joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45cbd0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push 4
lea eax, [ebp - 4]
push eax
push 4
push str.FirstHideBox
push str.SoftwareBaofengStormPlayerUserConfig
push SysReAllocString
mov dword [ebp - 4], 0
call edi
mov esi, eax
cmp esi, 5
jne 0x45cc49
push SysReAllocString
mov ecx, str.SoftwareBaofengStormPlayerUserConfig
mov dword [ebp - 8], vtable.CAccessPermission.0
call fcn.0045d030
test eax, eax
je 0x45cc49
push 4
lea ecx, [ebp - 4]
push ecx
push 4
push str.FirstHideBox
push str.SoftwareBaofengStormPlayerUserConfig
push SysReAllocString
call edi
push SysReAllocString
mov ecx, str.SoftwareBaofengStormPlayerUserConfig
mov esi, eax
call fcn.0045d110
test esi, esi
pop edi
sete al
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x45cc60
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
push 4
lea eax, [ebp + 8]
push eax
push 4
push ebx
push esi
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov edi, eax
cmp edi, 5
jne 0x45ccbd
push SysReAllocString
mov ecx, esi
mov dword [ebp - 4], vtable.CAccessPermission.0
call fcn.0045d030
test eax, eax
je 0x45ccbd
push 4
lea ecx, [ebp + 8]
push ecx
push 4
push ebx
push esi
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push SysReAllocString
mov ecx, esi
mov edi, eax
call fcn.0045d110
test edi, edi
sete al
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x45ccd0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0xc]
mov eax, esi
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x45cce0
mov ecx, dword [ebp + 8]
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push esi
push 1
push ecx
push edi
push ebx
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov esi, eax
cmp esi, 5
jne 0x45cd52
push ebx
mov ecx, edi
mov dword [ebp - 4], vtable.CAccessPermission.0
call fcn.0045d030
test eax, eax
je 0x45cd52
mov esi, dword [ebp + 0xc]
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x45cd25
sub eax, edx
sar eax, 1
lea edx, [eax + eax + 2]
mov eax, dword [ebp + 8]
push edx
push esi
push 1
push eax
push edi
push ebx
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push ebx
mov ecx, edi
mov esi, eax
call fcn.0045d110
test esi, esi
sete al
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x45cde0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x54b2c0]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x114], 6
jne 0x45ce20
mov eax, 1
cmp dword [ebp - 0x110], eax
je 0x45ce22
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e0040
mov esp, ebp
pop ebp
ret
Function at 0x45d030
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa1c
mov eax, dword [0x54b2c0]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push esi
add eax, 0x80000000
push edi
mov edi, ecx
cmp eax, 3
ja case.default.0x45d058
jmp dword [eax*4 + 0x45d0f4]
mov esi, str.CLASSES_ROOT
jmp 0x45d079
mov esi, str.CURRENT_USER
jmp 0x45d079
mov esi, str.MACHINE
jmp 0x45d079
mov esi, str.USERS
lea eax, [ebp - 0xa18]
push eax
lea ecx, [ebp - 0x214]
push ecx
mov dword [ebp - 0xa18], 0x202
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
push edi
push esi
push str._s_s
lea edx, [ebp - 0xa14]
push 0x800
push edx
call fcn.004e2d95
add esp, 0x14
push 0xf003f
lea eax, [ebp - 0x214]
push eax
push 2
lea edi, [ebp - 0xa14]
call fcn.0045cf30
pop edi
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004e0040
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 8]
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.004e0040
mov esp, ebp
pop ebp
ret 4

Function at 0x45d110
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa1c
mov eax, dword [0x54b2c0]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push esi
add eax, 0x80000000
push edi
mov edi, ecx
cmp eax, 3
ja case.default.0x45d138
jmp dword [eax*4 + 0x45d1d0]
mov esi, str.CLASSES_ROOT
jmp 0x45d159
mov esi, str.CURRENT_USER
jmp 0x45d159
mov esi, str.MACHINE
jmp 0x45d159
mov esi, str.USERS
lea eax, [ebp - 0xa18]
push eax
lea ecx, [ebp - 0x214]
push ecx
mov dword [ebp - 0xa18], 0x202
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
push edi
push esi
push str._s_s
lea edx, [ebp - 0xa14]
push 0x800
push edx
call fcn.004e2d95
add esp, 0x14
push 2
lea eax, [ebp - 0x214]
push eax
push 3
lea edi, [ebp - 0xa14]
call fcn.0045cf30
pop edi
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004e0040
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 8]
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.004e0040
mov esp, ebp
pop ebp
ret 4
Function at 0x45d1e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x503ffc
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x54b2c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 4], eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov byte [ebp - 4], 4
mov eax, dword [0x54af18]
mov edx, dword [eax + 0xc]
mov ecx, 0x54af18
lea edi, [esi + 0x44]
call edx
add eax, 0x10
mov dword [edi], eax
lea eax, [ebp + 0xc]
mov byte [ebp - 4], 5
call fcn.0045ca50
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x45d27c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x45d360
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x506cb0
mov eax, dword fs:[0]
push eax
sub esp, 0x208
mov eax, dword [0x54b2c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x214], 0
mov dword [ebp - 4], 1
mov eax, dword [esi + 0x44]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
push eax
push 0xff
lea eax, [ebp - 0x210]
push eax
push 0x51517c
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push edi
lea ecx, [ebp - 0x210]
mov dword [esi + 0x40], eax
call fcn.00459530
mov byte [ebp - 4], 0
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x45d3f1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x45d417
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e0040
mov esp, ebp
pop ebp
ret 8
Function at 0x45fde0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50224b
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x54b2c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, 4
mov dword [ebp - 0x234], eax
mov dword [ebp - 0x230], eax
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x22c]
push ecx
lea edx, [ebp - 0x230]
push edx
push str.OutputTimeFile
push str.SoftwareBaofengInstallOption
push SysReAllocString
mov dword [ebp - 0x22c], 0
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x45fe61
cmp dword [ebp - 0x22c], eax
setne al
jmp 0x45fe63
xor al, al
mov byte [0x54d072], al
test al, al
je 0x45ff80
mov eax, dword [0x553cbc]
test eax, eax
je 0x45fe82
push eax
call fcn.004e0de2
add esp, 4
lea eax, [ebp - 0x228]
push eax
mov dword [0x553cbc], 0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov edx, dword [0x54af18]
mov eax, dword [edx + 0xc]
mov ecx, 0x54af18
call eax
add eax, 0x10
mov dword [ebp - 0x22c], eax
mov dword [ebp - 4], 0
movzx ecx, word [ebp - 0x21c]
movzx edx, word [ebp - 0x21e]
movzx eax, word [ebp - 0x220]
push ecx
movzx ecx, word [ebp - 0x222]
push edx
movzx edx, word [ebp - 0x226]
push eax
movzx eax, word [ebp - 0x228]
push ecx
push edx
push eax
push str...Time_04d_02d_02d__02d_02d_02d.txt
lea edi, [ebp - 0x22c]
call fcn.00458f90
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x216]
push edx
mov word [ebp - 0x218], cx
call fcn.004e4be0
mov ecx, dword [0x553cc0]
add esp, 0x28
push 0x104
lea eax, [ebp - 0x218]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov esi, dword [ebp - 0x22c]
push esi
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push str.wt__ccsUTF_8
push eax
call fcn.004e0d17
mov dword [0x553cbc], eax
lea eax, [esi - 0x10]
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x45ff80
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e0040
mov esp, ebp
pop ebp
ret
Function at 0x4602f0
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x54b2c0]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x18]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x460325
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e0040
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x10]
push ecx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov eax, dword [ebp - 0x18]
push 0
push 0
push 0
lea edx, [ebp - 0x14]
push edx
push 0
push eax
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 4]
neg eax
sbb eax, eax
xor ecx, ebp
inc eax
call fcn.004e0040
mov esp, ebp
pop ebp
ret
Function at 0x468860
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [esi + 0x94], 0
je 0x4688ca
cmp dword [esi + 0x98], 0
jbe 0x4688ca
cmp dword [eax + 0x14], 8
mov dword [ebp - 4], 0
jb 0x468885
mov eax, dword [eax]
push 0x51936c
push eax
lea eax, [ebp - 4]
push eax
call fcn.004e0d2e
add esp, 0xc
test eax, eax
jne 0x4688ca
mov eax, dword [ebp - 4]
test eax, eax
je 0x4688ca
mov ecx, dword [esi + 0x98]
mov edx, dword [esi + 0x94]
push eax
push 1
push ecx
push edx
call fcn.004e3b98
mov eax, dword [ebp - 4]
push eax
call fcn.004e0de2
add esp, 0x14
mov al, 1
mov esp, ebp
pop ebp
ret
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x468930
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x505149
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x54b2c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [esi], vtable.CSkinApplication.0
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov eax, 1
mov dword [esi + 0x10], eax
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 4], ebx
mov dword [esi + 0x20], ebx
mov dword [ebp - 4], ebx
mov dword [esi], vtable.CB5_InstallApp.0
mov dword [esi + 0x24], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov byte [ebp - 4], al
mov eax, dword [0x54af18]
mov edx, dword [eax + 0xc]
mov ecx, 0x54af18
lea edi, [esi + 0x48]
call edx
add eax, 0x10
mov dword [edi], eax
lea eax, [esi + 0x54]
push 0x1388
push eax
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
mov byte [ebp - 4], 3
mov dword [esi + 0x6c], vtable.CHighResolutionTimer.0
mov dword [esi + 0x74], ebx
mov dword [esi + 0x78], ebx
mov dword [esi + 0x7c], ebx
mov byte [ebp - 4], 4
mov eax, dword [0x54af18]
mov edx, dword [eax + 0xc]
mov ecx, 0x54af18
call edx
add eax, 0x10
mov dword [esi + 0x80], eax
mov byte [ebp - 4], 5
mov dword [esi + 0x88], vtable.CHighResolutionTimer.0
mov dword [esi + 0x90], ebx
mov dword [esi + 0x94], ebx
mov dword [esi + 0x98], ebx
lea eax, [esi + 0xa0]
push 0x1388
push eax
mov byte [ebp - 4], 6
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
mov byte [ebp - 4], 7
mov eax, dword [0x54af18]
mov edx, dword [eax + 0xc]
mov ecx, 0x54af18
call edx
lea ecx, [eax + 0x10]
lea eax, [esi + 0xbc]
mov dword [eax], ecx
mov byte [ebp - 4], 8
mov dword [esi + 0xc4], vtable.CSHManage.0
mov byte [ebp - 4], 9
push 0x51517c
push eax
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0xb8], ebx
mov dword [esi + 0x44], ebx
call fcn.00459440
push 0x51517c
push edi
call fcn.00459440
xor eax, eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0xc8], eax
mov byte [esi + 0x28], al
push 0x51517c
lea eax, [esi + 0x80]
push eax
call fcn.00459440
xor eax, eax
mov dword [esi + 0x84], eax
mov dword [esi + 0xc0], eax
mov dword [esi + 0x9c], eax
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x468b00
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x505149
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x54b2c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [esi], vtable.CB5_InstallApp.0
mov dword [ebp - 4], 9
mov eax, dword [esi + 0xb8]
mov edi, dword [sym.imp.KERNEL32.dll_TerminateThread]
push 1
push eax
call edi
mov ecx, dword [esi + 0xc0]
push 1
push ecx
call edi
mov eax, dword [esi + 0x4c]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
cmp eax, ebx
je 0x468b66
push eax
call edi
mov dword [esi + 0x4c], ebx
mov eax, dword [esi + 0x84]
cmp eax, ebx
je 0x468b79
push eax
call edi
mov dword [esi + 0x84], ebx
mov eax, dword [esi + 0xc0]
cmp eax, ebx
je 0x468b8c
push eax
call edi
mov dword [esi + 0xc0], ebx
mov eax, dword [esi + 0xb8]
cmp eax, ebx
je 0x468b9f
push eax
call edi
mov dword [esi + 0xb8], ebx
mov ecx, dword [esi + 0xc8]
cmp ecx, ebx
je 0x468bb7
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov dword [esi + 0xc8], ebx
mov byte [ebp - 4], 8
mov dword [esi + 0xc4], vtable.CSHManage.0
mov byte [ebp - 4], 7
mov eax, dword [esi + 0xbc]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x468beb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esi + 0xa0]
mov byte [ebp - 4], 6
mov edi, dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push ecx
call edi
mov byte [ebp - 4], 5
mov eax, dword [esi + 0x90]
mov dword [esi + 0x88], vtable.CHighResolutionTimer.0
cmp eax, ebx
je 0x468c23
push eax
call dword [sym.imp.WINMM.dll_timeKillEvent]
mov dword [esi + 0x90], ebx
mov byte [ebp - 4], 4
mov eax, dword [esi + 0x80]
sub eax, 0x10
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x468c49
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 3
mov eax, dword [esi + 0x74]
mov dword [esi + 0x6c], vtable.CHighResolutionTimer.0
cmp eax, ebx
je 0x468c65
push eax
call dword [sym.imp.WINMM.dll_timeKillEvent]
mov dword [esi + 0x74], ebx
lea ecx, [esi + 0x54]
push ecx
mov byte [ebp - 4], 2
call edi
mov byte [ebp - 4], 1
mov eax, dword [esi + 0x48]
sub eax, 0x10
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x468c92
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], bl
mov edi, dword [esi + 0x2c]
cmp edi, ebx
je 0x468cbe
mov eax, dword [esi + 0x30]
cmp eax, ebx
jbe 0x468cb2
mov ebx, eax
mov eax, edi
call fcn.00469bf0
add edi, 0x2c
dec ebx
jne 0x468ca5
mov ecx, dword [esi + 0x2c]
push ecx
call fcn.004e0561
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov dword [esi], vtable.CSkinApplication.0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4691f0
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x506bdb
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x54b2c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x216]
push ecx
mov word [ebp - 0x218], ax
call fcn.004e4be0
add esp, 0xc
lea edx, [ebp - 0x218]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x218]
call fcn.00459530
push 0x19
push str.BaoFengDefaultBdSetup.xml
lea ebx, [ebp - 0x21c]
mov dword [ebp - 4], 0
call fcn.0045af80
mov eax, dword [0x553cc0]
mov edi, dword [ebp - 0x21c]
push str.RESOURCE_DATA
push 0x8f
push eax
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x4692a5
push edi
mov ecx, ebx
call fcn.00458760
add esp, 4
lea edi, [esi + 0x48]
lea eax, [ebp - 0x21c]
call fcn.0045ca50
mov ecx, dword [ebp - 0x21c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4692f4
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov eax, dword [ebp - 0x21c]
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x220], esp
mov edi, esp
call fcn.0045cb40
add eax, 0x10
push esi
mov dword [edi], eax
call fcn.00469340
call dword [sym.imp.ole32.dll_CoUninitialize]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x21c]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x46931d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e0040
mov esp, ebp
pop ebp
ret
Function at 0x46d2b0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x55555556
imul dword [ebp + 0x10]
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [eax*4]
sub ecx, eax
neg ecx
add ecx, ecx
lea edx, [ecx + ecx]
mov ecx, 0xc
sub ecx, edx
mov eax, 0x55555556
imul ecx
push ebx
mov eax, edx
push esi
shr eax, 0x1f
lea eax, [edx + eax + 1]
push edi
mov edi, dword [ebp + 0xc]
push eax
xor esi, esi
mov dword [ebp + 0xc], eax
call fcn.004dff58
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x46d30a
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
mov ecx, dword [ebp + 0xc]
push ecx
push 0
push ebx
call fcn.004e4be0
mov ecx, dword [ebp + 0x10]
add esp, 0xc
cmp ecx, 2
jle 0x46d3a4
lea edx, [ecx - 3]
mov eax, 0xaaaaaaab
mul edx
shr edx, 1
inc edx
lea eax, [edx*4]
sub eax, edx
neg eax
add ecx, eax
mov dword [ebp + 0x10], ecx
movzx ecx, byte [edi]
shr ecx, 2
movzx eax, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebx + esi], al
movzx ecx, byte [edi]
movzx eax, byte [edi + 1]
and ecx, 3
add ecx, ecx
shr eax, 4
mov cl, byte [eax + ecx*8 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebx + esi + 1], cl
movzx eax, byte [edi + 1]
movzx ecx, byte [edi + 2]
shr ecx, 6
and eax, 0xf
movzx eax, byte [ecx + eax*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebx + esi + 2], al
movzx ecx, byte [edi + 2]
and ecx, 0x3f
movzx eax, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebx + esi + 3], al
add esi, 4
add edi, 3
dec edx
jne 0x46d342
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x46d41a
movzx edx, byte [edi]
shr edx, 2
mov al, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebx + esi], al
cmp ecx, 1
jle 0x46d3fd
movzx ecx, byte [edi]
movzx edx, byte [edi + 1]
and ecx, 3
add ecx, ecx
shr edx, 4
mov al, byte [edx + ecx*8 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebx + esi + 1], al
movzx ecx, byte [edi + 1]
and ecx, 0xf
mov dl, byte [ecx*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebx + esi + 2], dl
mov byte [ebx + esi + 3], 0x3d
add esi, 4
pop edi
mov byte [ebx + esi], 0
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 0xc
movzx eax, byte [edi]
and eax, 3
shl eax, 4
mov cl, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebx + esi + 1], cl
mov word [ebx + esi + 2], 0x3d3d
add esi, 4
pop edi
mov byte [ebx + esi], 0
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 0xc
Function at 0x4705d0
Capabilities:
Get common file path
Get program files directory
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5067fb
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x54b2c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 0x230], 0
mov dword [ebp - 0x220], ebx
je 0x47078f
lea eax, [ebp - 0x21c]
push eax
mov ecx, 0x51517c
call fcn.00459530
mov dword [ebp - 4], 0
mov esi, dword [0x553cc8]
call fcn.0046a3c0
cmp dword [eax + 0x14], 0
push 0x206
push 0
je 0x4706d2
lea edx, [ebp - 0x216]
xor ecx, ecx
push edx
mov word [ebp - 0x218], cx
call fcn.004e4be0
add esp, 0xc
lea eax, [ebp - 0x224]
push eax
lea ecx, [ebp - 0x218]
push ecx
lea edx, [ebp - 0x220]
push edx
push 0x51517c
push str.SoftwareMicrosoftWindowsCurrentVersionApp_PathsStormPlayer.exe
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x224], 0x102
mov dword [ebp - 0x220], 1
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x47074f
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea edx, [ebp - 0x218]
lea edi, [ebp - 0x21c]
call fcn.004594f0
jmp 0x47074f
lea eax, [ebp - 0x216]
xor edx, edx
push eax
mov word [ebp - 0x218], dx
call fcn.004e4be0
add esp, 0xc
push 1
push 0x26
lea ecx, [ebp - 0x218]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea eax, [ebp - 0x218]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x470713
sub eax, edx
lea ecx, [ebp - 0x218]
sar eax, 1
push ecx
lea edx, [ebp - 0x21c]
push edx
mov ebx, eax
call fcn.00459440
push 0x14
push 0x519af8
lea ebx, [ebp - 0x21c]
call fcn.0045af80
mov ebx, dword [ebp - 0x220]
mov eax, dword [ebx + 0x230]
mov ecx, dword [ebp - 0x21c]
mov edx, dword [eax + 0x78]
push ecx
push edx
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x21c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x47078f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e0040
mov esp, ebp
pop ebp
ret