joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412860
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54e2b5
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x5aa464]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [ebp - 0x2c]
push eax
call fcn.00412970
mov ebx, eax
lea esi, [edi + 0x28]
cmp esi, ebx
je 0x4128d6
mov eax, dword [esi + 0x14]
cmp eax, 8
jb 0x4128af
inc eax
mov ecx, esi
push eax
push dword [esi]
call fcn.00406e80
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x4128c7
mov eax, dword [esi]
jmp 0x4128c9
mov eax, esi
xor ecx, ecx
mov word [eax], cx
mov ecx, esi
push ebx
call fcn.004096a0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x18]
cmp eax, 8
jb 0x4128f2
inc eax
lea ecx, [ebp - 0x2c]
push eax
push dword [ebp - 0x2c]
call fcn.00406e80
push 0x50
call fcn.00509486
mov esi, eax
mov dword [ebp - 0x10], esi
push 0x50
push 0
push esi
mov dword [ebp - 4], 1
call fcn.004b4650
sub esp, 0x18
mov ecx, 0x413ce0
mov eax, esp
mov dword [eax + 0x24], 0
test ecx, ecx
je 0x412934
mov dword [eax], vtable.std::_Func_impl_unsigned_long_int____stdcall___void____class_std::allocator_int___unsigned_long_int__void__.0
mov dword [eax + 4], 0x413ce0
mov dword [eax + 0x24], eax
push str.UnInstaller
push edi
mov ecx, esi
call fcn.0044e230
mov dword [edi + 0x74], eax
mov eax, dword [eax + 4]
test eax, eax
je 0x412952
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x414e50
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54d956
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x5aa464]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.00509486
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.004f4d9d
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x415c00
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54e63e
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push esi
push edi
mov eax, dword [0x5aa464]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea edi, [esi + 0x10]
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
mov ecx, dword [esi + 0x64]
test ecx, ecx
je 0x415c4c
mov eax, dword [ecx]
lea edx, [ebp - 0x38]
push edx
call dword [eax]
mov dword [ebp - 0x14], eax
push edi
lea ecx, [ebp - 0x38]
call fcn.00415f30
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x415c74
mov edx, dword [ecx]
lea eax, [ebp - 0x38]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov eax, dword [esi + 0x9c]
test eax, eax
je 0x415c85
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4164b0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x5aa464]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0
push 2
mov dword [ebp - 0x238], ecx
mov dword [ebp - 0x234], 0
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
mov dword [ebp - 0x230], 0x22c
lea eax, [ebp - 0x230]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x41650b
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00509444
mov esp, ebp
pop ebp
ret
push edi
mov edi, dword [sym.imp.KERNEL32.dll_Process32NextW]
lea eax, [ebp - 0x230]
push eax
push esi
mov dword [ebp - 0x230], 0x22c
call edi
test eax, eax
je 0x41656b
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpW]
push dword [ebp - 0x238]
lea eax, [ebp - 0x20c]
push eax
call ebx
test eax, eax
je 0x41655e
lea eax, [ebp - 0x230]
mov dword [ebp - 0x230], 0x22c
push eax
push esi
call edi
test eax, eax
jne 0x416531
jmp 0x41656a
mov eax, dword [ebp - 0x228]
mov dword [ebp - 0x234], eax
pop ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x234]
xor ecx, ebp
pop edi
pop esi
call fcn.00509444
mov esp, ebp
pop ebp
ret
Function at 0x418420
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54eb25
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x5aa464]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [ebp - 0x2c]
push eax
call fcn.00418580
mov ebx, eax
lea esi, [edi + 0x58]
cmp esi, ebx
je 0x418496
mov eax, dword [esi + 0x14]
cmp eax, 8
jb 0x41846f
inc eax
mov ecx, esi
push eax
push dword [esi]
call fcn.00406e80
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x418487
mov eax, dword [esi]
jmp 0x418489
mov eax, esi
xor ecx, ecx
mov word [eax], cx
mov ecx, esi
push ebx
call fcn.004096a0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x18]
cmp eax, 8
jb 0x4184b2
inc eax
lea ecx, [ebp - 0x2c]
push eax
push dword [ebp - 0x2c]
call fcn.00406e80
mov esi, dword [edi + 0x7c]
test esi, esi
je 0x4184fe
cmp dword [esi + 4], 0
je 0x4184e5
mov eax, dword [esi + 4]
test eax, eax
je 0x4184e5
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], 0
mov dword [esi], 0xffffffff
mov esi, dword [edi + 0x7c]
test esi, esi
je 0x4184fe
mov ecx, esi
call fcn.0044e480
push 0x50
push esi
call fcn.00509478
add esp, 8
push 0x50
call fcn.00509486
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
push 0x50
push 0
push esi
mov dword [ebp - 4], 1
call fcn.004b4650
sub esp, 0x1c
mov ecx, 0x41a090
mov eax, esp
mov dword [eax + 0x24], 0
test ecx, ecx
je 0x418543
mov dword [eax], vtable.std::_Func_impl_unsigned_long_int____cdecl___void____class_std::allocator_int___unsigned_long_int__void__.0
mov dword [eax + 4], 0x41a090
mov dword [eax + 0x24], eax
push str.ABDEF
push edi
mov ecx, esi
call fcn.0044e230
mov dword [edi + 0x7c], eax
mov eax, dword [eax + 4]
test eax, eax
je 0x418561
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41b740
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54ee18
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5aa464]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x41b791
mov eax, dword [esi]
jmp 0x41b793
mov eax, esi
mov edx, dword [ebp + 8]
xor ecx, ecx
mov word [eax], cx
cmp word [edx], cx
je 0x41b7b4
mov ecx, edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41b7a5
sub ecx, edi
sar ecx, 1
push ecx
push edx
mov ecx, esi
call fcn.00406720
mov edi, dword [ebp + 0xc]
xor eax, eax
mov dword [ebp - 4], 0
mov dword [esi + 0x2c], 7
mov dword [esi + 0x28], 0
mov word [esi + 0x18], ax
cmp word [edi], ax
jne 0x41b7e4
xor ecx, ecx
jmp 0x41b7ff
mov ecx, edi
lea ebx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41b7f0
sub ecx, ebx
sar ecx, 1
push ecx
push edi
lea ecx, [esi + 0x18]
call fcn.00406720
mov eax, dword [ebp + 0x14]
movsd xmm0, qword [0x5926c0]
mov dword [esi + 0x30], eax
xor eax, eax
mov dword [esi + 0x38], 0x40a300
movsd qword [esi + 0x40], xmm0
mov dword [esi + 0x48], 0xffffffff
mov dword [esi + 0x4c], 0xffffffff
mov dword [esi + 0x50], 0
mov dword [esi + 0x54], 0
mov byte [esi + 0x58], 0
mov dword [esi + 0x70], 7
mov dword [esi + 0x6c], 0
mov word [esi + 0x5c], ax
mov dword [esi + 0x84], eax
mov dword [esi + 0x88], 0xf
mov byte [esi + 0x74], al
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x422710
Capabilities:
Check if file exists
Get common file path
Get program files directory
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54fbbd
mov eax, dword fs:[0]
push eax
sub esp, 0x230
mov eax, dword [0x5aa464]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x218]
push 0x208
mov dword [ebp - 4], 0
push 0
push eax
mov dword [ebp - 0x23c], esi
mov dword [ebp - 0x234], 0
call fcn.004b4650
mov dword [esi + 0x10], 0
lea ecx, [edi + 0x758]
mov dword [esi + 0x14], 0
add esp, 0xc
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x42279c
mov eax, dword [esi]
jmp 0x42279e
mov eax, esi
xor edx, edx
push 0xffffffffffffffff
push edx
push ecx
mov ecx, esi
mov word [eax], dx
call fcn.00406820
xor eax, eax
mov dword [ebp - 0x234], 1
mov byte [edi + 0x7b9], 1
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], 0
mov word [ebp - 0x230], ax
lea ecx, [ebp - 0x230]
mov dword [ebp - 4], 1
call fcn.0044f470
cmp dword [ebp - 0x21c], 8
lea ecx, [ebp - 0x230]
cmovae ecx, dword [ebp - 0x230]
call fcn.0044f360
test eax, eax
mov dword [ebp - 0x238], eax
mov byte [edi + 0x7ba], 1
setne al
mov byte [edi + 0x7b9], al
call fcn.0044f2e0
mov ebx, eax
test ebx, ebx
setne al
mov byte [edi + 0x7ba], al
cmp dword [edi + 0x768], 0
je 0x42285a
cmp dword [edi + 0x754], 8
lea eax, [edi + 0x740]
jb 0x42284b
mov eax, dword [eax]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x42291f
cmp dword [ebp - 0x238], 0
je 0x4228a2
test ebx, ebx
je 0x4228a2
push 0x104
lea eax, [ebp - 0x218]
push eax
push str.APPDATA
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
lea eax, [ebp - 0x218]
push 0
je 0x4228aa
push str.fengsu
push eax
push 0
push 0x104
push eax
call fcn.00530e08
add esp, 0x18
jmp 0x4228c9
push 0
lea eax, [ebp - 0x218]
mov edi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x2a
push eax
push 0
call edi
test eax, eax
jne 0x4228c9
push eax
push 0x26
lea eax, [ebp - 0x218]
push eax
push 0
call edi
push 0x58d674
push str.MattingAssistant
lea eax, [ebp - 0x218]
push eax
push 0
push 0x104
push eax
call fcn.00530e08
add esp, 0x18
cmp word [ebp - 0x218], 0
jne 0x4228f8
xor ecx, ecx
jmp 0x422910
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x422901
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.00406720
mov ecx, dword [ebp - 0x21c]
cmp ecx, 8
jb 0x42293d
inc ecx
push ecx
push dword [ebp - 0x230]
lea ecx, [ebp - 0x230]
call fcn.00406e80
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00509444
mov esp, ebp
pop ebp
ret 4
Function at 0x422ac0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x5aa464]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x234]
push 0x208
push 0
push eax
mov esi, ecx
call fcn.004b4650
add esi, 0x758
add esp, 0xc
cmp dword [esi + 0x14], 8
jb 0x422afe
mov esi, dword [esi]
push 0x10
push edi
push 0x10
push esi
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRelativePathToW]
mov ecx, 0x58e278
lea eax, [ebp - 0x234]
nop dword [eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x422b46
test dx, dx
je 0x422b42
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x422b46
add eax, 4
add ecx, 4
test dx, dx
jne 0x422b20
xor eax, eax
jmp 0x422b4b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x422bff
push eax
push str.set.ini
push edi
push eax
lea esi, [eax + 1]
lea eax, [ebp - 0x234]
push 0x104
push eax
call fcn.00530e08
add esp, 0x18
lea eax, [ebp - 0x234]
push eax
push 0x14
lea eax, [ebp - 0x2c]
push eax
push 0x58d76c
push str.IsOverride
push 0x58fb88
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ecx, 0x58e1f0
lea eax, [ebp - 0x2c]
nop dword [eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x422bdf
test dx, dx
je 0x422bc2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x422bdf
add eax, 4
add ecx, 4
test dx, dx
jne 0x422ba0
xor eax, eax
xor ecx, ecx
test eax, eax
pop edi
cmovne esi, ecx
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00509444
mov esp, ebp
pop ebp
ret 4
sbb eax, eax
xor ecx, ecx
or eax, 1
test eax, eax
pop edi
cmovne esi, ecx
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00509444
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.00509444
mov esp, ebp
pop ebp
ret 4

Function at 0x422da0
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x5aa464]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push 0x208
push 0
push eax
mov dword [ebp - 0x210], 0
call fcn.004b4650
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push str.APPDATA
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x422e04
push eax
push 0x2e
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0
push 0x58fba0
lea eax, [ebp - 0x20c]
push eax
push 0
push 0x104
push eax
call fcn.00530e08
push 0
push str.MattingAssistant
lea eax, [ebp - 0x20c]
push eax
push 0
push 0x104
push eax
call fcn.00530e08
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
add esp, 0x30
mov word [esi], ax
cmp word [ebp - 0x20c], ax
jne 0x422e5d
xor ecx, ecx
jmp 0x422e75
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x422e66
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00406720
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00509444
mov esp, ebp
pop ebp
ret 4
Function at 0x423400
Capabilities:
Check if file exists
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54fd68
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x5aa464]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0x73c], 8
lea esi, [edi + 0x728]
jb 0x423440
mov ebx, dword [esi]
jmp 0x423442
mov ebx, esi
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareHuDunSoftMattingAssistant
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x423496
mov ecx, ebx
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x423470
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
push ebx
push 1
push 0
push str.InstallPath
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [edi + 0x720], 0
jne 0x423507
xor eax, eax
mov dword [ebp - 0x18], 7
push 0xffffffffffffffff
push eax
push esi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], ax
call fcn.00406820
push 0xa
push str.uninst.ep
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0
call fcn.00406940
lea ecx, [edi + 0x710]
cmp ecx, eax
je 0x4234f2
push 0xffffffffffffffff
push 0
push eax
call fcn.00406820
mov eax, dword [ebp - 0x18]
cmp eax, 8
jb 0x423507
inc eax
lea ecx, [ebp - 0x2c]
push eax
push dword [ebp - 0x2c]
call fcn.00406e80
cmp dword [edi + 0x724], 8
lea esi, [edi + 0x710]
jb 0x42351a
mov eax, dword [esi]
jmp 0x42351c
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42353e
cmp dword [esi + 0x14], 8
jb 0x42352f
mov esi, dword [esi]
push esi
push ecx
push str.UnInstallEp
call fcn.004520e0
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00509444
mov esp, ebp
pop ebp
ret

Function at 0x423890
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x780]
test eax, eax
je 0x4238c8
cmp eax, 5
jbe 0x4238c8
cmp dword [edi + 0x784], 8
lea eax, [edi + 0x770]
jb 0x4238b4
mov eax, dword [eax]
push 3
push 0
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp dword [edi + 0x70c], 8
lea esi, [edi + 0x6f8]
jb 0x4238d9
mov esi, dword [esi]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x423906
mov ecx, edi
call fcn.004939a0
mov ecx, eax
call fcn.0044d000
push 1
push 0
push 0
push esi
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop edi
pop esi
ret
Function at 0x4279f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x5aa464]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x10], eax
mov eax, dword [edx + 0x14]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 0x1c], eax
push edi
mov edi, dword [edx + 0x10]
cmp eax, 0x10
jb 0x427a24
mov ebx, dword [edx]
jmp 0x427a26
mov ebx, edx
xor ecx, ecx
mov esi, 0x811c9dc5
test edi, edi
je 0x427a42
movzx eax, byte [ebx + ecx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edi
jb 0x427a31
mov ebx, dword [ebp - 0xc]
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0xc]
and eax, esi
mov ebx, dword [ebx + 4]
mov dword [ebp - 0xc], ebx
mov esi, dword [ecx + eax*8]
add eax, eax
mov edx, dword [ecx + eax*4]
inc eax
mov dword [ebp - 0x14], edx
lea eax, [ecx + eax*4]
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 8]
cmp dword [ebp - 0x14], ebx
jne 0x427a71
mov eax, ebx
jmp 0x427a75
mov eax, dword [eax]
mov eax, dword [eax]
cmp esi, eax
je 0x427b0d
cmp dword [edx + 0x14], 0x10
lea ecx, [esi + 8]
jb 0x427a88
mov edx, dword [edx]
cmp dword [ecx + 0x14], 0x10
lea ebx, [ecx + 0x10]
jb 0x427a93
mov ecx, dword [ecx]
mov ebx, dword [ebx]
mov eax, edi
cmp ebx, edi
cmovb eax, ebx
push eax
push edx
push ecx
call fcn.0040a4f0
add esp, 0xc
test eax, eax
jne 0x427ab1
cmp ebx, edi
jb 0x427ab1
jbe 0x427abb
mov esi, dword [esi]
mov ebx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
jmp 0x427a65
cmp dword [esi + 0x1c], 0x10
lea edx, [esi + 8]
lea ebx, [edx + 0x10]
jb 0x427ac9
mov edx, dword [edx]
cmp dword [ebp - 0x1c], 0x10
mov ecx, dword [ebp - 8]
jb 0x427ad4
mov ecx, dword [ecx]
mov ebx, dword [ebx]
cmp edi, ebx
mov eax, ebx
cmovb eax, edi
push eax
push edx
push ecx
call fcn.0040a4f0
add esp, 0xc
test eax, eax
jne 0x427af2
cmp edi, ebx
jb 0x427af2
jbe 0x427af5
mov esi, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00509444
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov dword [eax], ebx
xor ecx, ebp
pop ebx
call fcn.00509444
mov esp, ebp
pop ebp
ret 8
Function at 0x428720
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x5aa464]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
cmp dword [edi + 0x1c], 0x10
lea edx, [edi + 8]
mov ebx, dword [edx + 0x10]
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], eax
jb 0x42874d
mov edx, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
test ebx, ebx
je 0x428769
movzx eax, byte [edx + ecx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, ebx
jb 0x428758
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x18]
mov ecx, dword [edx + 0xc]
and eax, esi
lea esi, [eax*8]
add ecx, esi
cmp dword [ecx + 4], edi
jne 0x42879f
cmp dword [ecx], edi
jne 0x428797
mov eax, dword [edx + 4]
mov dword [ecx], eax
mov ecx, dword [edx + 0xc]
mov eax, dword [edx + 4]
mov dword [esi + ecx + 4], eax
jmp 0x4287a7
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x4287a7
cmp dword [ecx], edi
jne 0x4287aa
mov eax, dword [edi]
mov dword [ecx], eax
mov edi, dword [ebp + 0xc]
mov eax, dword [edi + 4]
mov esi, dword [edi]
mov dword [eax], esi
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
lea ecx, [edi + 8]
dec dword [edx + 8]
call fcn.004288f0
push edi
call fcn.005094c0
mov eax, dword [ebp - 0xc]
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
mov dword [eax], esi
pop esi
pop ebx
call fcn.00509444
mov esp, ebp
pop ebp
ret 8
Function at 0x42c3f0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x550960
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5aa464]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov dword [ecx], vtable.hudun::sensors::SensorsTrackerImpl.0
lea edx, [ecx + 0x1c]
mov dword [ecx + 0x18], 0xf
lea esi, [ecx + 0x4c]
mov dword [ecx + 0x14], 0
lea ebx, [ecx + 0x64]
mov byte [ecx + 4], 0
lea edi, [ecx + 0x7c]
mov dword [edx + 0x14], 0xf
mov dword [edx + 0x10], 0
mov byte [edx], 0
mov dword [ecx + 0x48], 0xf
mov dword [ecx + 0x44], 0
mov byte [ecx + 0x34], 0
mov ecx, dword [ebp + 8]
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov byte [esi], 0
mov dword [ebx + 0x14], 0xf
mov dword [ebx + 0x10], 0
mov byte [ebx], 0
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], 0
mov byte [edi], 0
call fcn.0042bbc0
mov ecx, dword [ebp + 8]
mov edx, esi
lea ecx, [ecx + 0x30]
call fcn.0042bbc0
mov esi, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
lea ecx, [esi + 0x18]
lea edx, [edx + 0x34]
call fcn.0042bbc0
lea ecx, [esi + 0x48]
mov edx, ebx
call fcn.0042bbc0
lea ecx, [esi + 0x60]
mov edx, edi
call fcn.0042bbc0
mov ebx, dword [ebp - 0x10]
lea ecx, [esi + 0xac]
mov eax, dword [esi + 0xa8]
lea edx, [ebx + 4]
mov dword [ebx + 0x9c], eax
call fcn.0042bbc0
push 0x330
mov dword [ebx + 0x94], 0
call fcn.00509486
add esp, 4
mov ecx, eax
call fcn.0042beb0
mov edx, dword [ebp + 8]
mov esi, eax
push ecx
mov ecx, esi
lea edx, [edx + 0x90]
call fcn.0042bde0
add esp, 4
mov dword [ebx + 0xa0], esi
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4