joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405120
Capabilities:
Get common file path
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x30fc
call fcn.0046cfb0
mov eax, dword [0x4c9070]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x104
lea eax, [ebp - 0x108]
mov edi, ecx
push 0
push eax
call fcn.0046ea70
push 0x104
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.0046ea70
add esp, 0x18
lea eax, [ebp - 0x108]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
movsx eax, byte [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push str.._c:
push eax
call fcn.00403ce0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0
push 0
push 3
push 0
push 3
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4051c4
pop edi
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046be2f
mov esp, ebp
pop ebp
ret
push ebx
push 0x2710
lea eax, [ebp - 0x30ec]
mov dword [ebp - 0x30fc], 0
push 0
push eax
xor bl, bl
call fcn.0046ea70
push 0x3e8
lea eax, [ebp - 0x9dc]
push 0
push eax
call fcn.0046ea70
push 0x3e8
lea eax, [ebp - 0x5f4]
push 0
push eax
call fcn.0046ea70
add esp, 0x24
mov dword [ebp - 0x30f0], 0
lea eax, [ebp - 0x30fc]
xorps xmm0, xmm0
movq qword [ebp - 0x30f8], xmm0
mov dword [ebp - 0x30f8], 0
push 0
push eax
push 0x2710
lea eax, [ebp - 0x30ec]
mov dword [ebp - 0x30f4], 0
push eax
push 0xc
lea eax, [ebp - 0x30f8]
push eax
push 0x2d1400
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x40526b
mov bl, 2
jmp 0x4052ef
mov edx, dword [ebp - 0x30dc]
lea eax, [ebp - 0x5f4]
push eax
push 0
lea ecx, [ebp - 0x30ec]
call fcn.00404cb0
mov edx, dword [ebp - 0x30d4]
lea eax, [ebp - 0x9dc]
push eax
push 1
lea ecx, [ebp - 0x30ec]
call fcn.00404cb0
lea ecx, [ebp - 0x5f4]
add esp, 0x10
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4052b0
sub ecx, edx
lea edx, [ebp - 0x5f4]
push ecx
lea ecx, [edi + 0x18]
call fcn.00406540
lea edx, [ebp - 0x9dc]
add esp, 4
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x4052d4
sub edx, ecx
lea ecx, [edi + 0x18]
push edx
lea edx, [ebp - 0x9dc]
call fcn.00406540
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov al, bl
pop ebx
pop edi
xor ecx, ebp
pop esi
call fcn.0046be2f
mov esp, ebp
pop ebp
ret
Function at 0x4057c0
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0
mov ebx, ecx
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
cmp eax, 0x6f
je 0x4057e6
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push dword [ebp - 4]
call fcn.00476593
mov esi, eax
add esp, 4
test esi, esi
jne 0x405800
pop esi
mov al, 3
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
je 0x405820
push esi
call fcn.00471958
add esp, 4
mov al, 4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [esi + 0x190]
lea edx, [esi + 0x194]
lea ecx, [ebx + 0x18]
call fcn.00406540
push esi
call fcn.00471958
add esp, 8
xor al, al
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x405990
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov esi, ecx
xorps xmm0, xmm0
push 0x80
push 0
push dword [ebp + 8]
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
call fcn.0046ea70
mov dword [esi + 0x58], 0
add esp, 0xc
mov dword [esi + 0x5c], 0
mov ecx, esi
mov dword [esi + 0x60], 0x67452301
mov dword [esi + 0x64], 0xefcdab89
mov dword [esi + 0x68], 0x98badcfe
mov dword [esi + 0x6c], 0x10325476
call fcn.00405120
mov byte [esi + 0x10], al
test al, al
je 0x4059f8
mov ecx, esi
call fcn.00405310
mov byte [esi + 0x11], al
mov ecx, esi
call fcn.00405740
mov byte [esi + 0x12], al
test al, al
je 0x405a10
mov ecx, esi
call fcn.004057c0
mov byte [esi + 0x13], al
mov edx, esi
lea ecx, [esi + 0x18]
call fcn.00406600
push ecx
push dword [ebp + 8]
mov ecx, esi
call fcn.00404c30
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebp
ret 8
Function at 0x405b40
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
or eax, 0xffffffff
push edi
test dl, 3
je 0x405b6d
test esi, esi
je 0x405b6d
movzx ecx, byte [edx]
dec esi
xor ecx, eax
inc edx
movzx ecx, cl
shr eax, 8
xor eax, dword [ecx*4 + 0x4a1d20]
test dl, 3
jne 0x405b50
mov edi, esi
and edi, 0xfffffff0
add edi, edx
cmp edx, edi
jae 0x405c66
nop dword [eax]
xor eax, dword [edx]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x4a1d20]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x4a1d20]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x4a1d20]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x4a1d20]
xor eax, dword [edx + 4]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x4a1d20]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x4a1d20]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x4a1d20]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x4a1d20]
xor eax, dword [edx + 8]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x4a1d20]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x4a1d20]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x4a1d20]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x4a1d20]
xor eax, dword [edx + 0xc]
add edx, 0x10
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x4a1d20]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x4a1d20]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x4a1d20]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x4a1d20]
cmp edx, edi
jb 0x405b80
and esi, 0xf
xor edi, edi
push ebx
xor ebx, ebx
lea ecx, [esi + edx]
cmp edx, ecx
cmova esi, ebx
pop ebx
test esi, esi
je 0x405c9a
nop dword [eax + eax]
movzx ecx, byte [edx]
lea edx, [edx + 1]
xor ecx, eax
inc edi
movzx ecx, cl
shr eax, 8
xor eax, dword [ecx*4 + 0x4a1d20]
cmp edi, esi
jb 0x405c80
pop edi
not eax
pop esi
pop ebp
ret

Function at 0x408930
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 4]
mov dword [ebp - 8], 0x400
push eax
push 0x20119
push 0
push ecx
push reloc.upgrade.dll_Ordinal_2
mov esi, edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4089f6
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp - 0xc]
push eax
push 0
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x4089ea
cmp dword [ebp - 0xc], 1
mov ecx, edi
mov eax, 0xd
cmovne esi, eax
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x408990
sub ecx, edx
sar ecx, 1
jne 0x4089b7
push dword [ebp - 4]
mov esi, 0xd
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, edi
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4089c0
sub ecx, edx
sar ecx, 1
cmp word [edi + ecx*2 - 2], 0x5c
je 0x4089ea
push 0x4a1b6c
push 0x200
push edi
call fcn.004773af
add esp, 0xc
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x409660
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
xor edi, edi
test esi, esi
je 0x4097f2
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x4097f2
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
cmp ecx, 0xffffffff
je 0x4097e6
and ecx, 0x410
xor eax, eax
cmp ecx, 0x410
sete al
test eax, eax
je 0x4097e6
push edi
push 0x2200000
push 3
push edi
push 3
push Ordinal_1
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
jne 0x4096d7
lea eax, [edi + 5]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x4000
call fcn.00476593
mov esi, eax
mov dword [ebp - 4], edi
add esp, 4
test esi, esi
jne 0x409702
push dword [ebp - 0xc]
lea edi, [eax + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x4000
push 0
push esi
call fcn.0046ea70
add esp, 0xc
lea eax, [ebp - 4]
push 0
push eax
push 0x4000
push esi
push 0
push 0
push 0x900a8
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x409742
lea edi, [eax + 0x1e]
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4097cb
mov eax, dword [esi]
cmp eax, 0xa0000003
jne 0x40975c
movzx ecx, word [esi + 0xe]
lea edx, [esi + 0x10]
movzx eax, word [esi + 0xc]
shr ecx, 1
add edx, eax
jmp 0x409790
cmp eax, 0xa000000c
jne 0x409774
movzx ecx, word [esi + 0xe]
lea edx, [esi + 0x14]
movzx eax, word [esi + 0xc]
shr ecx, 1
add edx, eax
jmp 0x409790
lea edx, [esi + 8]
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 4], eax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x409780
sub ecx, dword [ebp - 4]
sar ecx, 1
mov dword [ebp - 4], ecx
cmp ecx, dword [ebx]
jae 0x4097c1
mov eax, dword [ebp - 8]
test eax, eax
je 0x4097ba
push ecx
push edx
push eax
call fcn.00476e08
mov eax, dword [ebp - 4]
add esp, 0xc
mov edx, dword [ebp - 8]
xor ecx, ecx
mov word [edx + eax*2], cx
mov ecx, dword [ebp - 4]
jmp 0x4097c6
mov edi, 0x57
jmp 0x4097c6
mov edi, 0x6f
lea eax, [ecx + 1]
mov dword [ebx], eax
push esi
call fcn.00471958
add esp, 4
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0xc
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0x57
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x409800
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, ecx
mov dword [ebp - 4], edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
test eax, eax
je 0x409989
cmp dword [ebp + 8], 0
je 0x409989
push edi
push eax
call fcn.00477476
mov edi, eax
add esp, 4
test edi, edi
jne 0x40983f
lea eax, [edi + 8]
pop edi
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push esi
mov esi, edi
nop dword [eax]
push edi
call ebx
cmp eax, 0xffffffff
je 0x40986b
and eax, 0x410
xor ecx, ecx
cmp eax, 0x410
sete cl
test ecx, ecx
jne 0x409887
push 0x5c
push edi
call fcn.0046e615
mov esi, eax
add esp, 8
test esi, esi
je 0x409972
xor eax, eax
mov word [esi], ax
jmp 0x409850
test esi, esi
je 0x409972
lea eax, [ebp - 8]
xor edx, edx
push eax
mov ecx, edi
call fcn.00409660
mov esi, eax
add esp, 4
cmp esi, 0x6f
jne 0x409977
mov ebx, dword [ebp - 0xc]
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4098b2
sub ecx, edx
mov edx, edi
sar ecx, 1
lea eax, [edx + 2]
mov dword [ebp - 0xc], eax
nop dword [eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x4098d0
sub edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
sar edx, 1
sub ecx, edx
xor edx, edx
add eax, ecx
mov ecx, dword [ebp + 8]
cmp eax, dword [ecx]
mov dword [ecx], eax
cmovb esi, edx
test esi, esi
jne 0x409977
mov edx, dword [ebp - 4]
push ecx
mov ecx, edi
call fcn.00409660
mov esi, eax
add esp, 4
test esi, esi
jne 0x409977
mov edx, dword [ebp - 4]
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x409915
sub edx, ecx
mov ecx, edi
sar edx, 1
lea eax, [ecx + 2]
mov dword [ebp - 0xc], eax
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x409930
sub ecx, dword [ebp - 0xc]
lea eax, [edx + edx]
mov edx, dword [ebp - 4]
sar ecx, 1
lea ecx, [ebx + ecx*2]
sub eax, ecx
add edx, eax
nop dword [eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x409950
push edi
call fcn.00471958
add esp, 4
mov eax, esi
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
mov esi, 0xc
push edi
call fcn.00471958
add esp, 4
mov eax, esi
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
mov eax, 0x57
mov esp, ebp
pop ebp
ret
Function at 0x4099a0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
mov eax, dword [0x4c9070]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x104
mov edi, ecx
push 0
push edi
call fcn.0046ea70
mov eax, dword fs:[0x2c]
add esp, 0xc
mov ecx, dword [eax]
mov eax, dword [0x4d67a8]
cmp eax, dword [ecx + 4]
jle 0x409a04
push 0x4d67a8
call fcn.0046c1c1
add esp, 4
cmp dword [0x4d67a8], 0xffffffff
jne 0x409a04
call fcn.00408a00
push 0x4d67a8
call fcn.0046c182
add esp, 4
push 0x4d69b0
push str._sVERSION
lea eax, [ebp - 0x408]
push 0x200
push eax
call fcn.004042f0
add esp, 0x10
lea eax, [ebp - 0x408]
push 0
push 0x80
push 3
push 0
push 1
push Ordinal_1
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x409a5f
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x104
jb 0x409a71
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046be2f
mov esp, ebp
pop ebp
ret
push 0
lea eax, [ebp - 0x40c]
push eax
push 0x104
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x409a58
mov ecx, edi
call fcn.004093e0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, edi
call fcn.00409610
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0046be2f
mov esp, ebp
pop ebp
ret
Function at 0x409d20
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
mov eax, dword [0x4c9070]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
push str.RtlGetVersion
push str.ntdll.dll
mov dword [ebp - 0x124], ecx
mov dword [ebp - 0x128], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x11c
mov esi, eax
mov dword [ebp - 0x12c], 0
xorps xmm0, xmm0
lea eax, [ebp - 0x120]
push 0
push eax
movups xmmword [ebp - 0x14c], xmm0
movups xmmword [ebp - 0x13c], xmm0
call fcn.0046ea70
add esp, 0xc
mov dword [ebp - 0x120], 0x11c
test esi, esi
je 0x409dac
lea eax, [ebp - 0x120]
push eax
call esi
test eax, eax
jns 0x409dcd
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x409dcd
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046be2f
mov esp, ebp
pop ebp
ret
test edi, edi
je 0x409dde
mov ecx, 0x47
lea esi, [ebp - 0x120]
rep movsd dword es:[edi], dword [esi]
push ebx
lea eax, [ebp - 0x14c]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov ecx, dword [ebp - 0x110]
xor ebx, ebx
cmp dword [ebp - 0x134], 0x21d8
sete bl
xor eax, eax
cmp ecx, 2
jne 0x409f0d
mov ecx, dword [ebp - 0x11c]
cmp ecx, 0xa
jne 0x409e48
cmp dword [ebp - 0x118], eax
jne 0x409f3f
cmp dword [ebp - 0x114], 0x55f0
jb 0x409e37
lea eax, [ecx + 9]
jmp 0x409f3f
xor eax, eax
cmp byte [ebp - 6], 1
setne al
add eax, 0x11
jmp 0x409f3f
cmp ecx, 6
jne 0x409ead
mov ecx, dword [ebp - 0x118]
cmp ecx, 3
jne 0x409e69
xor eax, eax
cmp byte [ebp - 6], 1
setne al
add eax, 0xf
jmp 0x409f3f
cmp ecx, 2
jne 0x409e7f
xor eax, eax
cmp byte [ebp - 6], 1
setne al
add eax, 0xd
jmp 0x409f3f
cmp ecx, 1
jne 0x409e94
xor eax, eax
cmp byte [ebp - 6], cl
setne al
add eax, 0xb
jmp 0x409f3f
test ecx, ecx
jne 0x409f3f
xor eax, eax
cmp byte [ebp - 6], 1
setne al
add eax, 9
jmp 0x409f3f
cmp ecx, 5
jne 0x409f01
mov ecx, dword [ebp - 0x118]
cmp ecx, 2
jne 0x409eee
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x409ed0
mov eax, 8
jmp 0x409f3f
cmp byte [ebp - 6], 1
jne 0x409ee7
cmp word [ebp - 0x14c], 9
jne 0x409ee7
mov eax, 6
jmp 0x409f3f
mov eax, 7
jmp 0x409f3f
cmp ecx, 1
jne 0x409ef8
lea eax, [ecx + 5]
jmp 0x409f3f
test ecx, ecx
jne 0x409f3f
lea eax, [ecx + 5]
jmp 0x409f3f
cmp ecx, 4
ja 0x409f3f
mov eax, 4
jmp 0x409f3f
cmp ecx, 1
jne 0x409f3f
cmp dword [ebp - 0x11c], 4
jne 0x409f3f
mov ecx, dword [ebp - 0x118]
test ecx, ecx
jne 0x409f2a
lea eax, [ecx + 1]
jmp 0x409f3f
cmp ecx, 0xa
jne 0x409f34
lea eax, [ecx - 8]
jmp 0x409f3f
cmp ecx, 0x5a
mov edx, 3
cmove eax, edx
mov ecx, dword [ebp - 0x124]
test ecx, ecx
je 0x409f4b
mov dword [ecx], eax
mov eax, dword [ebp - 0x128]
test eax, eax
je 0x409f57
mov dword [eax], ebx
mov ecx, dword [ebp - 4]
mov eax, 1
pop ebx
pop edi
xor ecx, ebp
pop esi
call fcn.0046be2f
mov esp, ebp
pop ebp
ret
Function at 0x409f70
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x58
mov eax, dword [0x4c9070]
xor eax, esp
mov dword [esp + 0x54], eax
push esi
mov esi, ecx
mov dword [esp + 0x18], 0
push edi
xor edi, edi
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x54], edi
mov word [esp + 0x58], 0x100
cmp dword [esi], edi
jne 0x40a144
lea eax, [esp + 0x14]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push 1
lea eax, [esp + 0x7c]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x40a0c2
mov eax, dword [esp + 0x14]
xorps xmm0, xmm0
movaps xmmword [esp + 0x30], xmm0
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x18]
push eax
push edi
lea eax, [esp + 0x28]
movaps xmmword [esp + 0x28], xmm0
push eax
push 1
mov dword [esp + 0x30], 0x10000000
mov dword [esp + 0x34], 2
mov dword [esp + 0x38], edi
mov dword [esp + 0x44], edi
mov dword [esp + 0x48], 5
call dword [sym.imp.ADVAPI32.dll_SetEntriesInAclW]
test eax, eax
jne 0x40a0c2
push 0x14
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
test edi, edi
je 0x40a0c2
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x40a0c2
push 0
push dword [esp + 0x1c]
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
je 0x40a0c2
push str.GlobalHRDAEMON_STATUS_MUTEX
push 0
push 0x1f0001
mov dword [esp + 0x54], 0xc
mov dword [esp + 0x58], edi
mov dword [esp + 0x5c], 0
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [esi + 8], eax
test eax, eax
je 0x40a0c2
push str.GlobalHRDAEMON_STATUS
push 0
push 6
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov dword [esi], eax
test eax, eax
je 0x40a0c2
push 0x1000
push 0
push 0
push 6
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
xor ecx, ecx
mov dword [esi + 4], eax
test eax, eax
mov eax, 1
cmovne ecx, eax
mov dword [esp + 0x1c], ecx
mov eax, dword [esp + 0x14]
test eax, eax
je 0x40a0d1
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov ecx, dword [esp + 0x18]
mov eax, dword [sym.imp.KERNEL32.dll_LocalFree]
test ecx, ecx
je 0x40a0e6
push ecx
call eax
mov eax, dword [sym.imp.KERNEL32.dll_LocalFree]
test edi, edi
je 0x40a0ed
push edi
call eax
cmp dword [esp + 0x1c], 0
jne 0x40a144
cmp dword [esi], 0
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x40a11e
mov eax, dword [esi + 4]
test eax, eax
je 0x40a114
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [esi + 4], 0
push dword [esi]
call edi
mov dword [esi], 0
mov eax, dword [esi + 8]
test eax, eax
je 0x40a12f
push eax
call edi
mov dword [esi + 8], 0
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x54]
xor ecx, esp
call fcn.0046be2f
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [esp + 0x5c]
mov eax, 1
pop edi
pop esi
xor ecx, esp
call fcn.0046be2f
mov esp, ebp
pop ebp
ret 4
Function at 0x40af20
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48eb1c
mov eax, dword fs:[0]
push eax
sub esp, 0x8c
mov eax, dword [0x4c9070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x94]
push edx
mov ecx, dword [eax + 0x108]
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, eax
mov dword [ebp - 4], 0
call dword [sym.imp.DuiLib.dll_public:_wchar_t_const____thiscall_DuiLib::CDuiString::operator_wchar_t_const__void_const]
push eax
lea ecx, [ebp - 0x98]
call fcn.00403eb0
lea ecx, [ebp - 0x94]
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.DuiLib.dll_public:_void___thiscall_DuiLib::CDuiString::destructor_void_]
mov eax, dword [ebp - 0x98]
mov edx, str.btn_privacy_policy
mov ecx, eax
nop
mov si, word [ecx]
cmp si, word [edx]
jne 0x40afc6
test si, si
je 0x40afc2
mov si, word [ecx + 2]
cmp si, word [edx + 2]
jne 0x40afc6
add ecx, 4
add edx, 4
test si, si
jne 0x40afa0
xor ecx, ecx
jmp 0x40afcb
sbb ecx, ecx
or ecx, 1
test ecx, ecx
jne 0x40afe6
push 1
push ecx
push ecx
push str.https:__www.huorong.cn_privacy_policy.html
push str.open
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x40b05f
mov ecx, str.btn_license
nop dword [eax + eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40b016
test dx, dx
je 0x40b012
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40b016
add eax, 4
add ecx, 4
test dx, dx
jne 0x40aff0
xor eax, eax
jmp 0x40b01b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40b036
push 1
push eax
push eax
push str.http:__www.huorong.cn_product.php_tolicensev5
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x40b05f
mov edx, 0x4a56a4
lea ecx, [ebp - 0x98]
call fcn.00408890
test al, al
je 0x40b05f
push 0
push 0xf060
push 0x112
push dword [edi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
mov edx, dword [ebp - 0x98]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40b07d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046be2f
mov esp, ebp
pop ebp
ret 4
Function at 0x40cb90
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x28
mov eax, dword [0x4c9070]
xor eax, esp
mov dword [esp + 0x24], eax
push esi
push edi
mov edi, ecx
mov esi, edi
neg esi
lea eax, [edi - 0x3bc]
sbb esi, esi
and esi, eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x40cc97
push dword [edi + 8]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x40cc97
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
jne 0x40cc8c
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsZoomed]
test eax, eax
jne 0x40cc8c
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x40cc8c
lea eax, [esp + 0x10]
mov ecx, edi
push eax
call fcn.0040caf0
push 1
push 0xffffffffffffffeb
push dword [edi + 8]
movups xmm0, xmmword [eax]
movups xmmword [esp + 0x1c], xmm0
call dword [sym.imp.USER32.dll_SetWindowLongW]
cmp dword [ebp + 8], 0
lea eax, [esp + 0x10]
lea ecx, [edi + 8]
je 0x40cc61
push 1
push eax
call fcn.0040cea0
push 0
push 0xffffffffffffffeb
push dword [edi + 8]
call dword [sym.imp.USER32.dll_SetWindowLongW]
pop edi
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.0046be2f
mov esp, ebp
pop ebp
ret 4
push 0x50
push eax
push dword [esi + 4]
call fcn.0040ced0
push 0
push 0xffffffffffffffeb
push dword [edi + 8]
call dword [sym.imp.USER32.dll_SetWindowLongW]
pop edi
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.0046be2f
mov esp, ebp
pop ebp
ret 4
push 0
push dword [edi + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
xor ecx, esp
call fcn.0046be2f
mov esp, ebp
pop ebp
ret 4

Function at 0x40ccb0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
cmp eax, 1
jne 0x40cce2
mov dword [ebp + 0xc], eax
lea eax, [ebp + 0xc]
push eax
sub esp, 0xc
call fcn.0040ca60
cmp dword [ebp + 0xc], 0
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
je 0x40cd5d
mov eax, 1
pop ebp
ret 0x18
cmp eax, 0xf
jne 0x40cd03
push 0
mov dword [ecx], 1
call fcn.0040cb90
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
xor eax, eax
pop ebp
ret 0x18
cmp eax, 3
jne 0x40cd1e
push 1
call fcn.0040cb90
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
xor eax, eax
pop ebp
ret 0x18
cmp eax, 5
jne 0x40cd3e
cmp dword [ecx], 0
je 0x40cd54
push 0
call fcn.0040cb90
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
xor eax, eax
pop ebp
ret 0x18
cmp eax, 0x18
jne 0x40cd5d
cmp dword [ebp + 0x10], 1
je 0x40cd54
push 0
push dword [ecx + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
xor eax, eax
pop ebp
ret 0x18