joyce8/EMBER2024-capa huggingface dataset:
Function at 0x482000
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x482066
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA
cmp eax, 6
je 0x482066
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x482047
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret

Function at 0x4852b0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4c70a8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov eax, dword [esp + 0x40]
push ebx
push esi
lea ecx, [esp + 8]
push eax
push ecx
mov ecx, dword [esp + 0x4c]
call fcn.004856a0
mov esi, eax
lea edx, [esp + 0x48]
xor ebx, ebx
push edx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x40], ebx
mov dword [esp + 0x4c], 0x53200c
call fcn.0049420e
mov ecx, dword [0x4d6e4c]
mov al, byte [esi]
push ecx
push ebx
push esi
lea ecx, [esp + 0x30]
mov byte [esp + 0x48], 1
mov byte [esp + 0x30], al
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
call fcn.00482a00
mov esi, 0x4d6ea4
mov dword [esp + 0x18], esi
mov eax, dword [esp + 0xc]
mov byte [esp + 0x3c], 3
cmp eax, ebx
je 0x485357
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x48534e
cmp al, 0xff
je 0x48534e
dec al
mov byte [ecx], al
jmp 0x485357
push ecx
call fcn.004b53b5
add esp, 4
lea ecx, [esp + 0x18]
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
call fcn.004b0e70
mov eax, dword [esp + 0x28]
mov dword [esp + 0x3c], 0xffffffff
cmp eax, ebx
mov dword [esp + 0x18], esi
je 0x48539d
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x485394
cmp al, 0xff
je 0x485394
dec al
mov byte [ecx], al
jmp 0x48539d
push ecx
call fcn.004b53b5
add esp, 4
lea ecx, [esp + 0x18]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
call fcn.00494295
mov ecx, dword [esp + 0x34]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x38
ret
Function at 0x4ab350
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4c8760
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov al, byte [esp + 0x3c]
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov byte [esp + 0x10], al
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov ecx, dword [esp + 0x44]
push ebx
mov dword [esp + 0x40], ebx
mov byte [esp + 0x28], al
mov edx, dword [ecx]
lea ecx, [esp + 0x28]
mov dword [esp + 0x24], edx
call fcn.004a0178
mov eax, dword [0x4dacd8]
lea ecx, [esp + 0x10]
push eax
push ebx
push ecx
lea ecx, [esp + 0x30]
call fcn.004a00aa
lea edx, [esp + 0x20]
lea eax, [esp + 8]
push edx
push eax
mov ecx, esi
mov byte [esp + 0x44], 1
call fcn.004abdf0
mov esi, dword [eax]
mov ecx, dword [eax + 4]
mov eax, dword [esp + 0x28]
cmp eax, ebx
mov dword [esp + 0xc], ecx
je 0x4ab3f7
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x4ab3ee
cmp al, 0xff
je 0x4ab3ee
dec al
mov byte [ecx], al
jmp 0x4ab3f7
push ecx
call fcn.004b53b5
add esp, 4
mov eax, dword [esp + 0x14]
mov dword [esp + 0x28], ebx
cmp eax, ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
je 0x4ab428
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x4ab41f
cmp al, 0xff
je 0x4ab41f
dec al
mov byte [ecx], al
jmp 0x4ab428
push ecx
call fcn.004b53b5
add esp, 4
mov ecx, dword [esp + 0x34]
lea eax, [esi + 0x10]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x38
ret 4
Function at 0x4b7b05
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4b7b3d
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004b5af2
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004b5aca
jmp 0x4b7b49
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4b91f8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4b923a
call fcn.004befe4
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4b923a
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4b9231
xor eax, eax
jmp 0x4b9242
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004b9248
pop edi
pop esi
pop ebx
ret 4

Function at 0x4bf514
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4bf542
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4bf560
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004bf47a
jmp 0x4bf560
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4bf560
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004bf47a
test edi, edi
mov eax, edi
jne 0x4bf54a
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x453a058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.0453a1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x453a07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x453a06a
add dl, dl
jne 0x453a089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x453a0dc
xor eax, eax
add dl, dl
jne 0x453a096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x453a17d
add dl, dl
jne 0x453a0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x453a0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x453a0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x453a0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x453a0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x453a075
mov eax, 1
add dl, dl
jne 0x453a0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x453a0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x453a0e1
sub eax, ebx
mov ebx, 1
jne 0x453a128
mov ecx, 1
add dl, dl
jne 0x453a10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x453a119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x453a105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x453a075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x453a13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x453a14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x453a136
cmp eax, 0x7d00
jae 0x453a16d
cmp eax, 0x500
jb 0x453a168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x453a075
cmp eax, 0x7f
ja 0x453a170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x453a075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x453a19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x453a075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x10003ae0
Capabilities:
Enumerate pe sections

Disassembly:
push esi
mov esi, dword [esp + 0xc]
mov ecx, dword [esi + 4]
sub ecx, 1
js 0x10003b0b
mov eax, dword [esi + 8]
lea edx, [eax + ecx*4]
mov eax, dword [edx]
movzx eax, word [eax + 6]
cmp eax, 4
je 0x10003b1e
cmp eax, 0xd
je 0x10003b1e
sub edx, 4
sub ecx, 1
jns 0x10003af3
mov eax, dword [esi]
sub eax, 1
je 0x10003b2c
sub eax, 2
je 0x10003b25
mov eax, 2
pop esi
ret
mov eax, 1
pop esi
ret
mov edx, 0x100040e0
jmp 0x10003b31
mov edx, 0x10004020
mov ecx, dword [esp + 8]
mov eax, dword [esp + 0x18]
sub edx, eax
sub edx, 0xa
mov dword [ecx + 1], eax
mov eax, dword [esp + 0x10]
mov byte [ecx], 0xb8
mov byte [ecx + 5], 0xe9
mov dword [ecx + 6], edx
mov dword [ecx + 0x10], eax
mov eax, dword [esp + 0x14]
mov dword [ecx + 0xc], esi
mov dword [ecx + 0x14], eax
xor eax, eax
pop esi
ret
Function at 0x401250
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
push 0
push dword [0x42d66c]
mov esi, ecx
push 0
push dword [esi + 4]
lea eax, [esi + 0xc]
push 0x13a
push 0x1f1
push 0
push 0
push 0x40000000
push 0x4258c8
push eax
push 0x10000
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [esi], eax
test eax, eax
jne 0x401295
pop esi
pop ebp
ret 4
push 0
push dword [0x42d66c]
push 0
push eax
push 0x14
push 0x1f7
push 0x3a
push 0
push 0x50000010
push 0x4258c8
push str.Static
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov ecx, esi
call fcn.00401190
mov ecx, esi
call fcn.00401120
mov ecx, esi
call fcn.00401550
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi]
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, 1
pop esi
pop ebp
ret 4

Function at 0x401690
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
test edx, edx
je 0x4017f2
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x4017f2
mov eax, dword [ebp + 0x10]
cmp eax, 1
jb 0x4017f2
push esi
xor esi, esi
test eax, eax
je 0x4017e7
dec eax
push ebx
mov bl, byte [ebp + 0xa]
shr eax, 2
inc eax
push edi
lea edi, [ecx + 2]
mov dword [ebp + 0xc], eax
mov dl, byte [edi - 2]
cmp dl, 0x2b
jne 0x4016dc
mov dl, 0x3e
jmp 0x40170a
cmp dl, 0x2f
jne 0x4016e5
mov dl, 0x3f
jmp 0x40170a
cmp dl, 0x39
jg 0x4016ef
add dl, 4
jmp 0x40170a
cmp dl, 0x3d
je 0x401708
cmp dl, 0x5a
jg 0x4016fe
sub dl, 0x41
jmp 0x40170a
cmp dl, 0x7a
jg 0x401708
sub dl, 0x47
jmp 0x40170a
mov dl, 0x40
mov cl, byte [edi - 1]
cmp cl, 0x2b
jne 0x401716
mov cl, 0x3e
jmp 0x401744
cmp cl, 0x2f
jne 0x40171f
mov cl, 0x3f
jmp 0x401744
cmp cl, 0x39
jg 0x401729
add cl, 4
jmp 0x401744
cmp cl, 0x3d
je 0x401742
cmp cl, 0x5a
jg 0x401738
sub cl, 0x41
jmp 0x401744
cmp cl, 0x7a
jg 0x401742
sub cl, 0x47
jmp 0x401744
mov cl, 0x40
mov al, cl
shl dl, 2
shr al, 4
add al, dl
mov edx, dword [ebp + 8]
mov byte [esi + edx], al
inc esi
mov al, byte [edi]
cmp al, 0x3d
je 0x40179d
mov bl, al
cmp bl, 0x2b
jne 0x401766
mov bl, 0x3e
jmp 0x40178f
cmp bl, 0x2f
jne 0x40176f
mov bl, 0x3f
jmp 0x40178f
cmp bl, 0x39
jg 0x401779
add bl, 4
jmp 0x40178f
cmp bl, 0x5a
jg 0x401783
sub bl, 0x41
jmp 0x40178f
cmp bl, 0x7a
jg 0x40178d
sub bl, 0x47
jmp 0x40178f
mov bl, 0x40
mov al, bl
shl cl, 4
shr al, 2
add al, cl
mov byte [esi + edx], al
inc esi
mov al, byte [edi + 1]
cmp al, 0x3d
je 0x4017d9
cmp al, 0x2b
jne 0x4017ac
mov al, 0x3e
jmp 0x4017ce
cmp al, 0x2f
jne 0x4017b4
mov al, 0x3f
jmp 0x4017ce
cmp al, 0x39
jg 0x4017bc
add al, 4
jmp 0x4017ce
cmp al, 0x5a
jg 0x4017c4
sub al, 0x41
jmp 0x4017ce
cmp al, 0x7a
jg 0x4017cc
sub al, 0x47
jmp 0x4017ce
mov al, 0x40
mov cl, bl
shl cl, 6
add cl, al
mov byte [esi + edx], cl
inc esi
add edi, 4
dec dword [ebp + 0xc]
jne 0x4016d0
pop edi
pop ebx
mov byte [esi + edx], 0
mov eax, esi
pop esi
pop ebp
ret 0xc
xor eax, eax
pop ebp
ret 0xc
Function at 0x401d20
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
push 0xffffffffffffffeb
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
je 0x401d81
mov ecx, dword [eax + 0x1b4]
mov esi, dword [eax + 0x1b8]
mov eax, dword [eax + 0x1bc]
mov dword [ebp - 4], eax
test ecx, ecx
je 0x401d5f
push 0
push ecx
call ebx
mov eax, dword [ebp - 4]
test eax, eax
je 0x401d68
push 0
push eax
call ebx
test esi, esi
je 0x401d81
push 1
push esi
call dword [sym.imp.USER32.dll_EnableWindow]
push 0x4259d8
push esi
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov eax, dword [edi]
test eax, eax
jne 0x401d9e
mov ecx, edi
call fcn.00401a90
push 5
mov ecx, edi
call fcn.00401a20
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 5
push eax
call ebx
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x401db0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x429280]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x30
lea eax, [ebp - 0x34]
mov edi, ecx
push 0
push eax
call fcn.00416d70
mov eax, dword [0x42d66c]
add esp, 0xc
mov dword [ebp - 0x34], 0x30
mov dword [ebp - 0x30], 3
mov dword [ebp - 0x2c], 0x401c70
push 5
mov dword [ebp - 0x20], eax
call dword [sym.imp.USER32.dll_GetSysColorBrush]
push 0x7f00
lea esi, [edi + 0x10]
mov dword [ebp - 0x14], eax
push 0
mov dword [ebp - 0xc], esi
call dword [sym.imp.USER32.dll_LoadCursorW]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExW]
push 0
push dword [0x42d66c]
push 0
push dword [edi + 4]
push 0x13a
push 0x1f1
push 0
push 0
push 0x40000000
push 0x4258c8
push esi
push 0x10000
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [edi], eax
test eax, eax
jne 0x401e63
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041050e
mov esp, ebp
pop ebp
ret
mov ecx, edi
call fcn.00401ba0
mov ecx, edi
call fcn.004018c0
push 0
push dword [edi]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [edi]
call dword [sym.imp.USER32.dll_UpdateWindow]
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
xor ecx, ebp
pop esi
call fcn.0041050e
mov esp, ebp
pop ebp
ret
Function at 0x402af0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x429280]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 8]
test eax, eax
je 0x402b1b
push 0x425b14
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov edi, dword [edi + 4]
test edi, edi
je 0x402b4a
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x408
push edi
call esi
inc eax
mov ecx, 0x64
cmp eax, ecx
push 0
cmovg eax, ecx
push eax
push 0x402
push edi
call esi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.00416d70
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x5c
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrRChrIW]
mov ecx, dword [0x42d670]
add eax, 2
mov dword [ebp - 0x218], eax
mov edx, str.SOFTWAREXCWiFiInfo
mov eax, str.SOFTWARESmxcInfo
cmp dword [ecx + 0x38], 0
lea ecx, [ebp - 0x210]
push ecx
lea ecx, [ebp - 0x214]
cmove eax, edx
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push eax
push 0x80000002
mov dword [ebp - 0x21c], eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x402c1a
push dword [ebp - 0x218]
call ebx
add eax, eax
push eax
push dword [ebp - 0x218]
push 1
push 0
push str.InstallName
push dword [ebp - 0x214]
call edi
push dword [ebp - 0x214]
call esi
call fcn.00405180
mov dword [ebp - 0x214], eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x218]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push dword [ebp - 0x21c]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x402c7f
push dword [ebp - 0x214]
call ebx
add eax, eax
push eax
push dword [ebp - 0x214]
push 1
push 0
push str.InstallPath
push dword [ebp - 0x218]
call edi
push dword [ebp - 0x218]
call esi
call fcn.00405070
mov esi, eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push dword [ebp - 0x21c]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x402cda
push esi
call ebx
add eax, eax
push eax
push esi
push 1
push 0
push str.StartMenuPath
push dword [ebp - 0x214]
call edi
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041050e
mov esp, ebp
pop ebp
ret
Function at 0x402cf0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x429280]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x42d670]
mov ecx, str.SOFTWAREXCWiFiInfo
push ebx
push esi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, str.SOFTWARESmxcInfo
cmp dword [eax + 0x38], 0
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmove esi, ecx
cmp dword [eax + 0x40], 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 8], 1
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push esi
push 0x80000002
jne 0x402d54
mov dword [ebp - 8], 0
call edi
test eax, eax
jne 0x402d78
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0
push str.Normal_Online
push dword [ebp - 0x10]
call ebx
push dword [ebp - 0x10]
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
mov eax, dword [0x42d670]
mov eax, dword [eax + 0x50]
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push esi
push 0x80000002
call edi
test eax, eax
jne 0x402dc1
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0
push str.Install_Plan
push dword [ebp - 0x10]
call ebx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041050e
mov esp, ebp
pop ebp
ret
Function at 0x403570
Capabilities:
Check if file exists
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x214
mov eax, dword [0x429280]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
push esi
push edi
xor eax, eax
mov edi, ecx
push 0x206
push eax
mov word [esp + 0x18], ax
lea eax, [esp + 0x1a]
push eax
call fcn.00416d70
add esp, 0xc
lea eax, [esp + 0x10]
push 0
push 0x23
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [esp + 0x10]
push 0x425db0
push eax
call ebx
mov esi, dword [0x42d670]
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x4035f2
push str.XCWiFi
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push dword [esi + 0x18]
lea eax, [esp + 0x14]
push eax
call ebx
push 0x425db4
lea eax, [esp + 0x14]
push eax
call ebx
push dword [edi + 8]
push dword [edi + 4]
call fcn.00405180
mov ecx, dword [0x42d67c]
push eax
call fcn.00408310
push dword [edi + 8]
push dword [edi + 4]
call fcn.00405070
mov ecx, dword [0x42d67c]
push eax
call fcn.00408310
push dword [edi + 8]
mov ecx, dword [0x42d67c]
lea eax, [esp + 0x14]
push dword [edi + 4]
push eax
call fcn.00408310
push 0
push ecx
call fcn.00405180
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
add esp, 4
push eax
call esi
push 0
push ecx
call fcn.00405070
add esp, 4
push eax
call esi
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x403686
lea ecx, [esp + 0x10]
call fcn.00408fe0
mov ecx, dword [esp + 0x21c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0041050e
mov esp, ebp
pop ebp
ret
Function at 0x403ae0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x429280]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0
push 0
push ecx
push 0x4039a0
push 0
push 0
mov dword [ecx], 0x404b20
call fcn.00410a63
mov esi, eax
add esp, 0x18
mov eax, 0x404b20
test eax, eax
jne 0x403b5b
test esi, esi
je 0x403b5b
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x403b5b
cmp dword [ebp - 8], 0
jne 0x403b5b
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041050e
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.0041050e
mov esp, ebp
pop ebp
ret 4
Function at 0x403e50
Capabilities:
Check os version
Reference cloudflare dns server

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x660
mov eax, dword [0x429280]
xor eax, esp
mov dword [esp + 0x65c], eax
push esi
push edi
lea eax, [esp + 8]
mov dword [esp + 8], 0x114
push eax
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0xc], 5
jne 0x404002
cmp dword [esp + 0x10], 1
jne 0x404002
xor eax, eax
push 0x206
push eax
mov word [esp + 0x258], ax
lea eax, [esp + 0x25a]
push eax
call fcn.00416d70
add esp, 0xc
xor eax, eax
mov word [esp + 0x124], ax
xorps xmm0, xmm0
mov dword [esp + 0x146], eax
mov word [esp + 0x14a], ax
push 0x3a
push eax
mov word [esp + 0x154], ax
lea eax, [esp + 0x156]
push eax
movdqu xmmword [esp + 0x132], xmm0
movdqu xmmword [esp + 0x142], xmm0
call fcn.00416d70
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [esp + 0x130]
add esp, 0xc
push str..wfver
push eax
call esi
push str.1.0.0.1
lea eax, [esp + 0x150]
push eax
call esi
push str..wfver
lea eax, [esp + 0x150]
push eax
call esi
call fcn.00405180
push eax
lea eax, [esp + 0x254]
push eax
call esi
lea eax, [esp + 0x14c]
push eax
lea eax, [esp + 0x254]
push eax
call esi
xor eax, eax
push 0x206
push eax
mov word [esp + 0x460], ax
lea eax, [esp + 0x462]
push eax
call fcn.00416d70
add esp, 0xc
call fcn.00405180
push eax
lea eax, [esp + 0x45c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push edi
call fcn.00405330
push eax
lea eax, [esp + 0x45c]
push eax
call esi
lea eax, [esp + 0x458]
push eax
lea eax, [esp + 0x150]
push eax
lea eax, [esp + 0x12c]
push eax
call fcn.00409980
push 0
push 0
push 1
push 0
push 0
push 0x10000000
lea eax, [esp + 0x268]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x403fe0
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
lea eax, [esp + 0x254]
push eax
call fcn.004096d0
pop edi
pop esi
mov ecx, dword [esp + 0x65c]
xor ecx, esp
call fcn.0041050e
mov esp, ebp
pop ebp
ret
xor eax, eax
push 0xc6
push eax
mov word [esp + 0x190], ax
lea eax, [esp + 0x192]
push eax
call fcn.00416d70
add esp, 0xc
call fcn.00405180
push eax
lea eax, [esp + 0x18c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [esp + 0x188]
push str.1.0.0.1
push eax
call esi
push str..wfver
lea eax, [esp + 0x18c]
push eax
call esi
push 0
push 0x80
push 2
push 0
push 2
push 0x40000004
lea eax, [esp + 0x1a0]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push edi
call fcn.004093d0
mov ecx, dword [esp + 0x664]
pop edi
pop esi
xor ecx, esp
call fcn.0041050e
mov esp, ebp
pop ebp
ret