joyce8/EMBER2024-capa huggingface dataset:
Function at 0x725b2226
Capabilities:
Encode data using xor

Disassembly:
push dword [esp + 4]
call fcn.726084ed
mov ebx, dword [ebx + 0x646ef]
pushfd
mov byte [esp], 0x65
pushfd
inc esi
push es
add byte [esi + eax*8 - 0x639adbfc], bl
call fcn.725252d6
jl 0x725943a4
insb byte es:[edi], dx
sbb dl, byte [ebx - 0x53dd0b6c]
xor dword [eax + 0x5f], edx
add dh, byte [ecx + ebp*2 - 0x1dc4e1b3]
out dx, eax
popfd
add ch, byte [edi + 0x36475f00]
pop edi
pop edi
inc edi
pop edi
xchg esp, eax
sbb ebp, edx
push eax
jge 0x7259435c
mov al, 0xdd
add eax, 0xc4324223
int 0xac
jp 0x72594382
sub bl, byte [eax + 0x6835a7bd]
js 0x725943df
mov al, 0xb2
sub al, 0x42
movsd dword es:[edi], dword [esi]
mov dl, cl
outsd dx, dword [esi]
sub eax, 0xb9cf8753
iretd
iretd
and al, 0x4d
sub al, 0xb4
imul ecx, dword [ebp - 0x36], 0xc19392f8
ror byte [ebx], 0x1a
dec esi
ja 0x725943aa
into
int3
call 0x855a0f8e
jae 0x725943f4
xchg ebx, eax
xchg esp, eax
hlt
imul ecx, dword [esi - 0x78], 0x6c0aae3f
jne 0x72594402
out dx, eax
fisubr word [ecx]
loop 0x725943ae
push ebp
pop eax
sub al, dl
push edx
push 0xcfbb1dc7
dec esp
salc
fistp qword [esi - 0x7b9c57f7]
test eax, 0xea4d69b4
les edi, [esi - 0x2d87b33d]
popfd
bound esi, qword [ebp + 0xf]
invalid
mov byte [esp], al
nop
jmp 0x725e68a7
mov ebx, dword [ebx + 0x646ef]
pushal
jmp 0x72571857
not bl
pop ebx
pop ebx
push 0xb54fa872
pushal
pushal
mov byte [esp + 0x10], 0xfc
xchg dword [esp + 0x44], ebx
lea esp, [esp + 0x44]
jl 0x725f8631
pushal
xchg dword [esp + 0x1c], ebx
movzx bx, bl
mov bl, byte [esp]
pushfd
setg bh
mov ebx, 0x7244ef97
mov byte [esp + 0x14], ah
jmp 0x725bd20d
pushal
push 0x76a3fe33
mov dword [esp + 0x20], ebx
lea ebx, [eax*2 + 0x7a937a9a]
lea ebx, [edi*4 + 0x4ba54d7f]
bswap ebx
mov ebx, 0x7244ef97
push dword [esp + 4]
jmp 0x72594359

Function at 0x72628c63
Capabilities:
Encode data using xor

Disassembly:
mov byte [esp], 0xff
inc esi
push 0xc7ec6c58
call fcn.7262856a
rcl dword [ecx - 0x7014f0e7], cl
sbb bl, byte [edi]
mov ebp, ebx
leave
dec esi
or eax, 0x95bbe58
stosb byte es:[edi], al
xchg eax, eax
dec edx
mov fs, eax
xor byte [esi], bh
adc byte [0xa458ea27], ah
jp 0x72628c7e
sbb esi, dword [ebx - 0x63]
mov ebp, 0x6ebde268
add esp, dword [edx + 0x2d]
sahf
cmp eax, 0x80337103
invalid

Function at 0x727ab088
Capabilities:
Access peb ldr_data

Disassembly:
pop ecx
mov ebx, dword [esp + 0x3c]
call fcn.72633d40
jmp 0x72630aba
pushfd
lea esi, [edx + 0x7fb7a6ac]
bswap ecx
mov esi, dword [esp + 4]
pushfd
mov edi, dword [esp + 0xc]
movzx bx, cl
pushal
mov ebx, dword [esp + 0x30]
lea ecx, [edi + 0x4f26a041]
call fcn.7260dbb3
lea esp, [esp + 0x30]
ja 0x7262f4a7
not si
setg cl
jbe 0x7262d9a1
movzx bx, bl
pop esi
movsx bx, dl
lea edi, [ebx + 0x22ad6d06]
pushal
pop ecx
mov edi, dword [esp + 0x1c]
pushal
bswap cx
jmp 0x7260d220
Function at 0x727ade94
Capabilities:
Encode data using xor

Disassembly:
inc ebp
invalid
pushfd
call fcn.727a9898
jns 0x72610df8
mov al, byte [0xc0c193a6]
outsd dx, dword [esi]
jo 0x72610d3a
out 0x3e, eax
xchg ecx, eax
fcomp dword [ebx - 0x67]
sbb dword [edi], esp
out dx, al
lodsb al, byte [esi]
invalid
imul eax, dword [eax], 0xffc56707
cld
xor dword [esi], ebp
jle 0x72610dfb
invalid
inc edi
cmp eax, dword [eax + 0x3594411d]
push es
jb 0x72610e45
cmpsd dword [esi], dword es:[edi]
bound ecx, qword [edi - 0xde0e5e9]
xchg esi, eax
movsd dword es:[edi], dword [esi]
jnp 0x72610d9c
mov dword [0x8369fa3e], eax
and esp, dword [ecx - 0x16]
stc
jb 0x72610e9a
xor al, 0xe1
push ebx
jb 0x72610e4a
dec eax
lodsd eax, dword [esi]
dec esi
scasb al, byte es:[edi]
movsb byte es:[edi], byte [esi]
or esp, dword [ecx - 0x71781d98]
aaa
cwde
jb 0x72610e38
test eax, 0xd346a4c7
jns 0x72610e43
cmpsd dword [esi], dword es:[edi]
into
aad 0x80
push ebx
movsd dword es:[edi], dword [esi]
add dword [edi + ebx + 0x5c313dbe], ebp
pop ebp
jbe 0x72610e5a
xor dword [ebp + ebx*2 + 0x76], ebx
or esi, eax
or ah, byte [ebp + ebx + 0x76]
lock or ah, byte [ebp + ebx + 0x76]
sub edx, eax
aad 0x30
pop es
pop ss
jle 0x72610e96
or eax, 0x896686ef
insb byte es:[edi], dx
and al, 4
push ds
int3
bt edx, ecx
shld di, dx, 7
pushal
mov edi, eax
sbb cx, di
dec ch
mov ecx, 0x104
clc
mov word [esp], 0x498d
sub al, al
bt bp, cx
push dword [esp + 0x10]
bt bp, di
cmp bl, 0xac
repne scasb al, byte es:[edi]
jmp 0x72610da4
Function at 0x404bef
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40db60]
jne 0x404bf9
repz ret
jmp fcn.0040883b

Function at 0x4060f3
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004029c4
and dword [ebp - 4], 0
cmp dword [0x40e54c], 0
mov ebx, eax
jne 0x4061a4
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x406255
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40aa14
push edi
call esi
test eax, eax
je 0x406255
push eax
call fcn.00402952
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x40e54c], eax
call esi
push eax
call fcn.00402952
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x40e550], eax
call esi
push eax
call fcn.00402952
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x40e554], eax
call esi
push eax
call fcn.00402952
pop ecx
mov dword [0x40e55c], eax
test eax, eax
je 0x4061a4
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00402952
pop ecx
mov dword [0x40e558], eax
mov eax, dword [0x40e558]
cmp eax, ebx
je 0x4061fc
cmp dword [0x40e55c], ebx
je 0x4061fc
push eax
call fcn.004029cd
push dword [0x40e55c]
mov esi, eax
call fcn.004029cd
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4061fc
test edi, edi
je 0x4061fc
call esi
test eax, eax
je 0x4061f3
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4061f3
test byte [ebp - 0xc], 1
jne 0x4061fc
or dword [ebp + 0x10], 0x200000
jmp 0x406235
mov eax, dword [0x40e550]
cmp eax, ebx
je 0x406235
push eax
call fcn.004029cd
pop ecx
test eax, eax
je 0x406235
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x406235
mov eax, dword [0x40e554]
cmp eax, ebx
je 0x406235
push eax
call fcn.004029cd
pop ecx
test eax, eax
je 0x406235
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x40e54c]
call fcn.004029cd
pop ecx
test eax, eax
je 0x406255
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x406257
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x433004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
mov ecx, 0x30b32133
nop
nop
nop
nop
nop
test eax, eax
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
mov eax, section..text_1
nop
nop
mov ebx, 0x4304d8
mov ecx, 0x6503751f
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x45597454
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x42e04e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x42e024
nop
mov eax, section..data
mov ebx, 0x42cd70
nop
mov ecx, 0x62cb2fcf
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0xc39250
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x7db000]
push edi
jmp 0xc3926a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xc39271
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xc39260
mov eax, 1
add ebx, ebx
jne 0xc39283
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xc39294
jne 0xc392b3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xc392b3
dec eax
add ebx, ebx
jne 0xc392a0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0xc39278
add ebx, ebx
jne 0xc392af
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0xc39305
xor ecx, ecx
sub eax, 3
jb 0xc392cb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xc3933a
sar eax, 1
mov ebp, eax
jmp 0xc392d6
add ebx, ebx
jne 0xc392d6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xc392a4
inc ecx
add ebx, ebx
jne 0xc392e4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xc392a4
add ebx, ebx
jne 0xc392f1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xc392e6
jne 0xc39302
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xc392e6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xc39324
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xc39316
jmp 0xc39266
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xc39324
add edi, ecx
jmp 0xc39266
pop esi
mov edi, esi
mov ecx, 0x40f0
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0xc39342
cmp byte [edi], 0x11
jne 0xc39342
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0xc39347
lea edi, [esi + 0x832000]
mov eax, dword [edi]
or eax, eax
je 0xc393bf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + str.PQ_F]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xf8d2c8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xc39374
mov ecx, edi
jns 0xc393a3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xf8d2cc]
or eax, eax
je 0xc393b9
mov dword [ebx], eax
add ebx, 4
jmp 0xc39391
call dword [esi + 0xf8d2dc]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0xc393f0
cmp al, 0xef
ja 0xc393e3
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0xc393c5
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0xc393d2
mov ebp, dword [esi + 0xf8d2d0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0xc39424
sub esp, 0xffffff80
jmp 0x420577
Function at 0x401bc3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
movzx eax, word [ebp + 0xc]
push esi
push dword [ebp + 0x14]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x401c46
push ebx
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
test ebx, ebx
je 0x401c0f
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [ebp - 4], eax
je 0x401c0f
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
mov dword [ebp + 0xc], eax
jne 0x401c13
xor eax, eax
jmp 0x401c45
mov esi, dword [ebp + 0x10]
push edi
lea edi, [ebx + 1]
push edi
call fcn.00407805
test eax, eax
je 0x401c31
push ebx
push dword [ebp + 0xc]
push eax
call fcn.00445450
add esp, 0xc
mov eax, edi
call fcn.0040782b
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor eax, eax
inc eax
pop edi
pop ebx
pop esi
leave
ret

Function at 0x401db0
Capabilities:
Get file size
Read file on windows

Disassembly:
push 8
mov eax, 0x4797cf
call fcn.0044ce07
mov esi, ecx
mov eax, dword [esi]
xor edi, edi
cmp dword [eax - 0xc], edi
mov dword [ebp - 0x14], edi
je 0x401e94
mov eax, dword [0x49ead4]
mov ecx, 0x49ead4
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
push dword [ebp + 0x10]
mov dword [ebp - 4], edi
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push dword [esi]
push str._s_d._s
push eax
call fcn.00407d26
add esp, 0x14
push edi
push 0x80
push 3
push edi
push 1
push bind
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp + 0x10], eax
je 0x401e89
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp ebx, edi
je 0x401e80
mov esi, dword [ebp + 0xc]
push edi
lea eax, [ebp + 8]
push eax
push ebx
lea eax, [ebx + 0xa]
push eax
mov dword [ebp + 8], edi
call fcn.00407805
push eax
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, edi
mov dword [ebp - 0x14], eax
je 0x401e77
cmp dword [ebp + 8], ebx
jne 0x401e77
mov eax, ebx
call fcn.0040782b
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00408f63
xor eax, eax
inc eax
jmp 0x401e97
xor eax, eax
mov edx, esi
call fcn.00407981
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00408f63
mov eax, dword [ebp - 0x14]
call fcn.0044cea6
ret 0xc
Function at 0x407600
Capabilities:
Check mutex on windows

Disassembly:
push esi
push str.GlobalkwifiInstance47A00554_F8AF_4d24_A47A_EE2D7BA07992
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
test esi, esi
jne 0x40761d
pop esi
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x407635
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
ret
xor eax, eax
mov dword [0x49fad8], esi
inc eax
pop esi
ret

Function at 0x408c92
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push dword [esp + 0xc]
mov esi, eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x408ca9
pop esi
ret
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x408cde
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, edi
and esi, 0xf
jbe 0x408cda
cmp edi, eax
jae 0x408cde
dec esi
movzx ecx, word [edi]
lea edi, [edi + ecx*2 + 2]
jne 0x408ccc
cmp edi, eax
jb 0x408ce2
xor eax, eax
jmp 0x408cec
mov ax, word [edi]
neg ax
sbb eax, eax
and eax, edi
pop edi
pop esi
ret

Function at 0x409185
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [esi]
and dword [esi], 0
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push 0
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4091e8
cmp dword [ebp + 0xc], 1
je 0x4091c1
cmp dword [ebp + 0xc], 2
je 0x4091c1
push 0xd
pop eax
jmp 0x4091e8
test edi, edi
mov eax, dword [ebp - 4]
je 0x4091e2
test eax, eax
je 0x4091de
test al, 1
jne 0x4091bc
mov ecx, eax
shr ecx, 1
cmp word [edi + ecx*2 - 2], 0
je 0x4091e2
jmp 0x4091bc
and word [edi], 0
shr eax, 1
mov dword [esi], eax
xor eax, eax
leave
ret 8
Function at 0x409315
Capabilities:
Check if file exists

Disassembly:
push ebp
lea ebp, [esp - 0x394]
sub esp, 0x414
mov eax, dword [0x49c0b8]
xor eax, ebp
mov dword [ebp + 0x390], eax
push esi
xor esi, esi
push 0x40e
lea eax, [ebp - 0x7e]
push esi
push eax
mov word [ebp - 0x80], si
call fcn.00445850
add esp, 0xc
push str.kinfoc.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp eax, esi
jne 0x409416
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push edi
push 0x104
lea eax, [ebp - 0x80]
push eax
push esi
call ebx
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, str.operationcaskinfoc.dll
je 0x4093af
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
push edi
lea eax, [ebp - 0x80]
push 0x208
push eax
call fcn.00446d2b
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
call esi
test eax, eax
jne 0x409414
push 0x410
lea eax, [ebp - 0x80]
push 0
push eax
call fcn.00445850
add esp, 0xc
push 0x104
lea eax, [ebp - 0x80]
push eax
push 0x400000
call ebx
test eax, eax
je 0x409411
lea eax, [ebp - 0x80]
push eax
call fcn.00446663
test eax, eax
pop ecx
je 0x409411
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push edi
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x409411
lea eax, [ebp - 0x80]
push eax
call esi
test eax, eax
jne 0x409414
push edi
call esi
pop edi
pop ebx
mov ecx, dword [ebp + 0x390]
xor ecx, ebp
pop esi
call fcn.00446679
add ebp, 0x394
leave
ret

Function at 0x409535
Capabilities:
Read .ini file

Disassembly:
push ebp
sub esp, 0x20c
lea ebp, [esp - 4]
mov eax, dword [0x49c0b8]
xor eax, ebp
mov dword [ebp + 0x20c], eax
push 4
mov eax, 0x47ad44
call fcn.0044ce07
xor esi, esi
push 0x208
lea eax, [ebp + 2]
push esi
push eax
mov word [ebp], si
call fcn.00445850
add esp, 0xc
lea eax, [ebp - 0x10]
call fcn.0040f323
push str.update_tempkwifi.txt
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 4], esi
call fcn.004078e0
push dword [ebp - 0x10]
lea eax, [ebp]
push 0x104
push eax
push 0x485898
push 0x4859e8
push 0x4859ec
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
jbe 0x4095ca
lea eax, [ebp]
push eax
call fcn.00446663
cmp eax, 0xa
pop ecx
jne 0x4095ca
lea eax, [ebp]
push eax
call fcn.004461d6
pop ecx
mov esi, eax
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00408f63
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x20c]
xor ecx, ebp
call fcn.00446679
add ebp, 0x210
leave
ret
Function at 0x40965f
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x47c7ec
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x49c0b8]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
lea esi, [esp + 0x1c]
call fcn.0040942c
xor ebx, ebx
mov dword [esp + 0x30], ebx
mov edi, dword [esp + 0x20]
cmp edi, ebx
je 0x4096bf
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x40]
cmp edi, ebx
je 0x4096bf
push dword [0x49f87c]
mov eax, dword [edi]
push str.ver_be
mov ecx, edi
call dword [eax + 0x14]
call fcn.00409535
cmp edi, ebx
je 0x4096d5
mov edx, dword [edi]
push eax
push str.ver_af
mov ecx, edi
call dword [edx + 0x14]
call fcn.004095fa
cmp edi, ebx
je 0x4096eb
mov edx, dword [edi]
push eax
push str.result
mov ecx, edi
call dword [edx + 0x14]
cmp dword [0x49fa54], ebx
je 0x4096f8
push 2
pop eax
jmp 0x409703
xor eax, eax
cmp dword [0x49fa40], ebx
sete al
cmp edi, ebx
je 0x409714
mov edx, dword [edi]
push eax
push str.up_way
mov ecx, edi
call dword [edx + 0x14]
push 1
push str.SOFTWAREkingsoftkwifiKSetting
push reloc.WS2_32.dll_bind
lea esi, [esp + 0x20]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], ebx
call fcn.00409281
test eax, eax
je 0x409746
lea eax, [esp + 0x18]
push eax
push str.uplivetype
mov eax, esi
call fcn.004092cf
xor eax, eax
cmp dword [esp + 0x18], ebx
sete al
cmp dword [esp + 0x14], ebx
mov esi, eax
je 0x409761
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, ebx
mov dword [esp + 0x14], ebx
je 0x40977d
mov eax, dword [edi]
xor ecx, ecx
cmp esi, ebx
sete cl
push ecx
push str.up_set
mov ecx, edi
call dword [eax + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x49f878]
mov ebx, 0x3e8
xor edx, edx
mov ecx, ebx
div ecx
test edi, edi
je 0x4097a7
mov edx, dword [edi]
push eax
push str.up_time
mov ecx, edi
call dword [edx + 0x14]
mov eax, dword [0x49f890]
cdq
and edx, 0x3ff
add eax, edx
sar eax, 0xa
test edi, edi
je 0x4097db
mov edx, dword [edi]
push eax
push str.up_size
mov ecx, edi
call dword [edx + 0x14]
push dword [0x49fa8c]
mov eax, dword [edi]
push str.askcs3
mov ecx, edi
call dword [eax + 0x14]
call esi
xor edx, edx
div ebx
test edi, edi
je 0x409807
mov edx, dword [edi]
push eax
push str.spacingtime
mov ecx, edi
call dword [edx + 0x14]
mov eax, dword [edi]
push str.kwifi_update
mov ecx, edi
call dword [eax + 0xc]
mov eax, dword [edi]
push 0
mov ecx, edi
call dword [eax + 0x20]
cmp byte [0x49f8a4], 0
je 0x40983c
mov eax, dword [0x49f894]
mov esi, dword [0x49fb98]
mov ebx, dword [0x49f898]
mov dword [esp + 0x18], eax
call fcn.00411259
push eax
push esi
push dword [0x49f89c]
push ebx
push dword [esp + 0x28]
call fcn.00409978
or dword [esp + 0x30], 0xffffffff
test edi, edi
je 0x40984c
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 8]
xor eax, eax
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40a4b2
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor ecx, ecx
cmp eax, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], ecx
je 0x40a543
push ebx
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea edx, [ebp - 4]
push edx
push ecx
lea edx, [ebp - 8]
push edx
push ecx
mov ebx, str.idex
push ebx
push eax
call edi
cmp dword [ebp - 8], 1
jne 0x40a541
push esi
mov esi, dword [ebp + 0xc]
call fcn.00409207
mov eax, dword [ebp - 4]
shr eax, 1
inc eax
push eax
call fcn.00408fe2
mov esi, eax
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 8]
push 0
push ebx
push dword [eax]
call edi
test eax, eax
jne 0x40a540
mov eax, dword [ebp - 4]
shr eax, 1
and word [esi + eax*2], 0
mov esi, dword [ebp + 0xc]
mov eax, dword [esi]
test eax, eax
je 0x40a532
push eax
call fcn.00446663
pop ecx
mov edx, esi
call fcn.00408dbe
mov dword [ebp - 0xc], 1
pop esi
pop edi
pop ebx
mov eax, dword [ebp - 0xc]
leave
ret 8