joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48d9c9
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x612136
call fcn.0060b6e8
sub esp, 0x20
push ebx
push esi
push edi
xor ebx, ebx
mov edi, ecx
push ebx
push ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
call fcn.0048dd22
mov esi, eax
mov dword [ebp - 0x14], esi
push 0xffffffffffffffff
mov dword [ebp - 4], ebx
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x48db42
mov ebx, dword [ebp - 0x10]
lea ecx, [edi + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [ebp - 0x14]
lea ecx, [edi + 0x30]
cmp eax, ecx
je 0x48da30
mov eax, esi
mov esi, dword [ecx]
mov dword [ecx], eax
mov eax, ebx
mov ebx, dword [ecx + 4]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], ebx
mov dword [ecx + 4], eax
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [edi + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test ebx, ebx
je 0x48db27
cmp dword [edi + 4], 0
jne 0x48da6b
push 0x69e50c
push dword [edi + 0x14]
call fcn.005e81ee
mov dword [edi + 4], eax
pop ecx
pop ecx
test eax, eax
je 0x48db27
and dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
mov byte [ebp - 4], 1
mov eax, dword [esi]
lea ecx, [ebp - 0x2c]
add eax, 8
cmp ecx, eax
je 0x48da94
push 0xffffffffffffffff
push 0
push eax
call fcn.00409916
mov esi, dword [esi]
dec ebx
push 0
push 1
mov dword [ebp - 0x10], ebx
mov ecx, dword [esi + 4]
mov eax, dword [esi]
mov dword [ecx], eax
mov ecx, dword [esi]
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
lea ecx, [esi + 8]
call fcn.004097fa
push 0x20
push 1
push esi
call fcn.00403f7c
add esp, 0xc
lea eax, [ebp - 0x2c]
cmp dword [ebp - 0x18], 0x10
cmovae eax, dword [ebp - 0x2c]
cmp dword [edi + 4], 0
je 0x48daf5
push dword [edi + 4]
push dword [ebp - 0x1c]
push 1
push eax
call fcn.005f1ea9
push dword [edi + 4]
push 2
push 1
push 0x6951b0
call fcn.005f1ea9
add esp, 0x20
mov esi, dword [ebp - 0x14]
test ebx, ebx
jne 0x48da7e
cmp dword [edi + 4], 0
je 0x48db0f
push dword [edi + 4]
call fcn.005e48cd
and dword [edi + 4], 0
pop ecx
push 0
push 1
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0
call fcn.004097fa
mov esi, dword [ebp - 0x14]
jmp 0x48da08
cmp dword [edi], 0
jne 0x48db42
push 0xffffffffffffffff
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea ecx, [edi + 0x18]
test eax, eax
je 0x48da0b
lea ecx, [ebp - 0x14]
call fcn.0048dc6a
mov ecx, dword [ebp - 0xc]
xor eax, eax
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x48db5d
Capabilities:
Delete file
Get file size
Move file
Set file attributes

Disassembly:
mov eax, 0x60c405
call fcn.0060b6e8
push ecx
push ebx
push edi
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 3
push SysReAllocString
push dword [0x6c7894]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x48dc01
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
xor eax, eax
cmp esi, 0xffffffff
push edi
cmove esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 0x80000
jb 0x48dc00
mov eax, dword [0x6c7894]
add eax, 0xfffffff0
push eax
call fcn.004067cf
add eax, 0x10
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], ebx
call fcn.0048dcb5
mov esi, dword [ebp - 0x10]
mov ebx, dword [0x6c7894]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push ebx
call edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
lea ecx, [esi - 0x10]
call fcn.00404ea9
pop esi
mov ecx, dword [ebp - 0xc]
xor eax, eax
pop edi
inc eax
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48de50
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x612195
call fcn.0060b6e8
sub esp, 0x90
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x9c], vtable.KMD5.0
push edi
mov esi, ecx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, eax
mov dword [ebp - 0x18], ebx
lea eax, [esi + 4]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], eax
lea ebx, [esi + 0x14]
call fcn.00404f47
push eax
lea ecx, [ebp - 0x10]
call fcn.004065d8
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 1
push eax
push edi
call fcn.0048dffb
test eax, eax
je 0x48dfd1
mov esi, dword [ebp - 0x10]
cmp dword [esi - 0xc], 0
je 0x48dfcc
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x48dfcc
push 0x5c
push esi
call fcn.005e2d90
pop ecx
pop ecx
test eax, eax
je 0x48dfcc
sub eax, esi
sar eax, 1
cmp eax, 0xffffffff
je 0x48dfcc
inc eax
lea ecx, [ebp - 0x10]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.0040a965
push eax
lea ecx, [ebx - 0xc]
mov byte [ebp - 4], 2
call fcn.00406123
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
call fcn.00404ea9
mov byte [ebp - 0x3c], 0
lea edi, [ebp - 0x3b]
xor eax, eax
stosd dword es:[edi], eax
push ecx
push ecx
push esi
stosd dword es:[edi], eax
lea ecx, [ebp - 0x9c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.00413262
test eax, eax
je 0x48dfcc
push 0x10
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.005dfc80
add esp, 0xc
call fcn.00404f47
push eax
lea ecx, [ebp - 0x14]
call fcn.004065d8
mov byte [ebp - 4], 3
xor edi, edi
movzx eax, byte [ebp + edi - 0x3c]
push eax
lea eax, [ebp - 0x14]
push 0x69b318
push eax
call fcn.004090e5
add esp, 0xc
inc edi
cmp edi, 0x10
jl 0x48df6a
mov edi, dword [ebp - 0x14]
cmp dword [edi - 0xc], 0
je 0x48df9b
lea eax, [ebp - 0x14]
mov ecx, ebx
push eax
call fcn.00406123
mov eax, dword [ebp - 0x18]
lea ecx, [edi - 0x10]
mov dword [ebp - 0x28], eax
call fcn.00404ea9
lea ecx, [esi - 0x10]
mov byte [ebp - 4], 0
call fcn.00404ea9
mov edi, dword [ebp - 0x1c]
add ebx, 4
inc edi
mov dword [ebp - 0x1c], edi
cmp edi, 3
jge 0x48dfdc
mov edi, dword [ebp - 0x28]
jmp 0x48de91
lea ecx, [esi - 0x10]
jmp 0x48dfd7
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00404ea9
lea ecx, [ebp - 0x9c]
call fcn.00413231
mov ecx, dword [ebp - 0xc]
xor eax, eax
pop edi
pop esi
inc eax
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48dffb
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x430
mov eax, ecx
push esi
xor esi, esi
mov dword [ebp - 8], eax
cmp dword [eax], esi
jne 0x48e017
xor eax, eax
jmp 0x48e147
mov eax, dword [ebp + 8]
mov dword [ebp - 4], esi
push ebx
mov ebx, esi
test eax, eax
je 0x48e144
cmp eax, 4
je 0x48e144
cmp eax, 8
je 0x48e144
push eax
push esi
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ecx, eax
mov dword [ebp + 8], ecx
test ecx, ecx
je 0x48e144
push edi
xor eax, eax
mov dword [ebp - 0x20], esi
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 4]
push eax
push 0x18
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 8]
push esi
push ecx
call dword [eax]
test eax, eax
jne 0x48e131
mov edi, dword [ebp - 0xc]
test edi, edi
je 0x48e131
cmp edi, 8
je 0x48e131
push edi
push esi
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
je 0x48e131
push 0x208
lea eax, [ebp - 0x228]
push esi
push eax
call fcn.005e1180
add esp, 0xc
lea eax, [ebp - 0x228]
push 0x103
push eax
push esi
push ebx
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
test eax, eax
jne 0x48e116
push 0x208
lea eax, [ebp - 0x430]
push esi
push eax
call fcn.005e1180
add esp, 0xc
lea eax, [ebp - 0x430]
push 0x104
push eax
push ebx
call dword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
je 0x48e131
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x430]
push eax
call fcn.0048e14e
test eax, eax
je 0x48e131
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x48e11f
mov dword [eax], edi
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x228]
push eax
call fcn.004060f8
xor esi, esi
inc esi
push dword [ebp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
test ebx, ebx
je 0x48e143
push ebx
call edi
pop edi
mov eax, esi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x48e14e
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4b8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x48e245
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x48e245
lea eax, [ebp - 0x4b8]
push eax
push 0x3e8
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x48e23d
xor eax, eax
mov dword [ebp + 8], eax
cmp word [ebp - 0x4b8], ax
je 0x48e23d
lea ebx, [ebp - 0x4b8]
mov dword [ebp + 0xc], eax
push 0x69e54c
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x48e21c
push 0x69e554
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x48e21c
mov ax, word [ebx]
mov word [ebp - 8], ax
mov eax, dword [ebp + 0xc]
push 0x64
mov ax, word [ebp + eax - 0x4b6]
mov word [ebp - 6], ax
xor eax, eax
mov word [ebp - 4], ax
lea eax, [ebp - 0xd0]
push eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x48e245
lea eax, [ebp - 0xd0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, eax
lea eax, [ebp - 0xd0]
push ebx
push eax
push edi
call fcn.005f159d
add esp, 0xc
test eax, eax
je 0x48e250
mov eax, dword [ebp + 8]
lea ebx, [ebp - 0x4b8]
add eax, 4
mov dword [ebp + 8], eax
add eax, eax
add ebx, eax
mov dword [ebp + 0xc], eax
xor eax, eax
cmp word [ebx], ax
jne 0x48e1a5
push edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea eax, [ebp - 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [edi + ebx*2]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
xor eax, eax
inc eax
jmp 0x48e247

Function at 0x48e26b
Capabilities:
Send icmp echo request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov esi, edx
call fcn.0048e337
test al, al
jne 0x48e28b
or eax, 0xffffffff
jmp 0x48e330
mov ecx, dword [esi + 4]
lea edx, [ebp - 4]
call fcn.0048e404
test al, al
je 0x48e283
mov esi, str.Data_Buffer
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor edi, edi
call dword [sym.imp.IPHLPAPI.DLL_IcmpCreateFile]
mov esi, eax
or ebx, 0xffffffff
cmp esi, ebx
jne 0x48e2ba
xor eax, eax
jmp 0x48e330
push dword [ebp - 4]
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 8], eax
cmp eax, ebx
jne 0x48e2d3
push esi
call dword [sym.imp.IPHLPAPI.DLL_IcmpCloseHandle]
jmp 0x48e2b6
push 0x28
call fcn.005f0453
mov ebx, eax
pop ecx
test ebx, ebx
je 0x48e2ca
mov dword [ebp - 4], 2
push 0x3e8
push 0x28
push ebx
push 0
push 0xc
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 8]
push esi
call dword [sym.imp.IPHLPAPI.DLL_IcmpSendEcho]
test eax, eax
je 0x48e30d
cmp dword [ebx + 4], 0
jne 0x48e30d
inc edi
sub dword [ebp - 4], 1
jne 0x48e2e8
push ebx
call fcn.005efad3
pop ecx
push esi
call dword [sym.imp.IPHLPAPI.DLL_IcmpCloseHandle]
call fcn.0048e3b6
test al, al
push 0xffffffffffffffff
pop eax
cmove edi, eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48e337
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1a4
lea eax, [esp + 0x14]
push esi
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
cmp eax, 0xffffffff
jne 0x48e398
push 0x6c3330
call fcn.0048e471
pop ecx
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push ecx
mov edx, str.An_error_occured_in_WSAStartup_operation:
mov ecx, esi
call fcn.00412451
mov edx, str.WSAGetLastError____
mov ecx, eax
call fcn.00412451
pop ecx
mov ecx, eax
call fcn.00410d92
push eax
call fcn.0048e471
xor al, al
jmp 0x48e3b0
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
movzx eax, word [esp + 0x16]
push eax
call fcn.005f1777
mov al, 1
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x48e404
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push esi
push ecx
mov esi, edx
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x48e44d
push 0x6c3330
call fcn.0048e471
pop ecx
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push ecx
mov edx, str.An_error_occured_in_gethostbyname_operation:_WSAGetLastError____
mov ecx, esi
call fcn.00412451
pop ecx
mov ecx, eax
call fcn.00410d92
push eax
call fcn.0048e471
pop ecx
xor al, al
jmp 0x48e46c
mov eax, dword [eax + 0xc]
push ecx
lea ecx, [esp + 8]
push dword [eax]
call fcn.0048e55b
pop ecx
pop ecx
push dword [esp + 4]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
mov dword [esi], eax
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x48e633
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags
Get process heap force flags

Disassembly:
mov eax, 0x6121e8
call fcn.0060b6e8
push ecx
push ebx
push esi
push edi
mov edi, ecx
xor esi, esi
mov dword [ebp - 0x10], edi
mov ebx, 0x692da4
push ebx
lea ecx, [edi + 0xc]
mov dword [edi], vtable.KInstallTool::KUIInfoReport.0
mov dword [edi + 4], esi
mov dword [edi + 8], esi
call fcn.00406173
push ebx
lea ecx, [edi + 0x10]
mov dword [ebp - 4], esi
call fcn.00406173
mov byte [ebp - 4], 1
call fcn.00404f47
push eax
lea ecx, [edi + 0x14]
call fcn.004065d8
push ebx
lea ecx, [edi + 0x18]
mov byte [ebp - 4], 2
call fcn.00406173
push ebx
lea ecx, [edi + 0x1c]
mov byte [ebp - 4], 3
call fcn.00406173
push ebx
lea ecx, [edi + 0x20]
mov byte [ebp - 4], 4
call fcn.00406173
mov ecx, dword [ebp - 0xc]
xor eax, eax
mov dword [edi + 0x24], eax
mov dword [edi + 0x2c], eax
mov dword [edi + 0x30], eax
mov eax, edi
mov byte [edi + 0x28], 7
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x48ea21
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor ebx, ebx
push edi
mov edi, ecx
lea eax, [edi + 0x2c]
push eax
mov dword [ebp - 8], eax
call esi
lea eax, [edi + 0x14]
push eax
mov dword [ebp - 4], eax
call esi
cmp byte [edi + 4], bl
jne 0x48ea4f
push 0xfffffffffffffffd
pop ebx
jmp 0x48ea65
push ebx
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [edi + 4], bl
push dword [ebp - 4]
mov esi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call esi
push dword [ebp - 8]
call esi
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x48ef23
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
xor esi, esi
lea eax, [edi + 0x2c]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, edi
call fcn.0048ef04
test al, al
je 0x48ef4a
or esi, 0xffffffff
jmp 0x48efb5
push ebx
push 8
call fcn.00430c2b
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x48ef5d
push 0xfffffffffffffffa
jmp 0x48efb3
lea eax, [edi + 0xc]
mov dword [ebx], edi
push eax
push esi
push ebx
push 0x48f231
push esi
push esi
mov dword [ebx + 4], esi
call fcn.005f33c0
add esp, 0x18
mov dword [edi + 8], eax
test eax, eax
je 0x48efa7
lea ebx, [edi + 0x14]
jmp 0x48ef91
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp byte [edi + 4], 0
push ebx
je 0x48ef83
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x48efb4
push 8
push ebx
call fcn.0049931c
pop ecx
pop ecx
push 0xfffffffffffffffe
pop esi
pop ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x48efc8
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
mov eax, 0x6121e8
call fcn.0060b6e8
push ecx
push ebx
mov ebx, ecx
push esi
mov dword [ebp - 0x10], ebx
push edi
mov edi, dword [ebp + 8]
lea esi, [ebx + 0xc]
mov dword [ebx], vtable.KInstallTool::KUIInfoReport.0
mov dword [ebp + 8], esi
mov eax, dword [edi + 4]
mov dword [ebx + 4], eax
mov eax, dword [edi + 8]
mov dword [ebx + 8], eax
mov eax, dword [edi + 0xc]
sub eax, 0x10
push eax
call fcn.004067cf
add eax, 0x10
mov dword [esi], eax
and dword [ebp - 4], 0
lea esi, [ebx + 0x10]
mov eax, dword [edi + 0x10]
sub eax, 0x10
mov dword [ebp + 8], esi
push eax
call fcn.004067cf
add eax, 0x10
mov dword [esi], eax
mov byte [ebp - 4], 1
lea esi, [ebx + 0x14]
mov eax, dword [edi + 0x14]
sub eax, 0x10
mov dword [ebp + 8], esi
push eax
call fcn.004067cf
add eax, 0x10
mov dword [esi], eax
mov byte [ebp - 4], 2
lea esi, [ebx + 0x18]
mov eax, dword [edi + 0x18]
sub eax, 0x10
mov dword [ebp + 8], esi
push eax
call fcn.004067cf
add eax, 0x10
mov dword [esi], eax
mov byte [ebp - 4], 3
lea esi, [ebx + 0x1c]
mov eax, dword [edi + 0x1c]
sub eax, 0x10
mov dword [ebp + 8], esi
push eax
call fcn.004067cf
add eax, 0x10
mov dword [esi], eax
mov byte [ebp - 4], 4
lea esi, [ebx + 0x20]
mov eax, dword [edi + 0x20]
sub eax, 0x10
mov dword [ebp + 8], esi
push eax
call fcn.004067cf
add esp, 0x18
add eax, 0x10
mov dword [esi], eax
mov al, byte [edi + 0x24]
mov byte [ebx + 0x24], al
mov al, byte [edi + 0x25]
mov byte [ebx + 0x25], al
mov al, byte [edi + 0x26]
mov byte [ebx + 0x26], al
mov al, byte [edi + 0x27]
mov byte [ebx + 0x27], al
mov al, byte [edi + 0x28]
mov byte [ebx + 0x28], al
mov eax, dword [edi + 0x2c]
mov ecx, dword [ebp - 0xc]
mov dword [ebx + 0x2c], eax
mov eax, dword [edi + 0x30]
pop edi
mov dword [ebx + 0x30], eax
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x490126
Capabilities:
Hide graphical window

Disassembly:
mov eax, 0x60c5af
call fcn.0060b6e8
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov ecx, dword [ebp + 8]
inc ebx
cmp dword [ecx + 8], ebx
jne 0x490244
mov ecx, dword [ecx + 0xc]
cmp ecx, ebx
jne 0x490158
mov ecx, esi
call fcn.00491666
mov eax, ebx
jmp 0x49024d
cmp ecx, 2
jne 0x490179
cmp byte [esi + 0x5f2], 0
jne 0x49016c
mov byte [esi + 0x5f2], bl
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x490151
cmp ecx, 0x65
jne 0x490187
mov ecx, esi
call fcn.00491784
jmp 0x490151
cmp ecx, 0x66
jne 0x4901a1
xor eax, eax
mov ecx, esi
cmp dword [esi + 0x584], eax
sete al
push eax
call fcn.004926cc
jmp 0x490151
cmp ecx, 0x191
jne 0x4901b2
mov ecx, esi
call fcn.00491878
jmp 0x490151
cmp ecx, 0x96
jne 0x4901dc
push dword [esi + 0x5b0]
push dword [esi + 0x588]
call dword [sym.imp.USER32.dll_SetWindowTextW]
push 0
push 0
mov ecx, esi
call fcn.004911d0
jmp 0x490151
cmp ecx, 0x1f5
jne 0x4901f0
mov ecx, esi
call fcn.004918e4
jmp 0x490151
cmp ecx, 0xa0
jne 0x490202
call fcn.004919d2
jmp 0x490151
cmp ecx, 0x68
jne 0x490213
mov ecx, esi
call fcn.0049243f
jmp 0x490151
cmp ecx, 0x2bf
jne 0x490244
push str.https:__www.ijinshan.com_privacy_dubaPrivacy.html
lea ecx, [ebp + 8]
call fcn.00406173
and dword [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.0047099b
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.00404ea9
jmp 0x490151
and dword [esi + 0x5b4], 0
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x49083c
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x6122a6
call fcn.0060b6e8
sub esp, 0x408
and dword [ebp - 0x14], 0
lea eax, [ebp - 0x414]
push esi
push edi
push 0x400
push 0
push eax
mov esi, str.https:__wpa1.qq.com_5ciKQjBf__typewpaqidiantrue
mov edi, str.MarketQQLink
call fcn.005e1180
mov eax, dword fs:[0x2c]
add esp, 0xc
mov ecx, dword [eax]
mov eax, dword [0x6c7e44]
cmp eax, dword [ecx + 4]
jle 0x4908bf
push 0x6c7e44
call fcn.00499481
cmp dword [0x6c7e44], 0xffffffff
pop ecx
jne 0x4908bf
and dword [ebp - 4], 0
call fcn.004906c8
push 0x612c34
call fcn.004997d8
or dword [ebp - 4], 0xffffffff
mov dword [esp], 0x6c7e44
call fcn.00499442
pop ecx
mov ecx, dword [0x6c7e4c]
test ecx, ecx
je 0x4908dd
mov eax, dword [ecx]
push ecx
call dword [eax + 0x1c]
test al, al
je 0x4908dd
mov esi, str.https:__wpa1.qq.com_FDdK6y0s__typewpaqidiantrue
mov edi, str.VipMarketQQLink
xor edx, edx
lea ecx, [ebp - 0x10]
call fcn.0040b184
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 1
call fcn.0040ab52
push str.dataoperation_contact.dat
lea ecx, [ebp - 0x10]
call fcn.004062d3
push dword [ebp - 0x10]
lea eax, [ebp - 0x414]
push 0x200
push eax
push esi
push edi
push str.FeedBack
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x414]
push eax
call fcn.00406173
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00404ea9
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x49182b
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
sub eax, 1
je 0x49186e
sub eax, 1
je 0x491867
sub eax, 1
je 0x49184f
sub eax, 1
jne 0x491873
call fcn.0049387e
jmp 0x491873
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 3
push dword [esi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
jmp 0x491873
call fcn.0049227f
jmp 0x491873
call fcn.00491cf2
pop esi
pop ebp
ret 4

Function at 0x4919d2
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x60c405
call fcn.0060b6e8
push ecx
push ebx
push edi
push 1
xor edi, edi
mov ebx, str.https:__www.ijinshan.com_privacy_duba_enduserlicenseandsevice_agreement.html
push edi
push edi
push ebx
push str.open
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jg 0x491a3c
push 1
push edi
push ebx
push str.IEXPLORE.EXE
push str.open
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jg 0x491a3c
lea ecx, [ebp - 0x10]
call fcn.0046f975
sub esp, 0xc
mov dword [ebp - 4], edi
mov ecx, dword [ebp - 0x10]
mov edx, ebx
call fcn.0046ee47
mov ecx, dword [ebp - 0x10]
add esp, 0xc
lea ecx, [ecx - 0x10]
call fcn.00404ea9
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret