joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c890
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40c8ca
test al, 0x10
je 0x40c8ca
mov eax, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00452da4
mov esp, ebp
pop ebp
ret
push esi
mov esi, edi
test edi, edi
jne 0x40c8e3
pop esi
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00452da4
mov esp, ebp
pop ebp
ret
push ebx
push 0x5c
push esi
call dword [sym.imp.MSVCR120.dll_wcschr]
mov esi, eax
add esp, 8
test esi, esi
je 0x40c984
cmp word [esi - 2], 0x3a
je 0x40c979
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40c906
sub eax, edx
mov edx, esi
sar eax, 1
lea ebx, [edx + 2]
lea ebx, [ebx]
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x40c920
sub edx, ebx
sar edx, 1
sub eax, edx
cmp eax, 0x7ffffffe
jbe 0x40c943
xor eax, eax
mov word [ebp - 0x20c], ax
jmp 0x40c951
push eax
push edi
push ecx
lea ecx, [ebp - 0x20c]
call fcn.0040cd50
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x40c979
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40c99a
add esi, 2
test esi, esi
jne 0x40c8e4
pop ebx
pop esi
mov eax, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00452da4
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop ebx
pop esi
xor ecx, ebp
pop edi
call fcn.00452da4
mov esp, ebp
pop ebp
ret

Function at 0x40c9b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, ecx
mov dword [ebp - 8], edx
test esi, esi
je 0x40ca59
cmp word [esi], 0
je 0x40ca59
push edi
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x40ca04
pop edi
mov eax, 0x80004005
pop esi
mov esp, ebp
pop ebp
ret 4
push 0
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push 0
push eax
push esi
push dword [ebp - 8]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40ca43
cmp dword [ebp - 4], esi
jne 0x40ca43
push edi
xor esi, esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
push edi
mov esi, 0x80004005
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, 0x80070057
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x40ce40
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0
push 2
mov dword [ebp - 0x234], 0
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
test esi, esi
je 0x40cefd
push ebx
lea eax, [ebp - 0x230]
mov dword [ebp - 0x230], 0x22c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x40cec2
mov edi, dword [sym.imp.KERNEL32.dll_Process32NextW]
mov ebx, dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
lea esp, [esp]
push 0xc
lea eax, [ebp - 0x20c]
push eax
push str.EXPLORER.EXE
call ebx
test eax, eax
je 0x40ceeb
lea eax, [ebp - 0x230]
push eax
push esi
call edi
test eax, eax
jne 0x40cea0
mov edi, dword [ebp - 0x234]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x234], 1
pop ebx
jne 0x40cefd
mov eax, edi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00452da4
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp - 0x228]
mov dword [ebp - 0x234], 1
jmp 0x40cec8
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.00452da4
mov esp, ebp
pop ebp
ret
Function at 0x40de80
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
add eax, eax
mov dword [edi], 0
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0x10]
push eax
push esi
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40def1
mov eax, dword [ebp + 0xc]
cmp eax, 1
je 0x40debf
cmp eax, 2
jne 0x40dedb
mov ecx, dword [ebp + 0x10]
test esi, esi
je 0x40deeb
test ecx, ecx
je 0x40dee6
test cl, 1
jne 0x40dedb
mov eax, ecx
shr eax, 1
cmp word [esi + eax*2 - 2], 0
je 0x40deeb
pop edi
mov eax, 0xd
pop esi
pop ebp
ret 0xc
xor eax, eax
mov word [esi], ax
shr ecx, 1
xor eax, eax
mov dword [edi], ecx
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x40df00
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push esi
mov esi, ecx
test edx, edx
jne 0x40df15
lea eax, [edx + 0xd]
pop esi
pop ebp
ret 0xc
mov eax, edx
push edi
lea edi, [eax + 2]
jmp 0x40df20
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40df20
sub eax, edi
sar eax, 1
lea eax, [eax*2 + 2]
push eax
push edx
push 1
push 0
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x40e7a0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x120]
mov dword [ebp - 0x120], 0x11c
push eax
xor esi, esi
call dword [sym.imp.ntdll.dll_RtlGetVersion]
test eax, eax
jns 0x40e7e2
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00452da4
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x11c]
movzx eax, word [ebp - 0xc]
cmp ecx, 5
jne 0x40e897
mov ecx, dword [ebp - 0x118]
cmp ecx, 1
jne 0x40e83a
cmp eax, 2
jne 0x40e81b
mov esi, 0x200
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00452da4
mov esp, ebp
pop ebp
ret
cmp eax, 3
jne 0x40e943
mov esi, 0x201
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00452da4
mov esp, ebp
pop ebp
ret
cmp ecx, 2
jne 0x40e943
test eax, eax
jne 0x40e85d
mov esi, 0x208
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00452da4
mov esp, ebp
pop ebp
ret
cmp eax, 1
jne 0x40e878
mov esi, 0x209
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00452da4
mov esp, ebp
pop ebp
ret
cmp eax, 2
jne 0x40e943
mov esi, 0x20a
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00452da4
mov esp, ebp
pop ebp
ret
cmp ecx, 6
jne 0x40e943
mov ecx, dword [ebp - 0x118]
test ecx, ecx
jne 0x40e8fa
test eax, eax
jne 0x40e8c4
mov esi, 0x258
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00452da4
mov esp, ebp
pop ebp
ret
cmp eax, 1
jne 0x40e8df
mov esi, 0x259
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00452da4
mov esp, ebp
pop ebp
ret
cmp eax, 2
jne 0x40e943
mov esi, 0x25a
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00452da4
mov esp, ebp
pop ebp
ret
cmp ecx, 1
jne 0x40e934
test eax, eax
jne 0x40e919
mov esi, 0x262
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00452da4
mov esp, ebp
pop ebp
ret
cmp eax, 1
jne 0x40e943
mov esi, 0x263
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00452da4
mov esp, ebp
pop ebp
ret
cmp ecx, 2
jne 0x40e943
test eax, eax
mov ecx, 0x26c
cmove esi, ecx
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00452da4
mov esp, ebp
pop ebp
ret
Function at 0x40ebd0
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x20006
xor esi, esi
push esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, 2
jne 0x40ec1b
push esi
lea eax, [ebp - 4]
push eax
push esi
push 0x20006
push esi
push esi
push esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40ec42
push 0x10
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x40ec98
mov dword [esi + 4], 0x20006
mov eax, dword [ebp - 4]
mov dword [esi], eax
test esi, esi
je 0x40ec98
test byte [esi + 4], 2
jne 0x40ec53
mov eax, 5
jmp 0x40ec63
push str.LightRegulate
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [esi + 0xc], eax
push ebx
xor ebx, ebx
test eax, eax
mov eax, dword [esi]
sete bl
test eax, eax
je 0x40ec80
push eax
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, ebx
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40eca0
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], 0
push eax
push 0x20019
xor esi, esi
push esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, 2
je 0x40ed10
test eax, eax
jne 0x40ed10
push 0x10
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x40edd4
mov dword [esi + 4], 0x20019
mov eax, dword [ebp - 0x214]
mov dword [esi], eax
test esi, esi
je 0x40edd4
push edi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
mov dword [ebp - 0x218], 0x208
test byte [esi + 4], 1
mov dword [ebp - 0x210], 0
je 0x40ed8e
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x210]
push eax
push 0
push str.LightRegulate
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x40ed81
mov dword [esi + 0xc], eax
or eax, 0xffffffff
jmp 0x40ed87
mov eax, dword [ebp - 0x210]
mov dword [esi + 8], eax
test eax, eax
jns 0x40ed94
cmp dword [esi + 0xc], 0
jne 0x40ed9b
mov edi, 1
jmp 0x40ed9d
xor edi, edi
mov eax, dword [esi]
test eax, eax
je 0x40edb2
push eax
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00452da4
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.00452da4
mov esp, ebp
pop ebp
ret
Function at 0x4104c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47cff4
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 0x78], 8
lea esi, [ebx + 0x64]
jb 0x4104fa
mov eax, dword [esi]
jmp 0x4104fc
mov eax, esi
push eax
push str.ReadReportFile_report_file__s
push 0
push str.Report.cpp
call fcn.00404060
add esp, 0x10
cmp dword [esi + 0x14], 8
jb 0x41051b
mov eax, dword [esi]
jmp 0x41051d
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x410544
push str.ReadReportFile_report_file_not_exsted
push 0
push str.Report.cpp
call fcn.00404060
add esp, 0xc
xor eax, eax
jmp 0x410697
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x44], 0
jb 0x410553
mov esi, dword [esi]
lea edx, [ebp - 0x44]
mov ecx, esi
call fcn.0040c7c0
mov ecx, dword [ebp - 0x44]
mov edx, eax
test ecx, ecx
je 0x410692
cmp byte [ecx], 0
je 0x410692
test edx, edx
jle 0x410692
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
lea eax, [ebx + 0x1c]
mov dword [ebp - 4], 0
push eax
lea eax, [ebx + 4]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.0041abb0
mov esi, dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 0xc
test eax, eax
je 0x410684
push ecx
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x40]
call fcn.0040c590
add esp, 4
mov byte [ebp - 4], 1
lea eax, [ebp - 0x40]
cmp dword [ebp - 0x2c], 8
cmovae eax, dword [ebp - 0x40]
push eax
push str.ReadReportFile_report_file_strDataW:_s
push 0
push str.Report.cpp
call fcn.00404060
add esp, 0x10
lea ecx, [ebp - 0x50]
call fcn.00408100
mov dword [ebp - 0x50], vtable.CReportData.0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x4c]
push eax
call fcn.004193c0
test al, al
je 0x4106b3
lea ecx, [ebp - 0x50]
call fcn.00408fc0
mov edi, eax
xor esi, esi
test edi, edi
jle 0x410668
lea eax, [ebx + 0x84]
mov ebx, dword [sym.imp.MSVCR120.dll_void____cdecl_operator_new_unsigned_int_]
mov dword [ebp - 0x54], eax
nop
push 0xc
call ebx
add esp, 4
mov dword [ebp - 0x44], eax
mov byte [ebp - 4], 3
test eax, eax
je 0x41064e
push esi
push eax
lea ecx, [ebp - 0x50]
call fcn.00408df0
jmp 0x410650
xor eax, eax
mov ecx, dword [ebp - 0x54]
mov byte [ebp - 4], 2
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x44]
push eax
call fcn.00411990
inc esi
cmp esi, edi
jl 0x410630
mov esi, dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
lea ecx, [ebp - 0x50]
call fcn.004081d0
cmp dword [ebp - 0x2c], 8
jb 0x410684
push dword [ebp - 0x40]
call esi
add esp, 4
cmp dword [ebp - 0x14], 0x10
jb 0x410692
push dword [ebp - 0x28]
call esi
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00452da4
mov esp, ebp
pop ebp
ret
push str.ReadReportFile_parse_json_failed
push 0
push str.Report.cpp
call fcn.00404060
add esp, 0xc
jmp 0x41066e
Function at 0x412430
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47d2dd
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x21c], 0
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov dword [ebp - 0x238], esi
mov word [esi], ax
push 0x208
mov dword [ebp - 4], eax
push eax
lea eax, [ebp - 0x218]
mov dword [ebp - 0x21c], 1
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [ebp - 0x218]
push 1
push 0x23
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x412584
xor eax, eax
mov dword [ebp - 0x220], 7
mov dword [ebp - 0x224], 0
mov word [ebp - 0x234], ax
cmp word [ebp - 0x218], ax
jne 0x4124e8
xor ecx, ecx
jmp 0x412500
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4124f1
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x234]
call fcn.0040235a
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x234]
mov dword [ebp - 4], 1
push eax
mov ecx, esi
call fcn.0040246e
mov byte [ebp - 4], 0
cmp dword [ebp - 0x220], 8
jb 0x412548
push dword [ebp - 0x234]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
push 1
push 0x48b30c
mov ecx, esi
call fcn.00402779
push 0xd
push str.LightRegulate
mov ecx, esi
call fcn.00402779
push 7
push str.Common
mov ecx, esi
call fcn.00402779
mov ecx, esi
call fcn.00411e10
test al, al
jne 0x412584
mov ecx, esi
call fcn.00411f30
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00452da4
mov esp, ebp
pop ebp
ret
Function at 0x4125a0
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47d2dd
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x21c], 0
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov dword [ebp - 0x238], esi
mov word [esi], ax
push 0x208
mov dword [ebp - 4], eax
push eax
lea eax, [ebp - 0x218]
mov dword [ebp - 0x21c], 1
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [ebp - 0x218]
push 1
push 0x23
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x4126f4
xor eax, eax
mov dword [ebp - 0x220], 7
mov dword [ebp - 0x224], 0
mov word [ebp - 0x234], ax
cmp word [ebp - 0x218], ax
jne 0x412658
xor ecx, ecx
jmp 0x412670
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x412661
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x234]
call fcn.0040235a
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x234]
mov dword [ebp - 4], 1
push eax
mov ecx, esi
call fcn.0040246e
mov byte [ebp - 4], 0
cmp dword [ebp - 0x220], 8
jb 0x4126b8
push dword [ebp - 0x234]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
push 1
push 0x48b30c
mov ecx, esi
call fcn.00402779
push 0xd
push str.LightRegulate
mov ecx, esi
call fcn.00402779
push 0xa
push str._bugreport
mov ecx, esi
call fcn.00402779
mov ecx, esi
call fcn.00411e10
test al, al
jne 0x4126f4
mov ecx, esi
call fcn.00411f30
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00452da4
mov esp, ebp
pop ebp
ret
Function at 0x412740
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47d320
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x28]
call fcn.00412430
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], 0
call fcn.0040fe20
push 1
push 0x48b30c
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.00402779
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.0040246e
push 5
push 0x48c564
lea ecx, [ebp - 0x28]
call fcn.00402779
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push str.IsCheckProxyByFile_path:__s
push 0
push str.Light_pub.cpp
call fcn.00404060
add esp, 0x10
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ebx, ebx
cmp eax, 0xffffffff
setne bl
push ebx
push str.IsFileExist_path:__d
push 0
push str.Light_pub.cpp
call fcn.00404060
xor eax, eax
add esp, 0x10
test ebx, ebx
sete al
cmp dword [ebp - 0x2c], 8
mov dword [ebp - 0x44], eax
jb 0x412820
push dword [ebp - 0x40]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
mov eax, dword [ebp - 0x44]
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x2c], 7
cmp dword [ebp - 0x14], 8
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], cx
jb 0x412849
push dword [ebp - 0x28]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
mov eax, dword [ebp - 0x44]
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00452da4
mov esp, ebp
pop ebp
ret
Function at 0x412870
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47d320
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [ebp - 0x28]
call fcn.00412430
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], 0
call fcn.0040fe20
push 1
push 0x48b30c
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.00402779
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.0040246e
push 5
push 0x48c564
lea ecx, [ebp - 0x28]
call fcn.00402779
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push str.GeneCheckProxyFile_path:__s
push 0
push str.Light_pub.cpp
call fcn.00404060
add esp, 0x10
lea eax, [ebp - 0x28]
test esi, esi
jne 0x412966
cmp dword [ebp - 0x14], 8
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4129b4
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push esi
cmovae eax, dword [ebp - 0x28]
push 0x80
push 2
push esi
push esi
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x4129b4
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.CreateFile_OK
push esi
push str.Light_pub.cpp
call fcn.00404060
add esp, 0xc
jmp 0x4129b4
cmp dword [ebp - 0x14], 8
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4129b4
cmp dword [ebp - 0x14], 8
lea esi, [ebp - 0x28]
mov edi, 1
cmovae esi, dword [ebp - 0x28]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41299f
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, eax
push edi
push str.RemoveFile:__d
push 0
push str.Light_pub.cpp
call fcn.00404060
add esp, 0x10
cmp dword [ebp - 0x2c], 8
mov esi, dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
jb 0x4129c8
push dword [ebp - 0x40]
call esi
add esp, 4
xor eax, eax
mov dword [ebp - 0x2c], 7
cmp dword [ebp - 0x14], 8
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], ax
jb 0x4129ea
push dword [ebp - 0x28]
call esi
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00452da4
mov esp, ebp
pop ebp
ret