joyce8/EMBER2024-capa huggingface dataset:
Function at 0x417780
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x547da0
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x5c5244]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push dword [edi + 8]
mov dword [edi], vtable.CAnimationTaskImpl.1.0
mov dword [edi + 4], vtable.CAnimationTaskImpl.0
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4177ca
push dword [edi + 8]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [edi + 0x28]
test eax, eax
je 0x4177ec
push 0x1f4
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4177ec
push 0
push dword [edi + 0x28]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
xor ebx, ebx
cmp dword [edi + 0x94], ebx
jbe 0x41785b
nop word [eax + eax]
mov eax, dword [edi + 0x84]
xor ecx, ecx
mov edx, dword [edi + 0x90]
test eax, eax
je 0x41781a
mov eax, dword [eax]
test eax, eax
je 0x41781a
mov ecx, dword [eax]
xor eax, eax
lea esi, [edx + ebx]
test ecx, ecx
je 0x41782b
mov ecx, dword [ecx]
test ecx, ecx
je 0x41782b
mov eax, dword [ecx]
test eax, eax
jne 0x417833
xor edx, edx
jmp 0x417835
mov edx, dword [eax]
mov eax, dword [edx + 8]
mov ecx, esi
dec eax
shr ecx, 2
and ecx, eax
and esi, 3
mov eax, dword [edx + 4]
mov eax, dword [eax + ecx*4]
mov eax, dword [eax + esi*4]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x18]
inc ebx
cmp ebx, dword [edi + 0x94]
jb 0x417800
lea ecx, [edi + 0x84]
call fcn.0041a890
lea ecx, [edi + 0x84]
call fcn.0041a890
push 8
push dword [edi + 0x84]
call fcn.004d9fad
add esp, 8
mov dword [edi + 0x84], 0
mov dword [edi + 0x38], vtable.layered_window_impl.0
push dword [edi + 0x3c]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4178a8
push dword [edi + 0x3c]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [edi + 0x60]
mov esi, dword [sym.imp.GDI32.dll_DeleteObject]
test eax, eax
je 0x4178c3
push eax
call esi
test eax, eax
je 0x4178c3
mov dword [edi + 0x60], 0
mov eax, dword [edi + 0x4c]
test eax, eax
je 0x4178d0
push eax
call fcn.004b2640
mov eax, dword [edi + 0x30]
test eax, eax
je 0x4178e5
push eax
call esi
test eax, eax
je 0x4178e5
mov dword [edi + 0x30], 0
mov eax, dword [edi + 0x28]
test eax, eax
je 0x4178fa
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 0x28], 0
mov eax, dword [edi + 0x18]
test eax, eax
je 0x417907
push eax
call fcn.004b2640
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4179a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
mov eax, dword [0x5c5244]
xor eax, esp
mov dword [esp + 0x28], eax
mov ecx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
mov dword [esp + 0xc], ebx
push esi
push edi
test ecx, ecx
jne 0x4179de
mov eax, 0x80004005
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.004da3bd
mov esp, ebp
pop ebp
ret 8
mov dword [ebx + 0x9c], ecx
lea edx, [esp + 0x20]
mov eax, dword [ecx]
push edx
push ecx
call dword [eax]
mov esi, dword [esp + 0x20]
mov dword [ebx + 0x34], esi
call fcn.00418b60
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], 1
push ecx
push 0xbb8
push 1
push 0
push esi
push 0x8021
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
cmp dword [esp + 0x10], 0
jne 0x417b2b
mov eax, dword [ebx + 0x9c]
lea edx, [esp + 0x18]
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
push edx
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
mov edx, dword [esp + 0x1c]
xorps xmm0, xmm0
mov ecx, dword [esp + 0x18]
push 0
movups xmmword [esp + 0x28], xmm0
call fcn.004232e0
mov ebx, eax
add esp, 4
mov dword [esp + 0x10], ebx
test ebx, ebx
je 0x417b2b
push 0
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push ebx
mov ebx, dword [sym.imp.GDI32.dll_SelectObject]
mov esi, eax
push esi
call ebx
mov ecx, dword [esp + 0x14]
mov edi, eax
push esi
mov ecx, dword [ecx + 0x9c]
push ecx
mov edx, dword [ecx]
call dword [edx + 0x10]
push edi
push esi
call ebx
mov ebx, dword [esp + 0x14]
mov edi, dword [esp + 0x10]
mov eax, dword [ebx + 0x30]
test eax, eax
je 0x417ab8
cmp eax, edi
je 0x417ab8
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [ebx + 0x30], edi
call fcn.00418b60
lea ecx, [esp + 0x14]
push ecx
push 0xbb8
push 1
lea ecx, [esp + 0x30]
push ecx
push ebx
push 0x8050
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
mov eax, dword [ebx + 0x9c]
push eax
mov ecx, dword [eax]
call dword [ecx + 4]
mov ecx, ebx
call fcn.00417920
push 0
push 0
push ebx
push 0x417bd0
push 0
push 0
call fcn.00510ce2
add esp, 0x18
mov dword [ebx + 0x28], eax
test eax, eax
jne 0x417b20
push eax
push eax
push 0x8020
push dword [ebx + 8]
call dword [sym.imp.USER32.dll_SendMessageW]
test esi, esi
je 0x417b2b
push esi
call dword [sym.imp.GDI32.dll_DeleteDC]
mov ecx, dword [esp + 0x34]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004da3bd
mov esp, ebp
pop ebp
ret 8
Function at 0x423350
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x68
push esi
push edi
lea eax, [esp + 0x30]
xorps xmm0, xmm0
push eax
push 0x18
push ecx
movaps xmmword [esp + 0x3c], xmm0
movq qword [esp + 0x4c], xmm0
call dword [sym.imp.GDI32.dll_GetObjectW]
mov eax, dword [esp + 0x44]
mov dword [esp + 0x14], eax
test eax, eax
je 0x423491
cmp word [esp + 0x42], 0x20
jne 0x423491
mov eax, dword [esp + 0x34]
shl eax, 2
push 0x10
mov dword [esp + 0x20], eax
call sub.gdiplus.dll_GdipAlloc
mov esi, eax
test esi, esi
je 0x4233e3
mov eax, dword [esp + 0x38]
lea edx, [esp + 0x18]
mov ecx, dword [esp + 0x34]
push edx
push 0
push 0x26200a
push 0
push eax
push ecx
mov dword [esi], vtable.Gdiplus::Bitmap.0
mov dword [esp + 0x30], 0
call dword [sym.imp.gdiplus.dll_GdipCreateBitmapFromScan0]
mov dword [esi + 8], eax
mov eax, dword [esp + 0x18]
mov dword [esi + 4], eax
jmp 0x4233e5
xor esi, esi
mov eax, dword [esp + 0x38]
xor edi, edi
test eax, eax
jle 0x423489
sub eax, edi
mov dword [esp + 0x20], 0
dec eax
mov dword [esp + 0x2c], 1
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x28], eax
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x68], eax
lea eax, [esp + 0x58]
push eax
push 0x26200a
push 6
lea eax, [esp + 0x2c]
mov dword [esp + 0x78], 0
push eax
push dword [esi + 4]
mov dword [esp + 0x70], 1
mov dword [esp + 0x78], 0x26200a
call dword [sym.imp.gdiplus.dll_GdipBitmapLockBits]
test eax, eax
je 0x42345f
mov dword [esi + 8], eax
lea eax, [esp + 0x58]
push eax
push dword [esi + 4]
call dword [sym.imp.gdiplus.dll_GdipBitmapUnlockBits]
test eax, eax
je 0x423474
mov dword [esi + 8], eax
mov eax, dword [esp + 0x1c]
inc edi
add dword [esp + 0x14], eax
mov eax, dword [esp + 0x38]
cmp edi, eax
jl 0x4233f3
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x428eb0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x548f56
mov eax, dword fs:[0]
push eax
sub esp, 0x210
mov eax, dword [0x5c5244]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x21c]
push eax
call fcn.00429510
mov dword [ebp - 4], 0
lea eax, [ebp - 0x218]
push 0x208
push 0
push eax
call fcn.004f39e0
add esp, 0xc
lea eax, [ebp - 0x218]
push str.360safe.exe
push dword [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov esi, eax
mov dword [ebp - 4], 0xffffffff
or ecx, 0xffffffff
mov edx, dword [ebp - 0x21c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x428f51
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004da3bd
mov esp, ebp
pop ebp
ret

Function at 0x429510
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5490cd
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x5c5244]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x228], esi
mov dword [ebp - 0x224], 0
mov eax, dword [edi + 4]
cmp dword [eax - 0xc], 0
jne 0x4295e2
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 0x220], 1
push 0
push eax
call fcn.004f39e0
add esp, 0xc
mov dword [ebp - 0x21c], 0x104
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x220]
push eax
push str.Path
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea edx, [ebp - 0x218]
lea ecx, [edx + 2]
nop dword [eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x4295c0
sub edx, ecx
lea eax, [ebp - 0x218]
sar edx, 1
lea ecx, [edi + 4]
push edx
push eax
call fcn.00429710
mov eax, dword [edi + 4]
add eax, 0xfffffff0
push eax
call fcn.00428580
add esp, 4
add eax, 0x10
mov dword [esi], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x224], 1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004da3bd
mov esp, ebp
pop ebp
ret 4

Function at 0x429850
Capabilities:
Check if file exists

Disassembly:
push esi
mov esi, ecx
push 0
mov eax, dword [esi]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
jne 0x42986b
mov ecx, esi
pop esi
jmp fcn.00428b50
pop esi
ret
Function at 0x42c060
Capabilities:
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x549c9c
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x5c5244]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x234], ecx
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x224], 0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x22c]
push 0x2001f
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push SysReAllocString
call fcn.0042e900
mov edi, dword [ebp - 0x22c]
test eax, eax
jne 0x42c1fd
call fcn.004287b0
mov ecx, eax
test ecx, ecx
je 0x42c245
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x220], eax
mov byte [ebp - 4], 2
lea eax, [ebp - 0x220]
push dword [esi + 8]
push dword [esi]
push 0x56e634
push eax
call fcn.0042de00
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004f39e0
add esp, 0x1c
mov dword [ebp - 0x21c], 0x208
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x230]
push eax
push 0
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x42c183
mov eax, dword [ebp - 0x230]
cmp eax, 1
je 0x42c171
cmp eax, 2
jne 0x42c183
cmp dword [ebp - 0x21c], 0
jne 0x42c183
xor eax, eax
mov word [ebp - 0x218], ax
mov esi, dword [ebp - 0x220]
lea eax, [ebp - 0x218]
push eax
push esi
call fcn.0051070a
add esp, 8
test eax, eax
je 0x42c1ca
test esi, esi
je 0x42c1ca
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x42c1a6
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push esi
push 1
push 0
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 0x234]
push str.Computer_Z
call fcn.0042d9a0
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x42c1f6
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, 1
jmp 0x42c1ff
xor esi, esi
mov dword [ebp - 4], 0xffffffff
test edi, edi
je 0x42c21b
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x228], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004da3bd
mov esp, ebp
pop ebp
ret 8
push 0x80004005
call fcn.004225f0
int3
Function at 0x42e030
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54a431
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x5c5244]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], 0
cmp word [0x5cb898], 0
jne 0x42e07d
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x100
push eax
push 0x5cb898
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
call fcn.004287b0
mov ecx, eax
test ecx, ecx
je 0x42e0f2
mov eax, dword [ecx]
call dword [eax + 0xc]
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
mov dword [ebp - 4], 1
mov ecx, esi
push 0x5cb898
call fcn.0042d870
test al, al
jne 0x42e0d0
mov ecx, 0x5cb898
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x42e0b4
sub ecx, edx
sar ecx, 1
push ecx
push 0x5cb898
mov ecx, esi
call fcn.00429710
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.004225f0
int3

Function at 0x42e100
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54a45b
mov eax, dword fs:[0]
push eax
sub esp, 0x220
mov eax, dword [0x5c5244]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
call fcn.004332f0
test eax, eax
je 0x42e14b
push str.ComputerZ_Tray
mov ecx, esi
call fcn.0042e3c0
test eax, eax
jne 0x42e25f
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x220], 0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x228]
push 0x2001f
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push SysReAllocString
call fcn.0042e900
mov esi, dword [ebp - 0x228]
test eax, eax
jne 0x42e237
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004f39e0
add esp, 0xc
mov dword [ebp - 0x21c], 0x208
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x22c]
push eax
push 0
push str.ComputerZ_Tray
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x42e237
mov eax, dword [ebp - 0x22c]
cmp eax, 1
je 0x42e1ef
cmp eax, 2
jne 0x42e237
mov eax, dword [ebp - 0x21c]
test eax, eax
je 0x42e237
test al, 1
jne 0x42e237
shr eax, 1
cmp word [ebp + eax*2 - 0x21a], 0
jne 0x42e237
cmp word [ebp - 0x218], 0
je 0x42e237
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x42e230
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x228], 0
mov eax, 1
jmp 0x42e255
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x42e253
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x228], 0
xor eax, eax
mov dword [ebp - 0x224], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004da3bd
mov esp, ebp
pop ebp
ret
Function at 0x42e7a0
Capabilities:
Check if file exists
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54a5fb
mov eax, dword fs:[0]
push eax
sub esp, 0x220
mov eax, dword [0x5c5244]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x220], 0
mov dword [ebp - 4], 0
call fcn.00433300
neg eax
lea ecx, [ebp - 0x228]
sbb eax, eax
and eax, 0x100
or eax, 0x20019
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0042e900
mov edi, dword [ebp - 0x228]
test eax, eax
jne 0x42e8b1
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004f39e0
add esp, 0xc
mov dword [ebp - 0x21c], 0x208
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x22c]
push eax
push 0
push str.ComputerZ_Tray
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x42e894
mov eax, dword [ebp - 0x22c]
cmp eax, 1
je 0x42e880
cmp eax, 2
jne 0x42e899
cmp dword [ebp - 0x21c], 0
jne 0x42e899
xor eax, eax
mov word [ebp - 0x218], ax
jmp 0x42e899
cmp eax, 0xd
jne 0x42e8b1
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov esi, eax
neg esi
sbb esi, esi
add esi, 2
jmp 0x42e8b3
xor esi, esi
mov dword [ebp - 4], 0xffffffff
test edi, edi
je 0x42e8cf
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x228], 0
mov eax, esi
mov dword [ebp - 0x224], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004da3bd
mov esp, ebp
pop ebp
ret
Function at 0x42ef60
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x42efb9
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x42efb9
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x42efaa
cmp esi, edx
jae 0x42efb9
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x42ef98
cmp esi, edx
jae 0x42efb9
cmp word [esi], 0
je 0x42efb9
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret

Function at 0x42fab0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp dword [esi + 8], 0
je 0x42fac7
mov eax, 0x8000ffff
pop esi
mov esp, ebp
pop ebp
ret
push edi
push 0
lea edi, [esi + 0x24]
push edi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
test eax, eax
jne 0x42faf2
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x42faec
movzx eax, ax
or eax, 0x80070000
test eax, eax
js 0x42fc0b
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push 0
push 0
mov byte [edi + 0x18], 1
call ebx
mov dword [esi + 0x40], eax
test eax, eax
jne 0x42fb29
cmp byte [edi + 0x18], al
je 0x42fb1d
push edi
mov byte [edi + 0x18], al
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
call fcn.0042f8b0
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push 0
call ebx
mov edi, eax
test edi, edi
jne 0x42fb62
call fcn.0042f8b0
push 0x2710
mov ecx, esi
mov edi, eax
call fcn.0042fcf0
test eax, eax
jns 0x42fc08
test edi, edi
pop ebx
cmovns edi, eax
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0
push 0
push edi
mov ecx, esi
call fcn.0042f650
mov dword [ebp - 4], eax
test eax, eax
jns 0x42fb92
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x2710
mov ecx, esi
call fcn.0042fcf0
mov eax, dword [ebp - 4]
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push 0
call ebx
mov ebx, eax
test ebx, ebx
je 0x42fb39
push 0
push 0
push ebx
mov ecx, esi
call fcn.0042f650
mov edi, eax
test edi, edi
jns 0x42fbd0
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x2710
mov ecx, esi
call fcn.0042fcf0
pop ebx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [esi + 4]
push eax
push 0
push esi
push 0x430010
push 0
push 0
call fcn.00510ce2
add esp, 0x18
mov dword [esi], eax
test eax, eax
je 0x42fb39
push 0xffffffffffffffff
push dword [esi + 0x40]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x42fc08
call fcn.0042f8b0
mov edi, eax
mov eax, edi
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x430890
Capabilities:
Check if file exists
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54ae66
mov eax, dword fs:[0]
push eax
sub esp, 0x418
mov eax, dword [0x5c5244]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004f39e0
add esp, 0xc
lea eax, [ebp - 0x218]
push 0
push 0x10
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x56ec30
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x430933
push str._xleh__relpace_old_shortname
call fcn.00492250
push 1
push 1
push 0
push str._ignore_flag__createurlhttp:__www.ludashi.com_cms_service_jump.php_keyxleh_shortcut
push str.UtilsLauncher.del.exe
push 0
call fcn.00433670
add esp, 0x1c
jmp 0x430a2e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.00510d9e
push 2
call fcn.004977e0
add esp, 8
test eax, eax
je 0x430a2e
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.004f39e0
add esp, 0xc
lea eax, [ebp - 0x420]
push 1
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.LudashiComputerZ.set
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x420]
push eax
push 0
push str.shortcut
push str.xleh
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, 1
je 0x430a2e
call fcn.004966f0
push eax
lea ecx, [ebp - 0x424]
call fcn.0042b850
mov dword [ebp - 4], 0
mov ecx, esi
push dword [ebp - 0x424]
call fcn.00430be0
test eax, eax
je 0x430a09
push 0x64
call fcn.00498d20
add esp, 4
cmp eax, dword [esi]
jge 0x430a09
push str._xleh__run_CCommon::RunApp_UtilsLauncher.del.exe...
call fcn.00492250
push 1
push 1
push 0
push str._createurlhttp:__www.ludashi.com_cms_service_jump.php_keyxleh_shortcut
push str.UtilsLauncher.del.exe
push 0
call fcn.00433670
add esp, 0x1c
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov edx, dword [ebp - 0x424]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x430a2e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004da3bd
mov esp, ebp
pop ebp
ret
Function at 0x432b90
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4010
call fcn.004da530
mov eax, dword [0x5c5244]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x4004]
push edi
mov edi, dword [ebp + 0xc]
push 0x4000
push 0
push eax
call fcn.004f39e0
add esp, 0xc
mov dword [ebp - 0x4008], 0
test esi, esi
je 0x432c86
test edi, edi
je 0x432c86
lea eax, [ebp - 0x4008]
push eax
push esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x432c86
cmp eax, 0x3fff
ja 0x432c86
lea ecx, [ebp - 0x4004]
push ecx
push eax
push 0
push esi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x432c86
lea eax, [ebp - 0x4010]
push eax
lea eax, [ebp - 0x400c]
push eax
push 0x56db64
lea eax, [ebp - 0x4004]
push eax
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x432c86
mov esi, dword [ebp + 0x10]
lea eax, [esi + esi]
push eax
push 0
push edi
call fcn.004f39e0
mov ecx, dword [ebp - 0x400c]
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
push str._d._d._d._d
lea eax, [esi - 1]
push eax
push edi
call fcn.00434b50
add esp, 0x28
mov eax, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004da3bd
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.004da3bd
mov esp, ebp
pop ebp
ret