joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4550e0
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x4b9f2c
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x50a360]
xor eax, esp
mov dword [esp + 0x214], eax
push esi
push edi
mov eax, dword [0x50a360]
xor eax, esp
push eax
lea eax, [esp + 0x224]
mov dword fs:[0], eax
mov esi, dword [esp + 0x238]
mov edi, dword [esp + 0x234]
push esi
lea ecx, [esp + 0x10]
mov dword [esp + 0x14], 0
call fcn.00402560
mov dword [esp + 0x22c], 0
test esi, esi
je 0x455293
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x455151
sub eax, edx
sar eax, 1
cmp eax, 2
jb 0x455293
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x22]
push ecx
mov word [esp + 0x24], ax
call fcn.00494750
add esp, 0xc
push esi
lea ecx, [esp + 0x14]
call fcn.00402560
push 2
push 0
lea edx, [esp + 0x1c]
push edx
lea ecx, [esp + 0x1c]
mov byte [esp + 0x238], 1
call fcn.004179c0
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x230], 2
call fcn.00401bf0
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x22c], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4551e1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [esp + 0x10]
push 0x104
lea ecx, [esp + 0x1c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x455254
push 2
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x14]
call fcn.00418610
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x230], 3
call fcn.00401bf0
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x22c], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x455244
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x18]
push ecx
push 0
lea ecx, [esp + 0x14]
call fcn.00417890
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
push eax
call fcn.00401560
add eax, 0x10
mov dword [edi], eax
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
add esp, 4
mov byte [esp + 0x22c], 0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4552a8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x4552a8
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
push eax
call fcn.00401560
add esp, 4
add eax, 0x10
mov dword [edi], eax
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
mov dword [esp + 0x22c], edx
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4552cf
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, edi
mov ecx, dword [esp + 0x224]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.004945a7
add esp, 0x224
ret 8
Function at 0x455300
Capabilities:
Enumerate processes

Disassembly:
push 0xffffffffffffffff
push 0x4b9f6b
mov eax, dword fs:[0]
push eax
sub esp, 0x238
mov eax, dword [0x50a360]
xor eax, esp
mov dword [esp + 0x234], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x50a360]
xor eax, esp
push eax
lea eax, [esp + 0x24c]
mov dword fs:[0], eax
mov edx, dword [esp + 0x25c]
xor edi, edi
mov ebp, ecx
cmp edx, edi
je 0x455427
mov eax, edx
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x455353
sub eax, esi
sar eax, 1
cmp eax, 2
jb 0x455427
push edx
lea eax, [esp + 0x1c]
push eax
mov ecx, ebp
call fcn.004550e0
push edi
push 2
mov dword [esp + 0x25c], edi
mov dword [esp + 0x1c], edi
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
mov dword [esp + 0x1c], 0x22c
cmp edi, 0xffffffff
je 0x4553f6
lea ecx, [esp + 0x1c]
push ecx
push edi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x4553ef
mov ebx, dword [sym.imp.KERNEL32.dll_OpenProcess]
nop
mov edx, dword [esp + 0x24]
push edx
push 0
push 0x1fffff
call ebx
mov esi, eax
test esi, esi
je 0x4553e0
mov eax, dword [esp + 0x18]
push eax
push esi
mov ecx, ebp
call fcn.00455000
test eax, eax
je 0x4553d9
inc dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x1c]
push ecx
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4553b0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov dword [esp + 0x254], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x455421
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x14]
jmp 0x455429
xor eax, eax
mov ecx, dword [esp + 0x24c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x234]
xor ecx, esp
call fcn.004945a7
add esp, 0x244
ret 4

Function at 0x455550
Capabilities:
Capture screenshot

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x70], 0
jne 0x455563
mov dword [edi + 0x70], 1
cmp dword [edi + 0x74], 0
jne 0x455570
mov dword [edi + 0x74], 1
mov esi, dword [esp + 0x1c]
mov eax, dword [esi + 8]
sub eax, dword [esi]
mov ecx, dword [edi + 0x70]
cdq
idiv ecx
mov ecx, eax
mov dword [esp + 0x1c], eax
test edx, edx
je 0x45558e
inc ecx
mov dword [esp + 0x1c], ecx
mov eax, dword [esi + 0xc]
sub eax, dword [esi + 4]
mov esi, dword [edi + 0x74]
cdq
idiv esi
mov ebp, eax
test edx, edx
je 0x4555a1
inc ebp
xor ebx, ebx
test ecx, ecx
jle 0x4555e7
xor esi, esi
test ebp, ebp
jle 0x4555e2
lea ecx, [ecx]
mov edx, dword [esp + 0x18]
mov eax, dword [edi + 0x74]
mov ecx, dword [edi + 0x70]
push 0xcc0020
push 0
push 0
push edx
push eax
imul eax, esi
push ecx
imul ecx, ebx
push eax
mov eax, dword [esp + 0x30]
push ecx
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
inc esi
cmp esi, ebp
jl 0x4555b0
mov ecx, dword [esp + 0x1c]
inc ebx
cmp ebx, ecx
jl 0x4555a7
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
Function at 0x4560b0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x20c
mov eax, dword [0x50a360]
xor eax, esp
mov dword [esp + 0x208], eax
push esi
push edi
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x12]
push ecx
mov word [esp + 0x14], ax
call fcn.00494750
mov eax, dword [0x50b824]
lea edx, [esp + 0x14]
push edx
push eax
call fcn.00458600
lea edi, [esp + 0x1c]
add esp, 0x14
add edi, 0xfffffffe
jmp 0x44ca40
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x44ca40
mov ecx, 6
mov esi, str.BinPack.ini
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 8]
push ecx
push 0
push str.LoadPolicy
push str.Setting
movsw word es:[edi], word [esi]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [esp + 0x210]
pop edi
pop esi
xor ecx, esp
call fcn.004945a7
add esp, 0x20c
ret
add ecx, 0x1cec
jmp 0x44c9f0

Function at 0x456ee0
Capabilities:
Check if file exists

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x1dd8]
xor ecx, ecx
test eax, eax
setne cl
push edi
mov edi, ecx
test eax, eax
je 0x456f1f
mov eax, dword [esi + 0x1e08]
cmp dword [eax - 0xc], 0
je 0x456f1f
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x456f1f
xor eax, eax
cmp dword [esi + 0x1ddc], eax
pop edi
setne al
pop esi
add eax, 2
ret
mov eax, edi
pop edi
pop esi
ret

Function at 0x458530
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push esi
push 0x4c9930
push eax
call fcn.00496ca9
mov esi, eax
add esp, 8
test esi, esi
jne 0x45854b
pop esi
ret
mov eax, dword [esp + 0x14]
mov ecx, eax
or ecx, dword [esp + 0x18]
push edi
je 0x458560
mov edi, dword [esp + 0x14]
mov dword [edi], eax
jmp 0x458583
push 2
push 0
push esi
call fcn.00497b5d
push esi
call fcn.004986e8
mov edi, dword [esp + 0x24]
push 0
push 0
push esi
mov dword [edi], eax
call fcn.00497b5d
add esp, 0x1c
mov eax, dword [esp + 0x20]
mov edx, eax
or edx, dword [esp + 0x24]
je 0x45859b
push 0
push eax
push esi
call fcn.00497b5d
add esp, 0xc
mov eax, dword [edi]
push ebp
push eax
call fcn.00464376
mov ebp, dword [esp + 0x18]
add esp, 4
mov dword [ebp], eax
test eax, eax
je 0x4585e6
mov ecx, dword [edi]
push ebx
push esi
push ecx
push 1
push eax
call fcn.004982f5
push esi
mov ebx, eax
call fcn.00496f9e
add esp, 0x14
cmp ebx, dword [edi]
pop ebx
je 0x4585ec
mov eax, dword [ebp]
test eax, eax
je 0x4585e6
push eax
call fcn.0046436b
add esp, 4
mov dword [ebp], 0
pop ebp
pop edi
xor eax, eax
pop esi
ret
pop ebp
pop edi
mov eax, 1
pop esi
ret
Function at 0x459480
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x4ba2c0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebp
push esi
push edi
mov eax, dword [0x50a360]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov ecx, dword [esp + 0x30]
push 0xffffffffffffffff
push 0
call fcn.0046e6d1
mov esi, dword [esp + 0x2c]
push esi
lea ecx, [esp + 0x18]
call fcn.00402560
mov eax, esi
mov dword [esp + 0x24], 0
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4594d0
sub eax, edx
sar eax, 1
jne 0x45951e
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov dword [esp + 0x24], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x459509
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x18
ret
mov ebp, dword [esp + 0x34]
mov esi, dword [esp + 0x14]
push ebp
push esi
call fcn.004952a4
add esp, 8
mov edi, eax
call fcn.0046c2c1
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x45954c
push 0x80004005
call fcn.00401150
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x10], eax
mov byte [esp + 0x24], 1
test edi, edi
je 0x4595d2
xor ecx, ecx
mov word [edi], cx
test esi, esi
jne 0x459572
xor eax, eax
jmp 0x459586
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x459577
sub eax, edx
sar eax, 1
push eax
push esi
lea ecx, [esp + 0x18]
call fcn.00401860
lea ecx, [esp + 0x10]
call fcn.00407740
lea ecx, [esp + 0x10]
call fcn.00407830
mov edx, dword [esp + 0x10]
cmp dword [edx - 0xc], 0
je 0x4595bf
mov ecx, dword [esp + 0x30]
mov eax, dword [ecx + 8]
lea edx, [esp + 0x10]
push edx
push eax
call fcn.0046e9cb
lea esi, [edi + 2]
push ebp
push esi
call fcn.004952a4
mov edi, eax
add esp, 8
test edi, edi
jne 0x459565
test esi, esi
jne 0x4595da
xor eax, eax
jmp 0x4595ef
mov eax, esi
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4595e0
sub eax, edx
sar eax, 1
push eax
push esi
lea ecx, [esp + 0x18]
call fcn.00401860
lea ecx, [esp + 0x10]
call fcn.00407740
lea ecx, [esp + 0x10]
call fcn.00407830
mov eax, dword [esp + 0x10]
cmp dword [eax - 0xc], 0
mov esi, dword [esp + 0x30]
je 0x45962a
mov eax, dword [esi + 8]
lea ecx, [esp + 0x10]
push ecx
push eax
mov ecx, esi
call fcn.0046e9cb
mov eax, dword [esp + 0x10]
mov esi, dword [esi + 8]
add eax, 0xfffffff0
mov byte [esp + 0x24], 0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x459652
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov dword [esp + 0x24], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x45967a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x18
ret
Function at 0x459ba0
Capabilities:
Write file on windows

Disassembly:
push ecx
mov eax, dword [esp + 8]
push esi
push eax
lea ecx, [esp + 8]
call fcn.00402560
mov ecx, dword [esp + 4]
push 0x4cb948
push ecx
call fcn.00496ca9
mov esi, eax
add esp, 8
test esi, esi
jne 0x459bed
mov eax, dword [esp + 4]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x459be8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
pop esi
pop ecx
ret
mov ecx, dword [esp + 0x10]
push ebx
push edi
mov edi, dword [esp + 0x1c]
push esi
push edi
push 1
push ecx
call fcn.004973f6
push esi
mov ebx, eax
call fcn.00496f9e
mov eax, dword [esp + 0x20]
add esp, 0x14
cmp ebx, edi
pop edi
pop ebx
jne 0x459bcc
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x459c32
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
pop esi
pop ecx
ret
Function at 0x45e970
Capabilities:
Get file version info

Disassembly:
mov eax, dword [esp + 4]
sub esp, 8
push ebx
push esi
push edi
mov esi, ecx
test eax, eax
je 0x45e99f
lea edx, [esi + 0x84]
sub edx, eax
jmp 0x45e990
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x45e990
lea eax, [esp + 0x18]
push eax
lea ebx, [esi + 0x84]
push ebx
mov dword [esp + 0x20], 0
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
je 0x45ea4f
mov eax, dword [esi]
test eax, eax
je 0x45e9d1
push eax
call fcn.0046436b
add esp, 4
push edi
call fcn.00464376
add esp, 4
mov dword [esi], eax
test eax, eax
je 0x45ea4f
mov ecx, dword [esp + 0x18]
push eax
push edi
push ecx
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x45ea4f
mov ecx, dword [esi]
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x14]
push eax
push str.VarFileInfoTranslation
push ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jle 0x45ea4f
cmp dword [esp + 0xc], 4
jb 0x45ea4f
mov eax, dword [esp + 0x10]
movzx edx, word [eax + 2]
movzx eax, word [eax]
push edx
push eax
push str.StringFileInfo_04x_04x_
add esi, 4
push esi
call fcn.00496035
add esp, 0x10
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 8
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 8
ret 4

Function at 0x460c80
Capabilities:
Generate random numbers via winapi

Disassembly:
push ecx
mov ecx, dword [ecx + 4]
lea eax, [esp + 3]
push eax
push 1
push ecx
mov byte [esp + 0xf], 0
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
movzx eax, byte [esp + 3]
cdq
mov ecx, 0xa
idiv ecx
mov eax, edx
pop ecx
ret
Function at 0x460da0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4bae4b
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x50a360]
xor eax, esp
mov dword [esp + 0x74], eax
push ebx
push esi
push edi
mov eax, dword [0x50a360]
xor eax, esp
push eax
lea eax, [esp + 0x88]
mov dword fs:[0], eax
mov esi, dword [esp + 0x98]
mov eax, dword [esp + 0x9c]
mov edi, ecx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], vtable.CFont.0
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [esp + 0x18], ecx
mov ecx, dword [eax + 8]
mov dword [esp + 0x1c], edx
mov edx, dword [eax + 0xc]
mov eax, dword [edi + 0x20]
push eax
mov dword [esp + 0x94], 0
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], edx
call dword [sym.imp.USER32.dll_GetParent]
push eax
call fcn.00467abd
mov ecx, dword [eax + 0x20]
push 0
push 0
push 0x31
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
push eax
call fcn.00470a28
mov eax, dword [eax + 4]
lea edx, [esp + 0x28]
push edx
push 0x5c
push eax
call dword [sym.imp.GDI32.dll_GetObjectW]
lea ecx, [esp + 0x28]
push ecx
mov dword [esp + 0x3c], 0x2bc
mov dword [esp + 0x2c], 0x14
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
push eax
lea ecx, [esp + 0x14]
call fcn.00470a3c
mov edx, dword [esi]
mov edx, dword [edx + 0x28]
lea eax, [esp + 0x10]
push eax
mov ecx, esi
call edx
push 1
mov ecx, esi
mov ebx, eax
call fcn.0046ff6a
mov ecx, dword [edi + 0x54]
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push ecx
mov ecx, esi
call edx
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x24]
mov edi, dword [edi + 0x60]
add dword [esp + 0x18], 0x14
sub eax, ecx
sub eax, 0x14
cdq
sub eax, edx
sar eax, 1
add ecx, eax
mov eax, dword [esi]
mov edx, dword [eax + 0x68]
mov dword [esp + 0x1c], ecx
push 4
lea ecx, [esp + 0x1c]
push ecx
push 0xffffffffffffffff
push edi
mov ecx, esi
call edx
test ebx, ebx
je 0x460edd
mov eax, dword [esi]
mov edx, dword [eax + 0x28]
push ebx
mov ecx, esi
call edx
lea ecx, [esp + 0x10]
mov dword [esp + 0x90], 0xffffffff
mov dword [esp + 0x10], vtable.CFont.0
call fcn.00407c10
mov ecx, dword [esp + 0x88]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x74]
xor ecx, esp
call fcn.004945a7
add esp, 0x84
ret 8

Function at 0x461110
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0x6a09e667
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0x3c6ef372
mov dword [eax + 0x14], 0xa54ff53a
mov dword [eax + 0x18], 0x510e527f
mov dword [eax + 0x1c], 0x9b05688c
mov dword [eax + 0x20], 0x1f83d9ab
mov dword [eax + 0x24], 0x5be0cd19
ret
Function at 0x463dd0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x20c
mov eax, dword [0x50a360]
xor eax, esp
mov dword [esp + 0x208], eax
push ebx
push ebp
push esi
push edi
xor eax, eax
push 0x206
mov esi, ecx
push eax
lea ecx, [esp + 0x1a]
push ecx
mov word [esp + 0x1c], ax
call fcn.00494750
push 0x208
lea ebx, [esi + 4]
push 0
push ebx
call fcn.00494750
push 0x208
lea ebp, [esi + 0x20c]
push 0
push ebp
call fcn.00494750
lea edx, [esp + 0x34]
push edx
push 0
call fcn.00458600
lea edi, [esp + 0x3c]
add esp, 0x2c
add edi, 0xfffffffe
lea ebx, [ebx]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x463e40
lea eax, [esp + 0x10]
push eax
push 0x104
push ebx
push 0x4ef7cc
mov ecx, 0xb
mov esi, str.ResearchDownload.ini
push str.Exsrv
rep movsd dword es:[edi], dword [esi]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push str.UsageStatistics
call esi
lea ecx, [esp + 0x10]
push ecx
push 0x104
push ebp
push 0x4ef7cc
push 0x4eae68
push str.UsageStatistics
call esi
mov ecx, dword [esp + 0x218]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004945a7
add esp, 0x20c
ret

Function at 0x464000
Capabilities:
Check internet connectivity via wininet
Get hostname

Disassembly:
sub esp, 0x218
mov eax, dword [0x50a360]
xor eax, esp
mov dword [esp + 0x214], eax
push ebp
push esi
xor ebp, ebp
push ebp
lea eax, [esp + 0x14]
push eax
mov esi, ecx
mov dword [esp + 0x18], ebp
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
test eax, eax
jne 0x464047
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.004945a7
add esp, 0x218
ret
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x1e]
push edx
mov word [esp + 0x20], cx
call fcn.00494750
add esp, 0xc
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x18]
push ecx
push 2
mov dword [esp + 0x18], 0x208
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
je 0x46402e
lea edx, [esp + 0x14]
push str.spreadtrum.com
push edx
call fcn.00495a5d
add esp, 8
test eax, eax
je 0x4640ab
lea eax, [esp + 0x14]
push str.unisoc.com
push eax
call fcn.00495a5d
add esp, 8
test eax, eax
jne 0x46402e
push edi
mov ecx, esi
mov dword [0x5089a8], 2
call fcn.00463dd0
lea edi, [esi + 4]
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4640c5
sub eax, edx
sar eax, 1
jne 0x46410b
lea eax, [esi + 0x20c]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4640e0
sub eax, edx
sar eax, 1
jne 0x46410b
pop edi
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.004945a7
add esp, 0x218
ret
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x464110
sub eax, edx
sar eax, 1
je 0x46413e
push edi
mov ecx, esi
call fcn.00463f10
test eax, eax
je 0x46413e
mov ebp, 1
mov dword [0x5089a8], 0
jmp 0x464178
lea edx, [esi + 0x20c]
mov eax, edx
lea edi, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x464150
sub eax, edi
sar eax, 1
je 0x464178
push edx
mov ecx, esi
call fcn.00463f10
test eax, eax
je 0x464178
mov ebp, 1
mov dword [0x5089a8], ebp
mov ecx, dword [esp + 0x220]
pop edi
pop esi
mov eax, ebp
pop ebp
xor ecx, esp
call fcn.004945a7
add esp, 0x218
ret
Function at 0x4641a0
Capabilities:
Create directory

Disassembly:
push ebp
lea ebp, [esp - 0x1a0]
sub esp, 0x220
mov eax, dword [0x50a360]
xor eax, ebp
mov dword [ebp + 0x19c], eax
mov eax, dword [ebp + 0x1ac]
push ebx
mov ebx, dword [ebp + 0x1a8]
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x80], eax
test ebx, ebx
je 0x4642e9
test eax, eax
je 0x4642e9
cmp dword [ebp + 0x1b0], 0
je 0x4642e9
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x6a]
push ecx
xor esi, esi
mov word [ebp - 0x6c], ax
call fcn.00494750
add esp, 0xc
lea edx, [ebp - 0x7c]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov eax, dword [0x5089a8]
cmp eax, 2
jne 0x46422f
mov ecx, edi
call fcn.00464000
mov eax, dword [0x5089a8]
cmp eax, 2
je 0x4642e5
test eax, eax
lea eax, [edi + 4]
je 0x46423c
lea eax, [edi + 0x20c]
movzx ecx, word [ebp - 0x76]
movzx edx, word [ebp - 0x7a]
push ecx
movzx ecx, word [ebp - 0x7c]
push edx
push ecx
push eax
lea edx, [ebp - 0x6c]
push str._s_04d__02d__02d
push edx
call fcn.00496035
add esp, 0x18
push 0
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
inc esi
cmp esi, 0x3fffffff
jg 0x4642a4
lea eax, [esi + esi]
call fcn.004947d0
mov edi, esp
test edi, edi
je 0x4642a4
push esi
push edi
push 0xffffffffffffffff
xor ecx, ecx
push ebx
push ecx
push 3
mov word [edi], cx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
neg eax
sbb eax, eax
and eax, edi
jmp 0x4642a6
xor eax, eax
movzx edx, word [ebp - 0x6e]
movzx ecx, word [ebp - 0x72]
push eax
movzx eax, word [ebp - 0x70]
push edx
movzx edx, word [ebp - 0x74]
push eax
push ecx
push edx
lea eax, [ebp - 0x6c]
push eax
mov ecx, eax
push str._s_02d__02d__02d__03d__s.bin
push ecx
call fcn.00496035
mov edx, dword [ebp + 0x1b0]
mov eax, dword [ebp - 0x80]
push edx
push eax
lea ecx, [ebp - 0x6c]
push ecx
call fcn.00459ba0
add esp, 0x2c
mov esi, eax
mov eax, esi
jmp 0x4642eb
xor eax, eax
lea esp, [ebp - 0x8c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x19c]
xor ecx, ebp
call fcn.004945a7
add ebp, 0x1a0
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4650a1
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
test ebx, 0xffff0000
jne 0x4650c5
cmp dword [edi + 0x54], 0
jne 0x4650c5
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.00471eac
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.00465062
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8