joyce8/EMBER2024-capa huggingface dataset:
Function at 0x70c125d0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
lea ebx, [esp + 0x24]
mov dword [esp], 0x71383040
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
jmp fcn.70c12630

Function at 0x70c12630
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x71384378]
test esi, esi
jle 0x70c1271d
mov edi, dword [0x7138437c]
xor ebx, ebx
lea edx, [edi + 4]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x70c12664
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x70c12716
add ebx, 1
add edx, 0xc
cmp ebx, esi
jne 0x70c12650
mov dword [esp], eax
mov esi, eax
call fcn.70c12dd0
test eax, eax
mov edi, eax
je 0x70c1275a
mov esi, dword [0x7138437c]
lea ebx, [ebx + ebx*2]
shl ebx, 2
add esi, ebx
mov dword [esi + 8], eax
mov dword [esi], 0
call fcn.70c12ee0
add eax, dword [edi + 0xc]
mov dword [esi + 4], eax
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov eax, dword [0x7138437c]
mov eax, dword [eax + ebx + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x70c1273a
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x70c1270f
sub eax, 0x40
and eax, 0xffffffbf
je 0x70c1270f
mov eax, dword [esp + 0x20]
add ebx, dword [0x7138437c]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
je 0x70c12724
add dword [0x71384378], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
xor ebx, ebx
jmp 0x70c1266e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.70c125d0
mov eax, dword [0x7138437c]
mov eax, dword [eax + ebx + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.70c125d0
mov dword [esp + 4], esi
mov dword [esp], str.Address__p_has_no_image_section
call fcn.70c125d0
lea esi, [esi]
Function at 0x70c12a40
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x71384388
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x71384380]
sub esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
je 0x70c12a95
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x70c12a8e
test esi, esi
je 0x70c12a8e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x70c12a70
mov dword [esp], 0x71384388
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x401029
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x423f20]
mov dword [ebp - 0x28], eax
mov eax, dword [str.__b_Y]
push esi
mov esi, dword [ebx]
push edi
mov edi, dword [ebx + 4]
xor ecx, ecx
mov dword [ebp - 0x24], eax
lea eax, [ebp - 8]
mov dword [ebp - 0x10], esi
mov dword [ebp - 8], ecx
call fcn.00401022
mov eax, dword [0x423f28]
add dword [ebp - 8], 0x23f
mov dword [ebp - 0x18], eax
mov eax, dword [0x423f2c]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], 0x20
mov dword [ebp - 0xc], 2
add dword [ebp - 0xc], 3
mov eax, esi
shl eax, 4
add eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [0x2443ef4]
cmp eax, 0xfa9
jne 0x4010a0
mov dword [0x2443ef0], 0xedeb2e40
cmp eax, 0x3eb
jne 0x4010ad
mov dword [0x244397c], ecx
mov eax, dword [ebp - 0x10]
shr eax, 5
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 8]
add edx, esi
xor eax, edx
xor eax, dword [ebp - 0x20]
cmp dword [0x2443ef4], 0x213
mov dword [0x2443eec], 0xf4ea3dee
mov dword [ebp - 4], eax
jne 0x4010ee
push ecx
push ecx
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoW]
mov eax, dword [ebp - 4]
xor ecx, ecx
sub edi, eax
cmp dword [0x2443ef4], 0xc
jne 0x401110
lea eax, [ebp - 0x2c]
push eax
push ecx
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
push 0
call dword [sym.imp.KERNEL32.dll_FindVolumeClose]
xor ecx, ecx
mov eax, edi
shr eax, 5
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x24]
add dword [ebp - 4], eax
mov edx, dword [ebp - 8]
add dword [ebp - 8], 0x61c88647
mov eax, edi
shl eax, 4
add eax, dword [ebp - 0x28]
add edx, edi
xor eax, edx
xor eax, dword [ebp - 4]
sub esi, eax
dec dword [ebp - 0x14]
mov dword [ebp - 0x10], esi
jne 0x401074
mov dword [ebx + 4], edi
pop edi
mov dword [ebx], esi
pop esi
leave
ret

Function at 0x40114e
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x2443ef4]
mov ecx, dword [0x2443980]
sub esp, 0xc00
push esi
shr eax, 3
xor esi, esi
cmp eax, esi
jbe 0x401209
push ebx
push edi
mov ebx, ecx
mov edi, eax
cmp dword [0x2443ef4], 0x959
jne 0x4011f8
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateJobObjectA]
push esi
push esi
lea eax, [ebp - 0x400]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesA]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsA]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push str.Mokigehate_xolega_viricuh_mazu_fiboy
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
push str.zewaxuwawazuwuyuvivi
push esi
call dword [sym.imp.KERNEL32.dll_FatalAppExitW]
push str.ozofowegad_dinomebaxedidox
push esi
call dword [sym.imp.KERNEL32.dll_SetFileShortNameW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessShutdownParameters]
push esi
lea eax, [ebp - 0xc00]
push eax
push esi
push str.pajebipew
push esi
push esi
call dword [sym.imp.KERNEL32.dll_LCMapStringW]
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call fcn.00401029
add ebx, 8
dec edi
jne 0x401176
pop edi
pop ebx
pop esi
leave
ret
Function at 0x4014df
Capabilities:
Clear file content
Get common file path

Disassembly:
sub esp, 0x400
push esi
xor esi, esi
cmp dword [0x2443ef4], 0x400
push edi
jne 0x40153a
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_DrawStateW]
push esi
push esi
call fcn.00401e66
push esi
push esi
call fcn.0040180e
push esi
call fcn.00401e01
push esi
push esi
call fcn.00401c4c
push esi
call fcn.00401f44
push esi
push esi
call fcn.00401712
add esp, 0x28
xor edi, edi
cmp edi, 0x16d2a
jge 0x40154f
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.GDI32.dll_GetCharWidthI]
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_LocalCompact]
cmp edi, 0x12e82fe
jg 0x401574
inc edi
cmp edi, 0x3011b
jl 0x40153c
mov eax, dword [0x426864]
mov dword [0x2443ef4], eax
call fcn.0040120c
mov edi, 0x2ec37
cmp dword [0x2443ef4], 0x51f
jne 0x4015a0
push esi
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
dec edi
jne 0x401588
pop edi
xor eax, eax
pop esi
add esp, 0x400
ret 0x10

Function at 0x4070ba
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x423cfc]
jne 0x4070c4
repz ret
jmp fcn.00409136
Function at 0x4083cd
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x423cfc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004054da
and dword [ebp - 0x14], 0
cmp dword [0x4314b4], 0
mov dword [ebp - 0x18], eax
jne 0x408480
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x408528
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x408528
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4314b4], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4314b8], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4314bc], eax
call edi
push eax
call esi
mov dword [0x4314c4], eax
test eax, eax
je 0x408480
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4314c0], eax
mov eax, dword [0x4314c0]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4084d9
cmp dword [0x4314c4], ecx
je 0x4084d9
push eax
call esi
push dword [0x4314c4]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4084d9
test ebx, ebx
je 0x4084d9
call edi
test eax, eax
je 0x4084d0
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4084d0
test byte [ebp - 8], 1
jne 0x4084d9
or dword [ebp + 0x10], 0x200000
jmp 0x40850c
mov eax, dword [0x4314b8]
cmp eax, dword [ebp - 0x18]
je 0x40850c
push eax
call esi
test eax, eax
je 0x40850c
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40850c
mov eax, dword [0x4314bc]
cmp eax, dword [ebp - 0x18]
je 0x40850c
push eax
call esi
test eax, eax
je 0x40850c
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4314b4]
call esi
test eax, eax
je 0x408528
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40852a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004070ba
leave
ret
Function at 0x405700
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4010
call fcn.0045f030
mov eax, dword [0x4da734]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x4004]
push edi
mov edi, dword [ebp + 0xc]
push 0x4000
push 0
push eax
call fcn.0046a460
add esp, 0xc
mov dword [ebp - 0x4008], 0
test esi, esi
je 0x4057f6
test edi, edi
je 0x4057f6
lea eax, [ebp - 0x4008]
push eax
push esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x4057f6
cmp eax, 0x3fff
ja 0x4057f6
lea ecx, [ebp - 0x4004]
push ecx
push eax
push 0
push esi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x4057f6
lea eax, [ebp - 0x400c]
push eax
lea eax, [ebp - 0x4010]
push eax
push 0x4b1768
lea eax, [ebp - 0x4004]
push eax
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4057f6
mov esi, dword [ebp + 0x10]
lea eax, [esi + esi]
push eax
push 0
push edi
call fcn.0046a460
mov ecx, dword [ebp - 0x4010]
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
push str._d._d._d._d
lea eax, [esi - 1]
push eax
push edi
call fcn.00405fb0
add esp, 0x28
mov eax, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045f015
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.0045f015
mov esp, ebp
pop ebp
ret

Function at 0x406050
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x4da734]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x4060d7
test ebx, ebx
je 0x4060d7
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x4060d7
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x4060d7
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 0x40
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x4060d1
push esi
push ebx
push edi
call fcn.00469960
add esp, 0xc
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x4060d1
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045f015
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045f015
mov esp, ebp
pop ebp
ret
Function at 0x4060f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x406149
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x406149
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x40613a
cmp esi, edx
jae 0x406149
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x406128
cmp esi, edx
jae 0x406149
cmp word [esi], 0
je 0x406149
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret

Function at 0x408dd0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a65b8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x4da734]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.0045ed2f
mov edi, eax
add esp, 4
test edi, edi
je 0x408e73
xorps xmm0, xmm0
movq qword [edi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.0042e62e
add esp, 4
mov dword [edi + 4], eax
jmp 0x408e75
xor edi, edi
mov eax, dword [ebp + 8]
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 0
mov ecx, dword [edi + 4]
mov dword [ebp - 4], 1
mov dword [ebp - 0x10], ecx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 2
push eax
call fcn.00403510
add esp, 4
mov ecx, eax
mov edx, dword [eax]
push 0x20
call dword [edx + 0x30]
movzx edi, ax
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 4], 3
test ecx, ecx
je 0x408ed5
mov eax, dword [ecx]
call dword [eax + 8]
test eax, eax
je 0x408ed5
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [esi + 0x38], 0
mov dword [ebp - 4], 0xffffffff
mov word [esi + 0x40], di
jne 0x408ef9
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
and eax, 0x13
or eax, 4
mov dword [esi + 0xc], eax
and ecx, eax
jne 0x408f1b
cmp byte [ebp + 0xc], 0
je 0x408f08
push esi
call fcn.0042eb55
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
test cl, 4
je 0x408f27
mov esi, str.ios_base::badbit_set
jmp 0x408f37
test cl, 2
mov esi, str.ios_base::failbit_set
mov eax, str.ios_base::eofbit_set
cmove esi, eax
lea eax, [ebp - 0x1c]
push 1
push eax
call fcn.00408f60
add esp, 8
lea ecx, [ebp - 0x30]
push eax
push esi
call fcn.00404180
push 0x4cca08
lea eax, [ebp - 0x30]
push eax
call fcn.0046953f
int3
Function at 0x40b850
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x1c], 8
push ebx
mov ebx, dword [eax + 0x18]
push esi
lea esi, [eax + 8]
mov dword [ebp - 4], ecx
push edi
jb 0x40b873
mov esi, dword [esi]
xor edx, edx
mov edi, 0x811c9dc5
add ebx, ebx
je 0x40b891
nop
movzx ecx, byte [edx + esi]
inc edx
xor ecx, edi
imul edi, ecx, 0x1000193
cmp edx, ebx
jb 0x40b880
mov ebx, dword [ebp - 4]
mov ecx, dword [ebx + 0x18]
mov edx, dword [ebx + 0xc]
and ecx, edi
lea esi, [ecx*8]
mov ecx, dword [edx + esi]
add edx, esi
cmp dword [edx + 4], eax
jne 0x40b8ca
cmp ecx, eax
jne 0x40b8c2
mov ecx, dword [ebx + 4]
mov dword [edx], ecx
mov edx, dword [ebx + 0xc]
mov ecx, dword [ebx + 4]
mov dword [esi + edx + 4], ecx
jmp 0x40b8d2
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
jmp 0x40b8d2
cmp ecx, eax
jne 0x40b8d2
mov ecx, dword [eax]
mov dword [edx], ecx
mov edx, dword [eax + 4]
lea ecx, [ebx + 4]
mov edi, dword [eax]
push eax
mov dword [edx], edi
mov esi, dword [eax]
mov edx, dword [eax + 4]
mov dword [esi + 4], edx
dec dword [ecx + 4]
call fcn.00419b10
mov eax, dword [ebp - 8]
mov dword [eax], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x40d590
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a6a48
mov eax, dword fs:[0]
push eax
sub esp, 0x244
mov eax, dword [0x4da734]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x238], esi
mov dword [ebp - 0x234], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x250]
push 3
push eax
mov dword [ebp - 0x234], 1
call fcn.0040ec40
add esp, 8
push 0xe
push str.debug_url.set
mov ecx, eax
mov dword [ebp - 4], 1
call fcn.00407c80
mov dword [ebp - 0x220], 0
xor ecx, ecx
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x234], 3
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x230], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x220], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov edx, dword [ebp - 0x23c]
mov byte [ebp - 4], 3
cmp edx, 8
jb 0x40d6a1
mov ecx, dword [ebp - 0x250]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40d697
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40d7aa
push edx
push ecx
call fcn.0045ed5f
add esp, 8
xor eax, eax
mov dword [ebp - 0x240], 0
cmp dword [ebp - 0x21c], 8
mov word [ebp - 0x250], ax
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
mov dword [ebp - 0x23c], 7
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40d750
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.0046a460
add esp, 0xc
lea eax, [ebp - 0x230]
cmp dword [ebp - 0x21c], 8
cmovae eax, dword [ebp - 0x230]
push eax
push 0x104
lea eax, [ebp - 0x218]
push eax
push 0x4b176c
push str.test_url
push str.DebugUrl
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40d732
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.00407f10
mov edx, dword [ebp - 0x21c]
cmp edx, 8
jb 0x40d78c
mov ecx, dword [ebp - 0x230]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40d782
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40d7af
push edx
push ecx
call fcn.0045ed5f
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045f015
mov esp, ebp
pop ebp
ret 4
call fcn.0046d8d9
call fcn.0046d8d9
int3
Function at 0x41d410
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a8628
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
mov eax, dword [0x4da734]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 0x10], esi
call fcn.0041f2b0
add esp, 4
push 0xd
push str.multi_wechat
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.00407c80
push eax
mov ecx, esi
call fcn.0040b900
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x41d49b
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41d491
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41d4c2
push edx
push ecx
call fcn.0045ed5f
add esp, 8
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x41d4a5
mov eax, dword [esi]
push 0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
call fcn.0046d8d9
int3
Function at 0x41d4d0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c8
mov eax, dword [0x4da734]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x4bc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
push 0x3e8
push 0
push eax
mov dword [ebp - 0x4c4], esi
mov dword [ebp - 0x4c0], ebx
call fcn.0046a460
push 0xc8
lea eax, [ebp - 0xd4]
push 0
push eax
call fcn.0046a460
add esp, 0x18
test esi, esi
je 0x41d5d0
test ebx, ebx
je 0x41d5d0
lea eax, [ebp - 0x4bc]
push eax
push 0x1f4
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x41d5d0
mov ax, word [ebp - 0x4bc]
xor esi, esi
test ax, ax
je 0x41d5d0
xor ecx, ecx
movzx edx, ax
mov ax, word [ebp + ecx - 0x4ba]
mov word [ebp - 0xa], ax
xor eax, eax
mov word [ebp - 8], ax
lea eax, [ebp - 0xd4]
push 0x64
push eax
lea eax, [ebp - 0xc]
mov word [ebp - 0xc], dx
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x41d5bb
lea eax, [ebp - 0xd4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
mov dword [ebp - 0x4c8], eax
lea eax, [ebp - 0xd4]
push eax
push dword [ebp - 0x4c4]
call fcn.004709b2
add esp, 0xc
test eax, eax
je 0x41d5e3
add esi, 4
lea ecx, [esi + esi]
movzx eax, word [ebp + ecx - 0x4bc]
mov edx, eax
test ax, ax
jne 0x41d561
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045f015
mov esp, ebp
pop ebp
ret
test edi, edi
je 0x41d639
cmp edi, 0x7fffffff
ja 0x41d630
mov ecx, ebx
mov esi, 0x7ffffffe
lea ebx, [ebp - 0xc]
sub esi, edi
mov edx, edi
sub ebx, ecx
nop
lea eax, [esi + edx]
test eax, eax
je 0x41d61b
movzx eax, word [ebx + ecx]
test ax, ax
je 0x41d61b
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x41d600
mov ebx, dword [ebp - 0x4c0]
lea eax, [ecx - 2]
test edx, edx
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
jmp 0x41d639
test edi, edi
je 0x41d639
xor eax, eax
mov word [ebx], ax
xor ecx, ecx
test edi, edi
je 0x41d647
cmp edi, 0x7fffffff
jbe 0x41d64c
mov ecx, 0x80070057
test ecx, ecx
js 0x41d67e
mov esi, edi
mov eax, ebx
test edi, edi
je 0x41d666
cmp word [eax], 0
je 0x41d666
add eax, 2
sub esi, 1
jne 0x41d658
xor eax, eax
mov ecx, 0x80070057
test esi, esi
cmovne ecx, eax
mov eax, edi
sub eax, esi
neg esi
sbb esi, esi
and esi, eax
jmp 0x41d680
xor esi, esi
test ecx, ecx
js 0x41d6d6
mov edx, edi
lea ecx, [ebx + esi*2]
sub edx, esi
je 0x41d6c9
mov eax, edx
sub eax, edi
mov edi, dword [ebp - 0x4c4]
add eax, 0x7ffffffe
add esi, eax
mov eax, dword [ebp - 0x4c8]
add eax, eax
sub eax, ecx
add edi, eax
nop word [eax + eax]
test esi, esi
je 0x41d6c9
movzx eax, word [edi + ecx]
test ax, ax
je 0x41d6c9
mov word [ecx], ax
dec esi
add ecx, 2
sub edx, 1
jne 0x41d6b0
test edx, edx
lea eax, [ecx - 2]
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045f015
mov esp, ebp
pop ebp
ret