joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10076011
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x1008a418]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 2
lea eax, [ebp - 0x218]
mov esi, ecx
push eax
lea ecx, [ebp - 0x238]
mov dword [ebp - 0x21c], esi
mov edi, edx
call fcn.100102ed
and dword [ebp - 0x23c], 0
lea eax, [ebp - 0x210]
push 0x208
push eax
lea ecx, [ebp - 0x228]
call fcn.100102ed
and dword [ebp - 0x22c], 0
and dword [ebp - 0x214], 0
cmp dword [esi + 0x18], 0
jne 0x10076083
mov esi, 0x8000ffff
jmp 0x10076170
test edi, edi
jne 0x1007608d
lea edi, [ebp - 0x23c]
cmp dword [edi], 0
mov ebx, 0x10003f08
mov ecx, ebx
je 0x1007609c
mov ecx, dword [edi + 4]
lea eax, [ebp - 0x22c]
mov edx, 0x100083e4
push eax
call fcn.1007a6cc
test eax, eax
js 0x100760d8
cmp dword [ebp - 0x22c], 0
mov eax, ebx
je 0x100760c2
mov eax, dword [ebp - 0x228]
push eax
mov ecx, esi
call fcn.10076617
test eax, eax
jne 0x100760d8
mov esi, 0x80070057
jmp 0x1007615b
push 1
lea eax, [ebp - 0x214]
push eax
push 0
push 3
push 0x100083f4
call dword [sym.imp.SHLWAPI.dll_SHRegCreateUSKeyW]
mov esi, eax
test esi, esi
je 0x10076103
jle 0x1007615b
movzx esi, si
or esi, 0x80070000
jmp 0x1007615b
mov edx, dword [edi]
mov ecx, ebx
test edx, edx
je 0x1007610e
mov ecx, dword [edi + 4]
mov eax, dword [ebp - 0x21c]
cmp dword [eax + 0x544], 0
je 0x10076123
mov ebx, dword [eax + 0x548]
push 2
lea eax, [edx*2 + 2]
push eax
push ecx
push 1
push ebx
push dword [ebp - 0x214]
call dword [sym.imp.SHLWAPI.dll_SHRegWriteUSValueW]
mov esi, eax
test esi, esi
jne 0x100760f6
push dword [ebp - 0x214]
call dword [sym.imp.SHLWAPI.dll_SHRegCloseUSKey]
mov esi, eax
test esi, esi
jne 0x100760f6
and dword [ebp - 0x214], esi
cmp dword [ebp - 0x214], 0
je 0x10076170
push dword [ebp - 0x214]
call dword [sym.imp.SHLWAPI.dll_SHRegCloseUSKey]
and dword [ebp - 0x22c], 0
lea ecx, [ebp - 0x228]
call fcn.1000deab
and dword [ebp - 0x23c], 0
lea ecx, [ebp - 0x238]
call fcn.1000deab
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10087900
mov esp, ebp
pop ebp
ret
Function at 0x10076617
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x840
mov eax, dword [0x1008a418]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ebp + 8]
xor eax, eax
push esi
push edi
mov edi, eax
mov esi, ecx
push 0x208
lea eax, [ebp - 0x82c]
push eax
lea ecx, [ebp - 0x838]
call fcn.100102ed
xor eax, eax
push 0x208
push eax
mov dword [ebp - 0x83c], eax
lea eax, [ebp - 0x214]
push eax
call sub.msvcrt.dll_memset
xor eax, eax
push 0x208
push eax
lea eax, [ebp - 0x624]
push eax
call sub.msvcrt.dll_memset
xor eax, eax
push 0x208
push eax
lea eax, [ebp - 0x41c]
push eax
call sub.msvcrt.dll_memset
add esp, 0x24
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea eax, [ebp - 0x83c]
mov ecx, esi
push eax
call fcn.1007650f
test eax, eax
js 0x100767d3
mov eax, 0x10003f08
cmp dword [ebp - 0x83c], edi
je 0x100766c3
mov eax, dword [ebp - 0x838]
mov esi, 0x104
push esi
push eax
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.msvcrt.dll__wfullpath]
add esp, 0xc
test eax, eax
je 0x100767d3
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
push esi
lea eax, [ebp - 0x624]
push ebx
push eax
call dword [sym.imp.msvcrt.dll__wfullpath]
add esp, 0xc
test eax, eax
je 0x100767d3
lea eax, [ebp - 0x624]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
cmp ecx, 0xffffffff
je 0x100767d3
shr eax, 4
test al, 1
jne 0x100767d3
mov eax, ecx
shr ecx, 1
shr eax, 2
or al, cl
not al
test al, 1
je 0x100767d3
lea ecx, [ebp - 0x214]
xor esi, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x1007674a
sub ecx, edx
lea eax, [ebp - 0x214]
sar ecx, 1
push ecx
push eax
lea eax, [ebp - 0x624]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x100767d5
lea eax, [ebp - 0x624]
push eax
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCanonicalizeW]
test eax, eax
jmp 0x100767b9
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x100767ce
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x100767d5
and eax, 6
cmp al, 6
je 0x100767d5
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
jne 0x1007678a
jmp 0x100767d5
xor edi, edi
inc edi
jmp 0x100767d5
xor esi, esi
lea ecx, [ebp - 0x838]
mov dword [ebp - 0x83c], esi
call fcn.1000deab
mov ecx, dword [ebp - 8]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10087900
mov esp, ebp
pop ebp
ret 4
Function at 0x1007d68f
Capabilities:
Check if file exists
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x47c
mov eax, dword [0x1008a418]
xor eax, esp
mov dword [esp + 0x478], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [esp + 0x270]
push esi
push edi
push 0x208
mov esi, ecx
mov dword [esp + 0x24], ebx
push eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x2c], esi
call fcn.100102ed
and dword [esp + 0xc], 0
lea eax, [esp + 0x28]
push 0x250
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov ecx, esi
push ebx
call fcn.1007d60a
mov esi, eax
test esi, esi
js 0x1007d83e
push ebx
lea ecx, [esp + 0x10]
call fcn.100115f7
mov esi, eax
test esi, esi
js 0x1007d83e
push 0x10008824
lea ecx, [esp + 0x10]
call fcn.10071181
mov esi, eax
test esi, esi
js 0x1007d83e
mov edi, dword [esp + 0xc]
mov eax, 0x10003f08
mov ebx, dword [esp + 0x10]
test edi, edi
je 0x1007d73b
mov eax, ebx
lea ecx, [esp + 0x28]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esp + 0x1c], eax
cmp eax, 0xffffffff
jne 0x1007d76e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x1007d767
call fcn.1000df00
mov esi, eax
jmp 0x1007d83e
xor esi, esi
jmp 0x1007d83e
push 0x10008120
lea eax, [esp + 0x58]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
je 0x1007d807
push 0x10008828
lea eax, [esp + 0x58]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
je 0x1007d807
mov eax, dword [esp + 0x28]
test al, 0x10
je 0x1007d807
and eax, 6
cmp al, 6
je 0x1007d807
lea eax, [edi + edi]
push eax
push 0
push ebx
call sub.msvcrt.dll_memset
and dword [esp + 0x18], 0
lea ecx, [esp + 0x18]
add esp, 0xc
push dword [esp + 0x20]
call fcn.100115f7
mov esi, eax
test esi, esi
js 0x1007d834
lea eax, [esp + 0x54]
push eax
lea ecx, [esp + 0x10]
call fcn.10071181
mov esi, eax
test esi, esi
js 0x1007d834
mov edi, dword [esp + 0xc]
mov eax, 0x10003f08
mov ebx, dword [esp + 0x10]
test edi, edi
je 0x1007d7f7
mov eax, ebx
mov ecx, dword [esp + 0x24]
push eax
call fcn.1007d68f
mov esi, eax
test esi, esi
js 0x1007d834
lea eax, [esp + 0x28]
push eax
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1007d76e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x1007d832
call fcn.1000df00
mov esi, eax
jmp 0x1007d834
xor esi, esi
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_FindClose]
and dword [esp + 0xc], 0
lea ecx, [esp + 0x10]
call fcn.1000deab
mov ecx, dword [esp + 0x484]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10087900
mov esp, ebp
pop ebp
ret 4
Function at 0x10085360
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.100881b0
mov eax, dword [0x1008a418]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 0x1018], edx
push 0x1000
lea eax, [ebp - 0x1008]
mov dword [ebp - 0x1014], esi
push esi
push eax
mov ebx, ecx
mov dword [ebp - 0x1010], esi
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x100c], esi
mov esi, dword [ebx]
mov edi, esp
xor eax, eax
push eax
mov ecx, dword [esi + 0x14]
push eax
push eax
push eax
push ebx
call dword [0x1008c6d4]
call dword [esi + 0x14]
cmp edi, esp
je 0x100853cf
mov ecx, 4
int 0x29
mov esi, eax
test esi, esi
js 0x100854e8
push 0xf0000000
push 1
push 0
push 0
lea eax, [ebp - 0x1014]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x10085401
call fcn.1000df00
mov esi, eax
jmp 0x100854e8
lea eax, [ebp - 0x1010]
push eax
push 0
push 0
push 0x8003
push dword [ebp - 0x1014]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x100853f5
mov esi, dword [ebx]
lea eax, [ebp - 0x100c]
mov edi, esp
push eax
push 0x1000
mov ecx, dword [esi + 0xc]
lea eax, [ebp - 0x1008]
push eax
push ebx
call dword [0x1008c6d4]
call dword [esi + 0xc]
cmp edi, esp
je 0x10085450
mov ecx, 4
int 0x29
mov esi, eax
test esi, esi
js 0x100854e8
cmp dword [ebp - 0x100c], 0
je 0x1008548f
push 0
push dword [ebp - 0x100c]
lea eax, [ebp - 0x1008]
push eax
push dword [ebp - 0x1010]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x100853f5
cmp dword [ebp - 0x100c], 0
jne 0x10085421
push 0
lea eax, [ebp - 0x100c]
mov dword [ebp - 0x100c], 0x10
push eax
push dword [ebp - 0x1018]
push 2
push dword [ebp - 0x1010]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x100853f5
mov esi, dword [ebx]
mov edi, esp
xor eax, eax
push eax
push eax
mov ecx, dword [esi + 0x14]
push eax
push eax
push ebx
call dword [0x1008c6d4]
call dword [esi + 0x14]
cmp edi, esp
je 0x100854e0
mov ecx, 4
int 0x29
mov esi, eax
test esi, esi
js 0x100854e8
xor esi, esi
cmp dword [ebp - 0x1010], 0
je 0x10085504
push dword [ebp - 0x1010]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
and dword [ebp - 0x1010], 0
cmp dword [ebp - 0x1014], 0
je 0x1008551b
push 0
push dword [ebp - 0x1014]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10087900
mov esp, ebp
pop ebp
ret
Function at 0x10085bf8
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x1008a418]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
and dword [eax], 0
mov edi, edx
push 0x208
mov dword [ebp - 0x418], eax
mov ebx, ecx
lea eax, [ebp - 0x20c]
push 0
push eax
call sub.msvcrt.dll_memset
push 0x670
call fcn.1008737f
add esp, 0x10
test eax, eax
je 0x10085c4f
mov ecx, eax
call fcn.10085ddb
mov esi, eax
jmp 0x10085c51
xor esi, esi
test esi, esi
jne 0x10085c5f
mov ebx, 0x8007000e
jmp 0x10085dc6
push edi
lea ecx, [esi + 0x660]
mov dword [esi + 0x18], ebx
call fcn.100115f7
mov ebx, eax
test ebx, ebx
js 0x10085da5
push edi
mov edx, 0x104
lea ecx, [ebp - 0x20c]
call fcn.1000b82d
mov ebx, eax
test ebx, ebx
js 0x10085da5
push 1
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHELL32.dll_PathResolve]
test eax, eax
jne 0x10085d15
push 0x208
push eax
lea eax, [ebp - 0x414]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x414]
mov ebx, 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
cmp eax, ebx
jbe 0x10085cde
mov ebx, 0x80004005
jmp 0x10085da5
push edi
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
test eax, eax
jne 0x10085d15
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x10085da5
movzx ebx, bx
or ebx, 0x80070000
jmp 0x10085da5
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
lea ecx, [ebp - 0x20c]
cmp ecx, eax
je 0x10085cd4
push eax
lea ecx, [esi + 0x448]
call fcn.100115f7
mov ebx, eax
test ebx, ebx
js 0x10085da5
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
je 0x10085cd4
lea eax, [ebp - 0x20c]
lea edi, [esi + 0x230]
push eax
mov ecx, edi
call fcn.100115f7
mov ebx, eax
test ebx, ebx
js 0x10085da5
cmp dword [edi], 0
lea ecx, [esi + 0x14]
mov edx, 0x10003f08
je 0x10085d79
mov edx, dword [edi + 4]
lea eax, [esi + 0x1c]
and dword [eax], 0
push eax
push 0
push 0xfff
call fcn.100855e1
mov ebx, eax
test ebx, ebx
js 0x10085da5
xor ebx, ebx
test ebx, ebx
js 0x10085da5
mov ecx, dword [ebp - 0x418]
lea eax, [esi + 0x10]
xor esi, esi
mov dword [ecx], eax
test esi, esi
je 0x10085dc6
mov eax, dword [esi]
mov edi, esp
push esi
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x1008c6d4]
call esi
cmp edi, esp
je 0x10085dc6
mov ecx, 4
int 0x29
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10087900
mov esp, ebp
pop ebp
ret 8

Function at 0x10087cb0
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x10087cee
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x10087ce6
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x10087cf0
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x10087cd6
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x10087dc0
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x10087dd6
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
jne 0x10087df1
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
Function at 0x4037c7
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
mov al, byte [esi]
cmp al, 0x22
jne 0x4037f0
cmp al, 0x22
je 0x4037e8
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x4037dc
cmp byte [esi], 0x22
jne 0x4037fa
inc esi
jmp 0x4037fa
cmp al, 0x20
jle 0x4037fa
inc esi
cmp byte [esi], 0x20
jg 0x4037f4
mov al, byte [esi]
test al, al
je 0x403804
cmp al, 0x20
jle 0x4037ed
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.00403872
push 0x405004
push section..data
call fcn.00403858
test byte [ebp - 0x18], 1
pop ecx
pop ecx
je 0x403834
movzx eax, word [ebp - 0x14]
jmp 0x403837
push 0xa
pop eax
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov esi, eax
call fcn.0040388a
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
mov ecx, 0x30a026db
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43304e
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..text_1
nop
nop
mov ebx, 0x4304d8
mov ecx, 0x13a15814
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43306c
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x401110
Capabilities:
Access firewall settings via inetfwmgr

Disassembly:
push esi
push 2
push 0
mov esi, eax
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jge 0x401128
cmp eax, 0x80010106
jne 0x4011a6
push edi
push esi
push 0x6c225c
push 1
push 0
push 0x6c224c
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov edi, eax
test edi, edi
jge 0x401157
push edi
push str.CoCreateInstance_NetFwMgr_failed:_0x_08lx_n
call fcn.005a9f90
add esp, 8
mov eax, edi
pop edi
pop esi
ret
mov eax, dword [esi]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x1c]
push ebx
lea edi, [esi + 4]
push edi
push eax
call edx
mov ebx, eax
test ebx, ebx
jge 0x401180
push ebx
push str.get_LocalPolicy_failed:_0x_08lx_n
call fcn.005a9f90
add esp, 8
mov eax, ebx
pop ebx
pop edi
pop esi
ret
mov eax, dword [edi]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x1c]
add esi, 8
push esi
push eax
call edx
mov esi, eax
test esi, esi
jge 0x4011a4
push esi
push str.get_CurrentProfile_failed:_0x_08lx_n
call fcn.005a9f90
mov eax, esi
add esp, 8
pop ebx
pop edi
pop esi
ret

Function at 0x4014a0
Capabilities:
Access firewall policy via inetfwpolicy2

Disassembly:
push esi
push 2
push 0
mov esi, eax
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jge 0x4014b8
cmp eax, 0x80010106
jne 0x40150c
push edi
push esi
push 0x6c229c
push 1
push 0
push 0x6c228c
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov edi, eax
test edi, edi
jge 0x4014e7
push edi
push str.CoCreateInstance_NetFwPolicy2_failed:_0x_08lx_n
call fcn.005a9f90
add esp, 8
mov eax, edi
pop edi
pop esi
ret
mov eax, dword [esi]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x48]
add esi, 4
push esi
push eax
call edx
mov esi, eax
test esi, esi
jge 0x40150b
push esi
push str.get_Rules_failed:_0x_08lx_n
call fcn.005a9f90
mov eax, esi
add esp, 8
pop edi
pop esi
ret
Function at 0x401590
Capabilities:
Access firewall rule properties via inetfwrule

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
cmp dword [esi + 4], 0
jne 0x4015a6
mov eax, 0x80004001
pop esi
pop ecx
ret 0xc
push ebx
push ebp
push edi
push str.RKS_STUDIO
call fcn.00401050
mov edi, eax
mov eax, dword [esp + 0x20]
push eax
call fcn.00401050
mov ecx, dword [esp + 0x28]
push ecx
mov ebp, eax
call fcn.00401050
mov dword [esp + 0x28], eax
add esp, 0xc
lea ebx, [esp + 0x20]
mov eax, esi
mov dword [esp + 0x10], 0
call fcn.00401510
mov esi, eax
test esi, esi
jge 0x401603
push esi
push str.IsAppEnabled_failed:_0x_08lx_n
call fcn.005a9f90
add esp, 8
pop edi
pop ebp
pop ebx
mov eax, esi
pop esi
pop ecx
ret 0xc
cmp dword [esp + 0x20], 0
je 0x401614
pop edi
pop ebp
pop ebx
xor eax, eax
pop esi
pop ecx
ret 0xc
lea edx, [esp + 0x10]
push edx
push 0x6c22bc
push 1
push 0
push 0x6c22ac
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
test esi, esi
jge 0x40163e
push esi
push str.CoCreateInstance_NetFwRule_failed:_0x_08lx_n
jmp 0x4016cd
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x20]
push edi
push eax
call edx
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x1c]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x28]
call eax
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x30]
push ebp
push eax
call edx
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x40]
push 0x100
push eax
call edx
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x98]
push 6
push eax
call edx
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xa8]
push 1
push eax
call edx
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x88]
push 0xffffffffffffffff
push eax
call edx
mov eax, dword [esp + 0x18]
mov eax, dword [eax + 4]
mov edx, dword [esp + 0x10]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x20]
call eax
mov esi, eax
test esi, esi
jge 0x4016d5
push esi
push str.Firewall_Rule_Add_failed:_0x_08lx_n
call fcn.005a9f90
add esp, 8
push edi
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
call edi
push ebp
call edi
mov ecx, dword [esp + 0x1c]
push ecx
call edi
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4016f8
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
pop edi
pop ebp
pop ebx
mov eax, esi
pop esi
pop ecx
ret 0xc
Function at 0x401910
Capabilities:
Copy file

Disassembly:
sub esp, 0x614
mov eax, dword [0x6f6dfc]
xor eax, esp
mov dword [esp + 0x610], eax
push esi
push edi
push 0x104
lea eax, [esp + 0x118]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x114]
push 0x5c
push ecx
call fcn.005d0430
mov esi, eax
inc esi
add esp, 8
cmp esi, 1
jne 0x40196b
push 0
push 0x14
push str..GenerateUpdaterXML.cpp
push str._DWORD_fname___1
call fcn.005aa2a0
add esp, 0x10
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x11c]
push ecx
call fcn.005aace0
add esp, 0xc
test al, al
jne 0x40199e
lea edx, [esp + 0x114]
push edx
push str.failed_to_get_crc_for__s_n
call fcn.005aa160
add esp, 8
push str.1.7.1
push esi
lea eax, [esp + 0x18]
push str._s__s.exe
push eax
call fcn.00401aa0
add esp, 0x10
push 0
lea ecx, [esp + 0x14]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x4019db
lea edx, [esp + 0x10]
push edx
push esi
push str.unable_to_copy__s___s_n
call fcn.005aa160
add esp, 0xc
push 0x2f
push str.http:__147.50.253.115_TANAWANT_THONGPING_launcher_woupd.xml
call fcn.005d0430
mov esi, eax
add esp, 8
test esi, esi
jne 0x401a05
push eax
push 0x21
push str..GenerateUpdaterXML.cpp
push str.updater_file
call fcn.005aa2a0
add esp, 0x10
lea edi, [esi + 1]
push 0x6c234c
push edi
call fcn.005ab1f0
mov esi, eax
push str._p__n
push esi
call fcn.005d045d
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
push eax
push str.1.7.1
push ecx
lea edx, [esp + 0x2c]
push edx
push str.http:__147.50.253.115_TANAWANT_THONGPING_launcher_
push str.__u_url__s_s__crc__u__ver__s__size__u____n
push esi
call fcn.005d045d
push str.__p__n
push esi
call fcn.005d045d
push esi
call fcn.005d05f0
lea eax, [esp + 0x48]
push eax
push edi
lea ecx, [esp + 0x258]
push str.XML__s_generated_nnew_exe:_s
push ecx
call fcn.00401ac0
add esp, 0x48
push 0
push str.Updater_XML
lea edx, [esp + 0x220]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x618]
pop edi
pop esi
xor ecx, esp
call fcn.005d0167
add esp, 0x614
ret

Function at 0x402440
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
lea eax, [esp + 4]
push eax
push 0x20019
push 0
push str.HARDWAREDESCRIPTIONSystemMultifunctionAdapter0DiskController0DiskPeripheral0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40248c
mov edx, dword [esp + 0xc]
lea ecx, [esp]
push ecx
add edx, 0x88
push edx
push eax
push eax
mov eax, dword [esp + 0x14]
push str.MHz
push eax
mov dword [esp + 0x18], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 8
ret 4
Function at 0x402bd0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
lea eax, [esp]
push eax
push 0xf003f
push 0
push str.SoftwareArktos_Entertainment_GroupWarZ
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x402bf8
mov al, 1
add esp, 0x10
ret
mov eax, dword [esp]
push esi
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x10]
push edx
push 0
push 0
push str.UpdaterTime1
push eax
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x20], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 4]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x402c6a
push esi
call fcn.005d0955
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
add esp, 4
add esi, 0x2a300
adc ecx, 0
cmp edx, ecx
jg 0x402c6a
jl 0x402c63
cmp eax, esi
jae 0x402c6a
xor al, al
pop esi
add esp, 0x10
ret
mov al, 1
pop esi
add esp, 0x10
ret

Function at 0x402de0
Capabilities:
Get common file path

Disassembly:
sub esp, 0xb14
mov eax, dword [0x6f6dfc]
xor eax, esp
mov dword [esp + 0xb10], eax
push 0x104
lea eax, [esp + 0x210]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp]
push ecx
lea edx, [esp + 0x10c]
push edx
push 0x104
lea eax, [esp + 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
mov eax, dword [esp]
test eax, eax
je 0x402e33
mov byte [eax - 1], 0
lea ecx, [esp + 4]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea edx, [esp + 4]
push edx
lea eax, [esp + 0x10c]
push eax
call fcn.005d3adc
add esp, 8
test eax, eax
je 0x402e95
lea ecx, [esp + 0x108]
push ecx
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x318]
push str.Updater_current_directory___s__is_different_from_working_directory___s_
push eax
call fcn.00406890
add esp, 0x10
push 0x30
push str.Warning
lea ecx, [esp + 0x318]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0xb10]
xor ecx, esp
mov al, 1
call fcn.005d0167
add esp, 0xb14
ret