joyce8/EMBER2024-capa huggingface dataset:
Function at 0x453c9f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0xa8]
sub esp, 0x128
mov eax, dword [0x5550ec]
xor eax, ebp
mov dword [ebp + 0xa4], eax
push ebx
push edi
xor eax, eax
xor ebx, ebx
mov byte [ebp + 0x94], bl
lea edi, [ebp + 0x95]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [0x55ace4]
cmp eax, ebx
push 0xf
pop edi
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x80], edi
jne 0x453e3e
lea eax, [ebp - 0x74]
push eax
push 0x20019
push ebx
push str.SOFTWAREMicrosoftInternet_Explorer
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x453e2b
push esi
mov esi, 0x103
push esi
lea eax, [ebp - 0x6f]
push ebx
push eax
mov byte [ebp - 0x70], bl
call sub.MSVCR80.dll_memset
add esp, 0xc
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x78]
push eax
push ebx
push str.svcVersion
push dword [ebp - 0x74]
mov dword [ebp - 0x7c], esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call esi
test eax, eax
jne 0x453d9f
cmp dword [ebp - 0x78], 1
jne 0x453d9f
lea eax, [ebp - 0x70]
push 0x5168c0
push eax
call dword [sym.imp.MSVCR80.dll_strstr]
cmp eax, ebx
pop ecx
pop ecx
je 0x453d9f
mov byte [eax], bl
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.MSVCR80.dll_atoi]
pop ecx
push 9
pop ecx
sub eax, ecx
je 0x453e24
dec eax
je 0x453d90
dec eax
jne 0x453dec
mov dword [0x55ace4], 0xb
jmp 0x453e2a
mov dword [0x55ace4], 0xa
jmp 0x453e2a
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp + 0x94]
push eax
lea eax, [ebp - 0x78]
push eax
push ebx
push str.Build
push dword [ebp - 0x74]
call esi
test eax, eax
jne 0x453e2a
lea eax, [ebp + 0x94]
push eax
call dword [sym.imp.MSVCR80.dll_atoi]
pop ecx
push 0xa
pop esi
jmp 0x453dd5
cdq
mov ecx, esi
idiv ecx
cmp eax, edi
jge 0x453dd0
push 6
pop ecx
sub eax, ecx
je 0x453e24
dec eax
je 0x453e18
dec eax
je 0x453e0c
dec eax
je 0x453e00
dec eax
je 0x453df8
mov dword [0x55ace4], 2
jmp 0x453e2a
mov dword [0x55ace4], esi
jmp 0x453e2a
mov dword [0x55ace4], 9
jmp 0x453e2a
mov dword [0x55ace4], 8
jmp 0x453e2a
mov dword [0x55ace4], 7
jmp 0x453e2a
mov dword [0x55ace4], ecx
pop esi
cmp dword [ebp - 0x74], ebx
je 0x453e39
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x55ace4]
mov ecx, dword [ebp + 0xa4]
pop edi
xor ecx, ebp
pop ebx
call fcn.004d6e66
add ebp, 0xa8
leave
ret

Function at 0x453f36
Capabilities:
Query or enumerate registry value

Disassembly:
cmp dword [esp + 8], 0
jne 0x453f41
xor eax, eax
jmp 0x453f66
lea ecx, [eax + 0x1004]
push ecx
push eax
add eax, 0x1000
push eax
mov eax, dword [esp + 0x10]
push 0
push dword [esp + 0x18]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
neg eax
sbb eax, eax
inc eax
ret 8
Function at 0x4559a7
Capabilities:
Get session user name

Disassembly:
push ebp
sub esp, 0x20c
lea ebp, [esp - 4]
mov eax, dword [0x5550ec]
xor eax, ebp
mov dword [ebp + 0x20c], eax
push 8
mov eax, 0x4f60b0
call fcn.004d766c
xor edi, edi
push 0x208
lea eax, [ebp + 2]
push edi
mov dword [ebp - 0x14], edi
push eax
mov word [ebp], di
call sub.MSVCR80.dll_memset
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp]
push eax
mov dword [ebp - 0x14], 0x104
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x455a0c
push str.defaultuser
push esi
call fcn.00402cc5
jmp 0x455a51
lea eax, [ebp]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00402cc5
lea ebx, [ebp - 0x10]
mov dword [ebp - 4], edi
call fcn.004400f0
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], edi
jne 0x455a39
push str.defaultuser
push esi
call fcn.00402cc5
jmp 0x455a46
add eax, 0xfffffff0
call fcn.00401311
add eax, 0x10
mov dword [esi], eax
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.004012f9
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x20c]
xor ecx, ebp
call fcn.004d6e66
add ebp, 0x210
leave
ret
Function at 0x455fe4
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
lea ebp, [esp - 0x90]
sub esp, 0x110
mov eax, dword [0x5550ec]
xor eax, ebp
mov dword [ebp + 0x8c], eax
mov eax, dword [ebp + 0x98]
push ebx
push esi
push edi
xor edi, edi
push 0x103
mov dword [ebp - 0x80], eax
lea eax, [ebp - 0x77]
push edi
push eax
mov esi, ecx
mov dword [ebp - 0x7c], edi
mov byte [ebp - 0x78], 0
call sub.MSVCR80.dll_memset
add esp, 0xc
push edi
push str.progman
call dword [sym.imp.USER32.dll_FindWindowW]
cmp eax, edi
je 0x456056
mov ebx, dword [sym.imp.USER32.dll_FindWindowExW]
push edi
push str.shelldll_defview
push edi
push eax
call ebx
cmp eax, edi
je 0x456056
push edi
push str.syslistview32
push edi
push eax
call ebx
cmp eax, edi
mov dword [esi + 0xc], eax
jne 0x456065
call fcn.0045650e
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0xc]
cmp eax, edi
je 0x456130
lea ecx, [ebp - 0x7c]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push dword [ebp - 0x7c]
push edi
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp eax, 0xffffffff
mov dword [esi + 0x10], eax
je 0x456130
cmp dword [esi + 0x30], edi
push 4
mov ebx, 0x1000
push ebx
je 0x4560b4
push 0x40
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
push eax
call edi
mov dword [esi + 0x20], eax
jmp 0x4560c3
push 0x34
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
push eax
call edi
mov dword [esi + 0x1c], eax
push 4
push ebx
push 0x104
push 0
push dword [esi + 0x10]
call edi
push 4
push ebx
push 0x10
push 0
push dword [esi + 0x10]
mov dword [esi + 0x24], eax
call edi
push 4
push ebx
push 8
xor ebx, ebx
push ebx
push dword [esi + 0x10]
mov dword [esi + 0x28], eax
call edi
cmp dword [esi + 0x1c], ebx
mov dword [esi + 0x2c], eax
jne 0x4560fe
cmp dword [esi + 0x20], ebx
je 0x45612e
cmp dword [esi + 0x24], 0
je 0x45612e
cmp dword [esi + 0x28], 0
je 0x45612e
test eax, eax
je 0x45612e
lea eax, [ebp - 0x78]
push eax
push dword [ebp - 0x80]
call fcn.004564ce
lea eax, [ebp - 0x78]
push eax
lea eax, [esi + 0x14]
push eax
call fcn.004058e5
mov dword [esi + 8], 1
xor edi, edi
cmp dword [esi + 8], edi
jne 0x45613a
call fcn.00456157
mov eax, dword [esi + 8]
mov ecx, dword [ebp + 0x8c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004d6e66
add ebp, 0x90
leave
ret 4
Function at 0x45d4eb
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push 0x278
mov eax, 0x4f5e08
call fcn.004d76d5
mov eax, dword [ebp + 8]
mov dword [ebp - 0x274], eax
lea eax, [ebp - 0x260]
mov esi, ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
jne 0x45d51f
xor eax, eax
jmp 0x45d60a
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edi, dword [ebp - 0x240]
xor ebx, ebx
cmp edi, ebx
je 0x45d518
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocStringLen
push esi
mov dword [ebp - 0x268], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x26c], eax
je 0x45d518
lea eax, [ebp - 0x261]
mov dword [ebp - 0x270], ebx
mov byte [ebp - 0x261], bl
push eax
lea eax, [edi + 2]
lea ebx, [ebp - 0x284]
call fcn.00454fd0
xor ebx, ebx
push ebx
lea eax, [ebp - 0x270]
push eax
push edi
push ebx
lea esi, [ebp - 0x284]
mov dword [ebp - 4], ebx
call fcn.0044c7a4
push eax
push dword [ebp - 0x26c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x45d5e9
cmp dword [ebp - 0x270], edi
jne 0x45d5e9
test edi, edi
jbe 0x45d5c6
push ebx
lea esi, [ebp - 0x284]
call fcn.0044c7a4
xor byte [eax], 0x4e
inc ebx
cmp ebx, edi
jb 0x45d5b2
push 0
lea esi, [ebp - 0x284]
call fcn.0044c7a4
push eax
push dword [ebp - 0x274]
call fcn.004058e5
mov dword [ebp - 0x268], 1
push dword [ebp - 0x26c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [ebp - 4], 0xffffffff
lea esi, [ebp - 0x284]
call fcn.0044c865
mov eax, dword [ebp - 0x268]
call fcn.004d7758
ret 4

Function at 0x45d612
Capabilities:
Read .ini file

Disassembly:
push 8
mov eax, 0x4f98f9
call fcn.004d766c
mov eax, dword [0x55a320]
mov ecx, 0x55a320
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
xor ebx, ebx
lea ecx, [ebp - 0x14]
call fcn.004907c2
mov byte [ebp - 4], 1
push dword [eax]
lea eax, [ebp - 0x10]
push str._sressrcchsuplive.svr
call fcn.00401a17
mov eax, dword [ebp - 0x14]
pop ecx
pop ecx
add eax, 0xfffffff0
call fcn.004012f9
mov esi, dword [ebp - 0x10]
push esi
push ebx
push str.TryNo
push str.Common
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edi, eax
lea eax, [esi - 0x10]
call fcn.004012f9
mov eax, edi
call fcn.004d7744
ret
Function at 0x45e053
Capabilities:
Acquire debug privileges

Disassembly:
push 0x28
push 0x531b88
call fcn.004d74d4
or dword [ebp - 0x20], 0xffffffff
xor esi, esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x28], esi
xor eax, eax
lea edi, [ebp - 0x24]
stosd dword es:[edi], eax
mov dword [ebp - 0x38], esi
lea edi, [ebp - 0x34]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 4], esi
lea eax, [ebp - 0x1c]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
cmp eax, esi
je 0x45e0da
lea eax, [ebp - 0x28]
push eax
push str.SeDebugPrivilege
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
cmp eax, esi
je 0x45e0da
mov dword [ebp - 0x38], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 2
push esi
push esi
push esi
lea eax, [ebp - 0x38]
push eax
push esi
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
cmp eax, esi
je 0x45e0da
mov dword [ebp - 0x20], esi
mov dword [ebp - 4], 0xfffffffe
call fcn.0045e0f1
mov eax, dword [ebp - 0x20]
call fcn.004d7519
ret

Function at 0x45ea35
Capabilities:
Check if file exists

Disassembly:
push 0xc
mov eax, 0x4f5d5b
call fcn.004d766c
mov esi, ecx
mov eax, dword [0x55a320]
and dword [ebp - 0x14], 0
mov ecx, 0x55a320
call dword [eax + 0xc]
lea edi, [eax + 0x10]
mov dword [ebp - 0x10], edi
and dword [ebp - 4], 0
mov ecx, dword [esi + 0x10]
xor eax, eax
inc eax
dec ecx
mov ebx, eax
shl ebx, cl
mov ecx, dword [ebp + 8]
test dword [ecx + 0xc], ebx
je 0x45ea76
mov dword [ebp - 0x14], eax
jmp 0x45ead3
mov eax, dword [esi + 8]
mov ecx, dword [esi + 4]
push eax
push ecx
push dword [esi]
lea eax, [ebp - 0x18]
push eax
call fcn.0045e9ad
lea edi, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.00402a4c
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.004012f9
mov edi, dword [ebp - 0x10]
cmp dword [edi - 0xc], 0
je 0x45ead3
mov esi, dword [esi + 0xc]
push dword [esi - 0xc]
lea eax, [ebp - 0x10]
push esi
call fcn.004029fb
mov edi, dword [ebp - 0x10]
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
mov dword [ebp - 0x14], eax
je 0x45ead3
mov eax, dword [ebp + 8]
add dword [eax + 0xc], ebx
lea eax, [edi - 0x10]
call fcn.004012f9
mov eax, dword [ebp - 0x14]
call fcn.004d7744
ret 4
Function at 0x45eae6
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x14
mov eax, 0x4f14bf
call fcn.004d766c
push str.IsWow64Process
xor ebx, ebx
push str.kernel32.dll
mov dword [ebp - 0x18], ebx
xor esi, esi
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
cmp edi, ebx
je 0x45eb2d
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call edi
cmp dword [ebp - 0x1c], 1
jne 0x45eb2d
inc esi
mov edi, dword [ebp + 0xc]
mov eax, dword [edi + 8]
neg esi
sbb esi, esi
lea ecx, [ebp - 0x18]
push ecx
and esi, 0x100
or esi, 0x20019
push esi
push ebx
push eax
push dword [edi + 4]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x45ec7a
mov dword [ebp - 0x1c], ebx
mov eax, dword [0x55a320]
mov ecx, 0x55a320
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 4], ebx
push 0xff
lea esi, [ebp - 0x10]
mov dword [ebp - 0x20], 0x104
call fcn.00401918
push eax
push dword [ebp - 0x1c]
push dword [ebp - 0x18]
call dword [sym.imp.SHLWAPI.dll_SHEnumKeyExW]
mov esi, eax
neg esi
sbb esi, esi
inc esi
cmp dword [ebp - 0x10], ebx
jne 0x45eba9
xor eax, eax
jmp 0x45ebb3
push dword [ebp - 0x10]
call dword [sym.imp.MSVCR80.dll_wcslen]
pop ecx
lea edx, [ebp - 0x10]
call fcn.00401385
lea eax, [ebp - 0x10]
call fcn.0042407f
cmp esi, ebx
je 0x45ec61
mov dword [ebp - 0x14], ebx
lea ebx, [edi + 0xc]
mov eax, ebx
call fcn.0047fa84
test eax, eax
jbe 0x45ec48
mov eax, ebx
call fcn.0047fa84
mov esi, dword [ebp - 0x14]
cmp esi, eax
jb 0x45ebf0
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov eax, dword [ebx + 4]
shl esi, 3
mov ecx, dword [eax + esi + 4]
mov eax, dword [ebp + 8]
xor edi, edi
dec ecx
inc edi
shl edi, cl
test dword [eax + 0xc], edi
jne 0x45ec36
mov eax, ebx
call fcn.0047fa84
cmp dword [ebp - 0x14], eax
jb 0x45ec1a
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov eax, dword [ebx + 4]
add eax, esi
push dword [eax]
xor ecx, ecx
lea esi, [ebp - 0x10]
call fcn.00406410
cmp eax, 0xffffffff
je 0x45ec36
mov eax, dword [ebp + 8]
add dword [eax + 0xc], edi
inc dword [ebp - 0x14]
mov eax, ebx
call fcn.0047fa84
cmp dword [ebp - 0x14], eax
jb 0x45ebdc
mov edi, dword [ebp + 0xc]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.004012f9
inc dword [ebp - 0x1c]
xor ebx, ebx
jmp 0x45eb5e
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.004012f9
cmp dword [ebp - 0x18], ebx
je 0x45ec7a
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.004d7744
ret 8
Function at 0x4605fe
Capabilities:
Check if file exists

Disassembly:
push 8
mov eax, 0x4f13a3
call fcn.004d766c
lea eax, [ebp - 0x10]
push eax
xor esi, esi
xor edi, edi
mov dword [ebp - 0x14], str.QQPCRTP
call fcn.00460661
pop ecx
mov dword [ebp - 4], esi
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], esi
je 0x460651
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x46064e
push dword [ebp + esi*4 - 0x14]
call fcn.00460cb3
test eax, eax
pop ecx
jne 0x46064b
inc esi
cmp esi, 1
jb 0x460635
jmp 0x46064e
xor edi, edi
inc edi
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.004012f9
mov eax, edi
call fcn.004d7744
ret

Function at 0x460bf9
Capabilities:
Create process on windows

Disassembly:
push 0x5c
mov eax, 0x4f1344
call fcn.004d766c
push 0x40
xor esi, esi
lea eax, [ebp - 0x64]
push esi
push eax
xor ebx, ebx
call sub.MSVCR80.dll_memset
xor eax, eax
mov dword [ebp - 0x20], esi
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [0x55a320]
xor edi, edi
inc edi
add esp, 0xc
mov ecx, 0x55a320
mov dword [ebp - 0x68], 0x44
mov dword [ebp - 0x3c], edi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x10]
push dword [ebp + 8]
mov dword [ebp - 4], esi
push str.__s___s
call fcn.00401a17
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x68]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp - 0x10]
mov word [ebp - 0x38], 0xa
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x460c80
mov ebx, edi
cmp dword [ebp - 0x20], esi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x460c93
push dword [ebp - 0x20]
call edi
mov dword [ebp - 0x20], esi
cmp dword [ebp - 0x1c], esi
je 0x460ca0
push dword [ebp - 0x1c]
call edi
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.004012f9
mov eax, ebx
call fcn.004d7744
ret

Function at 0x461293
Capabilities:
Hash data with md5

Disassembly:
and dword [eax + 0x10], 0
and dword [eax + 0x14], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x461f99
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
xor esi, esi
push esi
push 0x80
push 3
push esi
push 1
push SysReAllocStringLen
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x461fc7
xor eax, eax
jmp 0x46201e
lea eax, [ebp - 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x462015
push ebx
push dword [ebp - 0xc]
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
cmp ebx, esi
je 0x462014
push esi
lea eax, [ebp - 4]
push eax
push dword [ebp - 0xc]
mov dword [ebp - 4], esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x462014
push dword [ebp + 0xc]
push 1
push ebx
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
xor ecx, ecx
test eax, eax
setge cl
mov esi, ecx
pop ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop edi
pop esi
leave
ret
Function at 0x464780
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esi]
cmp dword [eax - 0xc], 0
jne 0x46478b
xor al, al
ret
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4647b1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x4647b1
push dword [esi]
call fcn.004909a6
neg eax
sbb eax, eax
pop ecx
neg eax
ret
mov al, 1
ret

Function at 0x464a22
Capabilities:
Check if file exists
Get file attributes

Disassembly:
test esi, esi
je 0x464a52
push esi
call dword [sym.imp.MSVCR80.dll_wcslen]
test eax, eax
pop ecx
je 0x464a52
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 2
setne cl
mov eax, ecx
ret
xor eax, eax
ret

Function at 0x464a55
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
sub esp, 0x20c
lea ebp, [esp - 4]
mov eax, dword [0x5550ec]
xor eax, ebp
mov dword [ebp + 0x20c], eax
push 0x10
mov eax, 0x4f5a9b
call fcn.004d766c
xor esi, esi
push 0x208
lea eax, [ebp + 2]
mov dword [ebp - 0x14], esi
push esi
push eax
mov dword [ebp - 0x18], esi
mov word [ebp], si
call sub.MSVCR80.dll_memset
mov eax, dword [0x55a320]
add esp, 0xc
mov ecx, 0x55a320
mov dword [ebp - 0x14], 0x20a
call dword [eax + 0xc]
lea ebx, [eax + 0x10]
mov dword [ebp - 0x10], ebx
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp]
push eax
lea eax, [ebp - 0x18]
push eax
push str.ProgramPath
push str.SOFTWAREkbasesrv
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], esi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x464b64
cmp dword [ebp - 0x18], 1
mov word [ebp + 0x208], si
jne 0x464b64
lea eax, [ebp]
push eax
call dword [sym.imp.MSVCR80.dll_wcslen]
test eax, eax
pop ecx
je 0x464b64
lea esi, [ebp]
call fcn.00464a22
test eax, eax
je 0x464b64
mov eax, esi
push eax
call dword [sym.imp.MSVCR80.dll_wcslen]
pop ecx
mov ecx, esi
mov ebx, eax
push ecx
lea eax, [ebp - 0x10]
call fcn.00402a8d
lea eax, [ebp - 0x1c]
xor ecx, ecx
push eax
inc ecx
lea eax, [ebp - 0x10]
call fcn.004076f2
push 0x5115d4
push eax
mov byte [ebp - 4], 1
call fcn.004018d9
test eax, eax
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x1c]
setne bl
add eax, 0xfffffff0
call fcn.004012f9
test bl, bl
je 0x464b5c
push 0x5c
lea eax, [ebp - 0x10]
call fcn.00442452
mov esi, dword [ebp - 0x10]
add esi, 0xfffffff0
jmp 0x464b67
lea esi, [ebx - 0x10]
mov eax, esi
call fcn.00401311
add eax, 0x10
mov dword [edi], eax
mov eax, esi
call fcn.004012f9
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x20c]
xor ecx, ebp
call fcn.004d6e66
add ebp, 0x210
leave
ret
Function at 0x464b9f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
sub esp, 0x20c
lea ebp, [esp - 4]
mov eax, dword [0x5550ec]
xor eax, ebp
mov dword [ebp + 0x20c], eax
push 0x14
mov eax, 0x4ff0dd
call fcn.004d766c
xor esi, esi
push 0x208
lea eax, [ebp + 2]
mov dword [ebp - 0x1c], esi
push esi
push eax
mov dword [ebp - 0x18], esi
mov word [ebp], si
call sub.MSVCR80.dll_memset
mov eax, dword [0x55a320]
add esp, 0xc
mov ecx, 0x55a320
mov dword [ebp - 0x1c], 0x20a
call dword [eax + 0xc]
lea ebx, [eax + 0x10]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], esi
lea esi, [ebp - 0x10]
call fcn.00463e7f
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp]
push eax
lea eax, [ebp - 0x18]
push eax
push str.ProgramPath
mov byte [ebp - 4], 1
push dword [ebp - 0x10]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x464cb8
and word [ebp + 0x208], ax
cmp dword [ebp - 0x18], 1
jne 0x464cb8
lea eax, [ebp]
push eax
call dword [sym.imp.MSVCR80.dll_wcslen]
test eax, eax
pop ecx
je 0x464cb8
lea esi, [ebp]
call fcn.00464a22
test eax, eax
je 0x464cb8
mov eax, esi
push eax
call dword [sym.imp.MSVCR80.dll_wcslen]
pop ecx
mov ecx, esi
mov ebx, eax
push ecx
lea eax, [ebp - 0x14]
call fcn.00402a8d
lea eax, [ebp - 0x20]
xor ecx, ecx
push eax
inc ecx
lea eax, [ebp - 0x14]
call fcn.004076f2
push 0x5115d4
push eax
mov byte [ebp - 4], 2
call fcn.004018d9
test eax, eax
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x20]
setne bl
add eax, 0xfffffff0
call fcn.004012f9
test bl, bl
je 0x464cb0
push 0x5c
lea eax, [ebp - 0x14]
call fcn.00442452
mov esi, dword [ebp - 0x14]
add esi, 0xfffffff0
jmp 0x464cbb
lea esi, [ebx - 0x10]
mov eax, esi
call fcn.00401311
add eax, 0x10
mov dword [edi], eax
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.004012f9
mov eax, esi
call fcn.004012f9
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x20c]
xor ecx, ebp
call fcn.004d6e66
add ebp, 0x210
leave
ret
Function at 0x465452
Capabilities:
Read .ini file

Disassembly:
push 0x10
mov eax, 0x5006d7
call fcn.004d766c
call fcn.004243c8
mov eax, dword [eax]
cmp eax, 2
je 0x46550a
cmp eax, 3
je 0x46550a
cmp eax, 8
jne 0x4654ba
call fcn.00401ad6
lea esi, [ebp - 0x18]
call fcn.004647b4
lea ecx, [ebp - 0x10]
push str.ressrcchsuplive.svr
push ecx
mov ecx, eax
mov dword [ebp - 4], 1
call fcn.004065f0
mov eax, dword [ebp - 0x18]
pop ecx
pop ecx
add eax, 0xfffffff0
call fcn.004012f9
push dword [ebp - 0x10]
push 0x1f41
jmp 0x465540
call fcn.00401ad6
lea esi, [ebp - 0x1c]
call fcn.004647b4
lea ecx, [ebp - 0x14]
push str.ressrcchsuplive.svr
push ecx
mov ecx, eax
mov dword [ebp - 4], 2
call fcn.004065f0
mov eax, dword [ebp - 0x1c]
pop ecx
pop ecx
add eax, 0xfffffff0
call fcn.004012f9
push dword [ebp - 0x14]
push 0x537
push str.TryNo
push str.Common
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov esi, eax
mov eax, dword [ebp - 0x14]
jmp 0x465555
call fcn.00401ad6
lea esi, [ebp - 0x18]
call fcn.004647b4
and dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
push str.uplive.svr
push ecx
mov ecx, eax
call fcn.004065f0
mov eax, dword [ebp - 0x18]
pop ecx
pop ecx
add eax, 0xfffffff0
call fcn.004012f9
push dword [ebp - 0x10]
push 0x64b
push str.TryNo
push str.Common
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov esi, eax
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.004012f9
mov eax, esi
call fcn.004d7744
ret

Function at 0x465565
Capabilities:
Create thread

Disassembly:
push ecx
mov eax, dword [0x5550ec]
xor eax, esp
mov dword [esp], eax
push edi
xor edi, edi
cmp dword [esi + 0x24], edi
jne 0x4655e2
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateEventW]
push edi
push edi
push 1
push edi
call ebx
cmp eax, edi
mov dword [esi + 0x1c], eax
je 0x4655b5
push edi
push edi
push 1
push edi
call ebx
cmp eax, edi
mov dword [esi + 0x20], eax
je 0x4655b5
push edi
push edi
push esi
push 0x46574d
push edi
push edi
call dword [sym.imp.MSVCR80.dll__beginthreadex]
add esp, 0x18
cmp eax, edi
mov dword [esi + 0x18], eax
jne 0x4655da
mov eax, dword [esi + 0x1c]
cmp eax, edi
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x4655c8
push eax
call ebx
mov dword [esi + 0x1c], edi
mov eax, dword [esi + 0x20]
cmp eax, edi
je 0x4655d5
push eax
call ebx
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
jmp 0x4655e1
mov dword [esi + 0x24], 1
pop ebx
mov ecx, dword [esp + 4]
pop edi
xor ecx, esp
call fcn.004d6e66
pop ecx
ret