joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4292b0
Capabilities:
Get common file path

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49f065
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x30
mov eax, dword [0x4cd070]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x34], esi
lea eax, [ebp - 0x34]
mov dword [ebp - 0x38], 0
mov edi, dword [sym.imp.USERENV.dll_GetAllUsersProfileDirectoryW]
push eax
push 0
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x34], 0
call edi
mov eax, dword [ebp - 0x34]
test eax, eax
jne 0x42932c
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
jmp 0x42947e
xor ecx, ecx
mov edx, 2
mul edx
xorps xmm0, xmm0
movq qword [ebp - 0x1c], xmm0
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00465400
add esp, 4
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x18], 0
push dword [ebp - 0x3c]
push eax
call fcn.00433550
mov eax, dword [ebp - 0x34]
add eax, eax
push eax
push 0
push dword [ebp - 0x1c]
call fcn.0047e1d0
add esp, 0xc
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 0x1c]
call edi
test eax, eax
jne 0x4293a8
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [ebp - 0x38], 1
mov dword [ebp - 4], 1
jmp 0x429457
xorps xmm0, xmm0
mov dword [ebp - 0x20], 0
push 0xffffffffffffffff
push dword [ebp - 0x1c]
movups xmmword [ebp - 0x30], xmm0
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x20], 0
movups xmmword [ebp - 0x30], xmm0
call fcn.00405e40
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x30]
add eax, 8
push eax
call fcn.004064a0
push str.Tencent
push eax
push dword [ebp - 0x30]
call fcn.00480d25
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x30]
add eax, 8
add esp, 0xc
mov dword [ebp - 0x2c], eax
add eax, 8
push eax
call fcn.004064a0
mov edi, dword [ebp - 0x30]
push str.WeChat_
push eax
push edi
call fcn.00480d25
add dword [ebp - 0x2c], 8
lea ecx, [ebp - 0x30]
add esp, 0xc
call fcn.00429970
lea eax, [ebp - 0x30]
mov ecx, esi
push eax
call fcn.00405bb0
mov dword [ebp - 0x38], 1
test edi, edi
je 0x429440
push edi
call fcn.00480a27
add esp, 4
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x429450
push eax
call fcn.00480a27
add esp, 4
mov dword [ebp - 4], 2
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x42947e
or edi, 0xffffffff
mov eax, edi
lock xadd dword [ecx + 4], eax
jne 0x42947e
mov eax, dword [ecx]
call dword [eax]
mov ecx, dword [ebp - 0x18]
lock xadd dword [ecx + 8], edi
dec edi
jne 0x42947e
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00464f19
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x429970
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x4cd070]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 4], 0
setle al
test al, al
je 0x4299a2
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00464f19
mov esp, ebp
pop ebp
ret
push 0x200
lea eax, [ebp - 0x204]
push 0
push eax
call fcn.0047e1d0
mov esi, dword [esi]
add esp, 0xc
test esi, esi
je 0x4299c4
cmp word [esi], 0
jne 0x4299c9
mov esi, 0x4aebf4
movzx eax, word [esi]
push ebx
mov ebx, 1
push edi
test ax, ax
je 0x429b0c
lea ecx, [ebp - 0x204]
mov dword [ebp - 0x220], 0x2f
sub ecx, esi
lea edx, [ebx + 0x39]
mov dword [ebp - 0x21c], ecx
mov edi, 0x5c
nop dword [eax]
cmp di, ax
je 0x429a12
cmp word [ebp - 0x220], ax
jne 0x429af6
cmp dx, word [esi - 2]
je 0x429af6
xorps xmm0, xmm0
mov dword [ebp - 0x208], 0
push 0xffffffffffffffff
lea eax, [ebp - 0x204]
mov dword [ebp - 0x208], 0
movups xmmword [ebp - 0x218], xmm0
push eax
lea ecx, [ebp - 0x218]
movups xmmword [ebp - 0x218], xmm0
call fcn.00405e40
mov edi, dword [ebp - 0x218]
test edi, edi
je 0x429a67
cmp word [edi], 0
mov eax, edi
jne 0x429a6c
mov eax, 0x4aebf4
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
sete al
test al, al
jne 0x429a96
push 0
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebx, eax
test ebx, ebx
je 0x429bb6
test edi, edi
je 0x429aad
push edi
call fcn.00480a27
add esp, 4
mov dword [ebp - 0x218], 0
mov eax, dword [ebp - 0x20c]
mov dword [ebp - 0x210], 0
mov dword [ebp - 0x214], 0
test eax, eax
je 0x429ae8
push eax
call fcn.00480a27
add esp, 4
mov dword [ebp - 0x20c], 0
mov dword [ebp - 0x208], 0
mov ecx, dword [ebp - 0x21c]
mov edi, 0x5c
lea edx, [edi - 0x22]
mov ax, word [esi]
mov word [ecx + esi], ax
add esi, 2
movzx eax, word [esi]
test ax, ax
jne 0x429a00
xorps xmm0, xmm0
mov dword [ebp - 0x208], 0
push 0xffffffffffffffff
lea eax, [ebp - 0x204]
mov dword [ebp - 0x208], 0
movups xmmword [ebp - 0x218], xmm0
push eax
lea ecx, [ebp - 0x218]
movups xmmword [ebp - 0x218], xmm0
call fcn.00405e40
mov esi, dword [ebp - 0x218]
test esi, esi
je 0x429b57
cmp word [esi], 0
mov eax, esi
jne 0x429b5c
mov eax, 0x4aebf4
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
sete al
test al, al
jne 0x429b7e
push 0
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebx, eax
test ebx, ebx
setne bl
test esi, esi
je 0x429b90
push esi
call fcn.00480a27
add esp, 4
mov ecx, dword [ebp - 0x20c]
test ecx, ecx
je 0x429ba3
push ecx
call fcn.00480a27
add esp, 4
pop edi
mov al, bl
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00464f19
mov esp, ebp
pop ebp
ret
test edi, edi
je 0x429bc3
push edi
call fcn.00480a27
add esp, 4
mov eax, dword [ebp - 0x20c]
test eax, eax
je 0x429bd6
push eax
call fcn.00480a27
add esp, 4
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop ebx
xor ecx, ebp
pop esi
call fcn.00464f19
mov esp, ebp
pop ebp
ret
Function at 0x42a250
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x288
mov eax, dword [0x4cd070]
xor eax, esp
mov dword [esp + 0x284], eax
push esi
push edi
mov eax, ecx
mov dword [esp + 0x10], edx
push 0
push eax
mov dword [esp + 0x88], eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov edi, eax
test edi, edi
jne 0x42a29e
xor al, al
pop edi
pop esi
mov ecx, dword [esp + 0x284]
xor ecx, esp
call fcn.00464f19
mov esp, ebp
pop ebp
ret
push edi
call fcn.004865a4
mov esi, eax
add esp, 4
test esi, esi
je 0x42a288
push esi
push edi
push 0
push dword [esp + 0x8c]
mov byte [esp + 0x1f], 0
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x42a30d
lea eax, [esp + 0x84]
push eax
lea eax, [esp + 0x84]
push eax
push 0x4b5884
push esi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x42a30d
mov eax, dword [esp + 0x80]
mov byte [esp + 0xf], 1
movups xmm0, xmmword [eax]
movups xmmword [esp + 0x40], xmm0
movups xmm0, xmmword [eax + 0x10]
movups xmmword [esp + 0x50], xmm0
movups xmm0, xmmword [eax + 0x20]
movups xmmword [esp + 0x60], xmm0
mov edi, dword [esp + 0x10]
mov ecx, edi
push 0x4aebf4
call fcn.00406050
cmp byte [esp + 0xf], 0
je 0x42a45c
push 0x100
lea eax, [esp + 0x8c]
push 0
push eax
call fcn.0047e1d0
add esp, 0xc
lea eax, [esp + 0x188]
push 0x100
push 0
push eax
call fcn.0047e1d0
mov ecx, dword [esp + 0x58]
add esp, 0xc
movzx eax, cx
shr ecx, 0x10
push eax
push ecx
mov ecx, dword [esp + 0x50]
movzx eax, cx
push eax
shr ecx, 0x10
lea eax, [esp + 0x94]
push ecx
push str._d._d._d._d_n
push 0x100
push eax
call fcn.00425f30
mov ecx, dword [esp + 0x70]
add esp, 0x1c
movzx eax, cx
shr ecx, 0x10
push eax
push ecx
mov ecx, dword [esp + 0x58]
movzx eax, cx
push eax
shr ecx, 0x10
lea eax, [esp + 0x194]
push ecx
push str._d._d._d._d_n
push 0x100
push eax
call fcn.00425f30
lea ecx, [esp + 0xa4]
add esp, 0x1c
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x42a3c4
sub ecx, edx
je 0x42a40d
lea eax, [esp + 0x88]
push eax
lea ecx, [esp + 0x18]
call fcn.00403b60
push ecx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x34]
call fcn.00405d00
mov ecx, dword [eax]
test ecx, ecx
je 0x42a3fb
cmp word [ecx], 0
jne 0x42a400
mov ecx, 0x4aebf4
push dword [eax + 4]
push ecx
mov ecx, edi
call fcn.00405e40
jmp 0x42a44a
lea ecx, [esp + 0x188]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x42a417
sub ecx, edx
je 0x42a45c
lea eax, [esp + 0x188]
push eax
lea ecx, [esp + 0x18]
call fcn.00403b60
push ecx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x34]
call fcn.00405d00
push eax
mov ecx, edi
call fcn.00406020
lea ecx, [esp + 0x2c]
call fcn.00405df0
lea ecx, [esp + 0x14]
call fcn.00403aa0
push esi
call fcn.00480a27
mov ecx, dword [esp + 0x290]
add esp, 4
mov al, byte [esp + 0xf]
pop edi
pop esi
xor ecx, esp
call fcn.00464f19
mov esp, ebp
pop ebp
ret
Function at 0x42a5b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x4cd070]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ecx]
mov dword [ebp - 8], 0
cmp eax, 0xffffffff
je 0x42a5f4
push 0
lea ecx, [ebp - 8]
push ecx
push dword [ebp + 8]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x42a5f4
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00464f19
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.writeFile_erro___d
push str.Utils
push 0x335
push str.utilsUtils.cpp
push 4
call fcn.0040e400
push eax
call fcn.00402c30
mov ecx, dword [ebp - 4]
add esp, 0x1c
xor ecx, ebp
xor eax, eax
call fcn.00464f19
mov esp, ebp
pop ebp
ret

Function at 0x42a630
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x4cd070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, edx
test ecx, ecx
je 0x42a6e8
cmp word [ecx], 0
je 0x42a6e8
push esi
push 0
push 0
push 3
push 0
push 1
push SysReAllocString
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x42a685
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00464f19
mov esp, ebp
pop ebp
ret
push edi
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
test edi, edi
jg 0x42a6af
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00464f19
mov esp, ebp
pop ebp
ret
push edi
mov ecx, ebx
call fcn.00405900
push 0
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push edi
push dword [ebx]
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00464f19
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
pop ebx
call fcn.00464f19
mov esp, ebp
pop ebp
ret

Function at 0x42a700
Capabilities:
Check if file exists
Move file

Disassembly:
mov edx, dword [edx]
test edx, edx
je 0x42a70c
cmp word [edx], 0
jne 0x42a711
mov edx, 0x4aebf4
mov ecx, dword [ecx]
test ecx, ecx
je 0x42a71d
cmp word [ecx], 0
jne 0x42a722
mov ecx, 0x4aebf4
jmp fcn.0042a730
Function at 0x42a730
Capabilities:
Check if file exists
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push edi
mov edi, ecx
mov ebx, edx
test edi, edi
je 0x42a7b9
test ebx, ebx
je 0x42a7b9
push esi
push 0xffffffffffffffff
xorps xmm0, xmm0
mov dword [ebp - 8], 0
push edi
lea ecx, [ebp - 0x18]
movups xmmword [ebp - 0x18], xmm0
call fcn.00405e40
mov esi, dword [ebp - 0x18]
test esi, esi
je 0x42a76d
cmp word [esi], 0
mov eax, esi
jne 0x42a772
mov eax, 0x4aebf4
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
sete byte [ebp - 1]
test esi, esi
je 0x42a78d
push esi
call fcn.00480a27
add esp, 4
mov eax, dword [ebp - 0xc]
pop esi
test eax, eax
je 0x42a79e
push eax
call fcn.00480a27
add esp, 4
cmp byte [ebp - 1], 0
je 0x42a7b9
push ebx
push edi
call fcn.0048927b
add esp, 8
neg eax
sbb eax, eax
inc eax
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42b8b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4cd070]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x20c]
mov esi, ecx
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0xffffffffffffffff
lea eax, [ebp - 0x20c]
mov dword [esi], 0
mov dword [esi + 4], 0
mov ecx, esi
mov dword [esi + 8], 0
push eax
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
call fcn.00405e40
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00464f19
mov esp, ebp
pop ebp
ret
Function at 0x42c240
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x158
mov eax, dword [0x4cd070]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, edx
lea eax, [ebp - 0x3c]
push edi
push eax
mov edi, ecx
mov dword [esi], 0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea eax, [ebp - 0x158]
mov dword [ebp - 0x158], 0x11c
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x42c474
mov eax, dword [ebp - 0x154]
xorps xmm0, xmm0
mov dword [ebp - 8], 0
mov dword [ebp - 8], 0
movups xmmword [ebp - 0x18], xmm0
movups xmmword [ebp - 0x18], xmm0
sub eax, 4
je 0x42c3e1
sub eax, 1
je 0x42c350
sub eax, 1
je 0x42c2ce
mov dword [esi], 0
push str.Windows_UnKnow
jmp 0x42c42f
mov eax, dword [ebp - 0x150]
lea ecx, [ebp - 0x18]
mov dword [esi], 3
sub eax, 0
je 0x42c336
sub eax, 1
je 0x42c311
sub eax, 1
je 0x42c2fc
mov dword [esi], 0
push str.Windows_unknow
jmp 0x42c432
push str.Windows_8
call fcn.00406050
mov dword [esi], 5
jmp 0x42c437
cmp byte [ebp - 0x3e], 1
jne 0x42c32c
push str.Windows_7
call fcn.00406050
mov dword [esi], 4
jmp 0x42c437
push str.Windows_Server_2008_R2
jmp 0x42c432
cmp byte [ebp - 0x3e], 1
jne 0x42c346
push str.Windows_Vista
jmp 0x42c432
push str.Windows_Server_2008
jmp 0x42c432
mov eax, dword [ebp - 0x150]
sub eax, 0
je 0x42c3cc
sub eax, 1
je 0x42c3c5
sub eax, 1
je 0x42c37d
push str.Windows_unknow
lea ecx, [ebp - 0x18]
call fcn.00406050
mov dword [esi], 0
jmp 0x42c437
cmp byte [ebp - 0x3e], 1
jne 0x42c394
cmp word [ebp - 0x3c], 9
jne 0x42c394
push str.Windows_XP_Professional_x64_Edition
jmp 0x42c42f
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x59
call esi
test eax, eax
jne 0x42c3ac
push str.Windows_Server_2003
jmp 0x42c42f
push 0x59
call esi
lea ecx, [ebp - 0x18]
test eax, eax
je 0x42c3be
push str.Windows_Server_2003_R2
jmp 0x42c432
push str.Windows_Server
jmp 0x42c432
push str.Windows_XP
jmp 0x42c42f
push str.Windows_2000
lea ecx, [ebp - 0x18]
call fcn.00406050
mov dword [esi], 2
jmp 0x42c437
mov eax, dword [ebp - 0x150]
test eax, eax
je 0x42c413
cmp eax, 0xa
je 0x42c40c
lea ecx, [ebp - 0x18]
cmp eax, 0x5a
je 0x42c405
mov dword [esi], 0
push str.Windows_UnKnow
jmp 0x42c432
push str.Windows_Me
jmp 0x42c432
push str.Windows_98
jmp 0x42c42f
mov eax, dword [ebp - 0x148]
cmp eax, 2
jne 0x42c425
push str.Windows_NT_4.0
jmp 0x42c42f
cmp eax, 1
jne 0x42c437
push str.Windows_95
lea ecx, [ebp - 0x18]
call fcn.00406050
lea eax, [ebp - 0x18]
mov ecx, edi
push eax
call fcn.00405bb0
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x42c452
push eax
call fcn.00480a27
add esp, 4
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x42c4aa
push eax
call fcn.00480a27
add esp, 4
mov eax, edi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00464f19
mov esp, ebp
pop ebp
ret
mov dword [esi], 0
mov ecx, edi
push 0xffffffffffffffff
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
push str.Windows_UnKnow
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
call fcn.00405e40
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.00464f19
mov esp, ebp
pop ebp
ret
Function at 0x42cde0
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49f46b
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x60
mov eax, dword [0x4cd070]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0x4b879c
mov dword [ebp - 4], 0
call fcn.00406050
lea ecx, [ebp - 0x6c]
call fcn.00429180
mov byte [ebp - 4], 1
mov edx, dword [eax]
test edx, edx
je 0x42ce49
cmp word [edx], 0
jne 0x42ce4e
mov edx, 0x4aebf4
xor eax, eax
mov dword [ebp - 0x40], 7
mov dword [ebp - 0x44], 0
mov word [ebp - 0x54], ax
cmp word [edx], ax
jne 0x42ce6b
xor ecx, ecx
jmp 0x42ce7f
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x42ce70
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x54]
call fcn.0040e570
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x6c]
test eax, eax
je 0x42cea4
push eax
call fcn.00480a27
add esp, 4
mov dword [ebp - 0x6c], 0
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x68], 0
test eax, eax
je 0x42ced0
push eax
call fcn.00480a27
add esp, 4
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 0
push 9
push str.All_Users
lea ecx, [ebp - 0x54]
call fcn.0041b110
push 8
push str.config_
lea ecx, [ebp - 0x54]
call fcn.0041b110
push 0xc
push str.configEx.ini
lea ecx, [ebp - 0x54]
call fcn.0041b110
cmp dword [ebp - 0x40], 8
lea eax, [ebp - 0x54]
cmovae eax, dword [ebp - 0x54]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x42cf18
mov byte [ebp - 0x55], al
jmp 0x42cf6f
cmp dword [ebp - 0x40], 8
lea ecx, [ebp - 0x54]
mov eax, dword [ebx + 8]
xorps xmm0, xmm0
cmovae ecx, dword [ebp - 0x54]
movq qword [ebp - 0x1c], xmm0
movups xmmword [ebp - 0x3c], xmm0
movups xmmword [ebp - 0x2c], xmm0
test eax, eax
je 0x42cf40
cmp word [eax], 0
jne 0x42cf45
mov eax, 0x4aebf4
push ecx
push 0x100
lea ecx, [ebp - 0x3c]
push ecx
push 0x4b87e0
push eax
push 0x4b8838
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x3c]
mov ecx, edi
push eax
call fcn.00406050
mov byte [ebp - 0x55], 1
mov eax, dword [ebp - 0x40]
cmp eax, 8
jb 0x42cf84
inc eax
lea ecx, [ebp - 0x54]
push eax
push dword [ebp - 0x54]
call fcn.0040e800
xor eax, eax
mov dword [ebp - 0x40], 7
mov word [ebp - 0x54], ax
mov eax, dword [ebx + 8]
mov dword [ebp - 0x44], 0
test eax, eax
je 0x42cfaf
push eax
call fcn.00480a27
add esp, 4
mov dword [ebx + 8], 0
mov eax, dword [ebx + 0x14]
mov dword [ebx + 0x10], 0
mov dword [ebx + 0xc], 0
test eax, eax
je 0x42cfcd
push eax
call fcn.00480a27
add esp, 4
mov al, byte [ebp - 0x55]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00464f19
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x42d230
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49f4e8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4cd070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
sub esp, 0x14
lea eax, [ebp + 0x1c]
mov ecx, esp
push eax
call fcn.00405bb0
sub esp, 0x14
lea eax, [ebp + 8]
mov ecx, esp
push eax
call fcn.00405bb0
call fcn.0042d720
add esp, 0x28
mov dword [ebp - 0x14], 0
xorps xmm0, xmm0
lea ecx, [ebp - 0x24]
movups xmmword [ebp - 0x24], xmm0
call fcn.00429180
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x24]
mov eax, dword [ebp - 0x20]
add eax, 9
push eax
call fcn.004064a0
push str.All_Users
push eax
push dword [ebp - 0x24]
call fcn.00480d25
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x24]
add eax, 9
add esp, 0xc
mov dword [ebp - 0x20], eax
add eax, 8
push eax
call fcn.004064a0
mov esi, dword [ebp - 0x24]
push str.config_
push eax
push esi
call fcn.00480d25
mov edi, dword [ebp - 0x20]
add esp, 0xc
add edi, 8
mov dword [ebp - 0x20], edi
test esi, esi
je 0x42d2f9
cmp word [esi], 0
jne 0x42d304
mov esi, 0x4aebf4
cmp word [esi], 0
je 0x42d317
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x42d317
shr eax, 4
and al, 1
jne 0x42d326
lea ecx, [ebp - 0x24]
call fcn.0042d890
test al, al
je 0x42d391
mov edi, dword [ebp - 0x20]
lea eax, [edi + 0xc]
push eax
lea ecx, [ebp - 0x24]
call fcn.004064a0
mov esi, dword [ebp - 0x24]
push str.configEx.ini
push eax
push esi
call fcn.00480d25
add esp, 0xc
test esi, esi
je 0x42d350
cmp word [esi], 0
mov edx, esi
jne 0x42d355
mov edx, 0x4aebf4
mov eax, dword [ebp + 0x1c]
test eax, eax
je 0x42d362
cmp word [eax], 0
jne 0x42d367
mov eax, 0x4aebf4
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x42d374
cmp word [ecx], 0
jne 0x42d379
mov ecx, 0x4aebf4
push edx
push eax
push ecx
push 0x4b8838
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
test eax, eax
je 0x42d394
mov byte [ebp - 0x25], 1
jmp 0x42d398
mov esi, dword [ebp - 0x24]
mov byte [ebp - 0x25], 0
test esi, esi
je 0x42d3a5
push esi
call fcn.00480a27
add esp, 4
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x42d3b5
push eax
call fcn.00480a27
add esp, 4
mov eax, dword [ebp + 8]
test eax, eax
je 0x42d3cc
push eax
call fcn.00480a27
add esp, 4
mov dword [ebp + 8], 0
mov eax, dword [ebp + 0x14]
mov dword [ebp + 0x10], 0
mov dword [ebp + 0xc], 0
test eax, eax
je 0x42d3f8
push eax
call fcn.00480a27
add esp, 4
mov dword [ebp + 0x14], 0
mov dword [ebp + 0x18], 0
mov eax, dword [ebp + 0x1c]
test eax, eax
je 0x42d40f
push eax
call fcn.00480a27
add esp, 4
mov dword [ebp + 0x1c], 0
mov eax, dword [ebp + 0x28]
mov dword [ebp + 0x24], 0
mov dword [ebp + 0x20], 0
test eax, eax
je 0x42d42d
push eax
call fcn.00480a27
add esp, 4
mov al, byte [ebp - 0x25]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00464f19
mov esp, ebp
pop ebp
ret
Function at 0x42d450
Capabilities:
Check if file exists
Get file attributes

Disassembly:
test ecx, ecx
je 0x42d46d
cmp word [ecx], 0
je 0x42d46d
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x42d46d
shr eax, 4
and eax, 1
ret
xor al, al
ret

Function at 0x42d470
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
mov eax, dword [0x4cd070]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x800
lea eax, [ebp - 0x804]
mov dword [ebp - 0x808], 0x400
push 0
push eax
mov edi, edx
mov esi, ecx
call fcn.0047e1d0
add esp, 0xc
lea eax, [ebp - 0x80c]
push eax
push 0xf003f
push 0
push str.SoftwareTencentWeChat
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42d592
lea eax, [ebp - 0x808]
push eax
lea eax, [ebp - 0x804]
push eax
push 0
push 0
push esi
push dword [ebp - 0x80c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x42d592
cmp word [ebp - 0x804], ax
je 0x42d563
lea esi, [ebp - 0x804]
lea ecx, [esi + 2]
nop dword [eax + eax]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x42d510
sub esi, ecx
mov ecx, edi
sar esi, 1
push esi
call fcn.004064a0
push esi
lea ecx, [ebp - 0x804]
push ecx
push eax
push dword [edi]
call fcn.0048618e
mov eax, dword [edi]
add esp, 0x10
xor ecx, ecx
mov word [eax + esi*2], cx
push dword [ebp - 0x80c]
mov dword [edi + 4], esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00464f19
mov esp, ebp
pop ebp
ret
mov eax, dword [edi]
test eax, eax
je 0x42d574
xor ecx, ecx
mov word [eax], cx
mov dword [edi + 8], ecx
mov dword [edi + 4], ecx
push dword [ebp - 0x80c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00464f19
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x80c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor al, al
pop edi
xor ecx, ebp
pop esi
call fcn.00464f19
mov esp, ebp
pop ebp
ret