joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40efe0
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
sub esp, 0x2c
push ebx
xor ebx, ebx
test byte [0x4492fc], 1
push esi
mov dword [esp + 0x14], ebx
mov byte [esp + 0x1c], bl
jne 0x40f009
or dword [0x4492fc], 1
call fcn.004089d0
mov dword [0x4492f8], eax
mov ecx, dword [0x4492f8]
mov eax, 0x20a
call fcn.0040d890
mov esi, eax
mov dword [esp + 0x10], esi
cmp esi, ebx
je 0x40f03a
push 0x20a
push ebx
push esi
mov dword [esp + 0x24], 0x104
call fcn.004243d0
add esp, 0xc
push 0x104
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x40f067
cmp esi, ebx
je 0x40f05f
push ebx
call fcn.00408b50
add esp, 4
xor al, al
pop esi
pop ebx
add esp, 0x2c
ret
cmp esi, ebx
je 0x40f084
mov eax, esi
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40f070
sub eax, esi
sar eax, 1
dec eax
mov dword [esp + 0x14], eax
push 0x431658
xor eax, eax
lea ecx, [esp + 0x14]
call fcn.0040c970
mov ebx, 0x431658
lea eax, [esp + 0x10]
call fcn.0040c8b0
lea esi, [esp + 0x20]
call fcn.0040c270
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0xc]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push 0x431868
push reloc.WS2_32.dll_bind
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 2
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40f0ec
cmp dword [esp + 0xc], eax
jne 0x40f131
mov eax, dword [esp + 8]
test eax, eax
je 0x40f0fb
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [esp + 0x20]
test esi, esi
je 0x40f110
mov ecx, dword [esp + 0x2c]
push ecx
call fcn.00408b50
add esp, 4
mov esi, dword [esp + 0x10]
test esi, esi
je 0x40f05f
mov edx, dword [esp + 0x1c]
push edx
call fcn.00408b50
add esp, 4
xor al, al
pop esi
pop ebx
add esp, 0x2c
ret
mov eax, dword [esp + 8]
push str.MeowPlayer
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
mov eax, dword [esp + 8]
sete bl
test eax, eax
je 0x40f155
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [esp + 0x20]
test esi, esi
je 0x40f16a
mov ecx, dword [esp + 0x2c]
push ecx
call fcn.00408b50
add esp, 4
mov esi, dword [esp + 0x10]
test esi, esi
je 0x40f17f
mov edx, dword [esp + 0x1c]
push edx
call fcn.00408b50
add esp, 4
pop esi
mov al, bl
pop ebx
add esp, 0x2c
ret

Function at 0x40fe70
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xe4
mov eax, dword [0x44405c]
xor eax, esp
mov dword [esp + 0xe0], eax
mov eax, dword [ebp + 8]
xor edx, edx
cmp eax, edx
push esi
mov dword [esp + 8], edx
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], 0x67452301
mov dword [esp + 0x14], 0xefcdab89
mov dword [esp + 0x18], 0x98badcfe
mov dword [esp + 0x1c], 0x10325476
jle 0x40feca
push eax
push ecx
lea esi, [esp + 0x10]
call fcn.0040fca0
add esp, 8
push edi
lea ecx, [esp + 0xc]
call fcn.0040fd40
mov ecx, dword [esp + 0xe8]
add esp, 4
pop esi
xor ecx, esp
call fcn.0041e30c
mov esp, ebp
pop ebp
ret
Function at 0x40fef0
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Manually build aes constants

Disassembly:
sub esp, 0x800
push ebx
push ebp
xor ecx, ecx
push esi
lea eax, [ecx + 1]
push edi
nop
mov edx, eax
and dl, 0x80
movsx edx, dl
neg edx
sbb edx, edx
and edx, 0x1b
lea esi, [eax + eax]
xor edx, esi
xor edx, eax
mov dword [esp + ecx*4 + 0x410], eax
mov dword [esp + eax*4 + 0x10], ecx
and edx, 0xff
inc ecx
cmp ecx, 0x100
mov eax, edx
jl 0x40ff00
mov eax, 1
mov ecx, 0x447880
lea esp, [esp]
mov edx, eax
and dl, 0x80
movsx edx, dl
neg edx
sbb edx, edx
mov dword [ecx], eax
and edx, 0x1b
add eax, eax
xor edx, eax
and edx, 0xff
add ecx, 4
cmp ecx, 0x4478a8
mov eax, edx
jl 0x40ff40
mov byte [0x446f80], 0x63
mov byte [0x44910b], 0
mov ebx, 1
jmp 0x40ff80
mov ecx, dword [esp + ebx*4 + 0x10]
add ecx, ecx
add ecx, ecx
lea edx, [esp + 0x80c]
sub edx, ecx
mov eax, dword [edx]
mov ecx, eax
sar ecx, 7
lea edx, [eax + eax]
or ecx, edx
and ecx, 0xff
xor eax, ecx
mov edx, ecx
sar edx, 7
add ecx, ecx
or edx, ecx
and edx, 0xff
xor eax, edx
mov ecx, edx
add edx, edx
sar ecx, 7
or ecx, edx
and ecx, 0xff
xor eax, ecx
mov edx, ecx
sar edx, 7
add ecx, ecx
or edx, ecx
xor edx, 0x63
and edx, 0xff
xor eax, edx
mov byte [ebx + 0x446f80], al
mov byte [eax + 0x4490a8], bl
inc ebx
cmp ebx, 0x100
jl 0x40ff80
xor ecx, ecx
movzx esi, byte [ecx + 0x446f80]
mov edx, esi
and dl, 0x80
movsx edx, dl
neg edx
sbb edx, edx
and edx, 0x1b
lea eax, [esi + esi]
xor edx, eax
and edx, 0xff
mov eax, edx
xor eax, esi
shl eax, 8
xor eax, esi
shl eax, 8
xor eax, esi
shl eax, 8
xor eax, edx
mov dword [ecx*4 + 0x448ca8], eax
rol eax, 8
mov dword [ecx*4 + 0x4488a8], eax
rol eax, 8
mov dword [ecx*4 + 0x4484a8], eax
rol eax, 8
mov dword [ecx*4 + 0x4480a8], eax
movzx eax, byte [ecx + 0x4490a8]
test eax, eax
je 0x4100a8
mov esi, dword [esp + eax*4 + 0x10]
mov edx, dword [esp + 0x48]
lea eax, [esi + edx]
cdq
mov edi, 0xff
idiv edi
mov eax, dword [esp + 0x34]
add eax, esi
mov ebp, dword [esp + edx*4 + 0x410]
cdq
idiv edi
mov ebx, dword [esp + edx*4 + 0x410]
mov edx, dword [esp + 0x44]
lea eax, [esi + edx]
cdq
idiv edi
mov eax, dword [esp + 0x3c]
add eax, esi
mov esi, 0xff
mov edi, dword [esp + edx*4 + 0x410]
cdq
idiv esi
mov edx, dword [esp + edx*4 + 0x410]
jmp 0x4100b0
xor ebp, ebp
xor ebx, ebx
xor edi, edi
xor edx, edx
shl edx, 8
xor edx, edi
shl edx, 8
xor edx, ebx
shl edx, 8
xor edx, ebp
mov dword [ecx*4 + 0x447ca8], edx
rol edx, 8
mov dword [ecx*4 + 0x4478a8], edx
rol edx, 8
mov dword [ecx*4 + 0x447480], edx
rol edx, 8
mov dword [ecx*4 + 0x447080], edx
inc ecx
cmp ecx, 0x100
jl 0x40fff2
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x800
ret
Function at 0x410620
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x11c
push esi
push edi
mov edi, ecx
push eax
lea esi, [edi + 8]
lea eax, [esp + 0xc]
mov dword [edi], 0xe
mov dword [edi + 4], esi
call fcn.00410100
mov eax, dword [esp + 0xc]
shl eax, 4
add eax, dword [esp + 0x10]
add esi, 4
mov ecx, dword [eax]
mov dword [esi - 4], ecx
mov edx, dword [eax + 4]
add eax, 4
mov dword [esi], edx
mov ecx, dword [eax + 4]
add eax, 4
add esi, 4
mov dword [esi], ecx
mov edx, dword [eax + 4]
add eax, 4
add esi, 4
mov dword [esi], edx
mov ecx, dword [edi]
dec ecx
add esp, 4
add esi, 4
sub eax, 0x1c
test ecx, ecx
jle 0x4107d5
movzx edx, byte [eax + 3]
movzx edx, byte [edx + 0x446f80]
mov edx, dword [edx*4 + 0x447080]
movzx edi, byte [eax + 2]
movzx edi, byte [edi + 0x446f80]
xor edx, dword [edi*4 + 0x447480]
movzx edi, byte [eax + 1]
movzx edi, byte [edi + 0x446f80]
xor edx, dword [edi*4 + 0x4478a8]
mov edi, dword [eax]
and edi, 0xff
movzx edi, byte [edi + 0x446f80]
xor edx, dword [edi*4 + 0x447ca8]
add eax, 0x10
mov dword [esi], edx
mov edx, dword [eax - 0xc]
movzx edi, byte [eax - 9]
movzx edi, byte [edi + 0x446f80]
and edx, 0xff
movzx edx, byte [edx + 0x446f80]
mov edx, dword [edx*4 + 0x447ca8]
xor edx, dword [edi*4 + 0x447080]
movzx edi, byte [eax - 0xa]
movzx edi, byte [edi + 0x446f80]
xor edx, dword [edi*4 + 0x447480]
movzx edi, byte [eax - 0xb]
movzx edi, byte [edi + 0x446f80]
xor edx, dword [edi*4 + 0x4478a8]
dec ecx
mov dword [esi + 4], edx
mov edx, dword [eax - 8]
movzx edi, byte [eax - 5]
movzx edi, byte [edi + 0x446f80]
and edx, 0xff
movzx edx, byte [edx + 0x446f80]
mov edx, dword [edx*4 + 0x447ca8]
xor edx, dword [edi*4 + 0x447080]
movzx edi, byte [eax - 6]
movzx edi, byte [edi + 0x446f80]
xor edx, dword [edi*4 + 0x447480]
movzx edi, byte [eax - 7]
movzx edi, byte [edi + 0x446f80]
xor edx, dword [edi*4 + 0x4478a8]
add esi, 0x10
mov dword [esi - 8], edx
mov edx, dword [eax - 4]
movzx edi, byte [eax - 1]
movzx edi, byte [edi + 0x446f80]
and edx, 0xff
movzx edx, byte [edx + 0x446f80]
mov edx, dword [edx*4 + 0x447ca8]
xor edx, dword [edi*4 + 0x447080]
movzx edi, byte [eax - 2]
movzx edi, byte [edi + 0x446f80]
xor edx, dword [edi*4 + 0x447480]
movzx edi, byte [eax - 3]
movzx edi, byte [edi + 0x446f80]
xor edx, dword [edi*4 + 0x4478a8]
sub eax, 0x20
mov dword [esi - 4], edx
test ecx, ecx
jg 0x410685
mov ecx, dword [eax]
mov dword [esi], ecx
mov edx, dword [eax + 4]
add esi, 4
add eax, 4
mov dword [esi], edx
mov ecx, dword [eax + 4]
add esi, 4
add eax, 4
mov dword [esi], ecx
mov edx, dword [eax + 4]
pop edi
mov dword [esi + 4], edx
pop esi
add esp, 0x11c
ret
Function at 0x413f00
Capabilities:
Encode data using base64

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0x10]
push esi
push edi
mov edi, dword [esp + 0x1c]
mov esi, eax
test edi, edi
je 0x41405f
lea ecx, [edi*8]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [eax + eax*2]
add ecx, ecx
mov edx, ecx
lea ecx, [edi*8]
sub ecx, edx
sub ecx, 2
je 0x413f4a
sub ecx, 2
jne 0x413f4d
add eax, 2
jmp 0x413f4d
add eax, 3
inc eax
cmp dword [ebx], eax
jge 0x413f5e
pop edi
mov dword [ebx], eax
pop esi
mov eax, 0xfffffff0
pop ebx
pop ecx
ret
mov ecx, dword [esp + 0x14]
mov eax, 0x55555556
imul edi
mov eax, edx
shr eax, 0x1f
add eax, edx
lea eax, [eax + eax*2]
xor edx, edx
push ebp
test eax, eax
jle 0x413ffc
lea edx, [eax - 1]
mov eax, 0xaaaaaaab
mul edx
shr edx, 1
inc edx
lea eax, [edx + edx*2]
mov dword [esp + 0x10], eax
movzx eax, byte [esi]
movzx ebp, byte [esi + 1]
mov ebx, eax
sar ebx, 2
inc esi
movzx edi, byte [esi + 1]
and ebx, 0x3f
mov bl, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], bl
inc esi
shl eax, 4
mov ebx, ebp
sar ebx, 4
add ebx, eax
and ebx, 0x3f
movzx eax, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 1], al
inc ecx
mov eax, edi
sar eax, 6
lea eax, [eax + ebp*4]
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
mov byte [ecx], al
and edi, 0x3f
movzx eax, byte [edi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
mov byte [ecx], al
inc esi
inc ecx
sub edx, 1
jne 0x413f92
mov edi, dword [esp + 0x20]
mov ebx, dword [esp + 0x1c]
mov edx, dword [esp + 0x10]
cmp edx, edi
jge 0x414053
movzx eax, byte [esi]
lea ebp, [edx + 1]
cmp ebp, edi
jge 0x414010
movzx esi, byte [esi + 1]
jmp 0x414012
xor esi, esi
mov edx, eax
sar edx, 2
and edx, 0x3f
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], dl
mov edx, esi
sar edx, 4
shl eax, 4
add edx, eax
and edx, 0x3f
mov al, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
mov byte [ecx], al
inc ecx
cmp ebp, edi
jge 0x41404b
and esi, 0xf
mov dl, byte [esi*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], dl
jmp 0x41404e
mov byte [ecx], 0x3d
inc ecx
mov byte [ecx], 0x3d
inc ecx
mov eax, ecx
sub eax, dword [esp + 0x18]
mov byte [ecx], 0
mov dword [ebx], eax
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x414070
Capabilities:
Encode data using base64

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
push edi
mov esi, eax
xor edi, edi
xor ecx, ecx
xor edx, edx
test esi, esi
jle 0x414182
mov ebp, esi
lea ebx, [ebx]
cmp ebp, 2
jl 0x4140a2
cmp byte [edx + ebx], 0xd
jne 0x4140a2
cmp byte [edx + ebx + 1], 0xa
je 0x4140cd
mov al, byte [edx + ebx]
cmp al, 0xa
je 0x4140cd
cmp al, 0x3d
jne 0x4140b3
inc ecx
cmp ecx, 2
jg 0x4140f9
cmp al, 0x7f
ja 0x4140f9
movzx eax, al
mov al, byte [eax + 0x431908]
cmp al, 0x7f
je 0x4140f9
cmp al, 0x40
jae 0x4140cc
test ecx, ecx
jne 0x4140f9
inc edi
inc edx
dec ebp
cmp edx, esi
jl 0x414090
test edi, edi
je 0x414182
mov ecx, dword [esp + 0x18]
lea eax, [edi + edi*2]
lea eax, [eax + eax + 7]
sar eax, 3
cmp dword [ecx], eax
jge 0x414103
pop edi
pop esi
pop ebp
mov dword [ecx], eax
mov eax, 0xfffffff0
pop ebx
ret
pop edi
pop esi
pop ebp
mov eax, 0xffffffee
pop ebx
ret
mov esi, dword [esp + 0x14]
xor ecx, ecx
xor edi, edi
mov ebp, 3
test edx, edx
jle 0x414178
mov al, byte [ebx]
cmp al, 0xd
je 0x41416e
cmp al, 0xa
je 0x41416e
movzx eax, al
mov al, byte [eax + 0x431908]
xor ebx, ebx
cmp al, 0x40
sete bl
movzx eax, al
and eax, 0x3f
shl ecx, 6
inc edi
sub ebp, ebx
or ecx, eax
cmp edi, 4
jne 0x41416a
xor edi, edi
test ebp, ebp
jle 0x41414f
mov eax, ecx
shr eax, 0x10
mov byte [esi], al
inc esi
cmp ebp, 1
jle 0x41415c
mov eax, ecx
shr eax, 8
mov byte [esi], al
inc esi
cmp ebp, 2
mov ebx, dword [esp + 0x1c]
jle 0x41416e
mov byte [esi], cl
inc esi
jmp 0x41416e
mov ebx, dword [esp + 0x1c]
dec edx
inc ebx
mov dword [esp + 0x1c], ebx
test edx, edx
jg 0x414114
sub esi, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [ecx], esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret

Function at 0x4142b0
Capabilities:
Get graphical window text

Disassembly:
push esi
push edi
mov edi, ecx
mov esi, eax
mov eax, dword [edi]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
cmp eax, dword [esi + 8]
jbe 0x4142cd
push 1
mov ecx, eax
call fcn.0040c550
mov eax, dword [esi + 8]
mov ecx, dword [esi]
inc eax
push eax
push ecx
mov ecx, dword [edi]
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov edx, dword [esi]
test edx, edx
je 0x4142f9
mov ecx, edx
mov di, word [ecx]
add ecx, 2
test di, di
jne 0x4142e6
sub ecx, edx
sar ecx, 1
dec ecx
mov dword [esi + 4], ecx
pop edi
pop esi
ret
Function at 0x417930
Capabilities:
Read file via mapping

Disassembly:
push esi
push str.944009C60EC84ED0B3117E8F52FFB1C4
push 0x1000
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov esi, eax
test esi, esi
je 0x41796c
push 0x1000
push 0
push 0
push 6
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
jne 0x417970
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop esi
ret
lea ecx, [eax + 4]
mov dword [sym.MeowPlayer1.0.0.6.exe_struct_HWND_____YmWndRadio], ecx
lea edx, [eax + 8]
lea ecx, [eax + 0xc]
mov dword [sym.MeowPlayer1.0.0.6.exe_struct_HWND_____YmWndUpdate], edx
mov dword [sym.MeowPlayer1.0.0.6.exe_bool__IsDebugging], ecx
lea edx, [eax + 0x10]
lea ecx, [eax + 0x14]
mov dword [sym.MeowPlayer1.0.0.6.exe_bool__OldDesktop], edx
lea edx, [eax + 0x18]
mov dword [sym.MeowPlayer1.0.0.6.exe_bool__ReuseData], ecx
lea ecx, [eax + 0x1c]
mov dword [sym.MeowPlayer1.0.0.6.exe_struct_HWND_____YmWndDebuger], eax
mov dword [sym.MeowPlayer1.0.0.6.exe_bool__RegetData], edx
lea edx, [eax + 0x20]
mov dword [sym.MeowPlayer1.0.0.6.exe_unsigned_long_int__YmUpdatePID], ecx
lea ecx, [eax + 0x24]
add eax, 0x800
mov dword [sym.MeowPlayer1.0.0.6.exe_wchar_t__YmExternInfo], eax
mov dword [0x449200], edx
mov dword [sym.MeowPlayer1.0.0.6.exe_bool__YmDebugServer], ecx
mov al, 1
pop esi
ret
Function at 0x417aa0
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
push 0x2001f
push 0
mov eax, str.HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun
lea ebx, [esp + 0x14]
mov dword [esp + 0x14], 0
call fcn.0040de20
test eax, eax
jne 0x417ae5
mov eax, dword [esp + 0xc]
test eax, eax
je 0x417adc
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
xor ebx, ebx
push eax
lea eax, [esp + 0x14]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x20], bl
call fcn.0040c770
mov edi, dword [esp + 0x14]
lea ecx, [edi + 1]
cmp ecx, dword [esp + 0x18]
jbe 0x417b20
push 1
lea esi, [esp + 0x14]
call fcn.0040c550
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
cmp edi, ebx
ja 0x417b2c
mov ebx, edi
jmp 0x417b3d
lea ecx, [edi + edi]
push ecx
lea edx, [esi + 2]
push esi
push edx
call fcn.0041e320
add esp, 0xc
inc edi
xor ecx, ecx
mov eax, 0x22
mov word [esi + ebx*2], ax
mov word [esi + edi*2], cx
lea ecx, [edi + 1]
or ebx, 0xffffffff
mov dword [esp + 0x14], edi
cmp ecx, dword [esp + 0x18]
jbe 0x417b70
push 1
lea esi, [esp + 0x14]
call fcn.0040c550
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
cmp edi, 0xffffffff
ja 0x417b79
mov ebx, edi
jmp 0x417b8e
lea edx, [edi + edi + 2]
push edx
lea eax, [esi - 2]
push eax
add eax, 2
push eax
call fcn.0041e320
add esp, 0xc
mov eax, 0x22
mov word [esi + ebx*2], ax
inc edi
xor ecx, ecx
mov eax, esi
mov word [esi + edi*2], cx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x417ba3
mov ecx, dword [esp + 0xc]
sub eax, edx
sar eax, 1
lea edx, [eax + eax + 2]
mov eax, dword [ebp + 8]
push edx
push esi
push 1
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete bl
test esi, esi
je 0x417be1
mov edx, dword [esp + 0x1c]
push edx
call fcn.00408b50
add esp, 4
mov eax, dword [esp + 0xc]
test eax, eax
je 0x417bf0
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x417c90
Capabilities:
Delete registry value

Disassembly:
push ecx
push ebx
push 0xf003f
push 0
mov eax, str.HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun
lea ebx, [esp + 0xc]
mov dword [esp + 0xc], 0
call fcn.0040de20
test eax, eax
mov eax, dword [esp + 4]
jne 0x417cc7
test eax, eax
je 0x417cc2
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
pop ebx
pop ecx
ret
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push str.UpdateMgr
push eax
call esi
mov ecx, dword [esp + 8]
push str.MewoPlay_Up
push ecx
call esi
test eax, eax
mov eax, dword [esp + 8]
sete bl
pop esi
test eax, eax
je 0x417cf7
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
pop ecx
ret
Function at 0x417d00
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor ebx, ebx
push eax
lea eax, [esp + 0x14]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x20], bl
call fcn.0040c770
lea esi, [esp + 0x20]
call fcn.0040c270
mov ecx, dword [esp + 0x10]
cmp word [ecx + 2], 0x3a
lea eax, [esp + 0x10]
je 0x417db5
call fcn.004087a0
lea eax, [esp + 0x10]
call fcn.004083a0
mov edi, dword [esp + 0x14]
cmp edi, ebx
jne 0x417d79
cmp dword [esp + 0x24], ebx
mov ebx, dword [esp + 0x20]
je 0x417da7
mov esi, dword [ebp + 8]
xor edx, edx
lea edi, [esp + 0x10]
mov word [ebx], dx
call fcn.00408350
jmp 0x417e0e
cmp edi, dword [esp + 0x28]
jbe 0x417d8c
push 1
mov ecx, edi
lea esi, [esp + 0x24]
call fcn.0040c550
mov ebx, dword [esp + 0x20]
test ebx, ebx
je 0x417da7
mov ecx, dword [esp + 0x10]
lea eax, [edi + edi + 2]
push eax
push ecx
push ebx
call fcn.00426530
add esp, 0xc
mov esi, dword [ebp + 8]
lea edi, [esp + 0x10]
call fcn.00408350
jmp 0x417e0e
call fcn.004083a0
mov edi, dword [esp + 0x14]
cmp edi, ebx
jne 0x417dd3
cmp dword [esp + 0x24], ebx
mov ebx, dword [esp + 0x20]
je 0x417e01
xor edx, edx
mov word [ebx], dx
jmp 0x417e01
cmp edi, dword [esp + 0x28]
jbe 0x417de6
push 1
mov ecx, edi
lea esi, [esp + 0x24]
call fcn.0040c550
mov ebx, dword [esp + 0x20]
test ebx, ebx
je 0x417e01
mov ecx, dword [esp + 0x10]
lea eax, [edi + edi + 2]
push eax
push ecx
push ebx
call fcn.00426530
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
lea eax, [esp + 0x14]
call fcn.0040c770
mov eax, dword [ebp + 0xc]
mov edi, dword [esp + 0x10]
push 1
push ebx
push eax
push edi
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
test eax, eax
setne byte [esp + 0xf]
test ebx, ebx
je 0x417e41
mov ecx, dword [esp + 0x2c]
push ecx
mov esi, ebx
call fcn.00408b50
add esp, 4
test edi, edi
je 0x417e54
mov edx, dword [esp + 0x1c]
push edx
mov esi, edi
call fcn.00408b50
add esp, 4
mov al, byte [esp + 0xf]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x418aa0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push 0xf003f
push 0
mov eax, str.HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionUninstall
lea ebx, [esp + 0xc]
mov dword [esp + 0xc], 0
call fcn.0040de20
test eax, eax
mov eax, dword [esp + 4]
jne 0x418adf
test eax, eax
je 0x418ad8
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
push str.MeowPlayer
push eax
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
call fcn.0040efe0
mov eax, dword [esp + 4]
test eax, eax
je 0x418aff
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x418c10
Capabilities:
Initialize winhttp library
Prepare http request
Receive http response
Set http header

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
xor esi, esi
push esi
push esi
push esi
push esi
push str.wind_runner_WinHTTP__1.0
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov edi, eax
mov dword [esp + 0x1c], edi
test edi, edi
je 0x418d5b
mov eax, dword [esp + 0x24]
push esi
push 0x50
push eax
push edi
call dword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov ebx, eax
mov dword [esp + 0x18], ebx
test ebx, ebx
je 0x418d54
mov ecx, dword [esp + 0x28]
push esi
push esi
push esi
push str.HTTP_1.1
push ecx
push str.POST
push ebx
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov ebp, eax
test ebp, ebp
je 0x418d4d
push 0x20000000
mov ecx, str.Content_Type:_application_x_www_form_urlencoded_r_n
call fcn.0040c060
push eax
push ecx
push ebp
call dword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
push esi
push eax
push eax
push edx
push esi
push esi
push ebp
call dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
je 0x418d46
push esi
push ebp
call dword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
test eax, eax
jne 0x418ccb
push str.netware_error_for_post_data
push 0xff
call sym.MeowPlayer1.0.0.6.exe_void___cdecl_ymPrint_int__wchar_t_const__
add esp, 8
jmp 0x418d46
lea eax, [esp + 0x10]
push eax
xor esi, esi
push ebp
mov dword [esp + 0x18], esi
call dword [sym.imp.WINHTTP.dll_WinHttpQueryDataAvailable]
mov edi, dword [esp + 0x34]
test eax, eax
je 0x418d3c
mov ebx, dword [sym.imp.WINHTTP.dll_WinHttpReadData]
jmp 0x418cf0
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x418d38
lea eax, [ecx + esi + 1]
cmp dword [edi + 4], eax
jae 0x418d0a
call fcn.00408fe0
mov ecx, dword [esp + 0x10]
mov eax, dword [edi]
lea edx, [esp + 0x14]
push edx
push ecx
add eax, esi
push eax
push ebp
call ebx
test eax, eax
je 0x418d38
add esi, dword [esp + 0x14]
lea eax, [esp + 0x10]
push eax
push ebp
mov dword [esp + 0x18], 0
call dword [sym.imp.WINHTTP.dll_WinHttpQueryDataAvailable]
test eax, eax
jne 0x418cf0
mov ebx, dword [esp + 0x18]
mov ecx, dword [edi]
mov edi, dword [esp + 0x1c]
mov byte [esi + ecx], 0
push ebp
call dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
push ebx
call dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
push edi
call dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret