joyce8/EMBER2024-capa huggingface dataset:
Function at 0x438cf0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
add byte [eax], al
mov eax, dword [0x678390]
xor eax, ebp
mov dword [ebp - 4], eax
lds ecx, [ecx + 0x5653fc45]
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push edi
push 0x208
push 0
push eax
call fcn.00483520
push esi
lea eax, [ebp - 0x20c]
push str.SYSTEMCurrentControlSet_services_s
push eax
call fcn.00407e80
add esp, 0x18
call fcn.004538be
test al, al
je 0x438d55
mov dl, 0x73
fdivr qword [ebx + 0xf]
fild qword [ebx + esi*8]
dec eax
cmp edx, dword [eax + 0x37f78900]
mov eax, 0x61dcef0e
aaa
xchg ecx, eax
outsb dx, byte [esi]
movsb byte es:[edi], byte [esi]
or dword [eax], edi
invalid
call fcn.00453765
test al, al
je 0x438d7c
jle 0x438cf7
std
fucompi st(4)
salc
push ebp
jae 0x438cff
mov eax, 0xe644e19
stc
cmp byte [esi - 0xe], ah
dec esi
bound edi, qword [ebx]
inc ecx
int1
enter 0x4aa5, 0xfffffffffffffff4
push ss
clc
lea eax, [ebp - 0x418]
push eax
push 0xf003f
push 0
add byte [edx], ch
lea eax, [ebp - 0x20c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x438ec8
push 0x208
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.00483520
add esp, 0xc
mov dword [ebp - 0x41c], 0x208
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x414]
push eax
push 0
push 0
push str.ImagePath
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00453a17
test al, al
je 0x438e12
imul edx, dword [edi + 0x2c], 0xbbb0c7f3
je 0x438d87
cmp byte [ebp - 0x5f15bb1c], bh
aad 0x5f
push edx
out dx, eax
add eax, 0xe8057682
xchg ebx, eax
test eax, 0xc0840001
call fcn.004537aa
test al, al
je 0x438e33
iretd
call fcn.00453834
test al, al
je 0x438e54
pop ss
mov ebx, 0x56ba6a81
cmpxchg byte [esi + 0x60eb8b5f], ah
push es
invalid
lea eax, [ebp - 0x414]
push eax
call fcn.0049007c
mov ecx, dword [ebp + 0xc]
add esp, 4
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x438e8c
test dx, dx
je 0x438e88
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x438e8c
add eax, 4
add ecx, 4
test dx, dx
jne 0x438e66
xor eax, eax
jmp 0x438e91
sbb eax, eax
or eax, 1
test eax, eax
jne 0x438ead
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047070c
mov esp, ebp
pop ebp
ret 8
call fcn.004539d2
test al, al
je 0x438ec8
cmp eax, 0xa04d2bc7
iretd
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047070c
mov esp, ebp
pop ebp
ret 8
Function at 0x438cf7
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
add byte [eax], al
mov eax, dword [0x678390]
xor eax, ebp
mov dword [ebp - 4], eax
lds ecx, [ecx + 0x5653fc45]
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push edi
push 0x208
push 0
push eax
call fcn.00483520
push esi
lea eax, [ebp - 0x20c]
push str.SYSTEMCurrentControlSet_services_s
push eax
call fcn.00407e80
add esp, 0x18
call fcn.004538be
test al, al
je 0x438d55
mov dl, 0x73
fdivr qword [ebx + 0xf]
fild qword [ebx + esi*8]
dec eax
cmp edx, dword [eax + 0x37f78900]
mov eax, 0x61dcef0e
aaa
xchg ecx, eax
outsb dx, byte [esi]
movsb byte es:[edi], byte [esi]
or dword [eax], edi
invalid
call fcn.00453765
test al, al
je 0x438d7c
jle 0x438cf7
std
fucompi st(4)
salc
push ebp
jae 0x438cff
mov eax, 0xe644e19
stc
cmp byte [esi - 0xe], ah
dec esi
bound edi, qword [ebx]
inc ecx
int1
enter 0x4aa5, 0xfffffffffffffff4
push ss
clc
lea eax, [ebp - 0x418]
push eax
push 0xf003f
push 0
add byte [edx], ch
lea eax, [ebp - 0x20c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x438ec8
push 0x208
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.00483520
add esp, 0xc
mov dword [ebp - 0x41c], 0x208
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x414]
push eax
push 0
push 0
push str.ImagePath
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00453a17
test al, al
je 0x438e12
imul edx, dword [edi + 0x2c], 0xbbb0c7f3
je 0x438d87
cmp byte [ebp - 0x5f15bb1c], bh
aad 0x5f
push edx
out dx, eax
add eax, 0xe8057682
xchg ebx, eax
test eax, 0xc0840001
call fcn.004537aa
test al, al
je 0x438e33
iretd
call fcn.00453834
test al, al
je 0x438e54
pop ss
mov ebx, 0x56ba6a81
cmpxchg byte [esi + 0x60eb8b5f], ah
push es
invalid
lea eax, [ebp - 0x414]
push eax
call fcn.0049007c
mov ecx, dword [ebp + 0xc]
add esp, 4
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x438e8c
test dx, dx
je 0x438e88
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x438e8c
add eax, 4
add ecx, 4
test dx, dx
jne 0x438e66
xor eax, eax
jmp 0x438e91
sbb eax, eax
or eax, 1
test eax, eax
jne 0x438ead
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047070c
mov esp, ebp
pop ebp
ret 8
call fcn.004539d2
test al, al
je 0x438ec8
cmp eax, 0xa04d2bc7
iretd
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047070c
mov esp, ebp
pop ebp
ret 8
Function at 0x438ee0
Capabilities:
Delete service
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x678390]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
push ebx
push esi
push edi
test eax, eax
je 0x438fe7
call fcn.004538be
test al, al
je 0x438f25
scasb al, byte es:[edi]
or eax, dword [eax - 0x5c7fa753]
clc
iretd
call fcn.00453765
test al, al
je 0x438f4c
mov al, 0xd1
in eax, 0xde
adc eax, dword [ebx - 0x998416d]
pop ecx
mov esp, dword [ecx]
lodsd eax, dword [esi]
push 0x2a14c155
std
push es
test byte [edx + 0x1e], 0x77
out 0xaf, al
push edi
mov eax, 0xd84d8b29
mov ecx, dword [ebp - 0x28]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x438f52
sub ecx, edx
sar ecx, 1
je 0x438fe7
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x24], eax
call fcn.004538be
test al, al
je 0x438f9d
pop ecx
xchg esi, eax
inc esi
retf 0x3a3
call fcn.00453765
test al, al
je 0x438fc4
lodsb al, byte [esi]
mov ebx, 0x281087bb
mov byte [esp + edi*2], al
xor dword [esi + ebx*2 + 0x4f36fabc], ebx
cli
dec edi
in al, dx
mov dh, 0x66
adc byte [eax + 0x3c], bh
xchg esp, eax
jbe 0x438fb3
mov edx, fs
lahf
out dx, al
mov ebx, dword [ebp - 0x24]
test ebx, ebx
je 0x438fe7
push 0x10020
push dword [ebp - 0x28]
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
jne 0x438ffc
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047070c
mov esp, ebp
pop ebp
ret 4
call fcn.00453765
test al, al
je 0x439027
invalid
lea eax, [ebp - 0x20]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, eax
call esi
push ebx
call esi
mov ecx, dword [ebp - 4]
xor eax, eax
test edi, edi
pop edi
setne al
xor ecx, ebp
pop esi
pop ebx
call fcn.0047070c
mov esp, ebp
pop ebp
ret 4
Function at 0x43a240
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e3152
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x678390]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 9
xor eax, eax
mov dword [ebp - 0x2c], 7
push str.WnUpd.exe
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], ax
call fcn.00402b90
cmp dword [ebp - 0x30], 0
mov dword [ebp - 4], 0
cld
add byte [eax], al
add byte [eax], al
je 0x43a3fd
call fcn.00453ae6
test al, al
je 0x43a2c5
mov byte [0xf03f7809], al
retf
call fcn.004538be
test al, al
je 0x43a2ee
in eax, dx
shl byte fs:[ebx + eax*8 + 0x17b0ea16], cl
aam 0xb9
cld
mov eax, dword [0x1237523c]
mov al, byte [0xb992849e]
sub ah, byte [edi - 0x4e8c5e5d]
xlatb
int 0xf3
or dh, byte [ebx]
rol bh, 0x45
in al, dx
pop es
add byte [eax], al
add byte [eax + 0x68], dl
js 0x43a294
xor eax, eax
mov dword [ebp - 0x14], 7
push eax
push 0x5e9978
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
pop esi
add byte [ebp + 0x45c7d84d], cl
call 0x43a307
mov word [ebp - 0x28], ax
call fcn.00402b90
mov eax, dword [0x67d4e4]
mov byte [ebp - 4], 1
test eax, eax
jne 0x43a349
push 0x15c
call fcn.0047045e
add esp, 4
mov dword [ebp - 0x44], eax
mov byte [ebp - 4], 2
test eax, eax
je 0x43a33e
mov ecx, eax
call fcn.00444f40
jmp 0x43a340
xor eax, eax
mov byte [ebp - 4], 1
mov dword [0x67d4e4], eax
mov ecx, eax
call fcn.00474b54
mov edx, eax
cmp word [edx], 0
jne 0x43a35c
xor ecx, ecx
jmp 0x43a370
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x43a361
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.00402b90
push 9
push str.WnUpd.exe
lea ecx, [ebp - 0x28]
call fcn.00405d30
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x43a3e8
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00453c3f
test al, al
je 0x43a3c9
jbe 0x43a41b
push edx
adc bh, al
push esi
out dx, al
or al, 0x99
sub esi, dword [ebx + 6]
rcl byte [edi]
ret 0x1f8e
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push 0
push 0
push 0x5ed67c
push eax
call int.0045e6c6
add esp, 0x14
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x43a3fd
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00402ce0
mov eax, dword [ebp - 0x2c]
cmp eax, 8
jb 0x43a412
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.00402ce0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
add byte [ecx + 0x5f], bl
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047070c
mov esp, ebp
pop ebp
ret
Function at 0x447190
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e45e8
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x678390]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x30], ecx
call fcn.00453bb5
test al, al
je 0x4471d8
sal byte [ecx + edx + 0x18], 0xb9
ret 0xc832
sbb byte [ecx - 0x1d37cd3e], bh
leave
sti
sbb ecx, ebp
mov al, byte [0x7cdee653]
push eax
call fcn.004538be
test al, al
je 0x447200
add byte [eax + eax*8 - 0x6ac9e08c], al
xchg ebp, eax
mov ebp, dword [ecx]
pop ds
sal byte [ebx + 0x46], cl
nop
adc al, 0xc0
pushfd
xor byte [0x256a7eb2], 0xab
pop edi
jl 0x4471dc
mov cl, 9
inc edx
dec eax
nop
jb 0x4471c4
bound ebp, qword [eax - 0x18]
salc
les eax, [eax]
add byte [eax + eax*8 + 0x31f01674], al
xchg ecx, eax
add eax, ebp
jg 0x447219
call fcn.004536db
test al, al
je 0x44721f
lock xor dword [ecx + 0x97fc503], edx
jns 0x44728e
mov ecx, 0x95d6694b
cli
inc edi
dec ebx
mov dl, byte [edi]
invalid
push 9
xor eax, eax
mov dword [ebp - 0x14], 7
push 0x5e9c5c
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
call fcn.00402b90
push 2
push 0x5ea6c8
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0
call fcn.00405d30
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x38]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.0047858b
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 1
call fcn.00471e60
test eax, eax
je 0x447283
xor esi, esi
jmp 0x44733b
call fcn.00453cc9
test al, al
je 0x44729f
invalid
pop ss
salc
ror dword [ecx + 0x66], cl
jmp 0x4472d6
call fcn.00453c3f
test al, al
je 0x4472c3
pop ecx
test byte ss:[ebp + 0x7eb439c8], cl
pop edx
inc ebx
or dh, dh
pop eax
cmp byte [ecx + eax*4 - 0x15], 0xfd
fisubr word [eax - 0x2d]
mov dh, 0x18
in eax, 0xf4
pop es
inc esi
call fcn.00453bfa
test al, al
je 0x4472e5
push ss
xchg edi, eax
push edx
mov eax, dword [0x7b2e72ec]
not dword [eax]
jb 0x44732d
adc byte [edx + 0x54], dh
adc al, 0x29
or esp, esi
jbe 0x44726f
push esp
and byte [eax + 0x7f], cl
salc
sahf
mov ecx, dword [ebp - 0x30]
push 0x5ea6c0
call fcn.00448440
mov esi, eax
test esi, esi
je 0x447319
lea ecx, [ebp - 0x29]
call fcn.0041dea0
push esi
lea ecx, [ebp - 0x29]
mov byte [ebp - 4], 2
call fcn.0042ed60
lea ecx, [ebp - 0x29]
mov byte [ebp - 4], 1
call fcn.00479050
call fcn.00453696
test al, al
je 0x447336
and bl, dh
mov byte [ecx + 0x4dea6bca], 0xde
pop ebp
mov esi, 0xa3405849
rcr byte [ebp - 0x410d0bf8], cl
add dword [eax], eax
add byte [eax], al
dec ecx
pop eax
inc eax
mov dword [0xf4089dd2], eax
mov esi, 1
mov esi, 1
lea ecx, [ebp - 0x38]
call fcn.004785a0
mov ecx, dword [ebp - 0x14]
cmp ecx, 8
jb 0x447358
inc ecx
push ecx
push dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
call fcn.00402ce0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047070c
mov esp, ebp
pop ebp
ret
Function at 0x448dc0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e47c3
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x678390]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0xc], 0
mov dword [esi + 0x20], 0x67d534
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
lea ecx, [esi + 0x34]
mov dword [esi], vtable.TiXmlDocument.0
mov dword [ebp - 4], 0
mov dword [ecx], 0x67d534
mov dword [esi + 0x40], 0xffffffff
mov dword [esi + 0x3c], 0xffffffff
push 0
push 0x5e976e
mov byte [ebp - 4], 1
mov dword [esi + 0x38], 4
mov byte [esi + 0x44], 0
mov byte [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.0044c9f0
mov dword [esi + 0x40], 0
mov eax, esi
mov dword [esi + 0x3c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x44f610
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor eax, eax
mov edx, eax
mov ecx, eax
and edx, 1
shr ecx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov dword [eax*4 + 0x681a20], ecx
inc eax
cmp eax, 0x100
jb 0x44f612
cmp eax, 0x800
jae 0x44f6e3
nop
mov edx, dword [eax*4 + 0x681620]
movzx ecx, dl
shr edx, 8
xor edx, dword [ecx*4 + 0x681a20]
mov dword [eax*4 + 0x681a20], edx
inc eax
cmp eax, 0x800
jb 0x44f6c0
mov dword [0x67d540], 0x450480
call fcn.004502b0
mov ecx, dword [0x67d540]
test eax, eax
mov edx, 0x450520
cmove ecx, edx
mov dword [0x67d540], ecx
ret
Function at 0x450800
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
sub esp, 0x10
mov ecx, dword [ebp + 0xc]
mov eax, dword [eax]
push ebx
xor ebx, ebx
and eax, 7
cmp ecx, 5
jae 0x450820
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
add dword [ebp + 0x10], 5
lea edx, [ecx - 4]
push esi
mov esi, dword [ebp + 8]
push edi
or edi, 0xffffffff
add edx, esi
mov dword [ebp - 4], edx
add esi, ebx
mov dword [ebp + 0xc], esi
cmp esi, edx
jae 0x450852
nop dword [eax]
mov cl, byte [esi]
and cl, 0xfe
cmp cl, 0xe8
je 0x45084f
inc esi
cmp esi, edx
jb 0x450840
mov dword [ebp + 0xc], esi
mov ebx, esi
sub ebx, dword [ebp + 8]
mov ecx, ebx
sub ecx, edi
cmp esi, edx
jae 0x45097c
cmp ecx, 3
jbe 0x450892
xor eax, eax
mov cl, byte [esi + 4]
mov edi, ebx
mov dword [ebp - 0x10], edi
test cl, cl
je 0x4508d0
cmp cl, 0xff
je 0x4508d0
mov edx, dword [ebp - 4]
and eax, 3
mov esi, dword [ebp + 8]
add eax, eax
mov ecx, 1
or eax, 1
add ebx, ecx
jmp 0x450834
dec ecx
shl eax, cl
and eax, 7
je 0x45086a
movzx ecx, byte [eax + 0x5ee494]
mov edx, esi
sub edx, ecx
cmp byte [eax + 0x5ee48c], 0
mov cl, byte [edx + 4]
je 0x4508ba
test cl, cl
je 0x4508ba
cmp cl, 0xff
jne 0x45086a
mov edx, dword [ebp - 4]
and eax, 3
mov esi, dword [ebp + 8]
add eax, eax
mov edi, ebx
or eax, 1
inc ebx
jmp 0x450834
movzx edi, cl
movzx ecx, byte [esi + 3]
shl edi, 8
or edi, ecx
movzx ecx, byte [esi + 2]
shl edi, 8
or edi, ecx
movzx ecx, byte [esi + 1]
mov esi, dword [ebp + 0x10]
shl edi, 8
or edi, ecx
cmp dword [ebp + 0x18], 0
je 0x4508fe
lea edx, [edi + ebx]
add edx, esi
jmp 0x450904
mov edx, edi
sub edx, ebx
sub edx, esi
test eax, eax
je 0x450942
movzx edi, byte [eax + 0x5ee494]
mov ecx, 0x18
shl edi, 3
sub ecx, edi
mov dword [ebp - 0xc], edi
mov edi, edx
shr edi, cl
mov ecx, edi
mov dword [ebp - 8], edi
test cl, cl
je 0x45092e
cmp cl, 0xff
jne 0x450942
mov ecx, 0x20
mov edi, 1
sub ecx, dword [ebp - 0xc]
shl edi, cl
dec edi
xor edi, edx
jmp 0x4508f1
mov esi, dword [ebp + 0xc]
mov ecx, edx
mov edi, dword [ebp - 0x10]
shr ecx, 0x18
and cl, 1
dec cl
mov byte [esi + 1], dl
not cl
mov byte [esi + 4], cl
mov ecx, edx
shr ecx, 0x10
mov byte [esi + 3], cl
mov ecx, edx
mov edx, dword [ebp - 4]
shr ecx, 8
mov byte [esi + 2], cl
mov ecx, 5
mov esi, dword [ebp + 8]
add ebx, ecx
jmp 0x450834
pop edi
pop esi
cmp ecx, 3
jbe 0x450991
mov ecx, dword [ebp + 0x14]
xor eax, eax
mov dword [ecx], eax
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
dec ecx
shl eax, cl
mov ecx, dword [ebp + 0x14]
and eax, 7
mov dword [ecx], eax
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4530c3
Capabilities:
Check if file exists
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x678390]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
xor esi, esi
push esi
push 0x2b
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov ebx, 0x5e9bd4
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.00491be2
lea eax, [ebp - 0x20c]
push str.WanNengWBInput
push eax
call fcn.00491be2
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.00491be2
lea eax, [ebp - 0x20c]
push 0x5e9c5c
push eax
call fcn.00491be2
lea eax, [ebp - 0x20c]
push 0x5ed954
push eax
call fcn.00491be2
add esp, 0x28
lea eax, [ebp - 0x20c]
push eax
push 0x104
lea eax, [ebp - 0x414]
push eax
push 0x5e9978
push str.InstallPath
push str.Globals
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x453181
xor al, al
jmp 0x4531aa
cmp word [ebp - 0x414], si
je 0x453199
lea eax, [ebp - 0x414]
push eax
call fcn.00491bc7
pop ecx
mov esi, eax
push esi
lea eax, [ebp - 0x414]
mov ecx, edi
push eax
call fcn.00402b90
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047070c
mov esp, ebp
pop ebp
ret 4
Function at 0x455ec7
Capabilities:
Write file on windows

Disassembly:
dec ebp
cld
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047070c
mov esp, ebp
pop ebp
ret
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push 0
push 0x80
push 2
push 0
xor ebx, ebx
inc ebx
push ebx
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 8], esi
cmp esi, 0xffffffff
jne 0x455efd
xor eax, eax
jmp 0x455fae
call fcn.00453b70
test al, al
je 0x455f1e
salc
mov edi, edx
inc ebx
cmp al, byte [edx]
out 0xd2, al
popal
xlatb
dec eax
test al, 0x2a
sti
scasb al, byte es:[edi]
jecxz 0x455eb7
cli
mov esi, dword [ebp - 8]
xor ebx, ebx
inc ebx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push 0
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00453aa1
test al, al
je 0x455f63
movsd dword es:[edi], dword [esi]
and ebx, 0x1f
stc
rcr al, 1
xchg esp, eax
movsb byte es:[edi], byte [esi]
das
insd dword es:[edi], dx
mov dword [ebx - 0x3aedb360], ebx
add al, 0x95
fidiv dword [eax + 0x12]
mov edi, 0xdc7c74ed
call fcn.00453903
test al, al
je 0x455f81
mov bl, 0x27
in eax, 0xa
and ebx, eax
pop esp
mov bh, 0x83
pop ecx
and al, 0xad
and ah, ah
sbb byte [edi + 0x4a], dh
invalid
call fcn.00453a5c
test al, al
je 0x455f9c
mov word [ebx + 0x36bae15c], ss
in eax, dx
mov bl, byte [ebx + 0x20]
outsb dx, byte [esi]
or byte [edi + 0x78], bl
cmp ch, ah
add byte [ebx + 0x7400f87d], 8
cmp dword [ebp - 8], 0
je 0x455faa
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 4]
je 0x455fac
xor ebx, ebx
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4597e8
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x678390]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00483520
push 0x5e9c5c
lea eax, [ebp - 0x20c]
push str.C:log_s.log
push eax
call fcn.00407e80
add esp, 0x18
call fcn.0045360c
test al, al
je 0x459842
push ds
adc byte [0x3e634147], 0xbe
cmp al, 0x60
mov bh, 5
push esi
rcr dh, 0x58
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, dword [ebp - 4]
neg eax
pop edi
sbb eax, eax
xor ecx, ebp
neg eax
pop esi
call fcn.0047070c
mov esp, ebp
pop ebp
ret
Function at 0x459a4d
Capabilities:
Check if file exists
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2018
call fcn.00470830
mov eax, dword [0x678390]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x200c], edi
mov dword [ebp - 0x2008], eax
call fcn.004597e8
test eax, eax
je 0x459bf7
xor ebx, ebx
push ebx
call fcn.00486e66
mov dword [ebp - 0x2018], eax
lea eax, [ebp - 0x2018]
push eax
mov dword [ebp - 0x2014], edx
call fcn.0048fbbe
pop ecx
pop ecx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push dword [ebp - 0x2008]
mov ecx, dword [esi + 0x10]
push eax
push dword [esi]
mov eax, dword [esi + 0x14]
inc ecx
push dword [esi + 4]
add eax, 0x76c
push dword [esi + 8]
push dword [esi + 0xc]
push ecx
push eax
lea eax, [ebp - 0x2004]
push str.__d__d__d__d__d__d___d_:_s
push eax
call fcn.00459619
add esp, 0x28
call fcn.004539d2
test al, al
je 0x459b05
invalid
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor esi, esi
inc esi
test eax, eax
cmovne ebx, esi
mov dword [ebp - 0x200c], ebx
call fcn.00453c3f
test al, al
je 0x459b36
cmp dl, byte [ebx]
invalid
push 0x5ee4d4
push edi
call fcn.004906f9
mov ebx, eax
mov dword [ebp - 0x2010], ebx
pop ecx
pop ecx
test ebx, ebx
je 0x459bf7
cmp dword [ebp - 0x200c], 0
jne 0x459b79
push ebx
push 2
lea eax, [ebp - 0x200c]
mov dword [ebp - 0x200c], 0xfeff
push esi
push eax
call fcn.00491b0b
add esp, 0x10
call fcn.00453b70
test al, al
je 0x459b9a
or bl, byte [edi + 0x186d7291]
daa
iretd
lea eax, [ebp - 0x2004]
push eax
call fcn.00491bc7
push ebx
add eax, eax
push eax
lea eax, [ebp - 0x2004]
push 1
push eax
call fcn.00491b0b
push ebx
push 2
lea eax, [ebp - 0x2008]
mov dword [ebp - 0x2008], 0xd
push 1
push eax
call fcn.00491b0b
push ebx
push 2
lea eax, [ebp - 0x2008]
mov dword [ebp - 0x2008], 0xa
push 1
push eax
call fcn.00491b0b
push ebx
call fcn.004904f7
add esp, 0x38
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047070c
mov esp, ebp
pop ebp
ret