joyce8/EMBER2024-capa huggingface dataset:
Function at 0x452f50
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x58f860]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x220], ecx
mov dword [ebp - 0xc], 1
lea ecx, [ebp + 0xc]
call fcn.0041cc20
cmp eax, 0x9ec
jle 0x452fa4
mov dword [ebp - 0x214], 0
lea ecx, [ebp + 8]
call fcn.0040f740
lea ecx, [ebp + 0xc]
call fcn.0040f740
mov eax, dword [ebp - 0x214]
jmp 0x453099
lea ecx, [ebp + 0xc]
call fcn.0041cb20
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 0x220]
mov eax, dword [edx + 4]
or eax, 0x20006
push eax
push 0
mov ecx, dword [ebp - 0x220]
add ecx, 0x10
call fcn.0041cb20
push eax
mov ecx, dword [ebp - 0x220]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x453017
mov dword [ebp - 0x218], 0
lea ecx, [ebp + 8]
call fcn.0040f740
lea ecx, [ebp + 0xc]
call fcn.0040f740
mov eax, dword [ebp - 0x218]
jmp 0x453099
lea eax, [ebp - 0x210]
push eax
call fcn.0051330e
add esp, 4
lea ecx, [eax + eax + 2]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x210]
push eax
push 1
push 0
lea ecx, [ebp + 8]
call fcn.0041cb20
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x45305a
mov dword [ebp - 0xc], 0
mov edx, dword [ebp - 0x220]
cmp dword [edx + 0xc], 0
jne 0x453070
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x21c], edx
lea ecx, [ebp + 8]
call fcn.0040f740
lea ecx, [ebp + 0xc]
call fcn.0040f740
mov eax, dword [ebp - 0x21c]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00512610
mov esp, ebp
pop ebp
ret 8

Function at 0x4530b0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], 1
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 4]
or edx, 0x20006
push edx
push 0
mov ecx, dword [ebp - 0x14]
add ecx, 0x10
call fcn.0041cb20
push eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x453104
mov dword [ebp - 0xc], 0
lea ecx, [ebp + 8]
call fcn.0040f740
mov eax, dword [ebp - 0xc]
jmp 0x45315a
push 4
lea edx, [ebp + 0xc]
push edx
push 4
push 0
lea ecx, [ebp + 8]
call fcn.0041cb20
push eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x45312c
mov dword [ebp - 8], 0
mov ecx, dword [ebp - 0x14]
cmp dword [ecx + 0xc], 0
jne 0x45313f
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x10], ecx
lea ecx, [ebp + 8]
call fcn.0040f740
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret 8
Function at 0x455ea0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov ecx, dword [ebp + 8]
mov eax, dword [edx + 0x16c]
call eax
push eax
lea ecx, [ebp - 4]
call fcn.0041c880
push 5
push 0
push 0
lea ecx, [ebp - 4]
call fcn.0041cb20
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 4]
call fcn.0040f740
mov esp, ebp
pop ebp
ret 0xc

Function at 0x455ef0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
push 1
push ecx
mov ecx, esp
push 0x554518
call fcn.0041c8a0
push ecx
mov ecx, esp
push 0x55baac
call fcn.0041c8a0
mov ecx, 0x591ad8
call fcn.0042ab10
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov ecx, dword [ebp + 8]
mov eax, dword [edx + 0x16c]
call eax
push eax
lea ecx, [ebp - 4]
call fcn.0041c880
push 5
push 0
push 0
lea ecx, [ebp - 4]
call fcn.0041cb20
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 4]
call fcn.0040f740
mov esp, ebp
pop ebp
ret 0xc
Function at 0x456ad0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x28], ecx
push 0x554518
lea ecx, [ebp - 0xc]
call fcn.0041c8a0
call fcn.0042e0c0
test eax, eax
setne al
mov byte [ebp - 5], al
movzx ecx, byte [ebp - 5]
test ecx, ecx
je 0x456b67
mov edx, dword [0x591308]
push edx
push str._smytime.dll
lea eax, [ebp - 0xc]
push eax
call fcn.004beff0
add esp, 0xc
push 0
lea ecx, [ebp - 0xc]
call fcn.0041cb20
push eax
push 0x55c000
push 0xd5
call fcn.004202c0
add esp, 0x10
mov ecx, dword [0x591308]
push ecx
push str._smytimeinj.exe
lea edx, [ebp - 0xc]
push edx
call fcn.004beff0
add esp, 0xc
push 0
lea ecx, [ebp - 0xc]
call fcn.0041cb20
push eax
push 0x55c000
push 0xd4
call fcn.004202c0
add esp, 0x10
jmp 0x456b9b
mov eax, dword [0x591308]
push eax
push str._smytime.dll
lea ecx, [ebp - 0xc]
push ecx
call fcn.004beff0
add esp, 0xc
push 0
lea ecx, [ebp - 0xc]
call fcn.0041cb20
push eax
push 0x55c000
push 0xd6
call fcn.004202c0
add esp, 0x10
mov edx, dword [0x591308]
push edx
push str._s_sound_remind.wav
lea eax, [ebp - 0xc]
push eax
call fcn.004beff0
add esp, 0xc
lea ecx, [ebp - 0xc]
call fcn.0041cb20
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x456be3
push 0
lea ecx, [ebp - 0xc]
call fcn.0041cb20
push eax
push 0x55bfa8
push 0xdb
call fcn.004202c0
add esp, 0x10
mov ecx, dword [0x591070]
push ecx
mov edx, dword [0x591304]
push edx
push str._s_d.xml
lea eax, [ebp - 0xc]
push eax
call fcn.004beff0
add esp, 0x10
push 0
lea ecx, [ebp - 0xc]
call fcn.0041cb20
push eax
push 0x558d40
push 0xcb
call fcn.004202c0
add esp, 0x10
mov ecx, dword [0x591308]
push ecx
push str._sweathericondefault.icn
lea edx, [ebp - 0xc]
push edx
call fcn.004beff0
add esp, 0xc
lea ecx, [ebp - 0xc]
call fcn.0041cb20
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x456c67
push 0
lea ecx, [ebp - 0xc]
call fcn.0041cb20
push eax
push 0x55c000
push 0xd9
call fcn.004202c0
add esp, 0x10
mov eax, dword [0x591304]
push eax
push str._sweatherlist.xml
lea ecx, [ebp - 0xc]
push ecx
call fcn.004beff0
add esp, 0xc
push 0
mov ecx, 0x5914a0
call fcn.0040f350
push 1
mov ecx, 0x5914a0
call fcn.0040f330
push ecx
mov ecx, esp
push str.WeatherList
call fcn.0041c8a0
push ecx
mov ecx, esp
lea edx, [ebp - 0xc]
push edx
call fcn.0041c880
mov ecx, 0x5914a0
call fcn.00441fd0
mov eax, dword [0x591304]
push eax
push str._smytimeset.cfg
lea ecx, [ebp - 0xc]
push ecx
call fcn.004beff0
add esp, 0xc
push 0
mov ecx, 0x591448
call fcn.0040f350
push 1
mov ecx, 0x591448
call fcn.0040f330
push ecx
mov ecx, esp
push str.mytimeset
call fcn.0041c8a0
push ecx
mov ecx, esp
lea edx, [ebp - 0xc]
push edx
call fcn.0041c880
mov ecx, 0x591448
call fcn.00441fd0
push ecx
mov ecx, esp
push str.Changed
call fcn.0041c8a0
push ecx
mov ecx, esp
push 0x55bed4
call fcn.0041c8a0
mov ecx, 0x591448
call fcn.00456d50
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x456d40
mov ecx, dword [ebp - 0x28]
call fcn.0045c210
lea ecx, [ebp - 0xc]
call fcn.0040f740
mov esp, ebp
pop ebp
ret
Function at 0x456fc0
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov dword [ebp - 0x60], ecx
lea ecx, [ebp - 0x28]
call fcn.0042e670
lea ecx, [ebp - 8]
call fcn.0040ee90
lea ecx, [ebp - 0x10]
call fcn.0040ee90
lea ecx, [ebp - 0xc]
call fcn.0040ee90
lea ecx, [ebp - 4]
call fcn.0040ee90
push ecx
mov ecx, esp
lea eax, [ebp + 8]
push eax
call fcn.0041c880
push ecx
mov ecx, esp
push 0x59130c
call fcn.0041c880
lea ecx, [ebp - 0x38]
push ecx
lea ecx, [ebp - 0x28]
call fcn.0042e910
push eax
lea ecx, [ebp - 0xc]
call fcn.0041c8e0
lea ecx, [ebp - 0x38]
call fcn.0040f740
push ecx
mov ecx, esp
lea edx, [ebp + 8]
push edx
call fcn.0041c880
push ecx
mov ecx, esp
push 0x591308
call fcn.0041c880
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x28]
call fcn.0042e910
push eax
lea ecx, [ebp - 8]
call fcn.0041c8e0
lea ecx, [ebp - 0x44]
call fcn.0040f740
lea ecx, [ebp - 0xc]
call fcn.0041cb20
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x45711a
lea ecx, [ebp - 0xc]
call fcn.0041cb20
push eax
lea ecx, [ebp - 0x48]
push ecx
call fcn.004240c0
add esp, 8
push eax
lea ecx, [ebp - 4]
call fcn.0041c8e0
lea ecx, [ebp - 0x48]
call fcn.0040f740
lea ecx, [ebp - 8]
call fcn.0041cb20
push eax
lea edx, [ebp - 0x4c]
push edx
call fcn.004240c0
add esp, 8
push eax
lea ecx, [ebp - 0x10]
call fcn.0041c8e0
lea ecx, [ebp - 0x4c]
call fcn.0040f740
push ecx
mov ecx, esp
lea eax, [ebp - 4]
push eax
call fcn.0041c880
push ecx
mov ecx, esp
lea edx, [ebp - 0x10]
push edx
call fcn.0041c880
call fcn.00422970
add esp, 8
mov byte [ebp - 0x29], al
movzx eax, byte [ebp - 0x29]
test eax, eax
je 0x45710b
push ecx
mov ecx, esp
lea edx, [ebp - 8]
push edx
call fcn.0041c880
push ecx
mov ecx, esp
lea eax, [ebp - 0xc]
push eax
call fcn.0041c880
call fcn.00422bd0
add esp, 8
lea ecx, [ebp - 0xc]
call fcn.0041cb20
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
movzx ecx, byte [ebp + 0xc]
test ecx, ecx
je 0x45716c
lea ecx, [ebp - 8]
call fcn.0041cb20
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x45716c
mov edx, dword [ebp - 0x60]
cmp dword [edx + 0x480], 0
je 0x45716c
push 0x55a5b0
lea ecx, [ebp + 8]
call fcn.00430140
test eax, eax
jne 0x45716c
push 2
push 0
push 0
mov eax, dword [ebp - 0x60]
mov ecx, dword [eax + 0x480]
add ecx, 0x2d8
call fcn.0048cd10
lea ecx, [ebp - 4]
call fcn.0040f740
lea ecx, [ebp - 0xc]
call fcn.0040f740
lea ecx, [ebp - 0x10]
call fcn.0040f740
lea ecx, [ebp - 8]
call fcn.0040f740
lea ecx, [ebp - 0x28]
call fcn.0042e690
lea ecx, [ebp + 8]
call fcn.0040f740
mov esp, ebp
pop ebp
ret 8
Function at 0x4571b0
Capabilities:
Create process on windows
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [ebp - 0x48], ecx
lea ecx, [ebp - 0x1c]
call fcn.0042e670
mov ecx, dword [ebp - 0x48]
call fcn.004572e0
mov dword [0x5912f0], eax
push 0
push 0
push 0x470
mov eax, dword [0x5912f0]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4572b1
call fcn.0042e0c0
test eax, eax
je 0x457244
push 0
push 0
push 0x554518
push ecx
mov ecx, esp
push 0x55c154
call fcn.0041c8a0
push ecx
mov ecx, esp
push 0x591308
call fcn.0041c880
lea ecx, [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x1c]
call fcn.0042e910
mov ecx, eax
call fcn.0041cb20
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x34]
call fcn.0040f740
jmp 0x4572b1
mov dword [ebp - 0x20], 0
push 0x554518
push 0x55c138
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 0x28], eax
lea edx, [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push ecx
mov ecx, esp
push 0x55c120
call fcn.0041c8a0
push ecx
mov ecx, esp
push 0x591308
call fcn.0041c880
lea ecx, [ebp - 0x40]
push ecx
lea ecx, [ebp - 0x1c]
call fcn.0042e910
mov ecx, eax
call fcn.0041cb20
push eax
mov edx, dword [ebp - 0x20]
push edx
call fcn.0041eaa0
add esp, 8
mov dword [ebp - 0x24], eax
lea ecx, [ebp - 0x40]
call fcn.0040f740
cmp dword [ebp - 4], 1
jne 0x4572c8
mov byte [ebp - 0x41], 1
lea ecx, [ebp - 0x1c]
call fcn.0042e690
mov al, byte [ebp - 0x41]
jmp 0x4572d7
mov byte [ebp - 0x42], 0
lea ecx, [ebp - 0x1c]
call fcn.0042e690
mov al, byte [ebp - 0x42]
mov esp, ebp
pop ebp
ret

Function at 0x4572e0
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
push 0
push 0x55c138
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x457333
push 0x554518
push 0x55c194
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_FindWindowExW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x457333
push 0
push 0x55c174
push 0
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.USER32.dll_FindWindowExW]
jmp 0x457335
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x457bc0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x58f860]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp + 0x14]
mov dword [eax], 0
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
sub eax, 0x1f5
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x14
ja case.0x457c07.3
mov ecx, dword [ebp - 0x24]
movzx edx, byte [ecx + 0x457d60]
jmp dword [edx*4 + 0x457d44]
mov ecx, dword [ebp - 0x20]
call fcn.00457e30
jmp case.0x457c07.3
mov eax, dword [ebp - 0x20]
movzx ecx, byte [eax + 0x4ad]
test ecx, ecx
jne 0x457c31
mov ecx, dword [ebp - 0x20]
call fcn.00458050
mov edx, dword [ebp - 0x20]
mov byte [edx + 0x4af], 0
jmp case.0x457c07.3
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov ecx, dword [ebp - 0x20]
call fcn.00457d80
mov byte [ebp - 0x19], al
movzx ecx, byte [ebp - 0x19]
test ecx, ecx
je 0x457caf
movzx edx, word [ebp - 0xe]
test edx, edx
je 0x457c6e
movzx eax, word [ebp - 0xe]
cmp eax, 0x1e
jne 0x457c8b
movzx ecx, word [ebp - 0xc]
test ecx, ecx
jne 0x457c8b
mov edx, dword [ebp - 0x20]
push edx
push 0
push 0x45da30
call fcn.0051af0d
add esp, 0xc
jmp 0x457caf
movzx eax, word [ebp - 0xe]
cmp eax, 0x1e
jne 0x457caf
movzx ecx, word [ebp - 0xc]
test ecx, ecx
jne 0x457caf
mov edx, dword [ebp - 0x20]
push edx
push 0
push 0x45da30
call fcn.0051af0d
add esp, 0xc
movzx eax, word [ebp - 0xc]
test eax, eax
jne 0x457cc5
mov ecx, dword [ebp - 0x20]
add ecx, 0x3e0
call fcn.00490cf0
jmp case.0x457c07.3
mov ecx, dword [ebp - 0x20]
push ecx
push 0
push 0x491550
call fcn.0051af0d
add esp, 0xc
jmp case.0x457c07.3
mov edx, dword [ebp - 0x20]
cmp dword [edx + 0x4b0], 5
jg 0x457cf7
mov ecx, dword [ebp - 0x20]
call fcn.004571b0
movzx eax, al
test eax, eax
je 0x457d09
push 0x203
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_KillTimer]
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 0x4b0]
add ecx, 1
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x4b0], ecx
jmp case.0x457c07.3
push 0xffffffffffffffff
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
xor eax, eax
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00512610
mov esp, ebp
pop ebp
ret 0x10
Function at 0x45bda0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 4]
or edx, 0xf003f
push edx
push 0
mov ecx, dword [ebp - 0x18]
add ecx, 0x10
call fcn.0041cb20
push eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x45bded
mov dword [ebp - 0xc], 0
lea ecx, [ebp + 8]
call fcn.0040f740
mov eax, dword [ebp - 0xc]
jmp 0x45be41
push 0
push 0
push 0
push 0
lea ecx, [ebp + 8]
call fcn.0041cb20
push eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], 0
jne 0x45be2f
mov dword [ebp - 0x10], 1
lea ecx, [ebp + 8]
call fcn.0040f740
mov eax, dword [ebp - 0x10]
jmp 0x45be41
mov dword [ebp - 0x14], 0
lea ecx, [ebp + 8]
call fcn.0040f740
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret 4

Function at 0x45be50
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0xc], 1
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 4]
or edx, 0x20006
push edx
push 0
mov ecx, dword [ebp - 0x18]
add ecx, 0x10
call fcn.0041cb20
push eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x45bea4
mov dword [ebp - 0x10], 0
lea ecx, [ebp + 8]
call fcn.0040f740
mov eax, dword [ebp - 0x10]
jmp 0x45bf00
mov edx, dword [ebp + 0xc]
mov dword [ebp - 4], edx
push 4
lea eax, [ebp + 0xc]
push eax
push 4
push 0
lea ecx, [ebp + 8]
call fcn.0041cb20
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x45bed2
mov dword [ebp - 0xc], 0
mov edx, dword [ebp - 0x18]
cmp dword [edx + 0xc], 0
jne 0x45bee5
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x14], edx
lea ecx, [ebp + 8]
call fcn.0040f740
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret 8
Function at 0x45d0f0
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
push 0x554518
push 0x55c138
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 0xc], eax
push 0x554518
push 0x55c194
push 0
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.USER32.dll_FindWindowExW]
mov dword [ebp - 8], eax
push 0
push 0x55c174
push 0
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.USER32.dll_FindWindowExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x45d151
push 0
push 0
push 5
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [ebp - 0x14]
call fcn.004572e0
mov dword [0x5912fc], eax
push 0
push 0
push 0x46d
mov eax, dword [0x5912fc]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
push 0
push str._PCMaster6
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x45d19c
push 0
push 2
push 0x709
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
push 0
push str._Pcmaster_LunarCalendar_MytimeWeb
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x45d1c2
push 0
push 0
push 0x10
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [ebp + 0x14]
mov dword [eax], 0
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x45e2c0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
movzx ecx, byte [eax + 0x4ae]
test ecx, ecx
je 0x45e2de
mov eax, 1
jmp 0x45e354
push 0
push 0
mov ecx, dword [ebp - 8]
call fcn.004cdeda
mov edx, dword [ebp - 8]
cmp dword [edx + 0x480], 0
je 0x45e30b
push 0
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x480]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push str.calendar_UICalendar
mov ecx, dword [ebp - 8]
add ecx, 0x20
call fcn.004dd71b
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x45e32c
mov ecx, dword [ebp - 4]
call fcn.00458000
mov byte [0x59107c], 0
mov byte [0x59107d], 0
mov byte [0x59107b], 0
mov byte [0x59107f], 0
mov eax, dword [ebp - 8]
mov byte [eax + 0x4a8], 0
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10

Function at 0x45e360
Capabilities:
Extract resource via kernel32 functions
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x24], ecx
cmp dword [0x591054], 0
jne 0x45e485
push 0x58
call fcn.00512067
add esp, 4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x45e396
mov ecx, dword [ebp - 0x18]
call fcn.0040f2e0
mov dword [ebp - 0x28], eax
jmp 0x45e39d
mov dword [ebp - 0x28], 0
mov eax, dword [ebp - 0x28]
mov dword [0x591054], eax
push 0x558d40
push 0xd2
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x10]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x45e485
mov eax, dword [ebp - 8]
add eax, 1
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004c8580
add esp, 4
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 8]
lea edx, [ecx + ecx + 2]
push edx
push 0
mov eax, dword [ebp - 0x14]
push eax
call fcn.00512af0
add esp, 0xc
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 0x14]
push eax
call fcn.00511ce0
add esp, 0xc
push 0
mov ecx, dword [ebp - 0x14]
add ecx, 2
push ecx
mov ecx, dword [0x591054]
call fcn.00442630
push str.CityList
mov ecx, dword [0x591054]
add ecx, 4
call fcn.0041cec0
mov ecx, dword [0x591054]
call fcn.00446e10
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
push eax
call fcn.005124eb
add esp, 4
mov eax, 1
mov esp, ebp
pop ebp
ret 0x10
Function at 0x468b70
Capabilities:
Check if file exists
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp + 8]
mov dword [eax + 0x360], ecx
lea ecx, [ebp - 0x18]
call fcn.0042e670
push ecx
mov ecx, esp
push str.rmup.exe
call fcn.0041c8a0
push ecx
push esp
lea ecx, [ebp - 0x18]
call fcn.0042e6b0
lea edx, [ebp - 0x1c]
push edx
lea ecx, [ebp - 0x18]
call fcn.0042e910
lea ecx, [ebp - 0x1c]
call fcn.0041cb20
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x468c0a
mov eax, dword [ebp - 0x2c]
movzx ecx, byte [eax + 0x35c]
test ecx, ecx
jne 0x468be5
push 0x468d00
push 0
push 0x4293a0
call fcn.0051af0d
add esp, 0xc
mov edx, dword [ebp - 0x2c]
mov byte [edx + 0x35c], 1
mov byte [ebp - 0x25], 0
lea ecx, [ebp - 0x1c]
call fcn.0040f740
lea ecx, [ebp - 0x18]
call fcn.0042e690
mov al, byte [ebp - 0x25]
jmp 0x468c33
mov byte [ebp - 0x26], 1
lea ecx, [ebp - 0x1c]
call fcn.0040f740
lea ecx, [ebp - 0x18]
call fcn.0042e690
mov al, byte [ebp - 0x26]
jmp 0x468c33
mov esp, ebp
pop ebp
ret 4