joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4631da
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x4aef58
call fcn.004acfc0
sub esp, 0x98
push ebx
push esi
xor ebx, ebx
push edi
mov esi, ecx
mov dword [ebp - 0xa4], vtable.KMD5.0
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, eax
lea eax, [esi + 4]
add esi, 0x14
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x18], esi
mov eax, dword [0x4df350]
mov ecx, 0x4df350
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x2c]
mov eax, edi
mov byte [ebp - 4], 1
call fcn.0046337c
test eax, eax
je 0x46334f
mov ebx, dword [ebp - 0x14]
cmp dword [ebx - 0xc], 0
je 0x463357
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x463357
push 0x5c
lea esi, [ebp - 0x14]
call fcn.00407e72
cmp eax, 0xffffffff
je 0x463357
lea edx, [eax + 1]
lea eax, [ebp - 0x28]
push eax
mov eax, esi
call fcn.00407dc8
mov edi, dword [ebp - 0x18]
add edi, 0xfffffff4
mov byte [ebp - 4], 2
call fcn.0040805e
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x28]
add eax, 0xfffffff0
call fcn.00405148
mov byte [ebp - 0x40], 0
xor eax, eax
lea edi, [ebp - 0x3f]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push ebx
lea edi, [ebp - 0xa4]
call fcn.00428a0d
test eax, eax
je 0x463357
push 0x10
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.0048ca60
mov eax, dword [0x4df350]
add esp, 0xc
mov ecx, 0x4df350
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 3
xor esi, esi
movzx eax, byte [ebp + esi - 0x40]
push eax
push 0x4c2db8
lea ecx, [ebp - 0x1c]
call fcn.0042f6fd
inc esi
cmp esi, 0x10
pop ecx
pop ecx
jl 0x4632f6
mov esi, dword [ebp - 0x1c]
cmp dword [esi - 0xc], 0
je 0x463325
mov edi, dword [ebp - 0x18]
lea eax, [ebp - 0x1c]
call fcn.0040805e
mov edi, dword [ebp - 0x24]
lea eax, [esi - 0x10]
call fcn.00405148
lea eax, [ebx - 0x10]
mov byte [ebp - 4], 0
call fcn.00405148
inc dword [ebp - 0x20]
add dword [ebp - 0x18], 4
cmp dword [ebp - 0x20], 3
jl 0x46321e
jmp 0x46335f
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
jmp 0x46335a
lea eax, [ebx - 0x10]
call fcn.00405148
lea ecx, [ebp - 0xa4]
call fcn.004289e3
mov ecx, dword [ebp - 0xc]
pop edi
xor eax, eax
pop esi
inc eax
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x46337c
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
sub esp, 0x440
push ebx
push esi
xor esi, esi
cmp dword [ecx], esi
push edi
jne 0x463398
xor eax, eax
jmp 0x4634dd
cmp eax, esi
mov dword [ebp - 8], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
je 0x4634da
cmp eax, 4
je 0x4634da
cmp eax, 8
je 0x4634da
mov ebx, dword [sym.imp.KERNEL32.dll_OpenProcess]
push eax
push esi
push 0x400
call ebx
cmp eax, esi
mov dword [ebp - 0xc], eax
je 0x4634da
xor eax, eax
mov dword [ebp - 0x2c], esi
lea edi, [ebp - 0x28]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x14]
push eax
push 0x18
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp + 8]
push esi
push dword [ebp - 0xc]
call dword [eax]
test eax, eax
jne 0x4634c5
mov eax, dword [ebp - 0x18]
cmp eax, esi
mov dword [ebp + 8], eax
je 0x4634c5
cmp eax, 8
je 0x4634c5
push eax
push esi
push 0x410
call ebx
mov edi, eax
cmp edi, esi
mov dword [ebp - 8], edi
je 0x4634c5
mov ebx, 0x206
push ebx
lea eax, [ebp - 0x232]
push esi
push eax
mov word [ebp - 0x234], si
call fcn.0048c840
add esp, 0xc
push 0x103
lea eax, [ebp - 0x234]
push eax
push esi
push edi
call sub.PSAPI.DLL_GetModuleFileNameExW
test eax, eax
jne 0x4634a3
push ebx
lea eax, [ebp - 0x43a]
push esi
push eax
mov word [ebp - 0x43c], si
call fcn.0048c840
add esp, 0xc
push 0x104
lea eax, [ebp - 0x43c]
push eax
push edi
call sub.PSAPI.DLL_GetProcessImageFileNameW
test eax, eax
je 0x4634c5
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x43c]
push eax
call fcn.004634e4
test eax, eax
je 0x4634c5
mov eax, dword [ebp + 0x10]
cmp eax, esi
je 0x4634af
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
lea eax, [ebp - 0x234]
push eax
push dword [ebp + 0xc]
call fcn.00408167
mov dword [ebp - 0x10], 1
push dword [ebp - 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
cmp dword [ebp - 8], esi
je 0x4634da
push dword [ebp - 8]
call edi
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x4634e4
Capabilities:
Get disk information

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0x4bc
push edi
xor edi, edi
cmp dword [ebp + 0x7c], edi
jne 0x4634fe
xor eax, eax
jmp 0x4635c1
push ebx
push esi
lea eax, [ebp - 0x44c]
push eax
push 0x3e8
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x4635b1
cmp word [ebp - 0x44c], di
mov dword [ebp + 0x6c], edi
je 0x4635b1
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
lea esi, [ebp - 0x44c]
push 0x4c3e14
push esi
call ebx
test eax, eax
je 0x46359b
push 0x4c3e1c
push esi
call ebx
test eax, eax
je 0x46359b
mov ax, word [esi]
and word [ebp + 0x68], 0
mov word [ebp + 0x64], ax
mov ax, word [ebp + edi - 0x44a]
mov word [ebp + 0x66], ax
push 0x64
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp + 0x64]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x4635bd
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, dword [ebp + 0x78]
mov esi, eax
push esi
lea eax, [ebp - 0x64]
push eax
push edi
call fcn.00491e9d
add esp, 0xc
test eax, eax
je 0x4635c9
add dword [ebp + 0x6c], 4
mov edi, dword [ebp + 0x6c]
add edi, edi
lea esi, [ebp + edi - 0x44c]
cmp word [esi], 0
jne 0x463536
push dword [ebp + 0x78]
push dword [ebp + 0x7c]
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
xor eax, eax
pop esi
pop ebx
pop edi
add ebp, 0x70
leave
ret 8
lea eax, [ebp + 0x64]
push eax
push dword [ebp + 0x7c]
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [edi + esi*2]
push eax
push dword [ebp + 0x7c]
call dword [sym.imp.KERNEL32.dll_lstrcatW]
xor eax, eax
inc eax
jmp 0x4635bf

Function at 0x463700
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags
Get process heap force flags

Disassembly:
mov eax, 0x4aef2b
call fcn.004acfc0
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, 0x4ba8e4
push ebx
lea eax, [edi + 0xc]
xor esi, esi
push eax
mov dword [edi], vtable.KInstallTool::KUIInfoReport.0
mov dword [edi + 4], esi
mov dword [edi + 8], esi
call fcn.00408124
push ebx
lea eax, [edi + 0x10]
push eax
mov dword [ebp - 4], esi
call fcn.00408124
lea esi, [edi + 0x14]
mov ecx, 0x4df350
mov byte [ebp - 4], 1
call fcn.004079e9
push ebx
lea eax, [edi + 0x18]
push eax
mov byte [ebp - 4], 2
call fcn.00408124
push ebx
lea eax, [edi + 0x1c]
push eax
mov byte [ebp - 4], 3
call fcn.00408124
push ebx
lea eax, [edi + 0x20]
push eax
mov byte [ebp - 4], 4
call fcn.00408124
and dword [edi + 0x2c], 0
and dword [edi + 0x30], 0
mov ecx, dword [ebp - 0xc]
mov byte [edi + 0x24], 0
mov byte [edi + 0x25], 0
mov byte [edi + 0x26], 0
mov byte [edi + 0x27], 0
mov byte [edi + 0x28], 2
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x4645fa
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, eax
mov eax, dword [ebp + 0xc]
sub edi, dword [esi + 0x18]
sub eax, dword [esi + 0x14]
mov edx, dword [esi]
push 1
xor ebx, ebx
push edi
push eax
mov ecx, esi
mov dword [ebp + 0xc], eax
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
call dword [edx + 0x6c]
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 0xfc]
cmp eax, ebx
mov dword [ebp - 0x14], eax
je 0x464733
push eax
call fcn.00407abb
mov ebx, eax
test ebx, ebx
pop ecx
je 0x464700
mov eax, dword [ebx + 0x10]
push 2
mov dword [ebp - 0xc], eax
mov eax, dword [ebx]
push 0
mov ecx, ebx
call dword [eax + 0x28]
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x34]
test eax, eax
je 0x464674
lea eax, [ebx + 0x14]
push eax
call fcn.0041cbb7
movzx eax, word [ebp + 0xc]
movzx edi, di
shl edi, 0x10
or edi, eax
push edi
push dword [ebp + 8]
mov ecx, ebx
push 0x202
call fcn.00407b4c
mov eax, dword [ebp - 0x10]
cmp dword [esi + 0xfc], eax
jne 0x4646ca
mov ecx, dword [ebx + 0x40]
xor eax, eax
cmp ecx, eax
je 0x4646bc
cmp word [ecx], ax
je 0x4646bc
push 1
push eax
push eax
push ecx
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x464700
cmp dword [ebx + 0x10], eax
je 0x464700
mov dword [ebp - 4], 1
jmp 0x464700
mov eax, dword [ebx]
push 1
push 0
mov ecx, ebx
call dword [eax + 0x28]
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x34]
test eax, eax
je 0x4646e9
lea eax, [ebx + 0x14]
push eax
call fcn.0041cbb7
push edi
push dword [ebp + 8]
mov ecx, ebx
push 0x2a3
call fcn.00407b4c
mov dword [ebp - 8], 1
xor ecx, ecx
cmp dword [ebp - 4], ecx
mov dword [esi + 0xfc], ecx
je 0x464711
push 0x67
jmp 0x46472c
cmp dword [ebp - 8], ecx
je 0x464733
cmp dword [ebp - 0xc], ecx
je 0x464733
mov edx, dword [ebp - 0x14]
lea eax, [esi + 0xf8]
cmp edx, dword [eax]
jne 0x46472a
mov dword [eax], ecx
push 0x6a
mov edi, ebx
call fcn.0046425b
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x466365
Capabilities:
Print debug messages

Disassembly:
mov eax, 0x4b2036
call fcn.004acfc0
sub esp, 0x10
push dword [ebp + 8]
lea eax, [ebp + 8]
push eax
call fcn.00408124
and dword [ebp - 4], 0
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0xe]
push eax
movzx eax, word [ebp - 0x10]
push eax
movzx eax, word [ebp - 0x12]
push eax
movzx eax, word [ebp - 0x14]
push eax
push str.__02d__02d__02d__03d__n
lea ecx, [ebp + 8]
call fcn.0042f6fd
add esp, 0x14
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.00405148
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret 4
Function at 0x467bc9
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
xor ebx, ebx
mov esi, ecx
mov ecx, dword [eax + 8]
inc ebx
cmp ecx, ebx
push edi
jne 0x467cce
mov eax, dword [eax + 0xc]
cmp eax, ebx
jne 0x467bef
call fcn.00469470
mov eax, ebx
jmp 0x467cd7
cmp eax, 2
jne 0x467c0e
lea eax, [esi + 0xc12]
xor ecx, ecx
cmp byte [eax], cl
jne 0x467c02
mov byte [eax], bl
push ecx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x467be8
cmp eax, 0x65
jne 0x467c1c
mov edi, esi
call fcn.0046954c
jmp 0x467be8
cmp eax, 0x66
jne 0x467c34
xor eax, eax
cmp dword [esi + 0x3d0], eax
sete al
push eax
call fcn.0046a193
jmp 0x467be8
cmp eax, 0x191
jne 0x467c54
xor ecx, ecx
mov eax, esi
call fcn.0046aa35
call fcn.0045f813
test eax, eax
je 0x467be8
call fcn.0040972f
jmp 0x467be8
cmp eax, 0x96
jne 0x467c7c
push dword [esi + 0x3fc]
push dword [esi + 0x3d4]
call dword [sym.imp.USER32.dll_SetWindowTextW]
xor ecx, ecx
push ecx
push ecx
push esi
call fcn.004692fc
jmp 0x467be8
cmp eax, 0x1f5
jne 0x467c8d
call fcn.004695f4
jmp 0x467be8
cmp eax, 0xa0
jne 0x467cbd
push ebx
xor ecx, ecx
push ecx
push ecx
push str.http:__www.ijinshan.com_protocol_dubaUserLicense.shtml
push str.open
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jg 0x467be8
call fcn.004696ba
jmp 0x467be8
cmp eax, 0x68
jne 0x467cce
mov ebx, esi
call fcn.00469ee9
xor eax, eax
inc eax
jmp 0x467cd7
and dword [esi + 0x400], 0
xor eax, eax
pop edi
pop esi
pop ebx
ret
Function at 0x46810f
Capabilities:
Get disk information
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
push dword [ebp + 8]
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x468180
xor eax, eax
mov dword [ebp - 0xc], esi
lea edi, [ebp - 8]
stosd dword es:[edi], eax
lea eax, [ebp - 0xc]
push eax
push esi
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x468180
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
shrd ecx, eax, 0x14
shr eax, 0x14
mov dword [ebp - 8], eax
and dword [ebp - 8], 0x80000000
and eax, 0x7fffffff
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0xc], esi
fild qword [ebp - 0x14]
fild qword [ebp - 0xc]
fchs
faddp st(1)
fcomp qword [0x4c57b0]
fnstsw ax
test ah, 1
jne 0x468180
inc esi
pop edi
mov eax, esi
pop esi
leave
ret
Function at 0x4686a3
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4b1581
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x108
push ebx
push esi
push edi
push 6
xor ebx, ebx
pop ecx
xor eax, eax
mov dword [esp + 0x14], ebx
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
lea edi, [esp + 0x30]
call fcn.00419935
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x11c], ebx
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov esi, dword [eax + 8]
mov eax, dword [eax + 0xc]
xor edi, edi
inc edi
push edi
push ecx
sub eax, edx
mov dword [esp + 0x30], eax
mov eax, esp
mov dword [esp + 0x18], esp
push str.0_0__0__0
sub esi, ecx
push eax
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], edx
mov dword [esp + 0x34], esi
call fcn.004079a6
push ecx
mov byte [esp + 0x128], 1
mov eax, esp
mov dword [esp + 0x18], esp
push 0x4bab3c
push eax
call fcn.004079a6
lea ecx, [esp + 0x3c]
mov byte [esp + 0x128], bl
call fcn.0041977d
lea eax, [esp + 0x14]
push eax
push ebx
push 0x47
lea ecx, [esp + 0x3c]
call fcn.00407b4c
push edi
push ecx
mov eax, esp
mov dword [esp + 0x14], esp
mov esi, 0x4bb0ec
push esi
push eax
call fcn.004079a6
push ecx
mov byte [esp + 0x128], 2
mov eax, esp
mov dword [esp + 0x1c], esp
push str.margin_left
push eax
call fcn.004079a6
lea ecx, [esp + 0x3c]
mov byte [esp + 0x128], bl
call fcn.0041977d
push edi
push ecx
mov eax, esp
mov dword [esp + 0x14], esp
push esi
push eax
call fcn.004079a6
push ecx
mov byte [esp + 0x128], 3
mov eax, esp
mov dword [esp + 0x1c], esp
push str.margin_right
push eax
call fcn.004079a6
lea ecx, [esp + 0x3c]
mov byte [esp + 0x128], bl
call fcn.0041977d
push edi
push ecx
mov eax, esp
mov dword [esp + 0x14], esp
push esi
push eax
call fcn.004079a6
push ecx
mov byte [esp + 0x128], 4
mov eax, esp
mov dword [esp + 0x1c], esp
push str.margin_top
push eax
call fcn.004079a6
lea ecx, [esp + 0x3c]
mov byte [esp + 0x128], bl
call fcn.0041977d
push edi
push ecx
mov eax, esp
mov dword [esp + 0x14], esp
push esi
push eax
call fcn.004079a6
push ecx
mov byte [esp + 0x128], 5
mov eax, esp
mov dword [esp + 0x1c], esp
push str.margin_bottom
push eax
call fcn.004079a6
lea ecx, [esp + 0x3c]
mov byte [esp + 0x128], bl
call fcn.0041977d
push edi
push ecx
mov eax, esp
mov dword [esp + 0x14], esp
push str.cnm_showdow
push eax
call fcn.004079a6
push ecx
mov byte [esp + 0x128], 6
mov eax, esp
mov dword [esp + 0x1c], esp
push str.skin
push eax
call fcn.004079a6
lea ecx, [esp + 0x3c]
mov byte [esp + 0x128], bl
call fcn.0041977d
push ebx
push dword [ebp + 8]
lea ecx, [esp + 0x38]
push 0xf
call fcn.00407b4c
or dword [esp + 0x11c], 0xffffffff
mov eax, dword [esp + 0x10c]
add eax, 0xfffffff0
call fcn.00405148
lea ecx, [esp + 0x30]
call fcn.004252b0
mov ecx, dword [esp + 0x114]
pop edi
pop esi
xor eax, eax
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x468953
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
inc esi
cmp dword [ebp + 0xc], 0x4e
push edi
mov edi, eax
jne 0x46898b
mov eax, dword [ebp + 0x14]
cmp dword [eax + 4], 0x3e8
jne 0x46898b
mov ecx, edi
mov dword [edi + 0x3b8], esi
call fcn.004688c9
mov dword [ebx], eax
cmp dword [edi + 0x3b8], 0
je 0x46898b
mov eax, esi
jmp 0x4689d2
push 0
push ebx
push dword [ebp + 0x14]
mov ecx, edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0046b055
test eax, eax
jne 0x468987
mov eax, dword [ebp + 0xc]
cmp eax, 0x402
jne 0x4689d8
push 5
push dword [edi + 4]
lea eax, [edi + 0x3b8]
mov dword [ebp + 0xc], eax
mov dword [eax], esi
call dword [sym.imp.USER32.dll_ShowWindow]
and dword [ebx], 0
mov eax, dword [ebp + 0xc]
cmp dword [eax], 0
jne 0x468987
xor eax, eax
pop edi
pop esi
pop ebp
ret 0x10
cmp eax, 0x403
jne 0x468a12
mov eax, dword [edi + 0x3c0]
mov dword [edi + 0x28], eax
xor eax, eax
push eax
push eax
push eax
mov dword [edi + 0x3b8], esi
mov dword [edi + 0x3ac], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_PostThreadMessageW]
and dword [ebx], 0
cmp dword [edi + 0x3b8], 0
jmp 0x4689ce
cmp eax, 0x465
jne 0x468a3f
lea ecx, [edi + 0x2c]
mov dword [edi + 0x3b8], esi
call fcn.0040a4a6
mov dword [edi + 0x41c], eax
mov eax, dword [edi + 0x30]
push 5
lea ecx, [edi + 0x3ec]
call fcn.00426437
jmp 0x468a06
cmp eax, 0x110
jne 0x4689d0
lea eax, [edi + 0x3b8]
push ecx
mov ecx, dword [ebp + 0x10]
mov dword [eax], esi
mov dword [ebp + 0xc], eax
mov eax, esp
mov dword [eax], ecx
call fcn.004683a9
mov dword [ebx], eax
jmp 0x4689c8

Function at 0x468c5c
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x4aee82
call fcn.004acfc0
sub esp, 0x404
and dword [ebp - 0x10], 0
and word [ebp - 0x410], 0
push ebx
push 0x3fe
lea eax, [ebp - 0x40e]
push 0
push eax
mov ebx, str.https:__url.cn_5MvNeeT__typewpaqidiantrue
mov dword [ebp - 0x10], str.MarketQQLink
call fcn.0048c840
add esp, 0xc
test byte [0x4e11e8], 1
jne 0x468cc3
or dword [0x4e11e8], 1
and dword [ebp - 4], 0
call fcn.00468ad5
push 0x4b2971
call fcn.0048cee9
or dword [ebp - 4], 0xffffffff
pop ecx
mov eax, dword [0x4e1134]
test eax, eax
je 0x468ce2
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
test al, al
je 0x468ce2
mov ebx, str.https:__url.cn_5f9aYiA__typewpaqidiantrue
mov dword [ebp - 0x10], str.VipMarketQQLink
push dword [edi]
lea eax, [ebp - 0x410]
push 0x200
push eax
push ebx
push dword [ebp - 0x10]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x410]
push eax
push dword [ebp + 8]
call fcn.00408124
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x4696ba
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x4ae423
call fcn.004acfc0
push ecx
push ecx
push esi
push 1
push 0
mov esi, str.http:__www.ijinshan.com_protocol_dubaUserLicense.shtml
push esi
push str.IEXPLORE.EXE
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jg 0x46970c
lea eax, [ebp - 0x10]
push eax
call fcn.0045f2a2
pop ecx
and dword [ebp - 4], 0
push esi
push dword [ebp - 0x10]
call fcn.0045e9a3
mov eax, dword [ebp - 0x10]
pop ecx
pop ecx
add eax, 0xfffffff0
call fcn.00405148
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
leave
ret

Function at 0x469a39
Capabilities:
Persist via run registry key

Disassembly:
mov eax, 0x4ae367
call fcn.004acfc0
push ecx
push ecx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], edi
mov eax, dword [0x4df350]
mov ecx, 0x4df350
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
push reloc.OLEAUT32.dll_SysReAllocString
lea esi, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.0043293f
test eax, eax
je 0x469a93
push ebx
lea eax, [ebp - 0x14]
push eax
push str.KAV7NEEDREBOOT
mov ebx, esi
call fcn.0043296d
test eax, eax
pop ebx
je 0x469a93
inc edi
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.00405148
cmp dword [ebp - 0x10], 0
je 0x469aad
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x469e21
Capabilities:
Check if file exists
Get disk information
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push dword [edi]
lea esi, [ebp - 4]
call fcn.0045eeb5
mov eax, dword [ebp - 4]
pop ecx
add eax, 0xfffffff0
call fcn.00405148
mov eax, dword [edi]
push 3
pop esi
cmp dword [eax - 0xc], esi
jl 0x469ee2
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x469e64
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 1
je 0x469ee2
mov ecx, esi
lea edx, [ebp - 4]
mov eax, edi
call fcn.00407de6
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, esi
mov eax, dword [ebp - 4]
setne bl
add eax, 0xfffffff0
call fcn.00405148
test bl, bl
je 0x469e91
push 2
pop eax
jmp 0x469ee5
mov ebx, edi
call fcn.00469d97
test eax, eax
je 0x469ea0
mov eax, esi
jmp 0x469ee5
mov ecx, esi
lea edx, [ebp - 4]
mov eax, edi
call fcn.00407de6
push dword [eax]
call fcn.0046810f
mov ebx, eax
mov eax, dword [ebp - 4]
neg ebx
sbb bl, bl
pop ecx
add eax, 0xfffffff0
inc bl
call fcn.00405148
test bl, bl
je 0x469ecf
push 4
jmp 0x469e8e
mov eax, dword [edi]
cmp dword [eax - 0xc], 0x96
jle 0x469ede
push 5
jmp 0x469e8e
xor eax, eax
jmp 0x469ee5
xor eax, eax
inc eax
pop esi
pop ebx
leave
ret
Function at 0x469ee9
Capabilities:
Get common file path
Set current directory

Disassembly:
mov eax, 0x4b06c7
call fcn.004acfc0
sub esp, 0x44c
push esi
push edi
xor esi, esi
push 0x206
lea eax, [ebp - 0x452]
push esi
push eax
mov word [ebp - 0x454], si
call fcn.0048c840
add esp, 0xc
lea eax, [ebp - 0x454]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [ebp - 0x1c]
push eax
push 0x11
push dword [ebx + 4]
mov dword [ebp - 0x1c], esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov eax, dword [0x4df350]
mov edi, 0x4df350
mov ecx, edi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], esi
push 0x105
lea esi, [ebp - 0x18]
call fcn.00407f07
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp dword [eax - 8], ecx
jge 0x469f76
push 0x80070057
call fcn.0040810c
mov dword [eax - 0xc], ecx
mov word [eax], cx
push 0x4c45c8
lea eax, [ebp - 0x18]
push eax
call fcn.00408167
mov eax, dword [ebx + 4]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x1c]
lea esi, [ebp - 0x18]
mov dword [ebp - 0x3c], eax
call fcn.00433e19
mov dword [ebp - 0x38], eax
xor esi, esi
lea eax, [ebp - 0x40]
push eax
mov dword [ebp - 0x34], 0x4c45d4
mov dword [ebp - 0x30], 1
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], esi
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderW]
cmp eax, esi
mov dword [ebp - 0x14], eax
je 0x46a086
push 0x206
lea eax, [ebp - 0x24a]
push esi
push eax
mov word [ebp - 0x24c], si
call fcn.0048c840
add esp, 0xc
lea eax, [ebp - 0x24c]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov eax, dword [0x4df350]
mov ecx, edi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x24c]
push eax
lea esi, [ebp - 0x20]
mov byte [ebp - 4], 1
call fcn.0045eeb5
pop ecx
mov byte [ebp - 4], 2
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
lea eax, [ebp - 0x14]
call fcn.00407d77
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff0
call fcn.00405148
push str.kingsoft_antivirus_
lea eax, [ebp - 0x14]
push eax
call fcn.00407d54
mov esi, dword [ebp - 0x14]
push esi
push dword [ebx + 0x3d4]
call dword [sym.imp.USER32.dll_SetWindowTextW]
lea edi, [ebp - 0x14]
call fcn.00469e21
push 0
push eax
push 0x46c
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
or dword [ebx + 0xc2c], 2
lea eax, [esi - 0x10]
call fcn.00405148
lea eax, [ebp - 0x454]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.00405148
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
pop esi
leave
ret