joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45aaf0
Capabilities:
Acquire debug privileges

Disassembly:
push 0xffffffffffffffff
push 0x46e7af
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4f8028]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
lea ecx, [esi + 0x210]
mov dword [esi], vtable.GA::RegistryControl.0
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x24], esp
push str.SeDebugPrivilege
mov dword [esp + 0x34], 0
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
call fcn.0045cc70
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x24], esp
push str.SeAuditPrivilege
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
call fcn.0045cc70
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x24], esp
push str.SeSecurityPrivilege
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
call fcn.0045cc70
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x24], esp
push str.SeTakeOwnershipPrivilege
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
call fcn.0045cc70
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x24], esp
push str.SeManageVolumePrivilege
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
call fcn.0045cc70
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x24], esp
push str.SeRestorePrivilege
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
call fcn.0045cc70
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x24], esp
push str.SeBackupPrivilege
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
call fcn.0045cc70
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x24], esp
push str.SeLoadDriverPrivilege
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
call fcn.0045cc70
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x24], esp
push str.SeSystemEnvironmentPrivilege
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
call fcn.0045cc70
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4
Function at 0x45af30
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x470a30
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
push esi
push edi
mov eax, dword [0x4f8028]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x1c], esi
cmp byte [ebp + 0xc], 0
je 0x45b0d9
xor edi, edi
mov dword [esp + 0x20], vtable.MemoryControl.0
mov dword [esp + 0x24], edi
mov dword [esp + 0x48], edi
mov eax, dword [esi]
mov edx, dword [eax + 0x20]
lea ecx, [esp + 0x14]
push ecx
push edi
mov ecx, esi
mov dword [esp + 0x1c], edi
call edx
mov eax, dword [esp + 0x14]
push eax
lea ecx, [esp + 0x24]
call fcn.0045d5d0
mov ebx, eax
mov eax, dword [esp + 0x24]
cmp eax, edi
je 0x45afb8
mov ecx, dword [esp + 0x28]
push ecx
push edi
push eax
call sub.ntdll.dll_memset
add esp, 0xc
mov edx, dword [esi]
mov edx, dword [edx + 0x20]
lea eax, [esp + 0x14]
push eax
push ebx
mov ecx, esi
call edx
test al, al
jne 0x45aff4
mov eax, dword [esp + 0x24]
cmp eax, edi
je 0x45afdd
push eax
call dword [sym.imp.MSVCR80.dll_free]
add esp, 4
xor al, al
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov byte [esp + 0x48], 1
mov eax, dword [esp + 0x14]
push eax
lea edx, [esp + 0x30]
mov ecx, ebx
call fcn.00460bd0
add esp, 4
xor ebx, ebx
mov dword [esp + 0x18], edi
mov edi, edi
mov esi, dword [esp + 0x30]
cmp esi, edi
mov edi, dword [esp + 0x34]
je 0x45b079
mov ecx, edi
sub ecx, esi
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ebx, eax
jae 0x45b079
mov edi, dword [esp + 0x18]
cmp dword [edi + esi + 0x18], 8
jb 0x45b058
mov esi, dword [edi + esi + 4]
jmp 0x45b05c
lea esi, [edi + esi + 4]
mov ecx, dword [esp + 0x1c]
mov edx, dword [ecx + 4]
push esi
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
add edi, 0x1c
add ebx, 1
mov dword [esp + 0x18], edi
xor edi, edi
jmp 0x45b020
xor ebx, ebx
cmp esi, ebx
mov byte [esp + 0x48], 0
je 0x45b0a4
cmp esi, edi
je 0x45b09b
mov ecx, esi
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
add esi, 0x1c
cmp esi, edi
jne 0x45b088
mov esi, dword [esp + 0x30]
push esi
call sub.MFC80U.DLL_Ordinal_764
add esp, 4
mov eax, dword [esp + 0x24]
cmp eax, ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
je 0x45b0c2
push eax
call dword [sym.imp.MSVCR80.dll_free]
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 8]
mov ecx, dword [esi + 4]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x45b0c2
cmp eax, 2
je 0x45b0c2
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x45db90
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
push edi
push ebx
mov esi, ecx
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
test eax, eax
jne 0x45dbda
test edi, edi
je 0x45dbda
cmp byte [ebp + 0x18], 0
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [esi + 4]
jne 0x45dbe5
push 0
push 0
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x45dbf6
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
push 2
push 0
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x45dbda
mov ecx, dword [esi + 4]
push 0
lea eax, [esp + 0x10]
push eax
push edi
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
pop edi
test eax, eax
pop esi
setne al
pop ebx
mov esp, ebp
pop ebp
ret 0x14

Function at 0x45dc20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
push edi
push ebx
mov esi, ecx
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x45dc64
test edi, edi
je 0x45dc64
cmp byte [ebp + 0x10], al
je 0x45dc6f
push 2
xor ecx, ecx
push ecx
push ecx
push eax
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x45dc97
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
cmp byte [ebp + 0x1c], 0
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x14]
mov eax, dword [esi + 4]
jne 0x45dc86
push 0
push 0
push ecx
push edx
jmp 0x45dc59
push 2
push 0
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x45dc64
mov edx, dword [esi + 4]
push 0
lea ecx, [esp + 0x10]
push ecx
push edi
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
test eax, eax
pop esi
setne al
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x45f9a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x28
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x45f9c4
xor al, al
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
test al, 0x10
mov esi, dword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
je 0x45fa02
lea eax, [esp + 8]
push eax
push 0x4ec888
mov dword [esp + 0x10], 0
call sub.ADVAPI32.dll_ConvertStringSidToSidW
mov ecx, dword [esp + 8]
push 0
push 0
push 0
push ecx
push 1
push 1
push edi
call esi
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
push 3
push 1
push 0x10000000
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
push 0x4ec92c
lea eax, [esp + 0x20]
push eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
call dword [sym.imp.ADVAPI32.dll_BuildExplicitAccessWithNameW]
lea ecx, [esp + 0xc]
push ecx
push 0
lea edx, [esp + 0x18]
push edx
push 1
call dword [sym.imp.ADVAPI32.dll_SetEntriesInAclW]
test eax, eax
jne 0x45f9ba
push eax
mov eax, dword [esp + 0x10]
push eax
push 0
push 0
push 4
push 1
push edi
call esi
test eax, eax
pop edi
sete al
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x460370
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
sub esp, 0x31c
mov eax, dword [0x4f8028]
xor eax, esp
mov dword [esp + 0x318], eax
push esi
xor eax, eax
push edi
push 0xfe
push eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov word [esp + 0x20], ax
lea eax, [esp + 0x22]
push eax
mov dword [esp + 0x14], 0
call sub.ntdll.dll_memset
push 0x206
lea ecx, [esp + 0x12a]
push 0
push ecx
mov word [esp + 0x130], 0
call sub.ntdll.dll_memset
add esp, 0x18
lea edx, [esp + 8]
push edx
call dword [sym.imp.RPCRT4.dll_UuidCreate]
movzx eax, byte [esp + 0x17]
movzx ecx, byte [esp + 0x16]
push eax
mov eax, dword [esp + 0x18]
push ecx
movzx ecx, byte [esp + 0x1b]
movzx edx, ah
push edx
movzx edx, byte [esp + 0x1e]
movzx eax, al
push eax
mov eax, dword [esp + 0x20]
push ecx
push edx
movzx ecx, ah
push ecx
movzx ecx, word [esp + 0x28]
movzx edx, al
movzx eax, word [esp + 0x2a]
push edx
mov edx, dword [esp + 0x28]
push eax
push ecx
push edx
lea eax, [esp + 0x44]
push str._.8x__.4x__.4x__.2x_.2x__.2x_.2x_.2x_.2x_.2x_.2x
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x34
lea edi, [esp + 0x118]
call fcn.00460620
mov esi, eax
test esi, esi
jne 0x46044d
push 0xb3
jmp 0x4604e4
mov edi, dword [sym.imp.MSVCR80.dll_wcscat_s]
push str.AomeiBR
lea ecx, [esp + 0x11c]
push 0x104
push ecx
call edi
add esp, 0xc
lea edx, [esp + 0x118]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4604a5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x4604a5
push 0
lea eax, [esp + 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov esi, eax
test esi, esi
jne 0x4604a5
push 0xbb
jmp 0x4604e4
push str.comn.ini
lea ecx, [esp + 0x11c]
push 0x104
push ecx
call edi
add esp, 0xc
lea edx, [esp + 0x118]
push edx
lea eax, [esp + 0x1c]
push eax
push str.MARK
push str.COMN
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov esi, eax
test esi, esi
jne 0x4604ec
push 0xc1
call fcn.0045fca0
add esp, 4
mov ecx, dword [esp + 0x320]
pop edi
mov eax, esi
pop esi
xor ecx, esp
call fcn.0046d6fd
add esp, 0x31c
ret
Function at 0x460510
Capabilities:
Check if file exists
Get file attributes
Get hostname
Read .ini file

Disassembly:
sub esp, 0x230
mov eax, dword [0x4f8028]
xor eax, esp
mov dword [esp + 0x22c], eax
push esi
push edi
push 0x206
lea eax, [esp + 0x32]
push 0
push eax
mov word [esp + 0x38], 0
call sub.ntdll.dll_memset
xor eax, eax
add esp, 0xc
lea edi, [esp + 0x2c]
mov word [esp + 0xc], 0
mov dword [esp + 0xe], eax
mov dword [esp + 0x12], eax
mov dword [esp + 0x16], eax
mov dword [esp + 0x1a], eax
mov dword [esp + 0x1e], eax
mov dword [esp + 0x22], eax
mov dword [esp + 0x26], eax
mov word [esp + 0x2a], ax
mov dword [esp + 8], 0xf
call fcn.00460620
mov esi, eax
test esi, esi
jne 0x460591
push 0xd0
call fcn.0045fca0
add esp, 4
jmp 0x460601
push str.AomeiBRcomn.ini
lea ecx, [esp + 0x30]
push 0x104
push ecx
call dword [sym.imp.MSVCR80.dll_wcscat_s]
add esp, 0xc
lea edx, [esp + 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov esi, ecx
test esi, esi
jne 0x4605d1
push 0xd4
call fcn.0045fca0
add esp, 4
jmp 0x460601
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea ecx, [esp + 0x2c]
push ecx
push 0x80
push ebx
lea edx, [esp + 0x18]
push edx
push str.MARK
push str.COMN
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ecx, dword [esp + 0x234]
pop edi
mov eax, esi
pop esi
xor ecx, esp
call fcn.0046d6fd
add esp, 0x230
ret

Function at 0x460620
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [0x4f8028]
xor eax, esp
mov dword [esp + 0x208], eax
push esi
push 0x206
lea eax, [esp + 0xa]
push 0
push eax
mov word [esp + 0x10], 0
call sub.ntdll.dll_memset
xor ecx, ecx
add esp, 0xc
test edi, edi
setne cl
mov esi, ecx
test esi, esi
jne 0x460682
push 0xe6
call fcn.0045fca0
add esp, 4
mov eax, esi
pop esi
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.0046d6fd
add esp, 0x20c
ret
lea edx, [esp + 4]
push edx
push 0
push 0
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [esp + 4]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4606a0
sub eax, edx
xor ecx, ecx
sar eax, 1
cmp eax, 0x104
setl cl
mov esi, ecx
test esi, esi
jne 0x4606e4
push 0xf3
call fcn.0045fca0
add esp, 4
mov eax, esi
pop esi
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.0046d6fd
add esp, 0x20c
ret
lea eax, [esp + 4]
mov edx, edi
mov ecx, eax
sub edx, ecx
mov edi, edi
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x4606f0
mov ecx, dword [esp + 0x20c]
mov eax, esi
pop esi
xor ecx, esp
call fcn.0046d6fd
add esp, 0x20c
ret
Function at 0x460850
Capabilities:
Check if file exists
Get file attributes
Read .ini file

Disassembly:
sub esp, 0x414
mov eax, dword [0x4f8028]
xor eax, esp
mov dword [esp + 0x410], eax
push ebx
push esi
push 0x206
lea eax, [esp + 0x216]
push 0
push eax
mov word [esp + 0x21c], 0
call sub.ntdll.dll_memset
push 0x206
lea ecx, [esp + 0x1a]
push 0
push ecx
mov word [esp + 0x20], 0
call sub.ntdll.dll_memset
add esp, 0x18
lea ebx, [esp + 0x210]
call fcn.00460720
mov esi, eax
test esi, esi
jne 0x4608d7
push 0x145
call fcn.0045fca0
add esp, 4
mov eax, esi
pop esi
pop ebx
mov ecx, dword [esp + 0x410]
xor ecx, esp
call fcn.0046d6fd
add esp, 0x414
ret
lea edx, [esp + 0x210]
push edx
lea eax, [esp + 0xc]
push str._sOther.ini
push eax
call dword [sym.imp.MSVCR80.dll__swprintf]
add esp, 0xc
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x460939
push edi
lea edi, [esp + 0xc]
call fcn.00460970
mov esi, eax
test esi, esi
pop edi
jne 0x460939
push 0x14b
call fcn.0045fca0
add esp, 4
mov eax, esi
pop esi
pop ebx
mov ecx, dword [esp + 0x410]
xor ecx, esp
call fcn.0046d6fd
add esp, 0x414
ret
lea edx, [esp + 8]
push edx
push 0
push str.ExperienceValue
push str.UserExperience
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [esp + 0x418]
pop esi
pop ebx
xor ecx, esp
call fcn.0046d6fd
add esp, 0x414
ret

Function at 0x460970
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x424
mov eax, dword [0x4f8028]
xor eax, esp
mov dword [esp + 0x420], eax
push esi
push 0x206
lea eax, [esp + 0x222]
push 0
push eax
mov esi, 1
mov word [esp + 0x228], 0
call sub.ntdll.dll_memset
push 0x206
lea ecx, [esp + 0x26]
push 0
push ecx
mov word [esp + 0x2c], 0
call sub.ntdll.dll_memset
add esp, 0x18
test edi, edi
jne 0x460a1a
push ebx
lea ebx, [esp + 0x220]
call fcn.00460720
mov esi, eax
test esi, esi
pop ebx
jne 0x460a00
push 0x15d
call fcn.0045fca0
add esp, 4
mov eax, esi
pop esi
mov ecx, dword [esp + 0x420]
xor ecx, esp
call fcn.0046d6fd
add esp, 0x424
ret
lea edx, [esp + 0x21c]
push edx
lea eax, [esp + 0x18]
push str._sOther.ini
push eax
call dword [sym.imp.MSVCR80.dll__swprintf]
jmp 0x460a2b
push edi
lea ecx, [esp + 0x18]
push 0x104
push ecx
call dword [sym.imp.MSVCR80.dll_wcscpy_s]
add esp, 0xc
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x460a80
xor eax, eax
mov dword [esp + 6], eax
mov dword [esp + 0xa], eax
mov dword [esp + 0xe], eax
mov word [esp + 0x12], ax
lea eax, [esp + 0x14]
push eax
push 8
lea ecx, [esp + 0xc]
push ecx
push 0
mov word [esp + 0x14], 0
call dword [sym.imp.MSVCR80.dll__itow]
add esp, 0xc
push eax
push str.ExperienceValue
push str.UserExperience
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ecx, dword [esp + 0x424]
mov eax, esi
pop esi
xor ecx, esp
call fcn.0046d6fd
add esp, 0x424
ret
Function at 0x462620
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push edi
push ebx
push ebp
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x462637
pop edi
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x462668
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, esi
and edi, 0xf
jbe 0x462664
cmp esi, eax
jae 0x462668
sub edi, 1
movzx ecx, word [esi]
lea esi, [esi + ecx*2 + 2]
jne 0x462654
cmp esi, eax
jb 0x46266e
pop esi
pop edi
xor eax, eax
pop ebp
ret
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebp
ret

Function at 0x4629e0
Capabilities:
Access peb ldr_data
Initialize winhttp library

Disassembly:
push 0xffffffffffffffff
push 0x47288b
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x4f8028]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, dword [esp + 0x20]
xor ebx, ebx
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov eax, dword [0x4fbd60]
mov edx, dword [eax + 0xc]
mov ecx, 0x4fbd60
call edx
add eax, 0x10
mov dword [esi + 0x14], eax
mov dword [esp + 0x18], ebx
call fcn.00465520
mov dword [esi + 0x1c], eax
mov byte [eax + 0x19], 1
mov eax, dword [esi + 0x1c]
mov dword [eax + 4], eax
mov eax, dword [esi + 0x1c]
mov dword [eax], eax
mov eax, dword [esi + 0x1c]
mov dword [eax + 8], eax
mov dword [esi + 0x20], ebx
push ebx
mov byte [esi + 0x24], bl
mov dword [esi + 0x28], ebx
push ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
push ebx
xor eax, eax
push ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x10], eax
push str.Aomei_Backupper_for_Windows
mov dword [esi + 0xc], 8
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov edi, dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
push 4
lea ecx, [esp + 0x24]
push ecx
push 3
mov ebx, 0x36ee80
push eax
mov dword [esi], eax
mov dword [esp + 0x30], ebx
call edi
mov eax, dword [esi]
push 4
lea edx, [esp + 0x24]
push edx
push 5
push eax
mov dword [esp + 0x30], ebx
call edi
mov edx, dword [esi]
push 4
lea ecx, [esp + 0x24]
push ecx
push 6
push edx
mov dword [esp + 0x30], ebx
call edi
mov ecx, dword [esi]
push 4
lea eax, [esp + 0x24]
push eax
push 6
push ecx
mov dword [esp + 0x30], ebx
call edi
push 4
lea edx, [esp + 0x24]
push edx
mov dword [esp + 0x28], 2
push 4
mov eax, dword [esi]
push eax
call edi
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 4
Function at 0x462bc0
Capabilities:
Prepare http request

Disassembly:
push 0xffffffffffffffff
push 0x472858
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x4f8028]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 8]
mov edi, dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
xor ebx, ebx
cmp eax, ebx
je 0x462bfd
push eax
call edi
mov dword [esi + 8], ebx
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x462c0a
push eax
call edi
mov dword [esi + 4], ebx
cmp dword [esi], ebx
je 0x462c66
mov eax, dword [0x4fbd60]
mov edx, dword [eax + 0xc]
mov ecx, 0x4fbd60
call edx
add eax, 0x10
mov dword [esp + 0x10], eax
mov eax, dword [0x4fbd60]
mov edx, dword [eax + 0xc]
mov ecx, 0x4fbd60
mov byte [esp + 0x14], bl
call edx
add eax, 0x10
mov dword [esp + 0x18], eax
mov word [esp + 0x1c], bx
mov dword [esp + 0x20], ebx
mov eax, dword [esp + 0x34]
push eax
lea eax, [esp + 0x14]
mov dword [esp + 0x30], ebx
call fcn.00462840
test al, al
jne 0x462c7d
lea esi, [esp + 0x10]
call fcn.00462cf0
xor al, al
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x20
ret 4
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov eax, dword [esi]
push ebx
push ecx
push edx
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpConnect]
cmp eax, ebx
mov dword [esi + 4], eax
je 0x462c5d
xor ecx, ecx
cmp byte [esp + 0x14], bl
je 0x462ca5
mov ecx, 0x800000
push ecx
mov ecx, dword [esp + 0x24]
push ebx
push ebx
push ebx
push ecx
push str.POST
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
cmp eax, ebx
mov dword [esi + 8], eax
lea esi, [esp + 0x10]
je 0x462c61
call fcn.00462cf0
mov al, 1
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x20
ret 4

Function at 0x462d30
Capabilities:
Set http header

Disassembly:
push 0xffffffffffffffff
push 0x471d48
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4f8028]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 8], 0
jne 0x462d73
xor al, al
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 8
mov eax, dword [0x4fbd60]
mov edx, dword [eax + 0xc]
mov ecx, 0x4fbd60
call edx
add eax, 0x10
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
push eax
push ecx
push str._s:__s
lea edi, [esp + 0x1c]
mov dword [esp + 0x28], 0
call fcn.00465680
mov esi, dword [esp + 0x1c]
mov edx, dword [ebx + 8]
add esp, 0xc
push 0xa0000000
push 0xffffffffffffffff
push esi
push edx
call dword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
test eax, eax
lea eax, [esi - 0x10]
setne bl
mov dword [esp + 0x1c], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x462deb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov al, bl
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 8