joyce8/EMBER2024-capa huggingface dataset:
Function at 0x452a40
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x487bc3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.0047b150
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], vtable.CBrush.0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], method.CEdit.virtual_0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov ecx, edi
call fcn.004807ef
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.00481d0b
test eax, eax
je 0x452b5c
mov ecx, dword [esp + 0x3c]
call fcn.0048081c
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x452b20
push edi
mov ecx, esi
call fcn.0047de7b
mov ecx, esi
call fcn.00452cc0
cmp dword [esp + 0x38], 1
jne 0x452b55
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.0047dfb6
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28
Function at 0x455580
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x4555b3
push esi
call fcn.00458670
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x4555ac
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x455639
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x455622
mov eax, dword [esi + 8]
test eax, eax
je 0x4555d7
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x45561e
cmp eax, 2
je 0x455622
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x4555ca
cmp eax, 3
je 0x4555fd
cmp eax, 1
jne 0x4555ca
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x4555ca
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x4555ca
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.00455660
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x455648
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.00455660
add esp, 4
pop esi
ret

Function at 0x4611c0
Capabilities:
Capture webcam image

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, ecx
mov eax, dword [eax + 4]
cmp dword [esi + 0xec], 1
jne 0x461263
test eax, eax
jbe 0x461263
mov ecx, dword [esi + 0xbc]
test ecx, ecx
jle 0x461263
mov ecx, dword [esi + 0x1c]
push edi
push 0
push eax
push 0x419
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
mov eax, dword [esi + 0xbc]
inc edi
test eax, eax
jne 0x46120e
xor esi, esi
jmp 0x461214
mov esi, dword [esi + 0xb4]
add esi, 4
xor ebx, ebx
test edi, edi
jbe 0x46123f
push ebp
mov ebp, edi
add esi, 6
push esi
call fcn.004631c0
add esi, eax
push esi
mov ebx, esi
call fcn.004631c0
add esp, 8
add esi, eax
dec edi
dec ebp
jne 0x461220
pop ebp
test edi, edi
pop edi
jne 0x461263
test ebx, ebx
je 0x461263
mov edx, dword [esp + 0x10]
push 0x4e
add edx, 0x10
push ebx
push edx
call fcn.0046a1e0
add esp, 0xc
mov eax, 1
pop esi
pop ebx
ret 0xc
pop esi
xor eax, eax
pop ebx
ret 0xc
Function at 0x4613a5
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x4614bd
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4614bd
mov eax, dword [esi + 0x3c]
push eax
call fcn.0047b5a2
mov esi, eax
test esi, esi
je 0x4614bd
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x4614bd
mov ecx, esi
call fcn.00461310
cmp edi, eax
jge 0x4614bd
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x461443
mov dword [esp + 0x34], 1
jmp 0x46149e
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x4614bd
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.004608d0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc
Function at 0x466390
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x4663d9
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4

Function at 0x466850
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x488290
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.00466400
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.00466480
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.00466480
lea ecx, [esi + 0xc]
call fcn.00479b03
lea ecx, [esi + 0x10]
call fcn.00479b03
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.00467a10
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.00467a10
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.00467a10
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.00479b78
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.00479b78
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x467c00
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x467c66
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA
cmp eax, 6
je 0x467c66
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x467c47
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret

Function at 0x47bf46
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x47bf7e
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00479fd3
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00479fab
jmp 0x47bf8a
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x47d638
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x47d67a
call fcn.004831b0
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x47d67a
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x47d671
xor eax, eax
jmp 0x47d682
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0047d688
pop edi
pop esi
pop ebx
ret 4

Function at 0x4836e0
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x48370e
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x48372c
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00483646
jmp 0x48372c
mov eax, dword [esi + 0x14]
test eax, eax
je 0x48372c
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00483646
test edi, edi
mov eax, edi
jne 0x483716
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x401c66
pop dword [ebp - 0x38]
mov eax, 0x401c66
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0x2712a78b
sub dword [ebp - 0x48], 0xd8c06240
mov dword [ebp - 0x44], 0x6360b176
add dword [ebp - 0x44], 0xced29acf
mov dword [ebp - 0x40], 0x7f6d646
add dword [ebp - 0x40], 0x44556de8
mov dword [ebp - 0x3c], 0xa8978c13
add dword [ebp - 0x3c], 0x576873ed
lea eax, [ebp - 0x48]
push eax
mov eax, 0x3a520257
add eax, 0xc5ee2dfd
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x2ee1fc42
add dword [ebp - 0x48], 0x45906d14
mov dword [ebp - 0x44], 0x992848bd
sub dword [ebp - 0x44], 0x57bbe748
mov dword [ebp - 0x40], 0x1800ebd4
add dword [ebp - 0x40], 0x4b6e8098
mov dword [ebp - 0x3c], 0x2a48ce0d
sub dword [ebp - 0x3c], 0x2a48ce0d
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0x6f20ea7f
add eax, 0x911f45ad
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x38032
push 0
call eax
mov ecx, 0xb9d95c65
sub ecx, 0xb9d90e45
mov esi, eax
mov edx, 0x407000
add edx, dword [ebp - 0x38]
mov edi, 0x5ce3663c
add edi, 0xd2cb1b2f
mov ebx, dword [edx]
xor dword [ebp - 0x30], edi
add ebx, edi
add dword [ebp - 4], 0x9f6dee1b
mov dword [esi], ebx
xor dword [ebp - 0x14], eax
add esi, 0xc29da40
sub esi, 0xc29da3c
add edx, 0xa99b5613
sub edx, 0xa99b560f
loop 0x401d7d
add eax, 0x12b53
xor ebx, ebx
add ebx, eax
add eax, 0x814505be
sub eax, 0x814505b9
mov ecx, 0x1efbbbf2
sub ecx, 0x1ebbbbf2
add ecx, dword [ebp - 0x38]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret
Function at 0x40108b
Capabilities:
Check if file exists

Disassembly:
push ebp
lea ebp, [esp - 0x394]
sub esp, 0x414
mov eax, dword [0x409020]
xor eax, ebp
mov dword [ebp + 0x390], eax
push esi
xor esi, esi
push 0x40e
lea eax, [ebp - 0x7e]
push esi
push eax
mov word [ebp - 0x80], si
call sub.MSVCR80.dll_memset
add esp, 0xc
push str.kinfoc.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp eax, esi
jne 0x40118e
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push edi
push 0x104
lea eax, [ebp - 0x80]
push eax
push esi
call ebx
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, str.operationcaskinfoc.dll
je 0x401126
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
push edi
lea eax, [ebp - 0x80]
push 0x208
push eax
call dword [sym.imp.MSVCR80.dll_wcscat_s]
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
call esi
test eax, eax
jne 0x40118c
push 0x410
lea eax, [ebp - 0x80]
push 0
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x104
lea eax, [ebp - 0x80]
push eax
push 0x400000
call ebx
test eax, eax
je 0x401189
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.MSVCR80.dll_wcslen]
test eax, eax
pop ecx
je 0x401189
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push edi
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x401189
lea eax, [ebp - 0x80]
push eax
call esi
test eax, eax
jne 0x40118c
push edi
call esi
pop edi
pop ebx
mov ecx, dword [ebp + 0x390]
xor ecx, ebp
pop esi
call fcn.0040430a
add ebp, 0x394
leave
ret
Function at 0x401616
Capabilities:
Create tcp socket
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x405343
mov eax, dword fs:[0]
push eax
sub esp, 0x1c8
mov eax, dword [0x409020]
xor eax, esp
mov dword [esp + 0x1c0], eax
push ebx
push esi
push edi
mov eax, dword [0x409020]
xor eax, esp
push eax
lea eax, [esp + 0x1d8]
mov dword fs:[0], eax
mov edi, dword [ebp + 0x10]
or dword [esp + 0x1c4], 0xffffffff
lea eax, [esp + 0x34]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x401688
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esp + 0x1c4], eax
xor ebx, ebx
mov dword [esp + 0x1e0], ebx
lea esi, [esp + 0x20]
mov dword [esp + 0x1c], vtable.CCmdLineParser.0
call fcn.004017bb
lea esi, [esp + 0x24]
mov byte [esp + 0x1e0], 1
call fcn.0040290e
cmp edi, ebx
mov byte [esp + 0x1e0], 2
mov byte [esp + 0x30], bl
je 0x4016cf
lea eax, [esp + 0x1c]
push eax
mov ecx, edi
call fcn.00402097
mov edx, str.send
lea eax, [esp + 0x1c]
mov byte [esp + 0x1e0], 3
call fcn.00402454
test al, al
je 0x401711
push str.kwifiFFC313BA3_128D_4303_8A30_EFFCAC0180B9
lea esi, [esp + 0x18]
call fcn.004013e3
mov byte [esp + 0x1e0], 4
cmp dword [esp + 0x14], ebx
jne 0x40174e
call fcn.00401447
call fcn.00401349
jmp 0x40174e
mov edx, str.active
lea eax, [esp + 0x1c]
call fcn.00402454
test al, al
je 0x40175e
push str.kwifiF68078689_4F4E_44c1_ADE4_9FF1FD6E4C91
lea esi, [esp + 0x18]
call fcn.004013e3
mov byte [esp + 0x1e0], 5
cmp dword [esp + 0x14], ebx
jne 0x40174e
call fcn.00401447
call fcn.004011fd
call fcn.004012bd
cmp dword [esp + 0x18], ebx
je 0x40175e
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x1c]
mov byte [esp + 0x1e0], bl
call fcn.00402055
cmp dword [esp + 0x1c4], 0xffffffff
je 0x40178d
push dword [esp + 0x1c4]
call dword [sym.imp.WS2_32.dll_closesocket]
or dword [esp + 0x1c4], 0xffffffff
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
mov ecx, dword [esp + 0x1d8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1c0]
xor ecx, esp
call fcn.0040430a
mov esp, ebp
pop ebp
ret 0x10

Function at 0x401d76
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push dword [esp + 0xc]
mov esi, eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401d8d
pop esi
ret
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x401dc2
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, edi
and esi, 0xf
jbe 0x401dbe
cmp edi, eax
jae 0x401dc2
dec esi
movzx ecx, word [edi]
lea edi, [edi + ecx*2 + 2]
jne 0x401db0
cmp edi, eax
jb 0x401dc6
xor eax, eax
jmp 0x401dd0
mov ax, word [edi]
neg ax
sbb eax, eax
and eax, edi
pop edi
pop esi
ret
Function at 0x402d92
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebx]
xor ecx, ecx
cmp eax, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], ecx
je 0x402e21
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea edx, [ebp - 4]
push edx
push ecx
lea edx, [ebp - 8]
push edx
push ecx
push dword [ebp + 8]
push eax
call edi
cmp dword [ebp - 8], 1
je 0x402dc9
cmp dword [ebp - 8], 2
jne 0x402e20
push esi
mov esi, dword [ebp + 0xc]
call fcn.00401c46
mov eax, dword [ebp - 4]
shr eax, 1
inc eax
push eax
call fcn.004018b7
mov esi, eax
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 8]
push dword [ebx]
call edi
test eax, eax
jne 0x402e1f
mov eax, dword [ebp - 4]
shr eax, 1
and word [esi + eax*2], 0
mov esi, dword [ebp + 0xc]
mov eax, dword [esi]
test eax, eax
je 0x402e11
push eax
call dword [sym.imp.MSVCR80.dll_wcslen]
pop ecx
mov edx, esi
call fcn.0040199e
mov dword [ebp - 0xc], 1
pop esi
pop edi
mov eax, dword [ebp - 0xc]
leave
ret 8

Function at 0x40330f
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push 8
mov eax, 0x405263
call fcn.00404c2c
mov eax, dword [0x409234]
mov ecx, 0x409234
xor ebx, ebx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], ebx
call fcn.00402f39
lea edi, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.00401828
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.00401eb8
push str.uplive.svr
mov eax, edi
push eax
call fcn.00401893
mov esi, dword [ebp - 0x10]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x403384
push esi
push ebx
push str.TryNo
push str.common
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ebx, eax
lea eax, [esi - 0x10]
call fcn.00401eb8
mov eax, ebx
call fcn.00404ccb
ret

Function at 0x403394
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push 8
mov eax, 0x405263
call fcn.00404c2c
mov eax, dword [0x409234]
mov ecx, 0x409234
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00402f39
lea edi, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.00401828
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.00401eb8
push str.datakwifimain.ini
mov eax, edi
push eax
call fcn.00401893
mov esi, dword [ebp - 0x10]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40340e
push esi
push 0
push str.version
push str.infos
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], eax
lea eax, [esi - 0x10]
call fcn.00401eb8
call fcn.00404ccb
ret 4
Function at 0x403492
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x120
mov eax, dword [0x409020]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
push edi
mov esi, 0x11c
push esi
xor edi, edi
lea eax, [ebp - 0xa8]
push edi
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
lea eax, [ebp - 0xa8]
mov dword [ebp - 0xa8], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push eax
call esi
cmp eax, edi
jne 0x4034f5
lea eax, [ebp - 0xa8]
push eax
mov dword [ebp - 0xa8], 0x114
call esi
cmp eax, edi
je 0x4035a3
mov eax, dword [ebp - 0x98]
dec eax
je 0x40358f
dec eax
jne 0x4035a3
cmp dword [ebp - 0xa4], 6
jne 0x403540
inc eax
cmp dword [ebp - 0xa0], eax
jne 0x403528
xor ecx, ecx
cmp byte [ebp + 0x72], al
setne cl
add ecx, 8
jmp 0x40353c
cmp dword [ebp - 0xa0], edi
jne 0x40357c
xor ecx, ecx
cmp byte [ebp + 0x72], al
setne cl
lea ecx, [ecx + ecx + 7]
mov edi, ecx
jmp 0x4035a3
cmp dword [ebp - 0xa4], 5
jne 0x40356f
cmp dword [ebp - 0xa0], 2
jne 0x403556
push 5
jmp 0x40358c
cmp dword [ebp - 0xa0], 1
jne 0x403563
push 6
jmp 0x40358c
cmp dword [ebp - 0xa0], edi
jne 0x4035a3
push 3
jmp 0x40358c
cmp dword [ebp - 0xa4], 4
ja 0x4035a3
push 4
jmp 0x40358c
cmp dword [ebp - 0xa0], 2
jne 0x4035a3
cmp byte [ebp + 0x72], al
jne 0x4035a3
push 0xa
pop edi
jmp 0x4035a3
mov eax, dword [ebp - 0x9c]
and eax, 0xffff0000
cmp eax, 0x45a0000
sbb edi, edi
inc edi
inc edi
mov ecx, dword [ebp + 0x74]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.0040430a
add ebp, 0x78
leave
ret

Function at 0x40390b
Capabilities:
Check if file exists

Disassembly:
push 8
mov eax, 0x4051f2
call fcn.00404c2c
mov esi, ecx
imul esi, esi, 0x14
push dword [esi + 0x409060]
mov edx, dword [esi + 0x40905c]
lea ecx, [ebp - 0x10]
call fcn.0040381c
pop ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], ebx
jne 0x403951
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00401eb8
mov al, bl
call fcn.00404ccb
ret
lea eax, [ebp - 0x10]
call fcn.00403448
push dword [esi + 0x409064]
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
call fcn.00401f93
pop ecx
pop ecx
push dword [eax]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov esi, eax
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.00401eb8
cmp esi, ebx
je 0x40393e
mov bl, 1
jmp 0x40393e

Function at 0x40398a
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push edi
push 6
pop ecx
xor ebx, ebx
push 0x80000004
push ebx
xor eax, eax
mov dword [ebp - 0x20], ebx
lea edi, [ebp - 0x1c]
push ebx
rep stosd dword es:[edi], eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x4039f0
push esi
push 4
push str.kxescore
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, eax
cmp edi, ebx
je 0x4039ea
lea eax, [ebp - 0x20]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x4039e7
cmp dword [ebp - 0x1c], 4
jne 0x4039e7
mov bl, 1
push edi
call esi
push dword [ebp - 4]
call esi
pop esi
pop edi
mov al, bl
pop ebx
leave
ret