joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45b3e0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x4979c8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4b62b0]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4b62b0]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov edi, dword [esp + 0x44]
push edi
lea ecx, [esp + 0x18]
call fcn.00415f20
push edi
mov dword [esp + 0x40], 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x45b499
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0
push edi
call ebx
test eax, eax
jne 0x45b499
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebp
cmp eax, 0xb7
je 0x45b499
lea esi, [esp + 0x14]
call fcn.0045b330
mov ecx, esi
call fcn.0042e0c0
test al, al
mov ecx, esi
jne 0x45b47e
call fcn.0041ba20
push eax
call fcn.0045b3e0
add esp, 4
test eax, eax
jne 0x45b487
lea ecx, [esp + 0x14]
call fcn.00432550
xor eax, eax
jmp 0x45b4a7
push 0
push edi
call ebx
test eax, eax
jne 0x45b499
call ebp
cmp eax, 0xb7
jne 0x45b47a
lea ecx, [esp + 0x14]
call fcn.00432550
mov eax, 1
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00472710
add esp, 0x2c
ret

Function at 0x45b4d0
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x4adee8
push 0x4789a0
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x4b62b0]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
xor esi, esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x38], esi
xor eax, eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 4], esi
lea eax, [ebp - 0x1c]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
cmp eax, esi
je 0x45b57e
lea ecx, [ebp - 0x28]
push ecx
push str.SeDebugPrivilege
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
cmp eax, esi
je 0x45b57e
mov edi, 1
mov dword [ebp - 0x38], edi
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 2
push esi
push esi
push esi
lea ecx, [ebp - 0x38]
push ecx
push esi
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
cmp eax, esi
je 0x45b57e
mov dword [ebp - 0x20], edi
mov dword [ebp - 4], 0xfffffffe
call fcn.0045b5a1
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45bec0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x498398
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4b62b0]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
mov eax, dword [0x4b62b0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov eax, dword [esp + 0x38]
push eax
lea ecx, [esp + 0xc]
xor esi, esi
call fcn.00415f20
lea ecx, [esp + 8]
mov dword [esp + 0x30], esi
call fcn.00432120
cmp eax, 1
jb 0x45bf4f
lea ecx, [esp + 8]
call fcn.00432120
sub eax, 1
push eax
lea ecx, [esp + 0xc]
call fcn.0042e080
movzx ecx, word [eax]
xor eax, eax
lea esp, [esp]
cmp cx, word [eax + 0x49faec]
je 0x45bf4f
add eax, 2
cmp eax, 4
jb 0x45bf30
push 0x4a7bdc
lea ecx, [esp + 0xc]
call fcn.00444570
lea ecx, [esp + 8]
call fcn.0041ba20
mov ecx, dword [esp + 0x3c]
push ecx
push eax
call fcn.0045b8c0
add esp, 8
test eax, eax
je 0x45bf6f
mov esi, 1
lea ecx, [esp + 8]
call fcn.00432550
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00472710
add esp, 0x2c
ret
Function at 0x45c270
Capabilities:
Access peb ldr_data
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x49835b
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x4b62b0]
xor eax, esp
mov dword [esp + 0x228], eax
push edi
mov eax, dword [0x4b62b0]
xor eax, esp
push eax
lea eax, [esp + 0x234]
mov dword fs:[0], eax
xor edi, edi
push edi
push 0x23
lea eax, [esp + 0x30]
push eax
push edi
mov dword [esp + 0x18], edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esp + 0x10]
call fcn.0041b8e0
lea ecx, [esp + 0xc]
mov dword [esp + 0x23c], edi
call fcn.0042e0c0
test al, al
je 0x45c2ed
push 0x4a6784
mov ecx, esi
call fcn.00415f20
jmp 0x45c369
lea ecx, [esp + 0xc]
call fcn.00432120
mov edi, eax
sub edi, 1
cmp dword [esp + 0x20], edi
ja 0x45c306
call fcn.00471132
lea ecx, [esp + 0xc]
call fcn.0041dc80
movzx eax, word [eax + edi*2]
cmp ax, 0x5c
je 0x45c32d
cmp ax, 0x2f
je 0x45c32d
push 0x4a7bdc
lea ecx, [esp + 0x10]
call fcn.00444340
push str.TencentSoftMgr_
lea ecx, [esp + 0x10]
call fcn.00444570
lea ecx, [esp + 0xc]
call fcn.0041ba20
push eax
call fcn.0045b3e0
add esp, 4
test eax, eax
mov ecx, esi
jne 0x45c35f
push 0x4a6784
call fcn.00415f20
jmp 0x45c369
lea edx, [esp + 0xc]
push edx
call fcn.0041b940
lea ecx, [esp + 0xc]
call fcn.0041b990
mov eax, esi
mov ecx, dword [esp + 0x234]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [esp + 0x228]
xor ecx, esp
call fcn.00472710
add esp, 0x238
ret

Function at 0x45c3e0
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x493fd8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4b62b0]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x2c]
xor esi, esi
push esi
push 0x80
push 3
push esi
push 1
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
mov dword [esp + 0x18], ebx
cmp ebx, 0xffffffff
mov dword [esp + 0x24], esi
je 0x45c4c1
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x200000
ja 0x45c4ba
lea edi, [eax + 1]
mov dword [esp + 0x14], esi
push edi
mov esi, eax
call fcn.00471171
mov ebp, eax
add esp, 4
test ebp, ebp
je 0x45c4ba
push edi
push 0
push ebp
call fcn.00472c50
add esp, 0xc
mov edi, ebp
lea esp, [esp]
push 0
lea ecx, [esp + 0x18]
push ecx
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x45c4b1
mov eax, dword [esp + 0x14]
test eax, eax
je 0x45c4b1
sub esi, eax
add edi, eax
test esi, esi
jne 0x45c470
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebp
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
push ebp
call fcn.0047271f
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x45c4e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x4956a6
mov eax, dword fs:[0]
push eax
sub esp, 0x250
mov eax, dword [0x4b62b0]
xor eax, esp
mov dword [esp + 0x24c], eax
push ebx
mov eax, dword [0x4b62b0]
xor eax, esp
push eax
lea eax, [esp + 0x258]
mov dword fs:[0], eax
test esi, esi
je 0x45c586
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x45c586
push 0x208
lea eax, [esp + 0x4a]
push 0
push eax
mov word [esp + 0x50], 0
call fcn.00472c50
add esp, 0xc
push 0x104
lea ecx, [esp + 0x48]
push esi
push ecx
call fcn.00477aeb
add esp, 0xc
test eax, eax
jne 0x45c5ad
push esi
lea ecx, [esp + 0x2c]
call fcn.00415f20
lea edx, [esp + 0x28]
push edx
mov ebx, 0x4ba548
mov dword [esp + 0x264], 0
call fcn.0045c9e0
lea ecx, [esp + 0x28]
call fcn.00432550
xor al, al
mov ecx, dword [esp + 0x258]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [esp + 0x24c]
xor ecx, esp
call fcn.00472710
add esp, 0x25c
ret
lea eax, [esp + 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test eax, 0x400
je 0x45c5ed
lea ecx, [esp + 0x44]
push ecx
lea ecx, [esp + 0x10]
call fcn.00415f20
lea edx, [esp + 0xc]
push edx
mov ebx, 0x4ba548
mov dword [esp + 0x264], 1
call fcn.0045c9e0
lea ecx, [esp + 0xc]
jmp 0x45c581
mov al, 1
jmp 0x45c588

Function at 0x45c600
Capabilities:
Get common file path

Disassembly:
sub esp, 0x214
mov eax, dword [0x4b62b0]
xor eax, esp
mov dword [esp + 0x210], eax
xor eax, eax
push 0x208
push eax
mov dword [esp + 8], eax
mov word [esp + 0xc], ax
lea eax, [esp + 0xe]
push eax
call fcn.00472c50
add esp, 0xc
lea ecx, [esp + 4]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea edx, [esp + 4]
push edx
mov ecx, esi
call fcn.00415f20
mov ecx, dword [esp + 0x210]
xor ecx, esp
mov eax, esi
call fcn.00472710
add esp, 0x214
ret
Function at 0x45c690
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x410
mov eax, dword [0x4b62b0]
xor eax, esp
mov dword [esp + 0x40c], eax
lea eax, [esp]
push eax
push 1
push 0
push str.SOFTWARETencentSoftMgr
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x45c774
push 0x400
push eax
lea ecx, [esp + 0x12]
push ecx
mov word [esp + 0x14], ax
call fcn.00472c50
mov ecx, dword [esp + 0xc]
add esp, 0xc
lea edx, [esp + 4]
push edx
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0x4a9008
push ecx
mov dword [esp + 0x1c], 0x200
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x45c76a
lea edx, [esp + 8]
push edx
push edi
push esi
call fcn.0047583f
mov eax, esi
add esp, 0xc
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x45c720
sub eax, edx
sar eax, 1
cmp word [esi + eax*2 - 2], 0x5c
je 0x45c746
push 0x4a7bdc
push edi
push esi
call fcn.00475be3
add esp, 0xc
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov ecx, dword [esp + 0x40c]
xor ecx, esp
call fcn.00472710
add esp, 0x410
ret
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x40c]
xor ecx, esp
xor eax, eax
call fcn.00472710
add esp, 0x410
ret

Function at 0x45c790
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x410
mov eax, dword [0x4b62b0]
xor eax, esp
mov dword [esp + 0x40c], eax
lea eax, [esp]
push eax
push 1
push 0
push str.SOFTWARETencentSoftMgr
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x45c84b
push 0x400
push eax
lea ecx, [esp + 0x12]
push ecx
mov word [esp + 0x14], ax
call fcn.00472c50
mov ecx, dword [esp + 0xc]
add esp, 0xc
lea edx, [esp + 4]
push edx
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0x4a8e3c
push ecx
mov dword [esp + 0x1c], 0x200
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x45c841
mov eax, dword [esp + 0x414]
lea edx, [esp + 8]
push edx
push eax
push esi
call fcn.0047583f
mov ecx, dword [esp + 0xc]
add esp, 0xc
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov ecx, dword [esp + 0x40c]
xor ecx, esp
call fcn.00472710
add esp, 0x410
ret
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x40c]
xor ecx, esp
xor eax, eax
call fcn.00472710
add esp, 0x410
ret
Function at 0x45c870
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4968b8
mov eax, dword fs:[0]
push eax
sub esp, 0x60
push ebx
push esi
push edi
mov eax, dword [0x4b62b0]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
mov edi, ecx
mov esi, edx
mov ebx, dword [ebp + 0xc]
push 0x40
lea eax, [esp + 0x2c]
push 0
push eax
call fcn.00472c50
xor eax, eax
add esp, 0xc
lea ecx, [esp + 0x10]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], 0x44
mov dword [esp + 0x50], 0x181
call fcn.0040f5f0
mov ecx, dword [ebp + 8]
push ebx
push ecx
lea edx, [esp + 0x18]
push str.__s___s
push edx
mov dword [esp + 0x88], 0
call fcn.00403280
add esp, 0x10
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x28]
push edx
push 0
push 0
push 0
mov eax, edi
neg eax
push 0
sbb eax, eax
push 0
and eax, 0xa
push 0
lea ecx, [esp + 0x30]
mov word [esp + 0x74], ax
call fcn.0041cae0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x45c979
mov eax, dword [ebp + 8]
push ebx
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.QMTFunction::RunApp_CreateProcessW_error:_d__wait:_d__show:_d__path:_ws__cmd:_s
mov esi, 0x4ba4f8
call fcn.00458e60
add esp, 0x18
lea ecx, [esp + 0x10]
call fcn.004023a0
xor eax, eax
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
mov eax, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov ebx, eax
je 0x45c9a2
push esi
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x45c9a2
mov ecx, dword [esp + 0x14]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test edi, edi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x45c9af
push edi
call esi
test ebx, ebx
je 0x45c9b6
push ebx
call esi
lea ecx, [esp + 0x10]
call fcn.004023a0
mov eax, 1
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45d4a0
Capabilities:
Check if file exists
Extract resource via kernel32 functions
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x497010
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x4b62b0]
xor eax, esp
mov dword [esp + 0x58], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4b62b0]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x80]
lea esi, [esp + 0x50]
mov byte [esp + 0x17], 0
call fcn.00466b60
xor esi, esi
lea ecx, [esp + 0x34]
mov dword [esp + 0x78], esi
call fcn.00415ec0
mov ecx, ebp
mov byte [esp + 0x78], 1
call fcn.0042e0c0
test al, al
je 0x45d533
lea eax, [esp + 0x50]
push eax
lea ecx, [esp + 0x1c]
call fcn.004665b0
push eax
lea ecx, [esp + 0x38]
mov byte [esp + 0x7c], 2
call fcn.00415f50
lea ecx, [esp + 0x18]
mov byte [esp + 0x78], 1
call fcn.00432550
jmp 0x45d53d
push ebp
lea ecx, [esp + 0x38]
call fcn.00415f50
lea ecx, [esp + 0x34]
call fcn.00432120
cmp eax, 1
jb 0x45d585
lea ecx, [esp + 0x34]
call fcn.00432120
sub eax, 1
push eax
lea ecx, [esp + 0x38]
call fcn.0042e080
movzx ecx, word [eax]
xor eax, eax
cmp cx, word [eax + 0x49faec]
je 0x45d585
add eax, 2
cmp eax, 4
jb 0x45d566
push 0x4a7bdc
lea ecx, [esp + 0x38]
call fcn.00444570
push 0x4a9110
lea edi, [esp + 0x38]
call fcn.004669d0
mov ecx, edi
call fcn.0041ba20
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push eax
call ebx
cmp eax, 0xffffffff
je 0x45d5b0
mov dword [ebp + 0x1c], esi
jmp 0x45d667
lea ecx, [esp + 0x50]
mov dword [ebp + 0x1c], 1
call fcn.00466400
push 0x4a9128
lea ecx, [esp + 0x1c]
call fcn.0041b8e0
lea edi, [esp + 0x18]
lea esi, [esp + 0x50]
mov byte [esp + 0x78], 3
call fcn.004667f0
mov ecx, edi
mov byte [esp + 0x78], 1
call fcn.0041b990
mov ecx, esi
call fcn.0041ba20
push eax
call ebx
cmp eax, 0xffffffff
je 0x45d60b
mov ecx, esi
push ecx
lea ecx, [ebp + 0x80]
call fcn.0041b9c0
jmp 0x45d662
mov edx, dword [0x4b8fa8]
push str.SKIN
push str.QMUIRES.dat
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x45d667
mov eax, dword [0x4b8fa8]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x45d667
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x45d667
mov ecx, dword [0x4b8fa8]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
lea edi, [ebp + 0xb0]
mov esi, eax
call fcn.0045cd50
mov byte [esp + 0x17], 1
lea ecx, [esp + 0x34]
call fcn.00432550
lea ecx, [esp + 0x50]
call fcn.00432550
mov al, byte [esp + 0x17]
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.00472710
add esp, 0x68
ret 4
Function at 0x45da20
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x496fc8
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x4b62b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov esi, ecx
mov edi, edx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x2d], 0
call fcn.0042e0c0
test al, al
jne 0x45db68
push esi
lea ecx, [ebp - 0x2c]
call fcn.00415ef0
lea esi, [ebp - 0x2c]
mov dword [ebp - 4], 0
call fcn.00466730
call fcn.00403510
mov ecx, edi
mov dword [ebp - 0x34], eax
call fcn.0040fa70
mov edi, eax
test edi, edi
je 0x45dade
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, eax
add ebx, 1
cmp ebx, 0x3fffffff
jg 0x45dad9
lea eax, [ebx + ebx]
call fcn.00480f50
mov esi, esp
test esi, esi
je 0x45dad9
mov ecx, dword [ebp - 0x34]
push ebx
push esi
push 0xffffffffffffffff
push edi
push 0
push ecx
mov word [esi], 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
neg eax
sbb eax, eax
and eax, esi
jmp 0x45dadb
xor eax, eax
mov ebx, dword [ebp - 0x38]
push eax
lea edi, [ebp - 0x2c]
call fcn.004669d0
mov ecx, edi
call fcn.0041ba20
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x45db60
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
test esi, esi
je 0x45db59
lea edx, [esi + 1]
push edx
mov dword [ebp - 0x34], 0
call fcn.00471171
add esp, 4
push 0
lea ecx, [ebp - 0x34]
push ecx
push esi
push eax
push edi
mov dword [ebx], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x45db59
cmp dword [ebp - 0x34], esi
jne 0x45db59
mov edx, dword [ebp - 0x3c]
mov dword [edx], esi
mov eax, dword [ebx]
mov byte [esi + eax], 0
mov byte [ebp - 0x2d], 1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x2c]
call fcn.00432550
mov al, byte [ebp - 0x2d]
lea esp, [ebp - 0x4c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00472710
mov esp, ebp
pop ebp
ret 8
Function at 0x45dda0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x498317
mov eax, dword fs:[0]
push eax
sub esp, 0xe0
mov eax, dword [0x4b62b0]
xor eax, esp
mov dword [esp + 0xd8], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4b62b0]
xor eax, esp
push eax
lea eax, [esp + 0xf4]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x104]
lea eax, [esp + 0x74]
xor esi, esi
push eax
mov byte [esp + 0x1b], 0
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
call fcn.0045a6f0
push 0x4a9154
lea ecx, [esp + 0x24]
mov dword [esp + 0x100], esi
call fcn.0040f9b0
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x1c]
push edx
push ebp
lea eax, [esp + 0x2c]
mov byte [esp + 0x108], 1
call fcn.0045db90
test al, al
lea ecx, [esp + 0x20]
sete bl
mov byte [esp + 0xfc], 0
call fcn.0040fa10
test bl, bl
jne 0x45dfac
mov edi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x74]
push eax
call fcn.0045b140
test al, al
je 0x45dfac
push str.strings
lea ecx, [esp + 0x78]
call fcn.00408720
cmp eax, esi
je 0x45dfac
mov ecx, str.string
call fcn.00459fd0
mov edi, eax
cmp edi, esi
je 0x45df9b
mov edi, edi
lea ecx, [esp + 0x58]
call fcn.0040f960
lea ecx, [esp + 0x3c]
call fcn.0040f960
lea esi, [edi + 0x44]
push esi
mov ebx, 0x4a7108
mov byte [esp + 0x100], 3
call fcn.0045b0e0
test eax, eax
je 0x45dec5
mov ecx, eax
call fcn.00408780
jmp 0x45dec7
xor eax, eax
push eax
lea ecx, [esp + 0x5c]
call fcn.0040fa40
push esi
mov ebx, 0x4a9170
call fcn.0045b0e0
test eax, eax
je 0x45dee9
mov ecx, eax
call fcn.00408780
jmp 0x45deeb
xor eax, eax
push eax
lea ecx, [esp + 0x40]
call fcn.0040fa40
cmp dword [esp + 0x6c], 0
je 0x45df4c
cmp dword [esp + 0x50], 0
je 0x45df4c
lea ecx, [esp + 0x3c]
lea ebx, [esp + 0x20]
call fcn.00469a20
mov ecx, ebx
push ecx
mov byte [esp + 0x100], 4
call fcn.0045dd20
add esp, 4
mov edx, ebx
push edx
push ecx
lea edx, [ebp + 0x2c]
lea ecx, [esp + 0x60]
call fcn.0045f1c0
add esp, 4
mov ecx, eax
call fcn.0041b9c0
mov ecx, ebx
mov byte [esp + 0xfc], 3
call fcn.0041b990
mov ebx, str.string
mov eax, edi
call fcn.00459f40
mov esi, eax
test esi, esi
je 0x45df7d
mov eax, dword [esi]
mov edx, dword [eax + 0x18]
mov ecx, esi
call edx
test eax, eax
jne 0x45df9f
mov ebx, str.string
mov eax, esi
call fcn.00459f40
mov esi, eax
test esi, esi
jne 0x45df5e
xor edi, edi
lea ecx, [esp + 0x3c]
call fcn.0040fa10
lea ecx, [esp + 0x58]
call fcn.0040fa10
test edi, edi
jne 0x45de90
xor esi, esi
mov bl, 1
jmp 0x45dfb0
mov eax, dword [esi]
mov edx, dword [eax + 0x18]
mov ecx, esi
call edx
mov edi, eax
jmp 0x45df7f
mov bl, byte [esp + 0x17]
mov eax, dword [esp + 0x18]
cmp eax, esi
je 0x45dfc1
push eax
call fcn.0047271f
add esp, 4
lea ecx, [esp + 0x74]
mov dword [esp + 0xfc], 0xffffffff
call fcn.00408850
mov al, bl
mov ecx, dword [esp + 0xf4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xd8]
xor ecx, esp
call fcn.00472710
add esp, 0xec
ret 4
Function at 0x4657a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4954e3
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x4b62b0]
xor eax, esp
mov dword [esp + 0x20], eax
mov eax, dword [0x4b62b0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
push str.masterconn11.qq.com
lea ecx, [esi + 0x10]
mov dword [esp + 8], esi
mov word [esi + 4], 0x161d
mov dword [esi + 8], 0x1bb
mov dword [esi + 0xc], 0x1f40
call fcn.0040f9b0
lea eax, [esi + 0x10]
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 0x34], 0
call fcn.0041aed0
mov byte [esp + 0x30], 1
movzx eax, word [esi + 8]
push 1
push eax
lea ecx, [esp + 0x10]
call fcn.0040fa70
push eax
call dword [0x4ba41c]
lea ecx, [esp + 8]
mov dword [esi], eax
call fcn.0040fa10
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00472710
add esp, 0x30
ret

Function at 0x465dc0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x49542b
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x4b62b0]
xor eax, esp
mov dword [esp + 0x228], eax
mov eax, dword [0x4b62b0]
xor eax, esp
push eax
lea eax, [esp + 0x230]
mov dword fs:[0], eax
push 0x206
lea eax, [esp + 0x2a]
push 0
push eax
mov dword [esp + 0x10], 0
mov word [esp + 0x30], 0
call fcn.00472c50
mov eax, 1
add esp, 0xc
test byte [0x4ba60c], al
jne 0x465e44
or dword [0x4ba60c], eax
mov ecx, 0x4ba5f0
call fcn.00415ec0
push 0x499050
call fcn.004733e5
add esp, 4
mov ecx, 0x4ba5f0
call fcn.0042e0c0
test al, al
je 0x465e9a
push 0x104
lea ecx, [esp + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea edx, [esp + 0x24]
push edx
lea ecx, [esp + 0xc]
call fcn.00415f20
push eax
mov ecx, 0x4ba5f0
mov dword [esp + 0x23c], 0
call fcn.00415f50
lea ecx, [esp + 8]
mov dword [esp + 0x238], 0xffffffff
call fcn.00432550
push 0x4ba5f0
mov ecx, esi
call fcn.00415ef0
mov eax, esi
mov ecx, dword [esp + 0x230]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [esp + 0x228]
xor ecx, esp
call fcn.00472710
add esp, 0x238
ret