joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401010
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x404780
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x3d8
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], 0x10
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x3e4]
push ecx
call fcn.00403dc0
add esp, 8
lea edx, [ebp - 0x3e4]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
movsx ecx, byte [eax + 1]
cmp ecx, 0x3a
jne 0x40109b
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
movsx edx, byte [ecx]
test edx, edx
je 0x40109b
mov eax, dword [ebp - 0x14]
movsx ecx, byte [eax]
cmp ecx, 0x5c
jne 0x40109b
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
movsx ecx, byte [eax]
test ecx, ecx
je 0x40110d
mov edx, dword [ebp - 0x14]
movsx eax, byte [edx]
cmp eax, 0x5c
jne 0x401102
mov ecx, dword [ebp - 0x14]
mov byte [ecx], 0
lea edx, [ebp - 0x3e4]
push edx
call dword [0x42ec84]
test eax, eax
jne 0x4010ed
push 0
lea eax, [ebp - 0x3e4]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x4010eb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4010eb
xor al, al
jmp 0x40112d
jmp 0x4010fc
mov ecx, dword [ebp - 0x18]
and ecx, 0x10
cmp ecx, 0x10
je 0x4010fc
xor al, al
jmp 0x40112d
mov edx, dword [ebp - 0x14]
mov byte [edx], 0x5c
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
jmp 0x40109b
jmp 0x401124
mov dword [ebp - 4], 0xffffffff
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401150
Capabilities:
Move file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x32c
push edi
mov eax, dword [ebp + 8]
push eax
call fcn.004015d0
add esp, 4
and eax, 0xff
test eax, eax
je 0x401179
mov eax, 1
jmp 0x40139c
mov ecx, dword [0x406054]
add ecx, 0x600
mov dword [ebp - 0x324], ecx
mov byte [ebp - 0x31c], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x31b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x20c], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x20b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea edx, [ebp - 0x104]
push edx
push 0x104
call fcn.00402ec0
add esp, 8
mov byte [ebp - 0x31c], 0x5c
push 0xa
lea eax, [ebp - 0x31b]
push eax
call fcn.004021b0
add esp, 8
push 0x42e9dc
lea ecx, [ebp - 0x31c]
push ecx
call fcn.00403f10
add esp, 8
lea edx, [ebp - 0x31c]
push edx
lea eax, [ebp - 0x104]
push eax
call fcn.00403f10
add esp, 8
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x320], eax
cmp dword [ebp - 0x320], 0
jne 0x401248
xor eax, eax
jmp 0x40139c
push 5
push 0
call fcn.00403cf0
add esp, 8
shl eax, 0x14
add eax, 0x4c
mov dword [ebp - 0x218], eax
mov edx, dword [0x406054]
mov eax, dword [edx + 0x5fc]
mov dword [ebp - 0x328], eax
push 0
push 0
mov ecx, dword [ebp - 0x328]
push ecx
mov edx, dword [ebp - 0x320]
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [ebp - 0x328]
shr eax, 1
push eax
push 0x46
call fcn.00403cf0
add esp, 8
mov dword [ebp - 0x214], eax
push 0
lea ecx, [ebp - 0x214]
push ecx
mov edx, dword [ebp - 0x214]
push edx
mov eax, dword [ebp - 0x324]
add eax, dword [ebp - 0x214]
push eax
mov ecx, dword [ebp - 0x320]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4012d3
jmp 0x401308
push 1
push 0
push 0x10004b
mov edx, dword [ebp - 0x320]
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0xffffffff
jne 0x4012fa
jmp 0x401308
mov eax, dword [ebp - 0x108]
cmp eax, dword [ebp - 0x218]
jb 0x40128a
push 0
push 0
push 0
mov ecx, dword [ebp - 0x320]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea edx, [ebp - 0x210]
push edx
mov eax, dword [ebp - 0x328]
push eax
mov ecx, dword [ebp - 0x324]
push ecx
mov edx, dword [ebp - 0x320]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0x320]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx]
test edx, edx
je 0x40137e
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov dword [ebp - 0x32c], eax
lea edx, [ebp - 0x104]
push edx
call fcn.00401440
add esp, 4
jmp 0x401397
lea eax, [ebp - 0x104]
push eax
push 0x42e9d8
mov ecx, dword [ebp + 8]
push ecx
call dword [0x42ec98]
add esp, 0xc
mov eax, 1
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x401440
Capabilities:
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
and eax, 1
test eax, eax
je 0x401463
push 0x80
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop ebp
ret

Function at 0x4015d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov al, cl
pop ebp
ret

Function at 0x401d60
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push edi
mov byte [ebp - 0x104], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x104]
push ecx
call fcn.00403dc0
add esp, 8
lea edx, [ebp - 0x104]
push edx
call fcn.00402ab0
add esp, 4
push 0x104
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x42eb70
call fcn.00403f60
add esp, 4
add eax, 1
push eax
push 0x42eb70
mov ecx, dword [ebp + 8]
push ecx
call fcn.00403f60
add esp, 4
mov edx, dword [ebp + 8]
add edx, eax
push edx
call fcn.00403e10
add esp, 0xc
lea eax, [ebp - 0x104]
push eax
call fcn.00403f60
add esp, 4
add eax, 1
push eax
lea ecx, [ebp - 0x104]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00403f60
add esp, 4
mov ecx, dword [ebp + 8]
add ecx, eax
push ecx
call fcn.00403e10
add esp, 0xc
mov edx, dword [ebp + 0xc]
push edx
call fcn.00403f60
add esp, 4
add eax, 1
push eax
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00403f60
add esp, 4
mov edx, dword [ebp + 8]
add edx, eax
push edx
call fcn.00403e10
add esp, 0xc
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x402850
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0
jmp 0x402868
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x100
jge 0x4028c2
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], 0
jmp 0x402889
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 8
jge 0x4028b3
mov eax, dword [ebp - 4]
and eax, 1
test eax, eax
je 0x4028a9
mov ecx, dword [ebp - 4]
shr ecx, 1
xor ecx, 0xedb88320
mov dword [ebp - 4], ecx
jmp 0x4028b1
mov edx, dword [ebp - 4]
shr edx, 1
mov dword [ebp - 4], edx
jmp 0x402880
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [eax*4 + 0x42f308], ecx
jmp 0x40285f
mov esp, ebp
pop ebp
ret

Function at 0x402dd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
mov ecx, 5
mov esi, 0x42e990
lea edi, [ebp - 0x14]
rep movsd dword es:[edi], dword [esi]
mov byte [ebp - 0x14], 0x52
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [0x42eca0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x42ecb4], eax
mov dword [ebp - 0x20], 0
xor edx, edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x20], 0x4e72454b
mov dword [ebp - 0x1c], 0x32336c65
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x402ec0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 3
jb 0x402efb
mov eax, dword [ebp + 0xc]
push eax
call fcn.004015d0
add esp, 4
and eax, 0xff
test eax, eax
jne 0x402f09
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov eax, dword [ebp + 0xc]
push eax
call fcn.00403e30
add esp, 4
push 0x42e9d0
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00403ff0
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x402f49
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
push 0x5c
mov eax, dword [ebp - 4]
push eax
call fcn.00403ed0
add esp, 8
mov byte [eax], 0
mov esp, ebp
pop ebp
ret
Function at 0x402a60
Capabilities:
Check if file exists
Get common file path
Get program files directory
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x64a3a4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x418]
push eax
push 0x20019
push 0
push 0x5d9c98
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x418], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x402ab6
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00426a9d
mov esp, ebp
pop ebp
ret 4
push 0x208
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.00492030
add esp, 0xc
mov dword [ebp - 0x41c], 0x104
lea eax, [ebp - 0x41c]
mov dword [ebp - 0x420], 1
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x420]
push eax
push 0
push 0x5d9890
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x402bb2
push esi
push edi
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00492030
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0
push 0x26
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea edi, [ebp - 0x20c]
add edi, 0xfffffffe
nop dword [eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x402b60
lea eax, [ebp - 0x20c]
mov ecx, 0x10
mov esi, str.Internet_Exploreriexplore.exe
rep movsd dword es:[edi], dword [esi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
pop edi
pop esi
test eax, eax
je 0x402aa3
lea ecx, [ebp - 0x20c]
mov eax, ecx
sub ebx, eax
nop dword [eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [ebx + ecx - 2], ax
test ax, ax
jne 0x402ba0
jmp 0x402bdc
lea ecx, [ebp - 0x414]
mov eax, ecx
sub ebx, eax
nop dword [eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [ebx + ecx - 2], ax
test ax, ax
jne 0x402bc0
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
pop ebx
call fcn.00426a9d
mov esp, ebp
pop ebp
ret 4
Function at 0x402cc0
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x64a3a4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x208
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x218], 0
push 0
push eax
mov dword [ebp - 0x210], 0
mov dword [ebp - 0x214], 0
mov dword [ebp - 0x21c], 0
call fcn.00492030
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x218]
add esp, 0xc
push eax
push 0x20019
push 0
push 0x5d9be4
push SysReAllocString
call esi
test eax, eax
je 0x402d47
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00426a9d
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x210]
push eax
push 0x20019
push 0
push str.shell
push dword [ebp - 0x218]
call esi
test eax, eax
jne 0x402d36
lea eax, [ebp - 0x214]
push eax
push 0x20019
push 0
push str.opencommand
push dword [ebp - 0x210]
call esi
test eax, eax
jne 0x402d36
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x21c], 0x104
push eax
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x220], 1
push eax
lea eax, [ebp - 0x220]
push eax
push 0
push 0x5d9890
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x210]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x214]
call esi
lea eax, [ebp - 0x20c]
push eax
call fcn.00494fa8
push 0x5d9c94
push eax
call fcn.004913e4
add esp, 0xc
test eax, eax
je 0x402d36
lea esi, [eax + 2]
push 0x5d9c94
push esi
call fcn.004913e4
add esp, 8
test eax, eax
je 0x402d36
xor ecx, ecx
push esi
mov word [eax], cx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, dword [ebp - 4]
neg eax
pop esi
sbb eax, eax
xor ecx, ebp
neg eax
call fcn.00426a9d
mov esp, ebp
pop ebp
ret
Function at 0x403320
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1fa4
call fcn.00426ab0
mov eax, dword [0x64a3a4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x804]
push esi
push edi
push 0x800
push 0
push eax
call fcn.00492030
push 0x800
lea eax, [ebp - 0x1004]
push 0
push eax
call fcn.00492030
add esp, 0x18
lea eax, [ebp - 0x1fa4]
push 0x7d0
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov ecx, 0x17
lea edi, [ebp - 0x1fa0]
mov esi, str.Program_FilesInternet_Exploreriexplore.exe
xor eax, eax
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
nop
movzx ecx, word [ebp + eax - 0x1fa4]
lea eax, [eax + 2]
mov word [ebp + eax - 0x1006], cx
test cx, cx
jne 0x403390
lea edx, [ebp - 0x804]
mov ecx, ebx
sub edx, ebx
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x4033b2
mov edx, ebx
mov esi, ebx
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x4033c6
lea edi, [ebp - 0x1fa4]
sub edx, esi
add edi, 0xfffffffe
nop dword [eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4033e0
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 1
push 0
push 0
push ebx
mov ecx, edx
and ecx, 3
push str.open
rep movsb byte es:[edi], byte [esi]
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop edi
pop esi
pop ebx
cmp eax, 0x20
ja 0x403430
push 0
push 0
lea eax, [ebp - 0x804]
push eax
lea eax, [ebp - 0x1004]
push eax
call fcn.0042831b
add esp, 0x10
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
call fcn.00426a9d
mov esp, ebp
pop ebp
ret 4

Function at 0x403cf0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x90], 8
lea esi, [edi + 0x7c]
jb 0x403d08
mov eax, dword [esi]
jmp 0x403d0a
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ebx, dword [ebp + 8]
test eax, eax
je 0x403d72
lea eax, [edi + 4]
lea ecx, [edi + 0xac]
cmp ecx, eax
je 0x403d2f
push 0xffffffffffffffff
push 0
push eax
call fcn.00404b30
cmp dword [esi + 0x14], 8
jb 0x403d39
mov eax, dword [esi]
jmp 0x403d3b
mov eax, esi
push ebx
push eax
mov ecx, edi
call fcn.00403c20
test eax, eax
jne 0x403d72
cmp dword [esi + 0x14], 8
jb 0x403d52
mov eax, dword [esi]
jmp 0x403d54
mov eax, esi
push 0
push 0
push ebx
push eax
call fcn.0042831b
add esp, 0x10
test eax, eax
je 0x403d72
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret 4
cmp dword [edi + 0xa8], 8
lea eax, [edi + 0x94]
jb 0x403d83
mov eax, dword [eax]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x403dd8
lea eax, [edi + 0x1c]
lea ecx, [edi + 0xac]
cmp ecx, eax
je 0x403da5
push 0xffffffffffffffff
push 0
push eax
call fcn.00404b30
cmp dword [esi + 0x14], 8
jb 0x403daf
mov eax, dword [esi]
jmp 0x403db1
mov eax, esi
push ebx
push eax
mov ecx, edi
call fcn.00403c20
test eax, eax
jne 0x403dd8
cmp dword [esi + 0x14], 8
jb 0x403dc6
mov esi, dword [esi]
push 0
push 0
push ebx
push esi
call fcn.0042831b
add esp, 0x10
test eax, eax
jne 0x403d66
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 4
Function at 0x404e60
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c7bfb
mov eax, dword fs:[0]
push eax
sub esp, 0x4e0
mov eax, dword [0x64a3a4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0xc]
lea ecx, [ebp - 0x4e0]
mov esi, dword [ebp + 8]
xor eax, eax
push eax
push 0x5d9890
mov dword [ebp - 0x4e8], ebx
mov dword [ebp - 0x4ec], 0
mov dword [ebp - 0x4cc], 7
mov dword [ebp - 0x4d0], 0
mov word [ebp - 0x4e0], ax
call fcn.00404c50
mov dword [ebp - 4], 0
test ebx, ebx
jne 0x404f21
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], ebx
mov ecx, esi
mov word [esi], ax
lea eax, [ebp - 0x4e0]
push eax
call fcn.00403e60
mov ecx, dword [ebp - 0x4cc]
cmp ecx, 8
jb 0x4050b1
inc ecx
push ecx
push dword [ebp - 0x4e0]
lea ecx, [ebp - 0x4e0]
call fcn.00404da0
jmp 0x4050b1
lea eax, [ebp - 0x4c8]
push eax
push 0x3e8
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x405001
xor ebx, ebx
cmp word [ebp - 0x4c8], bx
je 0x405001
lea edi, [ebp - 0x4c8]
mov dword [ebp - 0x4e4], ebx
nop word [eax + eax]
push 0x5d9ba4
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x404fe3
push 0x5d9bac
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x404fe3
movzx eax, word [edi]
mov word [ebp - 0x18], ax
mov eax, dword [ebp - 0x4e4]
push 0x64
movzx eax, word [ebp + eax - 0x4c6]
mov word [ebp - 0x16], ax
xor eax, eax
mov word [ebp - 0x14], ax
lea eax, [ebp - 0xe0]
push eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x405084
lea eax, [ebp - 0xe0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
lea eax, [ebp - 0xe0]
push edi
push eax
push dword [ebp - 0x4e8]
call fcn.00494c46
add esp, 0xc
test eax, eax
je 0x405045
add ebx, 4
lea edi, [ebp - 0x4c8]
lea eax, [ebx + ebx]
add edi, eax
mov dword [ebp - 0x4e4], eax
cmp word [edi], 0
jne 0x404f60
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov word [esi], ax
mov ecx, dword [ebp - 0x4cc]
cmp ecx, 8
jae 0x40509d
mov eax, dword [ebp - 0x4d0]
add eax, 1
je 0x4050a5
add eax, eax
push eax
lea eax, [ebp - 0x4e0]
push eax
push esi
call fcn.00490e70
mov ecx, dword [ebp - 0x4cc]
add esp, 0xc
jmp 0x4050a5
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x4e0]
call fcn.00405b80
mov ecx, dword [ebp - 0x4e8]
lea eax, [ecx + edi*2]
push eax
lea ecx, [ebp - 0x4e0]
call fcn.00405b80
lea eax, [ebp - 0x4e0]
mov ecx, esi
push eax
call fcn.004020b0
lea ecx, [ebp - 0x4e0]
call fcn.00402650
jmp 0x4050b1
push 0x5d9890
mov ecx, esi
call fcn.004020e0
lea ecx, [ebp - 0x4e0]
call fcn.00402650
jmp 0x4050b1
mov eax, dword [ebp - 0x4e0]
mov dword [esi], eax
mov eax, dword [ebp - 0x4d0]
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], ecx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00426a9d
mov esp, ebp
pop ebp
ret 8
Function at 0x405bd0
Capabilities:
Check if file exists
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c7d20
mov eax, dword fs:[0]
push eax
sub esp, 0xac
mov eax, dword [0x64a3a4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
lea ecx, [ebp - 0xac]
call fcn.0042eb16
cmp dword [ebx + 0x178], 8
lea esi, [ebx + 0x164]
jb 0x405c1e
mov eax, dword [esi]
jmp 0x405c20
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x405d28
cmp dword [esi + 0x14], 8
jb 0x405c37
mov esi, dword [esi]
push 0
push 0x80
push 4
push 0
push 1
push SysReAllocString
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x405d28
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0xb0], eax
inc eax
push eax
mov dword [ebp - 0xb4], eax
call fcn.00426add
mov edi, eax
add esp, 4
test edi, edi
je 0x405d28
push dword [ebp - 0xb4]
push 0
push edi
call fcn.00492030
add esp, 0xc
lea eax, [ebp - 0xb8]
push 0
push eax
push dword [ebp - 0xb0]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0xb0]
lea ecx, [ebp - 0xac]
push edi
call fcn.0042f4b5
push edi
call fcn.00426ae6
add esp, 4
lea eax, [ebp - 0x40]
lea ecx, [ebp - 0xac]
push eax
call fcn.0042ed1f
push eax
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
call fcn.00429bda
add esp, 8
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 2
call fcn.00402610
cmp dword [ebp - 0x18], 0
jbe 0x405d20
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
mov ecx, ebx
cmovae eax, dword [ebp - 0x28]
push eax
push str.FileMD5
push str.ZGSetting
call fcn.0042b396
lea ecx, [ebp - 0x28]
call fcn.00402650
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00426a9d
mov esp, ebp
pop ebp
ret
Function at 0x407780
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
push esi
mov esi, ecx
je 0x4077b0
lea eax, [esi + 0x2b8]
push eax
push 0
push esi
push 0x407760
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x2b4], eax
pop esi
pop ebp
ret 4
call fcn.004071f0
pop esi
pop ebp
ret 4

Function at 0x4077c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x64a3a4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x208
lea eax, [ebp - 0x20c]
mov esi, ecx
push 0
push eax
call fcn.00492030
push 0x208
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.00492030
add esp, 0x18
lea eax, [ebp - 0x20c]
push 0
push 0x2b
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp dword [esi + 0x118], 8
lea ecx, [esi + 0x104]
jb 0x407823
mov ecx, dword [ecx]
lea edx, [ebp - 0x414]
nop dword [eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x407830
push edi
lea edi, [ebp - 0x20c]
add edi, 0xfffffffe
nop dword [eax + eax]
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x407850
mov eax, dword [0x5d9da0]
lea edx, [ebp - 0x20c]
mov dword [edi], eax
add edx, 0xfffffffe
nop dword [eax]
mov cx, word [edx + 2]
lea edx, [edx + 2]
test cx, cx
jne 0x407870
mov ecx, dword [str.WorthyShop]
lea edi, [ebp - 0x20c]
mov dword [edx], ecx
add edi, 0xfffffffe
mov ecx, dword [0x5d9ddc]
mov dword [edx + 4], ecx
mov ecx, dword [0x5d9de0]
mov dword [edx + 8], ecx
mov ecx, dword [0x5d9de4]
mov dword [edx + 0xc], ecx
mov ecx, dword [0x5d9de8]
mov dword [edx + 0x10], ecx
mov cx, word [0x5d9dec]
mov word [edx + 0x14], cx
nop dword [eax]
mov cx, word [edi + 2]
lea edi, [edi + 2]
test cx, cx
jne 0x4078c0
mov dword [edi], eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0042f556
add esp, 4
lea ecx, [ebp - 0x20c]
add ecx, 0xfffffffe
pop edi
nop word [eax + eax]
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x4078f0
mov eax, dword [str.WorthyShop]
mov dword [ecx], eax
mov eax, dword [0x5d9ddc]
mov dword [ecx + 4], eax
mov eax, dword [0x5d9de0]
mov dword [ecx + 8], eax
mov eax, dword [0x5d9de4]
mov dword [ecx + 0xc], eax
mov eax, dword [0x5d9de8]
mov dword [ecx + 0x10], eax
mov ax, word [0x5d9dec]
mov word [ecx + 0x14], ax
lea ecx, [ebp - 0x20c]
add ecx, 0xfffffffe
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x407936
mov eax, dword [str..ini]
mov dword [ecx], eax
mov eax, dword [0x5d9fb8]
mov dword [ecx + 4], eax
mov ax, word [0x5d9fbc]
mov word [ecx + 8], ax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
push str.InstallPath
push str.ZGQJCfg
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea eax, [ebp - 0x414]
mov ecx, esi
push eax
push str.InstallPath
call fcn.004079a0
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00426a9d
mov esp, ebp
pop ebp
ret