
mov eax, dword [edi]
mov edx, dword [eax + 0x10]
mov ecx, edi
call edx
movzx eax, ax
movzx eax, ax
cmp ax, 0xffff
je 0x4224e1
mov word [ebp + 0x16], ax
jmp 0x4224e3
xor edi, edi
mov byte [ebp + 0x14], 1
cmp byte [ebp + 0x20], 0
mov esi, dword [ebp + 0x1c]
jne 0x42251f
test esi, esi
je 0x42251d
mov eax, dword [esi + 0x20]
cmp dword [eax], 0
je 0x42250b
mov ecx, dword [esi + 0x30]
cmp dword [ecx], 0
jle 0x42250b
mov edx, dword [eax]
movzx eax, word [edx]
jmp 0x422517
mov eax, dword [esi]
mov edx, dword [eax + 0x10]
mov ecx, esi
call edx
movzx eax, ax
cmp ax, 0xffff
jne 0x42251f
xor esi, esi
test edi, edi
jne 0x422548
test esi, esi
je 0x42254c
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x34]
cmp dword [esp + 0x18], ecx
je 0x422555
cmp dword [esp + 0x14], 0
jne 0x422555
fld qword [esp + 0x2c]
mov edx, dword [esp + 0x1c]
fstp qword [edx]
jmp 0x422558
test esi, esi
je 0x422527
mov eax, dword [esp + 0x10]
or dword [eax], 1
jmp 0x42252b
or dword [eax], 2
mov eax, dword [esp + 0x20]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x14]
mov dword [eax], ecx
mov dword [eax + 4], edi
mov dword [eax + 8], edx
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.0044266a
mov esp, ebp
pop ebp
ret 0x28
Function at 0x422590
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x465b68
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
mov eax, dword [0x485300]
xor eax, esp
mov dword [esp + 0x64], eax
push esi
push edi
mov eax, dword [0x485300]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x2c]
mov esi, ecx
mov ecx, dword [ebp + 0x28]
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 0x24]
lea edi, [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x14], 0
call fcn.00416500
lea ecx, [esp + 0x14]
push ecx
push ecx
push eax
lea edx, [ebp + 0x18]
push edx
lea eax, [ebp + 0xc]
push eax
lea edx, [esp + 0x48]
mov ecx, esi
mov dword [esp + 0x94], 0
call fcn.00423100
add esp, 0x10
push eax
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x40]
push edx
call fcn.00461010
fstp qword [esp + 0x3c]
mov dword [esp + 0x90], 0xffffffff
mov edi, dword [esp + 0x34]
add esp, 0x10
test edi, edi
je 0x422682
push 0
lea ecx, [esp + 0x2c]
call fcn.00460884
mov eax, dword [edi + 4]
test eax, eax
jbe 0x422660
cmp eax, 0xffffffff
jae 0x422660
add eax, 0xffffffff
mov dword [edi + 4], eax
mov esi, dword [edi + 4]
neg esi
sbb esi, esi
not esi
lea ecx, [esp + 0x28]
and esi, edi
call fcn.004608a5
test esi, esi
je 0x422682
mov eax, dword [esi]
mov edx, dword [eax]
push 1
mov ecx, esi
call edx
cmp byte [ebp + 0x14], 0
mov edi, dword [ebp + 0x10]
jne 0x4226c7
test edi, edi
je 0x4226c1
mov eax, dword [edi + 0x20]
cmp dword [eax], 0
je 0x4226a6
mov ecx, dword [edi + 0x30]
cmp dword [ecx], 0
jle 0x4226a6
mov edx, dword [eax]
movzx eax, word [edx]
jmp 0x4226b2
mov eax, dword [edi]
mov edx, dword [eax + 0x10]
mov ecx, edi
call edx
movzx eax, ax
movzx eax, ax
cmp ax, 0xffff
je 0x4226c1
mov word [ebp + 0x16], ax
jmp 0x4226c3
xor edi, edi
mov byte [ebp + 0x14], 1
cmp byte [ebp + 0x20], 0
mov esi, dword [ebp + 0x1c]
jne 0x4226ff
test esi, esi
je 0x4226fd
mov eax, dword [esi + 0x20]
cmp dword [eax], 0
je 0x4226eb
mov ecx, dword [esi + 0x30]
cmp dword [ecx], 0
jle 0x4226eb
mov edx, dword [eax]
movzx eax, word [edx]
jmp 0x4226f7
mov eax, dword [esi]
mov edx, dword [eax + 0x10]
mov ecx, esi
call edx
movzx eax, ax
cmp ax, 0xffff
jne 0x4226ff
xor esi, esi
test edi, edi
jne 0x422728
test esi, esi
je 0x42272c
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x34]
cmp dword [esp + 0x18], ecx
je 0x422735
cmp dword [esp + 0x14], 0
jne 0x422735
fld qword [esp + 0x2c]
mov edx, dword [esp + 0x1c]
fstp qword [edx]
jmp 0x422738
test esi, esi
je 0x422707
mov eax, dword [esp + 0x10]
or dword [eax], 1
jmp 0x42270b
or dword [eax], 2
mov eax, dword [esp + 0x20]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x14]
mov dword [eax], ecx
mov dword [eax + 4], edi
mov dword [eax + 8], edx
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.0044266a
mov esp, ebp
pop ebp
ret 0x28
Function at 0x426640
Capabilities:
Get file size

Disassembly:
sub esp, 0x10
push edi
mov edi, eax
lea eax, [esp + 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov ecx, dword [esp + 0xc]
push 0
push eax
push ecx
push 2
push 0
push edi
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.DLL_CreateFileMappingW]
test eax, eax
mov dword [esi + 8], eax
jne 0x42667a
call fcn.00415c90
pop edi
add esp, 0x10
ret
mov ecx, dword [esp + 8]
push 0
push ecx
mov dword [esi + 0x10], 0
mov edx, dword [esi + 0x10]
push edx
mov dword [esi + 4], ecx
mov dword [esi + 0x14], 0
mov ecx, dword [esi + 0x14]
push ecx
push 4
push eax
mov dword [esi + 0x18], 4
call dword [sym.imp.KERNEL32.DLL_MapViewOfFileEx]
test eax, eax
mov dword [esi], eax
jne 0x4266cf
call fcn.00415c90
mov edx, dword [esi + 8]
push edx
mov edi, eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dword [esi + 8], 0
mov eax, edi
pop edi
add esp, 0x10
ret
xor eax, eax
pop edi
add esp, 0x10
ret
Function at 0x426d30
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x4c
mov eax, dword [0x485300]
xor eax, esp
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x54]
push ebx
push ebp
mov ebp, dword [esp + 0x58]
push esi
push edi
xor esi, esi
push esi
push 0x80
push 4
push esi
push 1
push 0x40000000
push eax
mov dword [esp + 0x30], esi
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
cmp eax, 0xffffffff
jne 0x426e65
call fcn.00415c90
cmp eax, esi
jl 0x426e50
mov ebx, dword [esp + 0x14]
mov edi, dword [sym.imp.KERNEL32.DLL_SetFilePointer]
push esi
lea eax, [esp + 0x20]
push eax
push esi
push ebx
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], esi
call edi
cmp eax, 0xffffffff
jne 0x426da3
call fcn.00415c90
xor eax, eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x34], eax
push ecx
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], eax
mov dword [esp + 0x34], 0x51515346
mov dword [esp + 0x38], 0xad25d77
call dword [sym.imp.KERNEL32.DLL_GetLocalTime]
lea edx, [esp + 0x38]
push edx
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.DLL_SystemTimeToFileTime]
push esi
lea ecx, [esp + 0x1c]
push ecx
push 0x24
lea edx, [esp + 0x3c]
push edx
push ebx
mov dword [esp + 0x64], 0x30
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
jne 0x426e1b
call fcn.00415c90
mov esi, eax
test esi, esi
jl 0x426e43
mov eax, dword [esp + 0x50]
xor esi, esi
push esi
lea ecx, [esp + 0x20]
push ecx
push eax
push ebx
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], esi
call edi
cmp eax, 0xffffffff
jne 0x426e6e
call fcn.00415c90
cmp eax, esi
jge 0x426e6e
mov esi, eax
test ebx, ebx
je 0x426e4e
push ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.0044266a
add esp, 0x4c
ret 8
mov dword [esp + 0x14], eax
jmp 0x426d7d
xor eax, eax
add ebp, 0x2e8
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], 0x2e5
xor edi, edi
test byte [edi + 0x470db4], 2
jne 0x426ed5
mov ecx, dword [edi + 0x470db0]
cmp ecx, 0xa
ja case.default.0x426ea4
jmp dword [ecx*4 + 0x426f38]
mov edx, dword [ebp]
push edx
jmp 0x426ebb
mov ecx, dword [ebp]
push ecx
jmp 0x426ebb
mov eax, dword [ebp]
push eax
movzx ebx, word [edi + 0x470db6]
lea esi, [esp + 0x1c]
call fcn.00427320
mov ebx, dword [esp + 0x14]
xor esi, esi
cmp eax, esi
jl 0x426ee3
add edi, 0x18
add ebp, 4
cmp edi, 0x1cc8
jb 0x426e90
mov edx, dword [esp + 0x24]
push esi
mov esi, dword [esp + 0x20]
lea ecx, [esp + 0x1c]
push ecx
push edx
push esi
push ebx
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
jne 0x426f07
call fcn.00415c90
mov edi, eax
jmp 0x426f09
xor edi, edi
test esi, esi
je 0x426f16
push esi
call fcn.00444833
add esp, 4
test ebx, ebx
je 0x426f21
push ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ecx, dword [esp + 0x54]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0044266a
add esp, 0x4c
ret 8
Function at 0x427c70
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esi + 8]
test eax, eax
je 0x427cd0
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x427cd0
cmp dword [esp + 4], 0
jne 0x427cae
mov eax, dword [esi + 8]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esi + 8]
push 0x3e9
push ecx
call dword [sym.imp.USER32.dll_KillTimer]
mov dword [esi + 0x20], 0
ret 4
cmp dword [esi + 0x20], 0
jne 0x427cd0
mov edx, dword [esi + 0xc]
mov eax, dword [esi + 8]
push 0
push edx
push 0x3e9
push eax
call dword [sym.imp.USER32.dll_SetTimer]
mov dword [esi + 0x20], 1
ret 4

Function at 0x427e70
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x427ee8
cmp dword [esp + 8], 0x3e9
jne 0x427ee8
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x427ee8
push 4
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x3e9
push esi
call dword [sym.imp.USER32.dll_KillTimer]
push 0x213
push 0
push 0
push 0
push 0
push 0
push esi
call dword [sym.imp.USER32.dll_SetWindowPos]
push 0xffffffffffffffeb
push esi
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, eax
je 0x427ed2
mov dword [eax + 0x20], 0
call fcn.00427b70
test eax, eax
je 0x427ee8
push 0
push 0
push 0xf
push esi
call dword [sym.imp.USER32.dll_PostMessageW]
xor eax, eax
pop esi
ret 4
Function at 0x428170
Capabilities:
Hide graphical window

Disassembly:
push 0xffffffffffffffff
push 0x466198
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push edi
mov eax, dword [0x485300]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebx, edx
lea eax, [esp + 0xc]
push eax
call fcn.00405370
lea edi, [ebx + 0x18]
mov dword [esp + 0x28], 0
call fcn.004055e0
mov dword [esp + 0x28], 0xffffffff
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4281d9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [edi]
mov dword [ebx + 0xc], 0x1f4
cmp dword [ecx - 0xc], 0
jne 0x428236
mov eax, dword [ebx + 8]
test eax, eax
je 0x4282a6
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4282a6
mov edx, dword [ebx + 8]
push 0
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebx + 8]
push 0x3e9
push eax
call dword [sym.imp.USER32.dll_KillTimer]
mov dword [ebx + 0x20], 0
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0x20
ret
cmp dword [ebx + 0x10], 0
je 0x4282a6
cmp dword [ebx + 0x14], 0
je 0x4282a6
call fcn.00427ef0
mov eax, dword [ebx + 0x1c]
test eax, eax
je 0x4282a6
cmp dword [eax + 8], 0
je 0x4282a6
cmp dword [eax + 0x3c], 0
jle 0x4282a6
cmp dword [eax + 0x40], 0
jle 0x4282a6
mov edx, dword [ebx + 8]
lea ecx, [esp + 0x10]
xor eax, eax
push ecx
push edx
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebx + 0x1c]
mov ecx, dword [eax + 0x18]
mov edx, dword [eax + 0x14]
mov eax, dword [esp + 0x14]
push 1
push ecx
mov ecx, dword [esp + 0x18]
push edx
mov edx, dword [ebx + 8]
push eax
push ecx
push edx
call dword [sym.imp.USER32.dll_MoveWindow]
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0x20
ret