joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49fb30
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
cmp dword [ebp + 8], 0
jne 0x49fb43
xor eax, eax
jmp 0x49fbb4
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x49fb55
xor eax, eax
jmp 0x49fbb4
mov eax, dword [ebp + 8]
push eax
call fcn.0040b32e
mov dword [0x50f57c], eax
cmp dword [0x50f57c], 0
jne 0x49fb70
xor eax, eax
jmp 0x49fbb4
push str.Get360CommonInstance
mov eax, dword [0x50f57c]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x50f580], eax
cmp dword [0x50f580], 0
jne 0x49fba9
mov eax, dword [0x50f57c]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x50f580], 0
xor eax, eax
jmp 0x49fbb4
mov eax, dword [0x50f580]
mov dword [ebp - 4], eax
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x49fc40
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84c
mov eax, dword [0x50ab8c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
cmp dword [0x50f57c], 0
jne 0x49fcf2
mov dword [ebp - 8], 0x400
push 0x400
lea eax, [ebp - 0x808]
push eax
mov ecx, dword [0x50f578]
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov dword [ebp - 0x80c], 0
jmp 0x49fcab
mov eax, dword [ebp - 0x80c]
add eax, 1
mov dword [ebp - 0x80c], eax
mov eax, dword [ebp - 0x80c]
cmp eax, dword [0x50f574]
jge 0x49fcc8
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
jmp 0x49fc9c
push str.360Common.dll
lea eax, [ebp - 0x808]
push eax
lea ecx, [ebp - 0x808]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x808]
push eax
call fcn.0040b32e
mov dword [0x50f57c], eax
cmp dword [0x50f57c], 0
jne 0x49fd02
xor eax, eax
jmp 0x49fda1
push str.Get360CommonInstance
mov eax, dword [0x50f57c]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x50f580], eax
push str.Get360ProductHistoryManager
mov eax, dword [0x50f57c]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x50f588], eax
push str.Create360FireWareStateFunction
mov eax, dword [0x50f57c]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x50f58c], eax
push str.GetFireWallState
mov eax, dword [0x50f57c]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x50f590], eax
push str.Create360FireWareStateFunction2
mov eax, dword [0x50f57c]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x50f594], eax
push str.GetIAdMgr
mov eax, dword [0x50f57c]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x50f584], eax
push str.GetExcludeChecker
mov eax, dword [0x50f57c]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x50f598], eax
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ab7a8
mov esp, ebp
pop ebp
ret
Function at 0x4a1560
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0x3f4
je 0x4a157f
jmp 0x4a15eb
push str._src
lea eax, [ebp - 0x4c]
push eax
mov ecx, 0x50f1c0
call fcn.0047d320
mov ecx, eax
call fcn.00402c0f
push eax
push 0x4eee28
push 0x4eee28
push 0x4eee28
push 0x4e88e8
push str.newsreader
call fcn.004a1e00
mov ecx, eax
call fcn.00470750
lea ecx, [ebp - 0x4c]
call fcn.004027ef
mov dword [ebp - 8], 1
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0x4e8818
push 0x4e87e0
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push 0
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4a2430
Capabilities:
Hide graphical window
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push ebx
push esi
push edi
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4a24e9
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_BringWindowToTop]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 8], eax
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0x10], eax
push 1
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.USER32.dll_AttachThreadInput]
push 1
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 3
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
push 3
push 0
push 0
push 0
push 0
push 0xfffffffffffffffe
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.USER32.dll_AttachThreadInput]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a24f0
Capabilities:
Check if file exists
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x60], eax
mov ecx, dword [ebp - 0x60]
sub ecx, 0x712
mov dword [ebp - 0x60], ecx
cmp dword [ebp - 0x60], 0xa8
ja case.0x4a2525.1
mov edx, dword [ebp - 0x60]
movzx eax, byte [edx + 0x4a273c]
jmp dword [eax*4 + 0x4a2724]
call fcn.0049c3e0
test eax, eax
je 0x4a253c
call fcn.0049c490
jmp 0x4a2589
push str._src
lea eax, [ebp - 0x5c]
push eax
mov ecx, 0x50f1c0
call fcn.0047d320
mov ecx, eax
call fcn.00402c0f
push eax
push 0x4eee28
push 0x4eee28
push 0x4eee28
push str.setting_shortcut
push str.newsreader
call fcn.004a39c0
mov ecx, eax
call fcn.00470750
lea ecx, [ebp - 0x5c]
call fcn.004027ef
call fcn.0049c2f0
jmp case.0x4a2525.1
push str._src
lea eax, [ebp - 0x58]
push eax
mov ecx, 0x50f1c0
call fcn.0047d320
mov ecx, eax
call fcn.00402c0f
push eax
push 0x4eee28
push 0x4eee28
push 0x4eee28
push str.setting_defaultbrowser1
push str.newsreader
call fcn.004a39c0
mov ecx, eax
call fcn.00470750
lea ecx, [ebp - 0x58]
call fcn.004027ef
push 0
push 0
push 0x2403
mov ecx, 0x50f1c0
call fcn.0047ceb0
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
jmp case.0x4a2525.1
mov eax, dword [ebp - 4]
cmp dword [eax + 0x44], 0
jne 0x4a261a
push 0
push 0
push 0x2404
mov ecx, 0x50f1c0
call fcn.0047ceb0
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x4a263e
mov dword [ebp - 8], 0
push 4
lea eax, [ebp - 8]
push eax
push 4
push str.default_browser
push str.SOFTWARE360SafeNewsReader
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
jmp case.0x4a2525.1
push 0
push 0
push 0x2405
mov ecx, 0x50f1c0
call fcn.0047ceb0
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
jmp case.0x4a2525.1
push str.Utils360Feedback.exe
lea eax, [ebp - 0xc]
push eax
call fcn.0040f5a9
add esp, 8
lea ecx, [ebp - 0xc]
call fcn.00402c0f
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4a2702
push 0
lea ecx, [ebp - 0xc]
call fcn.00402c0f
push eax
call fcn.004094d6
add esp, 8
test eax, eax
je 0x4a2702
lea ecx, [ebp - 0x10]
call fcn.0040276e
lea eax, [ebp - 0x54]
push eax
mov ecx, 0x50f1c0
call fcn.0047d620
mov ecx, dword [eax]
push ecx
push str._catlogOther__desc
lea edx, [ebp - 0x10]
push edx
call fcn.00407a80
add esp, 0xc
lea ecx, [ebp - 0x54]
call fcn.004027ef
push 5
lea ecx, [ebp - 0x10]
call fcn.00402c0f
push eax
lea ecx, [ebp - 0xc]
call fcn.00402c0f
push eax
push 0
call fcn.004a3680
add esp, 0x10
push 0x4e8a38
call fcn.004a2430
add esp, 4
lea ecx, [ebp - 0x10]
call fcn.004027ef
lea ecx, [ebp - 0xc]
call fcn.004027ef
push 0
mov ecx, dword [ebp - 4]
sub ecx, 0x20
call fcn.0046daa0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4a2ab0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
call fcn.004a06c0
test eax, eax
jne 0x4a2af6
push 0
push ecx
mov ecx, esp
push 0
call fcn.00408e04
push 0
push 0
push 0
push ecx
mov ecx, esp
push 0
call fcn.00480050
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
sub ecx, 0x24
call fcn.004a31a0
mov dword [ebp - 8], 4
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x44
push ecx
lea edx, [ebp - 8]
push edx
push str.default_browser
push str.SOFTWARE360SafeNewsReader
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x44]
push ecx
push 0x7a7
mov edx, dword [ebp - 4]
add edx, 0x28
push ecx
mov ecx, esp
push edx
call fcn.004721c0
call fcn.0046f7f0
add esp, 0xc
call fcn.0049c3e0
push eax
push 0x7ce
mov eax, dword [ebp - 4]
add eax, 0x28
push ecx
mov ecx, esp
push eax
call fcn.004721c0
call fcn.0046f7f0
add esp, 0xc
lea ecx, [ebp - 0x1c]
call fcn.00465760
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 4]
sub ecx, 0x20
call fcn.0046da00
lea ecx, [ebp - 0x1c]
call fcn.0042dd02
mov ecx, dword [ebp + 0x14]
sub ecx, eax
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x24]
push eax
mov ecx, 0x50f1c0
call fcn.0047ceb0
push eax
call dword [sym.imp.USER32.dll_ClientToScreen]
lea ecx, [ebp - 0x1c]
call fcn.0042dd02
mov dword [ebp - 0x2c], eax
lea ecx, [ebp - 0x1c]
call fcn.0042dd08
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x24]
push eax
lea ecx, [ebp - 0x3c]
call fcn.004a2e30
push 1
lea ecx, [ebp - 0x3c]
call fcn.00465a00
push eax
mov ecx, dword [ebp - 4]
sub ecx, 0x20
call fcn.0046d950
push 1
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4a2c10
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
add ecx, 0x50
call fcn.004a06c0
test eax, eax
jne 0x4a2c59
push 0
push ecx
mov ecx, esp
push 0
call fcn.00408e04
push 0
push 0
push 0
push ecx
mov ecx, esp
push 0
call fcn.00480050
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x2c
call fcn.004a31a0
mov dword [ebp - 8], 4
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x94
push ecx
lea edx, [ebp - 8]
push edx
push str.default_browser
push str.SOFTWARE360SafeNewsReader
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x94]
push ecx
push 0x7a7
mov edx, dword [ebp - 4]
add edx, 0x78
push ecx
mov ecx, esp
push edx
call fcn.004721c0
call fcn.0046f7f0
add esp, 0xc
call fcn.0049c3e0
push eax
push 0x7ce
mov eax, dword [ebp - 4]
add eax, 0x78
push ecx
mov ecx, esp
push eax
call fcn.004721c0
call fcn.0046f7f0
add esp, 0xc
push str._uOmhVSb
push 0x7b4
mov eax, dword [ebp - 4]
add eax, 0x78
push ecx
mov ecx, esp
push eax
call fcn.004721c0
call fcn.0046fa20
add esp, 0xc
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0x1c]
mov dword [eax + 0x98], ecx
lea ecx, [ebp - 0x10]
call fcn.0040276e
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x98]
push ecx
push str._d__
lea edx, [ebp - 0x10]
push edx
call fcn.00407a80
add esp, 0xc
lea ecx, [ebp - 0x10]
call fcn.00402c0f
push eax
push 0x7c3
mov eax, dword [ebp - 4]
add eax, 0x78
push ecx
mov ecx, esp
push eax
call fcn.004721c0
call fcn.0046fa20
add esp, 0xc
lea ecx, [ebp - 0x20]
call fcn.00465760
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x30
call fcn.0046da00
lea ecx, [ebp - 0x20]
call fcn.0042dd02
mov ecx, dword [ebp + 0x14]
sub ecx, eax
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x28]
push eax
mov ecx, 0x50f1c0
call fcn.0047ceb0
push eax
call dword [sym.imp.USER32.dll_ClientToScreen]
lea ecx, [ebp - 0x20]
call fcn.0042dd02
mov dword [ebp - 0x30], eax
lea ecx, [ebp - 0x20]
call fcn.0042dd08
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x30]
push ecx
mov edx, dword [ebp - 0x24]
push edx
mov eax, dword [ebp - 0x28]
push eax
lea ecx, [ebp - 0x40]
call fcn.004a2e30
push 1
lea ecx, [ebp - 0x40]
call fcn.00465a00
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x30
call fcn.0046d950
push 1
mov ecx, dword [ebp - 4]
add ecx, 0x50
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x50]
mov eax, dword [edx + 8]
call eax
lea ecx, [ebp - 0x10]
call fcn.004027ef
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x4a38e0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
cmp dword [ebp + 8], 0
jne 0x4a38f3
xor eax, eax
jmp 0x4a3931
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4a3905
xor eax, eax
jmp 0x4a3931
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.004102a9
add esp, 8
test eax, eax
je 0x4a3921
mov eax, 1
jmp 0x4a3931
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004a3940
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4a3940
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
cmp dword [ebp + 8], 0
jne 0x4a3953
xor eax, eax
jmp 0x4a39b9
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4a3965
xor eax, eax
jmp 0x4a39b9
cmp dword [ebp + 0xc], 0
je 0x4a39ad
push str.360Base.dll
lea eax, [ebp - 0x44]
push eax
call fcn.0040f5a9
add esp, 8
mov ecx, eax
call fcn.00402c0f
push eax
call fcn.0040acda
add esp, 4
mov dword [ebp - 0x48], eax
lea ecx, [ebp - 0x44]
call fcn.004027ef
cmp dword [ebp - 0x48], 0
je 0x4a39ad
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.0040abf9
add esp, 8
jmp 0x4a39b9
mov eax, dword [ebp + 8]
push eax
call fcn.0045d150
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4a54d0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
push 1
push str.SafeCEF
call fcn.0040a258
add esp, 8
movzx eax, al
test eax, eax
jne 0x4a5557
push str.SoftMgrSDIS.exe
lea eax, [ebp - 4]
push eax
call fcn.0040f5a9
add esp, 8
lea ecx, [ebp - 4]
call fcn.00402c0f
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4a5544
push 0
push 5
push 0
push str._Softid2000001148__Show1
lea ecx, [ebp - 4]
call fcn.00402c0f
push eax
call fcn.004a5d60
add esp, 0x14
test eax, eax
setne al
mov byte [ebp - 0x46], al
lea ecx, [ebp - 4]
call fcn.004027ef
mov al, byte [ebp - 0x46]
jmp 0x4a5559
mov byte [ebp - 0x45], 0
lea ecx, [ebp - 4]
call fcn.004027ef
mov al, byte [ebp - 0x45]
jmp 0x4a5559
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a5d60
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xac
push ebx
push esi
push edi
cmp dword [ebp + 8], 0
jne 0x4a5d79
xor eax, eax
jmp 0x4a5f0a
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4a5d8e
xor eax, eax
jmp 0x4a5f0a
mov eax, dword [ebp + 8]
push eax
call fcn.004800b0
add esp, 4
test eax, eax
jne 0x4a5da5
xor eax, eax
jmp 0x4a5f0a
cmp dword [ebp + 0xc], 0
je 0x4a5dbf
mov eax, dword [ebp + 0xc]
push eax
call fcn.004ab78e
add esp, 4
mov dword [ebp - 0xac], eax
jmp 0x4a5dc9
mov dword [ebp - 0xac], 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.004ab78e
add esp, 4
mov edx, dword [ebp - 0xac]
lea eax, [eax + edx + 4]
mov dword [ebp - 4], eax
push 0x512838
xor ecx, ecx
mov eax, dword [ebp - 4]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004b0e0d
add esp, 8
mov dword [ebp - 0xa8], eax
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4a5e1f
xor eax, eax
jmp 0x4a5f0a
cmp dword [ebp + 0xc], 0
je 0x4a5e44
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x4ef580
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.004b0a5a
add esp, 0x14
jmp 0x4a5e5d
mov eax, dword [ebp + 8]
push eax
push str.__s_
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.004b0a5a
add esp, 0x10
mov dword [ebp - 0x4c], 0
push 0x40
push 0
lea eax, [ebp - 0x48]
push eax
call fcn.004ae3b0
add esp, 0xc
mov dword [ebp - 0x5c], 0
xor eax, eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], 0x44
mov ax, word [ebp + 0x14]
mov word [ebp - 0x1c], ax
lea eax, [ebp - 0x5c]
push eax
lea ecx, [ebp - 0x4c]
push ecx
mov edx, dword [ebp + 0x10]
push edx
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0
je 0x4a5ee8
cmp dword [ebp + 0x18], 0
je 0x4a5ed4
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp - 0x5c]
push ecx
call dword [sym.imp.USER32.dll_WaitForInputIdle]
mov eax, dword [ebp - 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
mov dword [ebp - 0xa4], eax
mov ecx, dword [ebp - 0xa4]
push ecx
call fcn.004aeee4
add esp, 4
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0x60]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a6910
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
push 0x4f0238
lea eax, [ebp - 8]
push eax
call fcn.0040f5a9
add esp, 8
lea ecx, [ebp - 8]
call fcn.00402c0f
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4a6957
push 0
lea ecx, [ebp - 8]
call fcn.00402c0f
push eax
call fcn.004094d6
add esp, 8
test eax, eax
jne 0x4a696b
mov dword [ebp - 0x54], 0
lea ecx, [ebp - 8]
call fcn.004027ef
mov eax, dword [ebp - 0x54]
jmp 0x4a69c5
lea ecx, [ebp - 0xc]
call fcn.0040276e
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
push ecx
push 0x4e8ed4
lea edx, [ebp - 0xc]
push edx
call fcn.00407a80
add esp, 0xc
push 0
push 0
push 0
lea ecx, [ebp - 0xc]
call fcn.00402c0f
push eax
lea ecx, [ebp - 8]
call fcn.00402c0f
push eax
call fcn.00409dd4
add esp, 0x14
mov dword [ebp - 0x50], 0
lea ecx, [ebp - 0xc]
call fcn.004027ef
lea ecx, [ebp - 8]
call fcn.004027ef
mov eax, dword [ebp - 0x50]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4ab7a8
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x50ab8c]
jne 0x4ab7b2
repz ret
jmp fcn.004ba471

Function at 0x4b3329
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x4b335a
call fcn.004b1d26
mov dword [eax], esi
call fcn.004b1d13
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.004ae6de
add esp, 0x14
push 0x16
pop eax
jmp 0x4b33af
test dword [ebp + 0xc], 0xfffffff9
jne 0x4b3336
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4b3387
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004b1d39
pop ecx
call fcn.004b1d13
mov eax, dword [eax]
jmp 0x4b33af
test al, 0x10
jne 0x4b33ad
test al, 1
je 0x4b33ad
test byte [ebp + 0xc], 2
je 0x4b33ad
call fcn.004b1d26
mov dword [eax], 5
call fcn.004b1d13
mov dword [eax], 0xd
jmp 0x4b337e
xor eax, eax
pop esi
pop ebp
ret
Function at 0x4d214e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004b9c7e
and dword [ebp - 4], 0
cmp dword [0x513640], 0
mov ebx, eax
jne 0x4d21ff
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4d22b0
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4d22b0
push eax
call fcn.004b9c0c
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x513640], eax
call esi
push eax
call fcn.004b9c0c
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x513644], eax
call esi
push eax
call fcn.004b9c0c
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x513648], eax
call esi
push eax
call fcn.004b9c0c
pop ecx
mov dword [0x513650], eax
test eax, eax
je 0x4d21ff
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004b9c0c
pop ecx
mov dword [0x51364c], eax
mov eax, dword [0x51364c]
cmp eax, ebx
je 0x4d2257
cmp dword [0x513650], ebx
je 0x4d2257
push eax
call fcn.004b9c87
push dword [0x513650]
mov esi, eax
call fcn.004b9c87
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4d2257
test edi, edi
je 0x4d2257
call esi
test eax, eax
je 0x4d224e
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4d224e
test byte [ebp - 0xc], 1
jne 0x4d2257
or dword [ebp + 0x10], 0x200000
jmp 0x4d2290
mov eax, dword [0x513644]
cmp eax, ebx
je 0x4d2290
push eax
call fcn.004b9c87
pop ecx
test eax, eax
je 0x4d2290
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4d2290
mov eax, dword [0x513648]
cmp eax, ebx
je 0x4d2290
push eax
call fcn.004b9c87
pop ecx
test eax, eax
je 0x4d2290
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x513640]
call fcn.004b9c87
pop ecx
test eax, eax
je 0x4d22b0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4d22b2
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4039c1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x4039d0
pop dword [ebp - 0x2c]
mov eax, 0x4039d0
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x84b917ed
sub dword [ebp - 0x3c], 0x3666d2a2
mov dword [ebp - 0x38], 0xf47d5752
add dword [ebp - 0x38], 0x3db5f4f3
mov dword [ebp - 0x34], 0x7ca8517e
sub dword [ebp - 0x34], 0x305c0d50
mov dword [ebp - 0x30], 0x8251503e
add dword [ebp - 0x30], 0x7daeafc2
lea eax, [ebp - 0x3c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x371e9b58
add dword [ebp - 0x3c], 0x3d53cdfe
mov dword [ebp - 0x38], 0x9c169b05
add dword [ebp - 0x38], 0xa555c670
mov dword [ebp - 0x34], 0x85dcb357
sub dword [ebp - 0x34], 0x226d46eb
mov dword [ebp - 0x30], 0x96cee15d
sub dword [ebp - 0x30], 0x96cee15d
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x369e8
push 0
call eax
mov ecx, 0x47a1
xor ebx, ebx
add ebx, eax
mov edi, 0xea4194e0
add edi, 0x15fef320
add edi, dword [ebp - 0x2c]
mov edx, 0xaa388d9b
add edx, 0x2a43a26a
sub dword [ebp - 0x28], 0x7d275a8a
mov esi, dword [edi]
sub dword [ebp - 0x14], 0xa24a40b9
xor esi, edx
mov dword [ebp - 0x14], 0x9d7feeba
mov dword [ebx], esi
add ebx, 0x5357f3ec
add ebx, 0xaca80c18
add edi, 4
loop 0x403adf
add eax, 0x87f99cb3
add eax, 0x780774a4
xor ebx, ebx
add ebx, eax
add eax, 0xfc977c80
sub eax, 0xfc977c7b
mov ecx, 0xcfbd6025
add ecx, 0x30829fdb
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret