joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4328fe
Capabilities:
Get disk information

Disassembly:
push 0x30
mov eax, 0x44adcb
call fcn.00425438
mov ebx, ecx
mov dword [ebp - 0x10], ebx
call fcn.00401407
cmp byte [0x4601b1], 0
jne 0x4329ea
mov ecx, ebx
call fcn.00401407
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
mov edi, eax
mov dword [ebp - 0x1c], edi
test edi, edi
jne 0x432942
xor al, al
jmp 0x432ab3
push edi
call fcn.00419c01
mov esi, eax
pop ecx
mov dword [ebp - 0x24], esi
push esi
push edi
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
mov edi, eax
mov dword [ebp - 0x20], edi
test edi, edi
je 0x432aaa
cmp edi, dword [ebp - 0x1c]
ja 0x432aaa
lea ecx, [ebp - 0x30]
call fcn.00430c98
mov byte [ebp - 4], 1
test edi, edi
je 0x4329e3
xor eax, eax
mov dword [ebp - 0x18], edi
inc eax
mov ecx, edi
mov dword [ebp - 0x14], eax
cmp byte [esi + eax - 1], 0
jne 0x4329d4
lea eax, [ebx + esi]
push eax
lea ecx, [ebp - 0x30]
call fcn.00430ea6
mov ebx, dword [ebp - 0x14]
lea edx, [ebp - 0x30]
lea ecx, [ebp - 0x3c]
call fcn.0043009c
mov edi, eax
mov ecx, dword [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.004014b2
mov ecx, dword [ebp - 0x10]
push edi
call fcn.00401473
mov byte [ebp - 4], 1
push dword [ebp - 0x3c]
call fcn.00419af9
pop ecx
mov ecx, dword [ebp - 0x18]
mov eax, ebx
inc eax
sub ecx, 1
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
jne 0x43298a
mov edi, dword [ebp - 0x20]
cmp ebx, edi
jmp 0x432a9e
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov edi, eax
mov dword [ebp - 0x20], edi
test edi, edi
je 0x43293b
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00419c01
mov esi, eax
pop ecx
mov dword [ebp - 0x24], esi
push esi
push edi
mov dword [ebp - 4], 3
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov edi, eax
test edi, edi
je 0x432aaa
cmp edi, dword [ebp - 0x20]
ja 0x432aaa
lea ecx, [ebp - 0x30]
call fcn.00430d8f
mov byte [ebp - 4], 4
mov edx, ebx
mov dword [ebp - 0x1c], edx
mov ecx, ebx
mov dword [ebp - 0x14], ecx
test edi, edi
je 0x432a9c
push 2
pop eax
mov dword [ebp - 0x18], eax
cmp word [esi + eax - 2], bx
jne 0x432a8b
lea eax, [edx + esi]
push eax
lea ecx, [ebp - 0x30]
call fcn.00430db3
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x1c], eax
call fcn.004014b2
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x30]
push eax
call fcn.00401473
mov eax, dword [ebp - 0x18]
mov edx, eax
mov ecx, dword [ebp - 0x14]
inc ecx
add eax, 2
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], eax
cmp ecx, edi
jb 0x432a55
mov edx, dword [ebp - 0x1c]
cmp edx, edi
push dword [ebp - 0x30]
sete bl
call fcn.00419af9
pop ecx
push esi
call fcn.00419af9
mov al, bl
pop ecx
call fcn.00425412
ret
Function at 0x4333c5
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x4601b1], 0
jne 0x4333f7
mov edx, ecx
lea ecx, [ebp - 0xc]
push esi
call fcn.004300fa
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.00419af9
pop ecx
mov eax, esi
pop esi
jmp 0x433408
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, eax
mov eax, ecx
mov esp, ebp
pop ebp
ret

Function at 0x433857
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push esi
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x433881
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x433881
xor al, al
jmp 0x433895
mov eax, dword [ebp + 8]
xor ecx, ecx
mov edx, dword [ebp - 4]
add ecx, esi
adc edx, 0
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x436b7f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
mov eax, ecx
push ebx
push ebp
push esi
push edi
cmp edx, 0xffffffff
je 0x436c61
mov ecx, dword [eax + 0x78]
mov eax, dword [eax + 0x7c]
and dword [esp + 0x34], 0
add eax, dword [ecx + edx*4]
mov dword [esp + 0x2c], eax
mov eax, dword [ecx + edx*4 + 4]
sub eax, dword [ecx + edx*4]
lea ecx, [esp + 0x2c]
mov dword [esp + 0x30], eax
call fcn.004390dc
mov ebx, eax
test ebx, ebx
jmp 0x436c57
lea ecx, [esp + 0x2c]
call fcn.004390c4
mov esi, dword [esp + 0x34]
xorps xmm0, xmm0
mov ecx, dword [esp + 0x2c]
movzx ebp, al
movlpd qword [esp + 0x20], xmm0
mov edi, dword [esp + 0x24]
mov byte [esp + 0x3c], al
lea ecx, [esi + ecx]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x18], 0
and ebp, 0xf
jbe 0x436c2c
mov esi, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
movzx eax, byte [esi + ebx]
shld edi, ecx, 8
cdq
shl ecx, 8
or edi, edx
or eax, ecx
inc esi
mov ecx, eax
cmp esi, ebp
jb 0x436c09
mov esi, dword [esp + 0x34]
mov ebx, dword [esp + 0x14]
mov al, byte [esp + 0x3c]
add esi, ebp
mov dword [esp + 0x34], esi
cmp ecx, 0x6f10701
jne 0x436c3e
test edi, edi
je 0x436c6d
test al, 0x20
je 0x436c54
lea ecx, [esp + 0x2c]
call fcn.004390dc
and dword [esp + 0x24], 0
add dword [esp + 0x34], eax
sub ebx, 1
mov dword [esp + 0x14], ebx
jne 0x436bc4
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 4
mov al, 1
jmp 0x436c63
Function at 0x43b1bd
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
push edi
xor edi, edi
test esi, esi
je 0x43b1cd
mov dword [esi], edi
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x43b213
push edi
lea ecx, [ebp + 0x14]
push ecx
mov ecx, 0x8000
cmp eax, ecx
cmovae eax, ecx
push eax
push dword [ebp + 0xc]
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0x14]
add dword [ecx + 8], edx
adc dword [ecx + 0xc], edi
test esi, esi
je 0x43b208
add dword [esi], edx
test eax, eax
jne 0x43b213
call fcn.0043b6d5
mov edi, eax
mov eax, edi
pop edi
pop esi
pop ebp
ret 0x10
Function at 0x444e12
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push 0x11
mov esi, ecx
call dword [sym.imp.USER32.dll_GetKeyState]
mov edx, dword [esp + 8]
shr eax, 0xf
and al, 1
movzx ecx, word [edx + 0xc]
cmp ecx, 8
je 0x444e53
cmp ecx, 0x52
je 0x444e42
cmp ecx, 0x76
jne 0x444e4f
mov ecx, esi
call fcn.00444377
jmp 0x444e5a
test al, al
je 0x444e4f
mov ecx, esi
call fcn.0044457d
jmp 0x444e5a
xor al, al
jmp 0x444e5c
mov ecx, esi
call fcn.00444512
mov al, 1
pop esi
ret 4
Function at 0x446499
Capabilities:
Get file system object information

Disassembly:
push 0x1c8
mov eax, 0x44cc90
call fcn.0042546c
mov ebx, ecx
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x1c8]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x1a4], eax
call fcn.00430d8f
and dword [ebp - 4], 0
cmp byte [edi], 0
je 0x44651c
push dword [edi + 0xc]
lea ecx, [ebp - 0x1b0]
push dword [edi + 8]
call fcn.00446413
push eax
mov edx, 0xdb0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1bc]
call fcn.00446459
push eax
lea ecx, [ebp - 0x1c8]
mov byte [ebp - 4], 2
call fcn.00430e48
push dword [ebp - 0x1bc]
call fcn.00419af9
pop ecx
mov byte [ebp - 4], 0
push dword [ebp - 0x1b0]
call fcn.00419af9
pop ecx
lea eax, [edi + 0x18]
mov ecx, eax
mov dword [ebp - 0x1a0], eax
call fcn.00430340
mov esi, eax
lea eax, [ebp - 0x1bc]
lea ecx, [esi + 1]
push ecx
push eax
lea ecx, [edi + 0x18]
call fcn.00403442
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x1b0]
mov eax, dword [edi + 0x18]
add eax, 2
lea eax, [eax + esi*2]
push eax
call fcn.00430ef6
lea eax, [ebp - 0x1bc]
mov byte [ebp - 4], 4
push eax
mov ecx, ebx
call fcn.004466ec
lea eax, [ebp - 0x1b0]
mov ecx, ebx
push eax
call fcn.004466ec
lea eax, [ebp - 0x1bc]
push eax
lea ecx, [ebp - 0x19c]
call fcn.00430e1a
lea ecx, [ebp - 0x19c]
mov byte [ebp - 4], 5
call fcn.004304a8
lea eax, [ebp - 0x1b0]
push eax
lea ecx, [ebp - 0x19c]
call fcn.00430429
lea ecx, [ebp - 0x19c]
call fcn.004304a8
lea eax, [ebp - 0x1c8]
push eax
lea ecx, [ebp - 0x19c]
call fcn.00430429
lea ecx, [ebp - 0x19c]
call fcn.004304a8
cmp byte [edi + 1], 0
je 0x446639
mov edx, 0x3f4
lea ecx, [ebp - 0x1d4]
call fcn.004345d0
push eax
lea ecx, [ebp - 0x19c]
mov byte [ebp - 4], 6
call fcn.00430429
mov byte [ebp - 4], 5
push dword [ebp - 0x1d4]
call fcn.00419af9
lea ecx, [ebp - 0x19c]
mov dword [esp], 0x454590
call fcn.004303dd
push 0
lea eax, [ebp - 0x30]
push eax
lea ecx, [edi + 0x10]
call fcn.0043437d
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x19c]
call fcn.004303dd
push dword [ebp + 8]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push dword [ebx + 4]
call edi
mov edx, dword [ebp - 0x19c]
mov ecx, eax
call fcn.00434d52
mov edx, dword [ebp - 0x1a0]
lea ecx, [ebp - 0x1d4]
call fcn.00401a0f
push pe_nt_image_headers32
push 0x160
lea ecx, [ebp - 0x190]
push ecx
push 0x80
push dword [eax]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
push dword [ebp - 0x1d4]
mov esi, eax
call fcn.00419af9
pop ecx
test esi, esi
je 0x4466b4
push dword [ebp - 0x1a4]
push dword [ebx + 4]
call edi
push 0
push dword [ebp - 0x190]
push 0x170
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [ebp - 0x19c]
call fcn.00419af9
pop ecx
push dword [ebp - 0x1b0]
call fcn.00419af9
pop ecx
push dword [ebp - 0x1bc]
call fcn.00419af9
pop ecx
push dword [ebp - 0x1c8]
call fcn.00419af9
pop ecx
call fcn.00425427
ret 0xc
Function at 0x446c66
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
sub esp, 0x28
mov eax, dword [edx]
push esi
mov esi, ecx
cmp eax, dword [esi + 0xb4]
jne 0x446c99
cmp dword [edx + 8], 0xffffff65
jne 0x446c99
movzx eax, word [edx + 0xc]
sub eax, 0x2d
je 0x446cd5
sub eax, 0x14
je 0x446ca2
dec eax
sub eax, 1
je 0x446cd5
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 8
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
je 0x446c99
push 2
pop eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x28]
push eax
push 0xffffffffffffffff
push 0x102b
push dword [esi + 0xb4]
call dword [sym.imp.USER32.dll_SendMessageA]
mov al, 1
jmp 0x446c9b
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
je 0x446c99
mov ecx, esi
call fcn.00446b76
jmp 0x446cd1
Function at 0x448eb9
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x168
mov eax, dword [0x45e008]
xor eax, esp
mov dword [esp + 0x164], eax
test cl, cl
mov edx, 0x4011
mov eax, 0x4110
cmovne eax, edx
push eax
push 0x160
lea eax, [esp + 8]
push eax
push 0x90
push 0x453854
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
mov ecx, dword [esp + 0x164]
xor ecx, esp
call fcn.00419ae8
mov esp, ebp
pop ebp
ret

Function at 0x448f0f
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2d0
mov eax, dword [0x45e008]
xor eax, esp
mov dword [esp + 0x2cc], eax
cmp byte [0x4601b1], 0
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, edx
jne 0x448f72
mov edx, ecx
lea ecx, [esp + 0xc]
call fcn.004300fa
push 0x4010
push 0x160
lea ecx, [esp + 0x20]
or esi, 0x80
push ecx
push esi
push dword [eax]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
push dword [esp + 0xc]
mov esi, eax
call fcn.00419af9
pop ecx
mov eax, esi
jmp 0x448f86
push ecx
push ecx
lea eax, [esp + 0x20]
or esi, 0x80
push eax
mov edx, esi
call fcn.00448e9b
mov ecx, dword [esp + 0x1c]
mov dword [edi], ecx
mov ecx, dword [esp + 0x2d4]
pop edi
pop esi
xor ecx, esp
call fcn.00419ae8
mov esp, ebp
pop ebp
ret 4

Function at 0x449667
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push esi
push edi
push eax
push ecx
mov esi, edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x449693
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x449693
xor al, al
jmp 0x4496a4
mov ecx, dword [ebp - 4]
xor eax, eax
add eax, edi
mov dword [esi], eax
mov al, 1
adc ecx, 0
mov dword [esi + 4], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10003420
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x1000342f
pop dword [ebp - 0x4c]
mov eax, 0x1000342f
sub dword [ebp - 0x4c], eax
push 0x40
push 0x1000
push 0x3aa78
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x4c]
call dword [eax]
mov ecx, 0x58aa
mov edx, eax
mov ebx, 0x10007400
add ebx, dword [ebp - 0x4c]
mov esi, 0xcfdb4c3e
sub esi, 0x5962eae5
sub dword [ebp - 0xc], 0x8b182826
mov edi, dword [ebx]
add dword [ebp - 0x40], eax
xor edi, esi
add dword [ebp - 0x34], 0x65fba9d0
mov dword [edx], edi
add edx, 0xf0b3b3bb
add edx, 0xf4c4c49
add ebx, 0x4682a0de
add ebx, 0xb97d5f26
loop 0x10003478
add eax, 0xa0dd34d6
sub eax, 0xa0dbdf5b
xor ebx, ebx
add ebx, eax
add eax, 0x5a2425c7
sub eax, 0x5a2425c2
mov ecx, 0x28d67e61
add ecx, 0xe729819f
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret

Function at 0x10003ae0
Capabilities:
Enumerate pe sections

Disassembly:
push esi
mov esi, dword [esp + 0xc]
mov ecx, dword [esi + 4]
sub ecx, 1
js 0x10003b0b
mov eax, dword [esi + 8]
lea edx, [eax + ecx*4]
mov eax, dword [edx]
movzx eax, word [eax + 6]
cmp eax, 4
je 0x10003b1e
cmp eax, 0xd
je 0x10003b1e
sub edx, 4
sub ecx, 1
jns 0x10003af3
mov eax, dword [esi]
sub eax, 1
je 0x10003b2c
sub eax, 2
je 0x10003b25
mov eax, 2
pop esi
ret
mov eax, 1
pop esi
ret
mov edx, 0x100040e0
jmp 0x10003b31
mov edx, 0x10004020
mov ecx, dword [esp + 8]
mov eax, dword [esp + 0x18]
sub edx, eax
sub edx, 0xa
mov dword [ecx + 1], eax
mov eax, dword [esp + 0x10]
mov byte [ecx], 0xb8
mov byte [ecx + 5], 0xe9
mov dword [ecx + 6], edx
mov dword [ecx + 0x10], eax
mov eax, dword [esp + 0x14]
mov dword [ecx + 0xc], esi
mov dword [ecx + 0x14], eax
xor eax, eax
pop esi
ret
Function at 0x4011a7
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x414020
push 0x40109a
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
call fcn.004012dd
push 0x414050
push 0x414040
push 0x414030
call sub.CRTDLL.DLL___GetMainArgs
add esp, 0xc
push 0x4111b0
push 0xb
call sub.CRTDLL.DLL_signal
add esp, 8
mov dword [0x414014], eax
mov dword [0x414014], 0x4111b0
push dword [0x414050]
push dword [0x414040]
push dword [0x414030]
mov dword [0x414018], esp
call fcn.00410a03
add esp, 0xc
mov dword [ebp - 4], 0
push eax
call sub.CRTDLL.DLL_exit
call sub.CRTDLL.DLL__cexit
call fcn.004013ab
call sub.kernel32.dll_ExitProcess
pop edi
leave
ret
Function at 0x417eb0
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x18]
mov ecx, 6
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
mov ecx, 0x4270fa
call fcn.004116cc
nop
mov esi, esp
push 0x10
mov eax, dword [ebp - 8]
add eax, 0xc
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.WS2_32.dll_connect]
cmp esi, esp
call fcn.004114b0
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x417f5b
mov esi, esp
push 0x41105a
mov edi, esp
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp edi, esp
call fcn.004114b0
mov edi, esp
push eax
push str.Connection_to_server_failed._Error_
mov eax, dword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
push eax
call fcn.0041133e
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___int_]
cmp edi, esp
call fcn.004114b0
mov ecx, eax
call dword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
cmp esi, esp
call fcn.004114b0
nop
mov ecx, dword [ebp - 8]
call fcn.0041156e
nop
xor al, al
jmp 0x417f87
mov esi, esp
push 0x41105a
push str.Connection_established_successfully._Ready_to_send_a_message_to_server
mov eax, dword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push eax
call fcn.0041133e
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
cmp esi, esp
call fcn.004114b0
nop
mov al, 1
pop edi
pop esi
pop ebx
add esp, 0xd8
cmp ebp, esp
call fcn.004114b0
mov esp, ebp
pop ebp
ret
Function at 0x401050
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44203e
mov eax, dword fs:[0]
push eax
sub esp, 0x70
mov eax, dword [0x45166c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x7c], edi
mov dword [0x454434], edi
xor ebx, ebx
mov dword [ebp - 4], ebx
lea esi, [edi + 0x38]
lea eax, [esi + 4]
mov byte [edi], bl
mov dword [edi + 4], 0x446884
mov dword [edi + 8], str.Bianya.exe
mov dword [edi + 0xc], 0x446898
mov dword [edi + 0x10], 0x4468a4
mov dword [edi + 0x14], 0x4468b0
mov dword [edi + 0x30], 0xa
mov byte [edi + 0x34], 1
mov dword [esi], eax
mov byte [eax], bl
push 0x4468c1
or eax, 0xffffffff
call fcn.00413e70
lea esi, [edi + 0x90]
lea eax, [esi + 4]
mov dword [edi + 0x7c], ebx
mov dword [edi + 0x80], 0x1010000
mov byte [edi + 0x84], 1
mov dword [edi + 0x88], ebx
mov dword [edi + 0x8c], ebx
mov dword [esi], eax
mov byte [eax], bl
push str.huvs__.uts.icl522__km.wj3_32513__77_keord
or eax, 0xffffffff
call fcn.00413e70
lea ebx, [edi + 0xd4]
xor eax, eax
mov dword [ebp - 0x58], ebx
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
lea eax, [ebp - 0x5c]
push eax
mov byte [ebp - 4], 3
call dword [sym.imp.SensApi.dll_IsNetworkAlive]
test eax, eax
je 0x401134
push ebx
call fcn.004057e0
mov byte [ebp - 4], 4
xor ebx, ebx
push 0x58
mov dword [edi + 0xec], ebx
call fcn.00423e3d
add esp, 4
cmp eax, ebx
je 0x401233
mov dword [edi + 0xe8], eax
mov dword [eax], eax
mov eax, dword [edi + 0xe8]
mov dword [eax + 4], eax
mov eax, dword [edi + 0xe8]
mov dword [eax + 8], eax
mov ecx, dword [edi + 0xe8]
mov byte [ecx + 0x54], 1
mov edx, dword [edi + 0xe8]
mov byte [edx + 0x55], 1
mov byte [ebp - 4], 5
mov edx, dword [esi]
xor eax, eax
mov ecx, edx
cmp byte [edx], al
je 0x4011a0
mov edi, edi
xor byte [ecx], al
inc eax
inc ecx
cmp eax, 5
jne 0x40119b
xor eax, eax
cmp byte [ecx], 0
jne 0x401190
push edx
or eax, 0xffffffff
call fcn.00413e70
push 0xa0
call fcn.00423e3d
add esp, 4
mov dword [ebp - 0x5c], eax
mov byte [ebp - 4], 6
cmp eax, ebx
je 0x4011c9
push eax
call fcn.0041bb10
jmp 0x4011cb
xor eax, eax
lea ecx, [ebp - 0x54]
mov dword [edi + 0x7c], eax
call fcn.004012c0
mov eax, dword [eax]
push eax
or eax, 0xffffffff
lea esi, [edi + 0x38]
call fcn.00413e70
mov eax, dword [ebp - 0x54]
lea ecx, [ebp - 0x50]
cmp eax, ecx
je 0x4011f7
push eax
call fcn.004244b1
add esp, 4
push ebx
lea edx, [ebp - 0x6c]
push edx
lea eax, [edi + 0x18]
push eax
mov dword [ebp - 0x6c], 1
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], ebx
call dword [sym.imp.gdiplus.dll_GdiplusStartup]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042396b
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x58]
push ecx
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x58], ebx
call fcn.00423a80
push 0x44d6c0
lea edx, [ebp - 0x78]
push edx
mov dword [ebp - 0x78], vtable.std::bad_alloc.0
call fcn.004264e2
int3
Function at 0x4012c0
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x45166c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x103
lea eax, [ebp - 0x107]
push 0
push eax
mov esi, ecx
mov byte [ebp - 0x108], 0
call fcn.0042cae0
add esp, 0xc
lea ecx, [ebp - 0x10c]
push ecx
push 0x26
push 0
mov dword [ebp - 0x10c], 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x401333
mov eax, dword [ebp - 0x10c]
lea edx, [ebp - 0x108]
push edx
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
mov ecx, dword [ebp - 0x10c]
push ecx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
lea eax, [esi + 4]
lea edx, [ebp - 0x108]
mov dword [esi], eax
mov byte [eax], 0
push edx
or eax, 0xffffffff
call fcn.00413e70
push 0x4468f4
mov eax, esi
call fcn.00413d70
push str.bianya2
mov eax, esi
call fcn.00413d70
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0042396b
mov esp, ebp
pop ebp
ret
Function at 0x401890
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1bc
mov eax, dword [0x45166c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
push esi
lea eax, [ebx + 4]
push edi
mov dword [ebx], eax
mov byte [eax], 0
push 0x4468c1
or eax, 0xffffffff
mov esi, ebx
call fcn.00413e70
lea eax, [ebp - 0x1ac]
mov dword [ebp - 0x1b0], eax
push str.Software_
or eax, 0xffffffff
lea esi, [ebp - 0x1b0]
mov byte [ebp - 0x1ac], 0
call fcn.00413e70
push str.bianya2
mov eax, esi
call fcn.00413d70
mov eax, dword [ebp - 0x1b0]
lea ecx, [ebp - 0x1b4]
push ecx
push 0x20019
push 0
push eax
push 0x80000002
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401987
push 0x103
push eax
lea edx, [ebp - 0x10f]
push edx
mov byte [ebp - 0x110], al
call fcn.0042cae0
mov edx, dword [ebp - 0x1b4]
add esp, 0xc
lea eax, [ebp - 0x1b8]
push eax
lea ecx, [ebp - 0x110]
push ecx
push 0
push 0
push 0x44693c
push edx
mov dword [ebp - 0x1b8], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40197a
lea eax, [ebp - 0x110]
push eax
push 0x446940
mov edi, ebx
call fcn.00414360
add esp, 8
mov ecx, dword [ebp - 0x1b4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebx]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401990
sub eax, edx
test eax, eax
jg 0x401aa8
lea edx, [ebp - 0x1b8]
push edx
lea eax, [ebp - 0x1b4]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
lea ecx, [ebp - 0x1b4]
push ecx
push 0x20006
push 0
push esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401aa8
lea edx, [ebp - 0x120]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [ebp - 0x116]
movzx edx, word [ebp - 0x118]
push ecx
movzx ecx, word [ebp - 0x11e]
lea eax, [ebp - 0x164]
push edx
movzx edx, word [ebp - 0x120]
mov dword [ebp - 0x168], eax
movzx eax, word [ebp - 0x11a]
push eax
push ecx
push edx
push str.__d_02d_02d_02d_02d
lea edi, [ebp - 0x168]
mov byte [ebp - 0x164], 0
call fcn.00414360
mov edx, dword [ebp - 0x168]
mov eax, edx
add esp, 0x18
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401a50
sub eax, esi
push eax
mov eax, dword [ebp - 0x1b4]
push edx
push 1
push 0
push 0x44693c
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 0x1b4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x168]
push edx
or eax, 0xffffffff
mov esi, ebx
call fcn.00413e70
mov eax, dword [ebp - 0x168]
lea ecx, [ebp - 0x164]
cmp eax, ecx
je 0x401aa8
push eax
call fcn.004244b1
add esp, 4
mov edx, 0x4468c1
mov ecx, 0x446958
call fcn.00414060
mov eax, dword [ebp - 0x1b0]
lea edx, [ebp - 0x1ac]
cmp eax, edx
je 0x401ad0
push eax
call fcn.004244b1
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.0042396b
mov esp, ebp
pop ebp
ret