joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4302c6
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, edx
xor edx, edx
push edi
mov edi, ecx
push 0x34
lea ecx, [esi - 1]
mov dword [ebp - 0x10], ecx
mov eax, dword [edi + ecx*4]
mov dword [ebp - 4], eax
pop eax
div esi
lea ebx, [eax + 6]
xor eax, eax
cmp ecx, 1
jb 0x4303b8
jmp 0x4303b0
sub eax, 0x61c88647
xor ecx, ecx
mov dword [ebp - 0x14], eax
dec ebx
shr eax, 2
and eax, 3
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 8], ecx
cmp dword [ebp - 0x10], ecx
jbe 0x43036d
mov ebx, dword [ebp - 0xc]
mov edx, dword [edi + ecx*4 + 4]
mov esi, edx
shr eax, 5
mov ecx, edx
xor edx, dword [ebp - 0x14]
shl esi, 2
xor esi, eax
shr ecx, 3
mov eax, dword [ebp - 4]
shl eax, 4
xor ecx, eax
add esi, ecx
mov ecx, dword [ebp - 8]
mov eax, ecx
and eax, 3
xor eax, ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + eax*4]
xor eax, dword [ebp - 4]
mov ebx, dword [ebp - 0xc]
add eax, edx
xor esi, eax
add dword [edi + ecx*4], esi
mov eax, dword [edi + ecx*4]
inc ecx
mov dword [ebp - 4], eax
mov dword [ebp - 8], ecx
cmp ecx, dword [ebp - 0x10]
jb 0x43031e
mov ebx, dword [ebp - 0x18]
mov edx, dword [edi]
mov esi, edx
shr eax, 5
mov ecx, edx
xor edx, dword [ebp - 0x14]
shl esi, 2
xor esi, eax
shr ecx, 3
mov eax, dword [ebp - 4]
shl eax, 4
xor ecx, eax
mov eax, dword [ebp - 8]
and eax, 3
add esi, ecx
xor eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + eax*4]
xor eax, dword [ebp - 4]
add eax, edx
xor esi, eax
mov eax, dword [ebp - 0x10]
add dword [edi + eax*4], esi
mov eax, dword [edi + eax*4]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x14]
test ebx, ebx
jne 0x4302f9
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4303c1
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
push 0x34
xor edx, edx
mov ebx, 0xb54cda56
mov eax, dword [edi]
lea ecx, [esi - 1]
mov dword [ebp - 4], eax
pop eax
div esi
mov dword [ebp - 0xc], ecx
imul eax, eax, 0x61c88647
sub ebx, eax
cmp ecx, 1
jb 0x4304b1
test ebx, ebx
je 0x4304b1
mov eax, ebx
mov esi, ecx
shr eax, 2
and eax, 3
mov dword [ebp - 8], esi
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
test ecx, ecx
je 0x430465
mov edx, dword [edi + esi*4 - 4]
mov esi, edx
shr eax, 3
mov ecx, edx
shl esi, 4
xor esi, eax
shr ecx, 5
mov eax, dword [ebp - 4]
shl eax, 2
xor ecx, eax
mov eax, dword [ebp - 8]
add esi, ecx
and eax, 3
xor eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + eax*4]
mov eax, ebx
xor eax, dword [ebp - 4]
xor ecx, edx
add ecx, eax
mov eax, dword [ebp - 8]
xor esi, ecx
sub dword [edi + eax*4], esi
mov esi, eax
mov eax, dword [edi + esi*4]
sub esi, 1
mov dword [ebp - 4], eax
mov dword [ebp - 8], esi
jne 0x430415
mov ecx, dword [ebp - 0xc]
mov edx, dword [edi + ecx*4]
and esi, 3
mov ecx, dword [edi + ecx*4]
xor esi, dword [ebp - 0x10]
shr eax, 3
shl edx, 4
xor edx, eax
shr ecx, 5
mov eax, dword [ebp - 4]
shl eax, 2
xor ecx, eax
mov eax, dword [ebp + 8]
add edx, ecx
mov ecx, dword [eax + esi*4]
mov eax, dword [ebp - 0xc]
xor ecx, dword [edi + eax*4]
mov eax, ebx
xor eax, dword [ebp - 4]
add ecx, eax
xor edx, ecx
mov ecx, dword [ebp - 0xc]
sub dword [edi], edx
mov eax, dword [edi]
mov dword [ebp - 4], eax
add ebx, 0x61c88647
jne 0x4303fe
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4305b2
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
mov edi, ecx
test edx, edx
jne 0x4305c6
xor eax, eax
jmp 0x4306e9
push ebx
mov eax, edx
xor edx, edx
push 3
pop ecx
div ecx
mov ecx, eax
mov ebx, edx
xor eax, eax
mov dword [ebp - 4], ecx
test ebx, ebx
mov dword [ebp - 8], ebx
setne al
add eax, ecx
xor ecx, ecx
shl eax, 2
add eax, 1
setb cl
neg ecx
or ecx, eax
push ecx
call fcn.0064388e
mov edx, eax
mov dword [ebp - 0xc], edx
pop ecx
test edx, edx
je 0x4306e8
cmp dword [ebp - 4], 0
push esi
mov esi, edx
jbe 0x430673
mov ebx, dword [ebp - 4]
movzx ecx, byte [edi]
movzx eax, byte [edi + 1]
movzx edx, byte [edi + 2]
add edi, 3
shl eax, 8
shl ecx, 0x10
or ecx, eax
or edx, ecx
mov eax, edx
shr eax, 0x12
mov al, byte [eax + 0x6c9ca0]
mov byte [esi], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
mov al, byte [eax + 0x6c9ca0]
mov byte [esi + 1], al
mov eax, edx
shr eax, 6
and edx, 0x3f
and eax, 0x3f
mov al, byte [eax + 0x6c9ca0]
mov byte [esi + 2], al
mov al, byte [edx + 0x6c9ca0]
mov byte [esi + 3], al
add esi, 4
sub ebx, 1
jne 0x430612
mov ebx, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
cmp ebx, 1
jne 0x43069f
movzx ecx, byte [edi]
mov eax, ecx
and ecx, 3
shr eax, 2
shl ecx, 4
mov al, byte [eax + 0x6c9ca0]
mov byte [esi], al
mov al, byte [ecx + 0x6c9ca0]
mov byte [esi + 1], al
mov word [esi + 2], 0x3d3d
jmp 0x4306df
cmp ebx, 2
jne 0x4306e2
movzx ecx, byte [edi]
movzx eax, byte [edi + 1]
shl ecx, 8
or ecx, eax
mov eax, ecx
shr eax, 0xa
mov al, byte [eax + 0x6c9ca0]
mov byte [esi], al
mov eax, ecx
shr eax, 4
and eax, 0x3f
and ecx, 0xf
mov al, byte [eax + 0x6c9ca0]
mov byte [esi + 1], al
mov al, byte [ecx*4 + 0x6c9ca0]
mov byte [esi + 2], al
mov byte [esi + 3], 0x3d
add esi, 4
mov byte [esi], 0
mov eax, edx
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x433f8e
Capabilities:
Parse credit card information

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
xor cl, cl
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x4340f7
mov edx, 0x10000000
cmp eax, 0x7c
je 0x4340f7
cmp eax, 0x29
jne 0x433fc7
cmp dword [esi + 0x10], 0
jne 0x4340f7
test dword [esi + 0x50], edx
je 0x4340fd
cmp eax, 0x2e
jne 0x433fe2
push 5
lea ecx, [esi + 0x24]
call fcn.004341f1
mov ecx, esi
call fcn.00433f69
jmp 0x4340e1
cmp eax, 0x5c
jne 0x43403f
mov ecx, esi
call fcn.00433f69
mov eax, dword [esi + 0x50]
and eax, 0x80
je 0x434015
cmp word [esi + 0x48], 0x62
jne 0x434015
push 4
lea ecx, [esi + 0x24]
call fcn.004341f1
mov ecx, esi
call fcn.00433f69
jmp 0x4340e8
test eax, eax
je 0x434033
cmp word [esi + 0x48], 0x42
jne 0x434033
push 4
lea ecx, [esi + 0x24]
call fcn.004341f1
mov eax, dword [esi + 0x28]
xor dword [eax + 8], 1
jmp 0x434009
mov ecx, esi
call fcn.00434563
jmp 0x4340e1
cmp eax, 0x5b
jne 0x434063
mov ecx, esi
call fcn.00433f69
mov ecx, esi
call fcn.00434517
cmp dword [esi + 0x4c], 0x5d
je 0x433fd6
push 4
jmp 0x4340ff
cmp eax, 0x28
jne 0x434087
mov ecx, esi
call fcn.00433f69
mov ecx, esi
call fcn.0043465b
cmp dword [esi + 0x4c], 0x29
mov bl, al
jne 0x4340fd
mov ecx, esi
call fcn.00433f69
jmp 0x4340dd
cmp eax, 0x5e
jne 0x434093
push 2
jmp 0x434001
cmp eax, 0x24
jne 0x43409f
push 3
jmp 0x434001
cmp eax, 0x2a
je 0x4340f3
cmp eax, 0x2b
je 0x4340f3
cmp eax, 0x3f
je 0x4340f3
cmp eax, 0x7b
je 0x4340f3
cmp eax, 0x7d
jne 0x4340bd
test dword [esi + 0x50], edx
je 0x4340ef
cmp eax, 0x5d
jne 0x4340c7
test dword [esi + 0x50], edx
je 0x43405c
movzx eax, word [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.00434811
mov ecx, esi
call fcn.00433f69
mov bl, 1
test bl, bl
je 0x4340e8
mov ecx, esi
call fcn.0043474d
mov cl, 1
jmp 0x433f95
push 6
jmp 0x4340ff
push 0xa
jmp 0x4340ff
pop esi
mov al, cl
pop ebx
pop ecx
ret
push 5
call fcn.0060fbec
int3
Function at 0x436bad
Capabilities:
Check for time delay via gettickcount
Delete file
Move file

Disassembly:
push 0x34
mov eax, 0x66e845
call fcn.00626979
cmp dword [0x71d9c8], 0
je 0x436d44
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x71dd84]
cmp eax, 0x927c0
jb 0x436d44
mov edi, 0x400000
cmp dword [0x71d9b8], edi
jg 0x436d44
push 0x800000
push 0x71d9b8
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
mov ebx, eax
cmp ebx, edi
je 0x436c30
test ebx, ebx
je 0x436c30
cmp ebx, edi
jle 0x436c18
push 0xff800000
jmp 0x436d39
lea eax, [ebx - 1]
cmp eax, 0x3ffffe
ja 0x436d44
push 0xffc00000
jmp 0x436d39
call esi
cmp dword [0x70ba9c], 0xffffffff
mov dword [0x71dd84], eax
je 0x436d31
push 9
pop ecx
xor eax, eax
lea edi, [ebp - 0x40]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x40]
xor esi, esi
push eax
push esi
mov edi, 0x71d9d0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
mov eax, dword [0x70ba9c]
cmp dword [ebp - 0x24], esi
jb 0x436d31
ja 0x436c7a
cmp dword [ebp - 0x20], eax
jb 0x436d31
push edi
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], esi
call fcn.0043784d
push str..old
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], esi
call fcn.004375c5
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push dword [0x71d9c8]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp - 0x14]
mov dword [0x71d9c8], esi
push 0x71d9d0
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
push ecx
push ecx
push 0x80
push 2
push ecx
push 0x40000000
push 0x71d9d0
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.00419a90
test eax, eax
js 0x436d1c
push 2
push ecx
push ecx
lea ecx, [ebp - 0x1c]
call fcn.00436659
cmp byte [0x71d9cc], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], esi
mov dword [0x71d9c8], eax
je 0x436d26
push str.NewFile
push esi
push esi
call fcn.00436fd4
add esp, 0xc
jmp 0x436d1f
mov esi, dword [ebp - 0x1c]
test esi, esi
je 0x436d26
push esi
call edi
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.0042470b
mov eax, 0xff800000
sub eax, ebx
push eax
push 0x71d9b8
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
call fcn.00626923
ret
Function at 0x436d4a
Capabilities:
Delete file
Move file

Disassembly:
push 0x38
mov eax, 0x66e88a
call fcn.00626979
mov edi, ecx
mov dword [ebp - 0x14], edi
push 0x71d9bc
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
cmp eax, 1
jne 0x436ec7
xor ebx, ebx
mov dword [0x70ba9c], 0x400000
mov byte [ebp - 0x41], bl
mov dword [ebp - 0x1c], ebx
call fcn.00424649
push eax
lea ecx, [ebp - 0x1c]
call fcn.0041b814
mov dword [ebp - 4], ebx
test edi, edi
jne 0x436dc3
lea ecx, [ebp - 0x14]
call fcn.00436a75
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.00430a48
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.0042470b
mov esi, dword [ebp - 0x1c]
mov edi, esi
mov dword [ebp - 0x14], esi
jmp 0x436dc6
mov esi, dword [ebp - 0x1c]
push edi
call fcn.00643278
push edi
push 0x6d49f4
push 0x104
push 0x71d9d0
call fcn.004377b7
add esp, 0x14
lea edi, [ebp - 0x40]
xor eax, eax
push 9
pop ecx
rep stosd dword es:[edi], eax
mov edi, dword [ebp - 0x14]
lea eax, [ebp - 0x40]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
cmp dword [ebp - 0x24], ebx
ja 0x436e0b
cmp dword [ebp - 0x20], 0x400000
jb 0x436e4c
push edi
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], ebx
call fcn.0043784d
push 2
pop eax
push str..old
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], al
call fcn.004375c5
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push dword [ebp - 0x14]
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov byte [ebp - 0x41], 1
call fcn.0042470b
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
cmp byte [ebp - 0x41], 0
push ecx
push ecx
push 0x80
push 4
pop eax
push 2
pop ecx
cmovne eax, ecx
mov byte [ebp - 4], 3
push eax
push ecx
push 0x40000000
push edi
lea ecx, [ebp - 0x18]
call fcn.00419a90
test eax, eax
js 0x436eb1
push 2
pop eax
push eax
push ecx
push ecx
lea ecx, [ebp - 0x18]
call fcn.00436659
cmp byte [0x71d9cc], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], ebx
mov dword [0x71d9c8], eax
je 0x436ebf
push str.BEGAIN_n
push ebx
push ebx
call fcn.00436fd4
add esp, 0xc
jmp 0x436eb4
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x436ebf
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esi - 0x10]
call fcn.0042470b
call fcn.00626923
ret
Function at 0x436ecd
Capabilities:
Write file on windows

Disassembly:
push 0x18
mov eax, 0x66e8cf
call fcn.00626979
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x14], ebx
call fcn.00424649
push eax
lea ecx, [ebp - 0x14]
call fcn.0041b814
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
lea eax, [ebp - 0x14]
push str.:__Tid_d_
push eax
call fcn.0043774e
add esp, 0xc
push 0x6d4a80
call fcn.00641cc0
pop ecx
push eax
push ecx
mov ecx, esi
call fcn.00437643
lea ecx, [ebp - 0x24]
call fcn.00436b3a
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
push ecx
mov edx, eax
lea ecx, [ebp - 0x20]
call fcn.0043730a
pop ecx
push esi
mov edx, eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1c]
call fcn.0043730a
pop ecx
push eax
mov ecx, esi
mov byte [ebp - 4], 3
call fcn.00437427
mov ecx, dword [ebp - 0x1c]
lea ecx, [ecx - 0x10]
call fcn.0042470b
mov ecx, dword [ebp - 0x20]
lea ecx, [ecx - 0x10]
call fcn.0042470b
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x24]
lea ecx, [ecx - 0x10]
call fcn.0042470b
call fcn.00436bad
cmp dword [0x71d9b8], 0x400000
jge 0x436fc3
mov edi, 0x71d9b8
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
cmp eax, 0x400000
jge 0x436fbc
mov ecx, dword [0x71d9c8]
test ecx, ecx
je 0x436fbc
mov eax, dword [esi]
lea edx, [ebp - 0x18]
push ebx
push edx
mov dword [ebp - 0x18], ebx
push dword [eax - 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.0042470b
call fcn.00626923
ret
Function at 0x437958
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Read file on windows
Read pipe

Disassembly:
push 0x49c
mov eax, 0x66ea2b
call fcn.00626979
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x43c], edi
xor ebx, ebx
mov dword [ebp - 0x448], 0xc
push ebx
lea eax, [ebp - 0x448]
mov dword [ebp - 0x4a8], ebx
push eax
lea eax, [ebp - 0x43c]
mov dword [ebp - 0x444], ebx
push eax
lea eax, [ebp - 0x438]
mov dword [ebp - 0x440], 1
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x4379c4
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], ebx
mov byte [edi], bl
jmp 0x437b94
push 0x40
lea eax, [ebp - 0x4a0]
push ebx
push eax
call fcn.0063e4e0
xor eax, eax
mov dword [ebp - 0x4a4], 0x44
add esp, 0xc
mov word [ebp - 0x474], ax
cmp dword [esi + 0x14], 0x10
xorps xmm0, xmm0
mov eax, dword [ebp - 0x43c]
mov dword [ebp - 0x478], 0x101
mov dword [ebp - 0x468], eax
mov dword [ebp - 0x464], eax
movups xmmword [ebp - 0x458], xmm0
jb 0x437a17
mov esi, dword [esi]
lea eax, [ebp - 0x458]
push eax
lea eax, [ebp - 0x4a4]
push eax
push ebx
push ebx
push 0x10
push 1
push ebx
push ebx
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x437a54
push dword [ebp - 0x43c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x438]
call esi
jmp 0x4379b3
mov dword [ebp - 0x420], 0xf
mov dword [ebp - 0x424], ebx
mov byte [ebp - 0x434], bl
mov dword [ebp - 4], ebx
mov esi, dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
push 0x32
push dword [ebp - 0x458]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebx, eax
neg ebx
sbb bl, bl
inc bl
jmp 0x437b13
mov ecx, dword [ebp - 0x418]
test ecx, ecx
je 0x437b3c
push 0
mov edx, 0x3ff
lea eax, [ebp - 0x41c]
push eax
cmp ecx, edx
mov eax, edx
cmovb eax, ecx
push eax
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0x438]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x437b3c
mov eax, dword [ebp - 0x41c]
test eax, eax
je 0x437b3c
cmp eax, 0x400
jae 0x437b9c
mov byte [ebp + eax - 0x414], 0
cmp byte [ebp - 0x414], 0
jne 0x437af3
xor eax, eax
jmp 0x437b00
lea eax, [ebp - 0x414]
push eax
call fcn.00641cc0
pop ecx
push eax
lea eax, [ebp - 0x414]
push eax
lea ecx, [ebp - 0x434]
call fcn.00423950
xor ecx, ecx
lea eax, [ebp - 0x418]
push ecx
push eax
push ecx
push ecx
push ecx
push dword [ebp - 0x438]
mov dword [ebp - 0x41c], ecx
mov dword [ebp - 0x418], ecx
call esi
test eax, eax
jne 0x437a8e
test bl, bl
je 0x437a73
push dword [ebp - 0x43c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x438]
call esi
push dword [ebp - 0x458]
call esi
push dword [ebp - 0x454]
call esi
xor ebx, ebx
mov dword [edi + 0x14], 0xf
lea eax, [ebp - 0x434]
mov dword [edi + 0x10], ebx
push eax
mov ecx, edi
mov byte [edi], bl
call fcn.00428f2c
push ebx
push 1
lea ecx, [ebp - 0x434]
call fcn.00429656
mov eax, edi
call fcn.00626923
ret
call fcn.00625df4
int3
Function at 0x43855e
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x70b034]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x40
lea eax, [ebp - 0x50]
push 0
push eax
call fcn.0063e4e0
add esp, 0xc
xorps xmm0, xmm0
movlpd qword [ebp - 0x10], xmm0
push str.GetPhysicallyInstalledSystemMemory
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4385a7
lea ecx, [ebp - 0x10]
push ecx
call eax
mov eax, dword [ebp - 0x10]
mov ecx, eax
mov edx, dword [ebp - 0xc]
or ecx, edx
je 0x4385bc
shrd eax, edx, 0xa
shr edx, 0xa
jmp 0x4385da
lea eax, [ebp - 0x50]
mov dword [ebp - 0x50], 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x44]
shrd eax, ecx, 0x14
shr ecx, 0x14
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00625788
mov esp, ebp
pop ebp
ret
Function at 0x4396a8
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x220
mov eax, 0x66ee7f
call fcn.00626979
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x21c]
mov ebx, dword [ebp + 0xc]
xor esi, esi
push 0x20a
push esi
push eax
mov dword [ebp - 0x22c], edi
mov dword [ebp - 0x228], esi
call fcn.0063e4e0
mov dword [edi + 0x14], 7
add esp, 0xc
cmp dword [edi + 0x14], 8
mov dword [edi + 0x10], esi
jb 0x4396f4
mov eax, dword [edi]
jmp 0x4396f6
mov eax, edi
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x224]
mov dword [ebp - 4], esi
push eax
push 0x20019
push esi
push ebx
push closesocket
mov dword [ebp - 0x228], 1
mov dword [ebp - 0x224], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43978d
lea eax, [ebp - 0x220]
mov dword [ebp - 0x220], 0x104
push eax
lea eax, [ebp - 0x21c]
push eax
push esi
push esi
push 0x6d4ce0
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x439781
cmp word [ebp - 0x21c], ax
je 0x439772
lea eax, [ebp - 0x21c]
push eax
call fcn.00643278
pop ecx
mov esi, eax
push esi
lea eax, [ebp - 0x21c]
mov ecx, edi
push eax
call fcn.004284f9
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
call fcn.00626923
ret 0x10

Function at 0x439797
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x220
mov eax, 0x66ee7f
call fcn.00626979
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x21c]
mov ebx, dword [ebp + 0xc]
xor esi, esi
push 0x20a
push esi
push eax
mov dword [ebp - 0x22c], edi
mov dword [ebp - 0x228], esi
call fcn.0063e4e0
mov dword [edi + 0x14], 7
add esp, 0xc
cmp dword [edi + 0x14], 8
mov dword [edi + 0x10], esi
jb 0x4397e3
mov eax, dword [edi]
jmp 0x4397e5
mov eax, edi
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x224]
mov dword [ebp - 4], esi
push eax
push 0x20019
push esi
push ebx
push closesocket
mov dword [ebp - 0x228], 1
mov dword [ebp - 0x224], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43987c
lea eax, [ebp - 0x220]
mov dword [ebp - 0x220], 0x104
push eax
lea eax, [ebp - 0x21c]
push eax
push esi
push esi
push str.InstallPath
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x439870
cmp word [ebp - 0x21c], ax
je 0x439861
lea eax, [ebp - 0x21c]
push eax
call fcn.00643278
pop ecx
mov esi, eax
push esi
lea eax, [ebp - 0x21c]
mov ecx, edi
push eax
call fcn.004284f9
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
call fcn.00626923
ret 0xc
Function at 0x439dfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x70b034]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x30]
xor esi, esi
push eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x18], esi
call fcn.0042166f
cmp dword [eax + 0x14], 8
jb 0x439e29
mov eax, dword [eax]
lea ecx, [ebp - 0x18]
push ecx
push 0x20019
push esi
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
lea ecx, [ebp - 0x30]
push esi
neg ebx
push 1
sbb bl, bl
call fcn.00428ecb
add bl, 1
je 0x439e93
push 4
pop ebx
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], ebx
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0xc], esi
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push str.SupplyId
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x439e8a
cmp dword [ebp - 0xc], ebx
jne 0x439e8a
mov eax, dword [ebp - 0x10]
xor esi, esi
mov dword [edi], eax
inc esi
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 8]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00625788
mov esp, ebp
pop ebp
ret 4

Function at 0x439feb
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
lea eax, [ebp - 0x1c]
push esi
push ecx
push eax
mov esi, ecx
call fcn.0043a5b1
add esi, 0x224
cmp dword [esi + 0x14], 8
jb 0x43a00c
mov esi, dword [esi]
cmp dword [eax + 0x14], 8
jb 0x43a014
mov eax, dword [eax]
push esi
push 0
push str.VMIndexBase
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push 1
lea ecx, [ebp - 0x1c]
mov esi, eax
call fcn.00428ecb
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x43a03a
Capabilities:
Check if file exists

Disassembly:
push 0x270
mov eax, 0x66eefb
call fcn.00626979
mov ebx, ecx
push 0x208
lea eax, [ebp - 0x21c]
push 0
push eax
call fcn.0063e4e0
add esp, 0xc
lea eax, [ebp - 0x21c]
push 0x103
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edi, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x21c]
push eax
call edi
cmp word [ebp - 0x21c], 0
jne 0x43a092
xor eax, eax
jmp 0x43a09f
lea eax, [ebp - 0x21c]
push eax
call fcn.00643278
pop ecx
push eax
lea eax, [ebp - 0x21c]
lea esi, [ebx + 0x224]
push eax
mov ecx, esi
call fcn.004284f9
push 0x6d4cb8
mov edx, esi
lea ecx, [ebp - 0x264]
call fcn.00438834
and dword [ebp - 4], 0
lea ecx, [ebp - 0x24c]
mov edx, eax
mov dword [esp], str.Config.ini
call fcn.00438c18
pop ecx
push eax
mov ecx, esi
call fcn.0042525f
push 0
push 1
lea ecx, [ebp - 0x24c]
call fcn.00428ecb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x264]
push 0
push 1
call fcn.00428ecb
cmp dword [esi + 0x14], 8
jb 0x43a113
mov eax, dword [esi]
jmp 0x43a115
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x43a1ae
lea eax, [ebp - 0x21c]
push eax
call edi
cmp word [ebp - 0x21c], 0
jne 0x43a13b
xor eax, eax
jmp 0x43a148
lea eax, [ebp - 0x21c]
push eax
call fcn.00643278
pop ecx
push eax
lea eax, [ebp - 0x21c]
mov ecx, esi
push eax
call fcn.004284f9
push 0x6d4cb8
mov edx, esi
lea ecx, [ebp - 0x24c]
call fcn.00438834
xor edi, edi
lea ecx, [ebp - 0x264]
inc edi
mov edx, eax
mov dword [ebp - 4], edi
mov dword [esp], str.Config.ini
call fcn.00438c18
pop ecx
push eax
mov ecx, esi
call fcn.0042525f
push 0
push edi
lea ecx, [ebp - 0x264]
call fcn.00428ecb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24c]
push 0
push edi
call fcn.00428ecb
jmp 0x43a1b1
xor edi, edi
inc edi
and dword [ebp - 0x224], 0
xor eax, eax
mov esi, str.MobileGamePC
mov dword [ebp - 0x220], 7
push esi
mov word [ebp - 0x234], ax
call fcn.00643278
pop ecx
push eax
push esi
lea ecx, [ebp - 0x234]
call fcn.004284f9
lea eax, [ebp - 0x234]
mov dword [ebp - 4], 2
push eax
push ecx
push ecx
lea eax, [ebp - 0x27c]
mov ecx, ebx
push eax
call fcn.00439ea8
push eax
lea ecx, [ebx + 0x20c]
call fcn.0042525f
push 0
push edi
lea ecx, [ebp - 0x27c]
call fcn.00428ecb
push 0
push edi
lea ecx, [ebp - 0x234]
call fcn.00428ecb
call fcn.00626923
ret 4