joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4253c1
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov edi, ecx
cmp byte [edi + 0x30], 0
jne 0x4253d7
push 2
call fcn.0042525b
mov esi, dword [edi + 0x14]
call dword [sym.imp.USER32.dll_GetCapture]
mov ebx, dword [esp + 0x34]
mov ebp, dword [esp + 0x30]
cmp eax, esi
jne 0x42542c
cmp byte [edi + 0x31], 0
je 0x42542c
mov ecx, dword [esp + 0x38]
mov byte [edi + 0x24], 0
call fcn.00422115
mov esi, eax
mov dword [esp + 0x18], 2
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [edi + 0x38]
lea edx, [esp + 0x18]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ebx
mov eax, dword [ecx]
push edx
call dword [eax + 0x74]
cmp byte [edi + 0x30], 0
je 0x425438
cmp byte [edi + 0x31], 0
jne 0x4254a4
mov ecx, dword [edi + 0x38]
lea edx, [esp + 0x10]
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], ebx
call fcn.00423c51
cmp byte [edi + 0x24], 0
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
je 0x425464
cmp dword [edi + 0x28], edx
jne 0x425464
cmp dword [edi + 0x2c], eax
je 0x4254a4
mov ecx, dword [esp + 0x38]
mov dword [edi + 0x28], edx
mov dword [edi + 0x2c], eax
mov byte [edi + 0x24], 1
call fcn.00422115
mov esi, eax
mov dword [esp + 0x18], 4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [edi + 0x38]
lea edx, [esp + 0x18]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ebx
mov eax, dword [ecx]
push edx
call dword [eax + 0x7c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 0x10
Function at 0x425e5f
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
sub esp, 0x41c
push ebx
push ebp
push esi
push edi
xor eax, eax
mov esi, 0x206
push esi
mov word [esp + 0x228], ax
xor ebx, ebx
lea eax, [esp + 0x22a]
mov edi, ecx
push ebx
push eax
call sub.msvcrt.dll_memset
xor eax, eax
push esi
mov word [esp + 0x2c], ax
lea eax, [esp + 0x2e]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0x18
mov dword [esp + 0x10], ebx
lea eax, [esp + 0x10]
push eax
push 0x20019
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerUser_Shell_Folders
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebp, 0x104
test eax, eax
jne 0x425f37
lea eax, [esp + 0x18]
mov dword [esp + 0x14], 1
push eax
lea eax, [esp + 0x228]
mov dword [esp + 0x1c], ebp
push eax
lea eax, [esp + 0x1c]
push eax
push ebx
push str.Local_AppData
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x425f2d
push ebp
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push str.anti_injection.dat
push 0x4559b4
lea eax, [esp + 0x24]
push eax
push 0x455978
push ebp
push eax
call fcn.0040203a
add esp, 0x18
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x23c
call dword [sym.imp.msvcrt.dll_malloc]
pop ecx
test eax, eax
je 0x425f52
mov ecx, eax
call fcn.00435e22
mov esi, eax
jmp 0x425f54
mov esi, ebx
mov ecx, dword [edi]
mov dword [edi], ebx
test ecx, ecx
je 0x425f61
call fcn.00425f82
lea ecx, [esi + 0x18]
mov dword [edi], esi
cmp word [ecx], bx
jne 0x425f77
lea eax, [esp + 0x1c]
mov edx, ebp
push eax
call fcn.00401617
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x41c
ret

Function at 0x42754c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
cmp dword [ebp + 8], 0
push ebx
push esi
mov ebx, ecx
jne 0x42758e
lea eax, [ebp - 0x214]
mov esi, pe_nt_image_headers32
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x427580
call fcn.00419a27
jmp 0x427633
cmp eax, esi
jbe 0x4275a8
mov eax, 0x80020013
jmp 0x427633
push dword [ebp + 8]
mov edx, 0x104
lea ecx, [ebp - 0x214]
call fcn.00401617
cmp eax, 0x8007007a
je 0x427584
push edi
lea eax, [ebp - 0x41c]
xor edi, edi
push eax
push edi
push 0x455b30
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x4275d0
call fcn.00419a27
jmp 0x427632
xor eax, eax
lea esi, [ebx + 4]
mov word [ebp - 0x216], ax
mov edx, 0x101
lea eax, [ebp - 0x41c]
mov ecx, esi
push eax
call fcn.00401617
push edi
push 0x2100
push 2
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0xc
push eax
mov ecx, 0x40000000
mov dword [ebp - 8], edi
push edi
push ecx
push esi
mov dword [ebp - 4], 1
mov dword [ebx + 0x208], ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x42762e
call fcn.00419a27
mov edi, eax
jmp 0x427630
mov dword [ebx], eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x42763b
Capabilities:
Check if file exists
Delete file
Move file

Disassembly:
push esi
mov esi, ecx
cmp dword [esi], 0
je 0x42764e
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [esi], 0
cmp dword [esp + 8], 0
jne 0x427665
lea eax, [esi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
pop esi
ret 4
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x427687
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x427687
mov ecx, eax
call fcn.0042753e
jmp 0x427661
push dword [esp + 8]
lea eax, [esi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x42765f
call fcn.00419a27
jmp 0x427661

Function at 0x427f56
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x424
push ebx
push esi
mov esi, ecx
push edi
lea edi, [esi + 0x58]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call fcn.0040129e
push eax
lea ecx, [esp + 0x10]
call fcn.004028e5
mov eax, dword [esi + 0x28]
mov dword [esp + 0x14], eax
test eax, eax
je 0x428038
mov ebx, 0x455d74
lea eax, [esp + 0x14]
push eax
call fcn.0040538c
mov esi, dword [eax]
test esi, esi
je 0x42802d
mov eax, dword [esi + 4]
lea ecx, [esp + 0xc]
push dword [eax - 0xc]
push eax
call fcn.00401a0b
mov ecx, ebx
call fcn.00401bae
push eax
push ebx
lea ecx, [esp + 0x14]
call fcn.00401a0b
mov eax, dword [esi + 8]
lea ecx, [esp + 0xc]
push dword [eax - 0xc]
push eax
call fcn.00401a0b
mov ecx, ebx
call fcn.00401bae
push eax
push ebx
lea ecx, [esp + 0x14]
call fcn.00401a0b
movzx eax, word [esi + 0xc]
push ecx
push eax
lea ecx, [esp + 0x18]
call fcn.0042872c
lea ecx, [esp + 0xc]
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
call fcn.00401a0b
mov ecx, dword [esp + 0x10]
lea ecx, [ecx - 0x10]
call fcn.0040169b
mov esi, 0x455e04
mov ecx, esi
call fcn.00401bae
push eax
push esi
lea ecx, [esp + 0x14]
call fcn.00401a0b
cmp dword [esp + 0x14], 0
jne 0x427f94
and dword [esp + 0x18], 0
lea ecx, [esp + 0x228]
push 1
push 2
pop edx
call fcn.00435c08
lea eax, [esp + 0x22c]
push eax
lea ecx, [esp + 0x20]
call fcn.0042754c
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x428086
cmp dword [esp + 0x18], 0
je 0x42807b
push dword [esp + 0x18]
call ebx
and dword [esp + 0x18], 0
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push 0
push ecx
mov eax, dword [esi - 0xc]
add eax, eax
push eax
push esi
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4280ab
call fcn.00419a27
push dword [ebp + 8]
lea ecx, [esp + 0x1c]
call fcn.0042763b
cmp dword [esp + 0x18], 0
je 0x4280e6
push dword [esp + 0x18]
call ebx
and dword [esp + 0x18], 0
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [esp + 0x18], 0
je 0x4280e6
push dword [esp + 0x18]
call ebx
and dword [esp + 0x18], 0
lea ecx, [esi - 0x10]
call fcn.0040169b
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x428c87
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
push edi
call fcn.0040129e
push eax
lea ecx, [ebp - 8]
call fcn.004028e5
lea ecx, [ebp - 8]
call fcn.00428dc0
call fcn.0040129e
push eax
lea ecx, [ebp - 4]
call fcn.004028e5
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call sub.msvcrt.dll_memset
xor ebx, ebx
lea ecx, [ebp - 0x210]
inc ebx
push 0
mov edx, ebx
call fcn.00435c08
add esp, 0x10
lea eax, [ebp - 0x210]
push 0x453a30
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x210]
call fcn.00401bae
push eax
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 4]
call fcn.00401b24
mov edi, dword [ebp - 8]
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov esi, dword [ebp - 4]
test eax, eax
je 0x428d30
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x428d32
xor bl, bl
lea ecx, [esi - 0x10]
call fcn.0040169b
lea ecx, [edi - 0x10]
call fcn.0040169b
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x428dc0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x834
push ebx
push esi
push edi
xor eax, eax
mov edi, 0x206
push edi
mov word [ebp - 0x21c], ax
xor ebx, ebx
lea eax, [ebp - 0x21a]
mov esi, ecx
push ebx
push eax
call sub.msvcrt.dll_memset
xor eax, eax
push edi
mov word [ebp - 0x62c], ax
lea eax, [ebp - 0x62a]
push ebx
push eax
call sub.msvcrt.dll_memset
xor eax, eax
push edi
mov word [ebp - 0x424], ax
lea eax, [ebp - 0x422]
push ebx
push eax
call sub.msvcrt.dll_memset
xor eax, eax
push edi
mov word [ebp - 0x834], ax
lea eax, [ebp - 0x832]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0x30
lea eax, [ebp - 0x21c]
push eax
push ebx
push ebx
push 0x1a
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x428f9a
lea ecx, [ebp - 0x21c]
call fcn.00401bae
push eax
lea eax, [ebp - 0x21c]
mov ecx, esi
push eax
call fcn.00401b24
lea eax, [ebp - 0x62c]
mov edx, str.NowUser
push eax
lea ecx, [ebp - 0x21c]
call fcn.00428fa1
lea eax, [ebp - 0x834]
mov edx, str.IsLogined
push eax
lea ecx, [ebp - 0x21c]
call fcn.00428fa1
pop ecx
pop ecx
lea eax, [ebp - 0x62c]
push eax
lea ecx, [ebp - 0xc]
call fcn.004025b6
lea eax, [ebp - 0x834]
push eax
lea ecx, [ebp - 8]
call fcn.004025b6
call fcn.0040129e
push eax
lea ecx, [ebp - 4]
call fcn.004028e5
push 0x44de30
lea ecx, [ebp - 0xc]
call fcn.004037f8
test eax, eax
je 0x428f64
push 0x45606c
lea ecx, [ebp - 8]
call fcn.004037f8
test eax, eax
je 0x428f64
lea eax, [ebp - 0x424]
mov edx, str.UserMd5
push eax
lea ecx, [ebp - 0x21c]
call fcn.00428fa1
pop ecx
lea ecx, [ebp - 0x424]
call fcn.00401bae
push eax
lea eax, [ebp - 0x424]
push eax
lea ecx, [ebp - 4]
call fcn.00401b24
lea eax, [ebp - 4]
mov edx, str.360se6_appsdatausers_
push str.360sefav.db
push eax
lea ecx, [ebp - 0x10]
call fcn.00415192
pop ecx
mov edx, eax
lea ecx, [ebp - 0x14]
call fcn.0040e170
pop ecx
mov ecx, esi
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
call fcn.00401a0b
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.0040169b
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.0040169b
jmp 0x428f79
mov edi, str.360se6_appsdatausersdefault360sefav.db
mov ecx, edi
call fcn.00401bae
push eax
push edi
mov ecx, esi
call fcn.00401a0b
mov ecx, dword [ebp - 4]
lea ecx, [ecx - 0x10]
call fcn.0040169b
mov ecx, dword [ebp - 8]
lea ecx, [ecx - 0x10]
call fcn.0040169b
mov ecx, dword [ebp - 0xc]
lea ecx, [ecx - 0x10]
call fcn.0040169b
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x429943
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xc
push ebp
push esi
push edi
xor edi, edi
mov ebp, edx
push edi
push 0x80
push 4
push edi
push edi
push 0x40000000
push dword [ecx]
mov esi, edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x429972
call fcn.00419a27
jmp 0x429976
mov esi, eax
mov eax, edi
test eax, eax
je 0x42998d
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
je 0x42998d
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, edi
mov edx, dword [ebp]
lea ecx, [esp + 0x10]
call fcn.004062f7
mov edi, dword [eax]
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x42999e
mov edx, dword [ebp]
sub edi, ecx
lea ecx, [esp + 0xc]
call fcn.004062f7
push 0
lea ecx, [esp + 0x18]
push ecx
push edi
push dword [eax]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4299cd
call fcn.00419a27
cmp dword [esp + 0xc], 0
mov edi, dword [sym.imp.msvcrt.dll_free]
je 0x4299e1
push dword [esp + 0xc]
call edi
pop ecx
cmp dword [esp + 0x10], 0
je 0x4299ef
push dword [esp + 0x10]
call edi
pop ecx
test esi, esi
je 0x4299fa
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
add esp, 0xc
ret
Function at 0x42c469
Capabilities:
Delete internet cache
Enumerate internet cache

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov ebx, 0x100000
push edi
push ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.msvcrt.dll_malloc]
mov esi, eax
lea eax, [ebp - 4]
pop ecx
push eax
push esi
push 0
mov dword [esi], ebx
call dword [sym.imp.WININET.dll_FindFirstUrlCacheEntryW]
mov edi, eax
test edi, edi
jne 0x42c4a1
push esi
call dword [sym.imp.msvcrt.dll_free]
pop ecx
jmp 0x42c4f9
mov ebx, dword [ebp + 8]
mov eax, ebx
shr eax, 1
and eax, 0xffffff01
shr ebx, 2
mov dword [ebp + 8], eax
and bl, 1
test dword [esi + 0xc], 0x100000
je 0x42c4c3
test bl, bl
jmp 0x42c4c5
test al, al
je 0x42c4d0
push dword [esi + 4]
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntryW]
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x100000
push eax
push esi
push edi
call dword [sym.imp.WININET.dll_FindNextUrlCacheEntryW]
test eax, eax
mov eax, dword [ebp + 8]
jne 0x42c4b6
push esi
call dword [sym.imp.msvcrt.dll_free]
pop ecx
push edi
call dword [sym.imp.WININET.dll_FindCloseUrlCache]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x42dbf3
Capabilities:
Set registry value

Disassembly:
mov edx, dword [esp + 8]
push esi
mov esi, ecx
test edx, edx
jne 0x42dc03
push 0xd
pop eax
jmp 0x42dc32
mov ecx, edx
push ebx
push edi
xor ebx, ebx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x42dc0c
sub ecx, edi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push ebx
push ebx
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop ebx
pop esi
ret 0xc

Function at 0x42dc36
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x214
push ebp
push esi
push edi
mov edi, ecx
xor ebp, ebp
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], ebp
mov dword [esp + 0x10], ebp
mov eax, dword [edi + 4]
or eax, 0x2001f
push eax
push dword [esp + 0x228]
push dword [edi]
call fcn.0042dbaa
jmp 0x42dc72
lea eax, [esp + 0x20]
push eax
call fcn.0042dc36
mov esi, eax
test esi, esi
jne 0x42dcba
lea eax, [esp + 0x18]
mov dword [esp + 0x14], pe_nt_image_headers32
push eax
push ebp
push ebp
push ebp
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x34]
push eax
push ebp
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea ecx, [esp + 0xc]
test eax, eax
je 0x42dc68
call fcn.00411434
push dword [esp + 0x224]
mov ecx, edi
call fcn.0042db46
mov esi, eax
lea ecx, [esp + 0xc]
call fcn.00411434
pop edi
mov eax, esi
pop esi
pop ebp
add esp, 0x214
ret 4
Function at 0x42eefb
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push esi
xor eax, eax
xor esi, esi
push 0x206
mov word [ebp - 0x208], ax
lea eax, [ebp - 0x206]
push esi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x208]
push 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
test eax, eax
je 0x42ef96
push str..exe
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x42ef96
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
jne 0x42ef8d
call fcn.00406399
cmp dword [eax], 3
jl 0x42ef8d
push esi
push esi
push str.___make_default_browser
lea eax, [ebp - 0x208]
push eax
push str.runas
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov al, 1
jmp 0x42ef98
mov cl, 1
call fcn.0042f01b
jmp 0x42ef98
xor al, al
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x42efa0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push esi
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
jne 0x42f00f
call fcn.00406399
cmp dword [eax], 3
jl 0x42f00f
xor eax, eax
xor esi, esi
push 0x206
mov word [ebp - 0x208], ax
lea eax, [ebp - 0x206]
push esi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x208]
push 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push esi
push esi
push str.___uninst_default_browser
lea eax, [ebp - 0x208]
push eax
push str.runas
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov al, 1
jmp 0x42f016
xor cl, cl
call fcn.0042f01b
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x42f01b
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x538
push ebx
push ebp
push esi
push edi
push 0x320
xor ebp, ebp
lea eax, [esp + 0x224]
push ebp
push eax
mov bl, cl
call sub.msvcrt.dll_memset
add esp, 0xc
xor eax, eax
mov word [esp + 0x10], ax
mov edi, ebp
lea eax, [esp + 0x12]
mov dword [esp + 0x540], edi
push 0x208
push ebp
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
test bl, bl
je 0x42f08f
push 0x104
lea eax, [esp + 0x14]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [esp + 0x220]
lea ecx, [esp + 0x10]
call fcn.0042d308
jmp 0x42f0d1
call fcn.0042edda
lea eax, [esp + 0x10]
push eax
push ebp
push ebp
push 0x26
push ebp
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x42f0d8
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
push 0x457380
lea ecx, [esp + 0x14]
call fcn.0042dad7
lea edx, [esp + 0x220]
lea ecx, [esp + 0x10]
call fcn.0042cc35
mov edi, dword [esp + 0x540]
lea ecx, [esp + 0x220]
call fcn.0042f939
mov esi, ebp
test edi, edi
je 0x42f102
mov eax, dword [esp + esi*4 + 0x220]
test eax, eax
je 0x42f0fd
push eax
call dword [sym.imp.msvcrt.dll_free]
pop ecx
inc esi
cmp esi, edi
jb 0x42f0ea
lea ecx, [esp + 0x10]
test bl, bl
je 0x42f10e
xor dl, dl
jmp 0x42f110
mov dl, 1
call fcn.0042f57b
push ebp
push ebp
push ebp
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
push 2
push ebp
call dword [sym.imp.ole32.dll_CoInitializeEx]
test bl, bl
je 0x42f14a
lea ecx, [esp + 0x10]
call fcn.0042f16e
call fcn.00406399
cmp dword [eax], 5
jl 0x42f15e
mov ecx, 0x45701c
jmp 0x42f159
call fcn.00406399
cmp dword [eax], 5
jl 0x42f15e
mov ecx, str.Internet_Explorer
call fcn.0042f43f
call dword [sym.imp.ole32.dll_CoUninitialize]
pop edi
mov al, 1
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42f1fe
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
push ebx
push esi
push edi
push 0
push 0
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push 0x90000000
push eax
push str.STATIC
push 0x80
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov esi, eax
test esi, esi
je 0x42f294
push 2
push esi
call dword [sym.imp.USER32.dll_MonitorFromWindow]
mov edx, eax
test edx, edx
je 0x42f28d
push 9
pop ecx
xor eax, eax
lea edi, [ebp - 0x28]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0x28
push eax
push edx
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
xor eax, eax
push eax
push eax
push eax
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
cdq
sub eax, edx
sar eax, 1
add eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x18]
cdq
sub eax, edx
sar eax, 1
add eax, dword [ebp - 0x18]
push eax
push esi
call dword [sym.imp.USER32.dll_MoveWindow]
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0x38
lea eax, [ebp - 0x64]
push 0
push eax
call sub.msvcrt.dll_memset
and dword [ebp - 4], 0
lea eax, [ebp - 0x68]
add esp, 0xc
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x68], 0x3c
xor bl, bl
mov dword [ebp - 0x64], 0x40
mov dword [ebp - 0x60], esi
push eax
mov dword [ebp - 0x5c], str.runas
mov dword [ebp - 0x54], str.__make_default_browser___make_default_browser_admin
mov dword [ebp - 0x4c], 5
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
cmp eax, 1
jne 0x42f305
push 0xffffffffffffffff
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
movzx ebx, bl
push 1
pop eax
cmovne ebx, eax
test esi, esi
je 0x42f310
push esi
call dword [sym.imp.USER32.dll_DestroyWindow]
test bl, bl
je 0x42f31f
cmp dword [ebp - 4], 0
jne 0x42f31f
xor eax, eax
inc eax
jmp 0x42f321
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x430665
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
lea edi, [ecx + 4]
mov ecx, dword [edi]
cmp dword [ecx - 0xc], 0
jle 0x43067a
add ecx, 0xfffffff0
jmp 0x4306db
push ecx
push ecx
mov ecx, dword [0x460d50]
lea eax, [ebp - 4]
push eax
mov ecx, dword [ecx]
call fcn.00436239
lea eax, [ebp - 4]
mov ecx, edi
push eax
call fcn.00405f8f
mov ecx, dword [ebp - 4]
lea ecx, [ecx - 0x10]
call fcn.0040169b
mov eax, dword [edi]
cmp dword [eax - 0xc], 0
jne 0x4306d6
push ebx
push esi
mov ebx, 0x104
mov ecx, edi
push ebx
call fcn.00401ad3
push ebx
mov ecx, edi
mov esi, eax
call fcn.00401bca
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push eax
mov ecx, edi
call fcn.0040606c
pop esi
pop ebx
mov ecx, dword [edi]
sub ecx, 0x10
call fcn.00402a75
pop edi
lea ecx, [eax + 0x10]
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x4308f9
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x230
push ebx
push ebp
push esi
push edi
xor eax, eax
xor esi, esi
push 0x206
mov word [esp + 0x3c], ax
lea eax, [esp + 0x3e]
push esi
push eax
call sub.msvcrt.dll_memset
xor eax, eax
mov dword [esp + 0x1c], esi
mov word [esp + 0x30], ax
lea edi, [esp + 0x32]
stosd dword es:[edi], eax
push esi
mov dword [esp + 0x28], 0x12
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call dword [sym.imp.msvcrt.dll__time64]
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x2c]
push eax
mov dword [esp + 0x34], edx
call dword [sym.imp.msvcrt.dll__localtime64]
push dword [eax + 0xc]
mov ecx, dword [eax + 0x10]
mov eax, dword [eax + 0x14]
inc ecx
push ecx
add eax, 0x76c
push eax
push str._04d_02d_02d
lea eax, [esp + 0x48]
push 9
push eax
call fcn.0040203a
mov edi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea eax, [esp + 0x44]
add esp, 0x2c
mov ebp, str.SoftwareKingsoftLBMINI
push eax
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x1c]
push eax
push str.now_date
push ebp
push SysReAllocStringLen
call edi
push 4
pop ebx
test eax, eax
jne 0x430a39
cmp dword [esp + 0x14], 1
jne 0x430a39
lea ecx, [esp + 0x38]
lea eax, [esp + 0x24]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4309dd
test dx, dx
je 0x4309e2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4309dd
add eax, ebx
add ecx, ebx
test dx, dx
jne 0x4309bb
jmp 0x4309e2
sbb esi, esi
or esi, 1
test esi, esi
jne 0x430a39
lea eax, [esp + 0x18]
mov dword [esp + 0x18], ebx
push eax
lea eax, [esp + 0x14]
mov esi, SysReAllocStringLen
push eax
lea eax, [esp + 0x1c]
push eax
push str.dump_counts
push ebp
push esi
call edi
test eax, eax
jne 0x430a39
cmp dword [esp + 0x14], ebx
jne 0x430a39
mov eax, dword [esp + 0x10]
cmp eax, 0xa
jb 0x430a1e
xor al, al
jmp 0x430a68
push ebx
lea ecx, [esp + 0x14]
inc eax
push ecx
push ebx
push str.dump_counts
push ebp
push esi
mov dword [esp + 0x28], eax
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
jmp 0x430a66
mov esi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
lea eax, [esp + 0x10]
push ebx
push eax
push ebx
push str.dump_counts
push ebp
mov ebx, SysReAllocStringLen
push ebx
call esi
push 0x12
lea eax, [esp + 0x28]
push eax
push 1
push str.now_date
push ebp
push ebx
call esi
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x230
ret