joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46a4eb
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
xor eax, eax
mov dword [esi], eax
push ebx
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], eax
mov dword [edi], eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x46a574
push ebx
call fcn.004863d6
pop ecx
push eax
push ebx
push dword [ebp - 8]
mov dword [ebp - 4], eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x46a565
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x4b3f7c
push dword [ebp - 4]
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x46a565
cmp dword [ebp - 0xc], ebx
je 0x46a565
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 8]
mov dword [edi], ecx
mov eax, dword [eax + 0xc]
mov dword [esi], eax
mov dword [ebp - 0x14], 1
cmp dword [ebp - 4], 0
je 0x46a574
push dword [ebp - 4]
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
pop ecx
mov eax, dword [ebp - 0x14]
pop ebx
leave
ret

Function at 0x46a795
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x120
mov eax, dword [0x4dc0a8]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
push edi
mov esi, 0x11c
push esi
xor edi, edi
lea eax, [ebp - 0xa8]
push edi
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
lea eax, [ebp - 0xa8]
mov dword [ebp - 0xa8], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push eax
call esi
cmp eax, edi
jne 0x46a7f8
lea eax, [ebp - 0xa8]
push eax
mov dword [ebp - 0xa8], 0x114
call esi
cmp eax, edi
je 0x46a8ae
mov eax, dword [ebp - 0x98]
dec eax
je 0x46a89a
dec eax
jne 0x46a8ae
mov eax, dword [ebp - 0xa4]
xor edx, edx
push 6
pop ecx
inc edx
cmp eax, ecx
jne 0x46a847
cmp dword [ebp - 0xa0], edx
jne 0x46a831
xor eax, eax
cmp byte [ebp + 0x72], dl
setne al
add eax, 8
jmp 0x46a896
cmp dword [ebp - 0xa0], edi
jne 0x46a87f
xor eax, eax
cmp byte [ebp + 0x72], dl
setne al
lea eax, [eax + eax + 7]
jmp 0x46a896
cmp eax, 5
jne 0x46a871
cmp dword [ebp - 0xa0], 2
jne 0x46a858
push eax
jmp 0x46a878
cmp dword [ebp - 0xa0], 1
jne 0x46a865
mov edi, ecx
jmp 0x46a8ae
cmp dword [ebp - 0xa0], edi
jne 0x46a8ae
push 3
jmp 0x46a878
cmp eax, 4
ja 0x46a87b
push 4
pop edi
jmp 0x46a8ae
cmp eax, ecx
jb 0x46a8ae
cmp dword [ebp - 0xa0], 2
jae 0x46a88c
cmp eax, ecx
jbe 0x46a8ae
cmp byte [ebp + 0x72], dl
jne 0x46a8ae
call fcn.0046a6da
mov edi, eax
jmp 0x46a8ae
mov eax, dword [ebp - 0x9c]
and eax, 0xffff0000
cmp eax, 0x45a0000
sbb edi, edi
inc edi
inc edi
mov ecx, dword [ebp + 0x74]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.00486d86
add ebp, 0x78
leave
ret

Function at 0x46b4ca
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x46b4e1
test al, 0x10
jne 0x46b4e1
xor eax, eax
inc eax
ret
xor eax, eax
ret
Function at 0x46b55a
Capabilities:
Read .ini file

Disassembly:
push ebp
lea ebp, [esp - 0x18c]
sub esp, 0x20c
mov eax, dword [0x4dc0a8]
xor eax, ebp
mov dword [ebp + 0x188], eax
test esi, esi
mov eax, dword [ebp + 0x194]
mov dword [ebp - 0x80], eax
je 0x46b5e2
test edi, edi
je 0x46b5e2
push esi
call fcn.0046b4ca
test al, al
pop ecx
je 0x46b5e2
and word [ebp - 0x78], 0
push 0x1fe
lea eax, [ebp - 0x76]
push 0
push eax
mov dword [ebp - 0x7c], 0x80004005
call sub.MSVCR80.dll_memset
add esp, 0xc
push esi
push 0x100
lea eax, [ebp - 0x78]
push eax
push 0
push edi
push str.SPCfg
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x46b5dd
mov ecx, dword [ebp - 0x80]
lea eax, [ebp - 0x78]
push eax
call dword [0x4a9398]
and dword [ebp - 0x7c], 0
mov eax, dword [ebp - 0x7c]
jmp 0x46b5e7
mov eax, 0x80004005
mov ecx, dword [ebp + 0x188]
xor ecx, ebp
call fcn.00486d86
add ebp, 0x18c
leave
ret

Function at 0x46b842
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x4dc0a8]
xor eax, ebp
mov dword [ebp - 4], eax
test edi, edi
jne 0x46b863
mov eax, 0x80004005
jmp 0x46b8e6
push edi
call fcn.0046b4ca
test al, al
pop ecx
je 0x46b859
and word [ebp - 0x804], 0
push ebx
push 0x7fe
lea eax, [ebp - 0x802]
push 0
push eax
mov ebx, 0x80004005
call sub.MSVCR80.dll_memset
add esp, 0xc
push edi
push 0x400
lea eax, [ebp - 0x804]
push eax
push 0
mov eax, str.SPRoot
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x46b8e3
lea eax, [ebp - 0x804]
push eax
mov ecx, esi
call dword [0x4a9398]
mov eax, dword [esi + 0x14]
dec eax
push eax
mov ecx, esi
call dword [sym.imp.MSVCP80.dll_public:_wchar_t____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator___unsigned_int_]
cmp word [eax], 0x5c
je 0x46b8e1
push 0x4b3f7c
mov ecx, esi
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::append_wchar_t_const__]
xor ebx, ebx
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00486d86
leave
ret
Function at 0x46b96d
Capabilities:
Read .ini file

Disassembly:
push ebp
lea ebp, [esp - 0x78c]
sub esp, 0x80c
mov eax, dword [0x4dc0a8]
xor eax, ebp
mov dword [ebp + 0x788], eax
test edi, edi
mov eax, dword [ebp + 0x794]
push esi
mov dword [ebp - 0x80], eax
je 0x46b9fd
xor eax, eax
mov esi, str.kxebase.dll
cmp eax, esi
je 0x46b9fd
push edi
call fcn.0046b4ca
test al, al
pop ecx
je 0x46b9fd
and word [ebp - 0x78], 0
push 0x7fe
lea eax, [ebp - 0x76]
push 0
push eax
mov dword [ebp - 0x7c], 0x80004005
call sub.MSVCR80.dll_memset
add esp, 0xc
push edi
push 0x400
lea eax, [ebp - 0x78]
push eax
push 0
push esi
push str.ProductInfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x46b9f8
mov ecx, dword [ebp - 0x80]
lea eax, [ebp - 0x78]
push eax
call dword [0x4a9398]
and dword [ebp - 0x7c], 0
mov eax, dword [ebp - 0x7c]
jmp 0x46ba02
mov eax, 0x80004005
mov ecx, dword [ebp + 0x788]
xor ecx, ebp
pop esi
call fcn.00486d86
add ebp, 0x78c
leave
ret

Function at 0x46bc03
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, eax
xor eax, eax
cmp dword [esp + 8], eax
je 0x46bc5b
push edi
movzx ecx, byte [esi]
mov dx, ax
dec dword [esp + 0xc]
shr dx, 0xc
movzx edx, dl
shl eax, 4
mov edi, ecx
shr edi, 4
xor edx, edi
xor ax, word [edx*2 + 0x4b3730]
and ecx, 0xf
movzx eax, ax
mov dx, ax
shr dx, 0xc
movzx edx, dl
shl eax, 4
xor edx, ecx
xor ax, word [edx*2 + 0x4b3730]
inc esi
cmp dword [esp + 0xc], 0
movzx eax, ax
jne 0x46bc0f
pop edi
pop esi
ret
Function at 0x46c011
Capabilities:
Terminate thread

Disassembly:
mov eax, dword [esi]
test eax, eax
je 0x46c02f
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [esi], 0
or dword [esi + 0xc], 0xffffffff
ret

Function at 0x46d80d
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test ecx, ecx
push esi
mov esi, edx
jne 0x46d818
xor eax, eax
pop esi
ret
cmp eax, 8
push ebx
not esi
mov edx, 0xff
jb 0x46d8ca
push edi
mov edi, eax
shr edi, 3
movzx ebx, byte [ecx]
xor ebx, esi
and ebx, edx
shr esi, 8
xor esi, dword [ebx*4 + 0x4b3308]
inc ecx
movzx ebx, byte [ecx]
xor ebx, esi
and ebx, edx
shr esi, 8
xor esi, dword [ebx*4 + 0x4b3308]
inc ecx
movzx ebx, byte [ecx]
xor ebx, esi
and ebx, edx
shr esi, 8
xor esi, dword [ebx*4 + 0x4b3308]
inc ecx
movzx ebx, byte [ecx]
xor ebx, esi
and ebx, edx
shr esi, 8
xor esi, dword [ebx*4 + 0x4b3308]
inc ecx
movzx ebx, byte [ecx]
xor ebx, esi
and ebx, edx
shr esi, 8
xor esi, dword [ebx*4 + 0x4b3308]
inc ecx
movzx ebx, byte [ecx]
xor ebx, esi
and ebx, edx
shr esi, 8
xor esi, dword [ebx*4 + 0x4b3308]
inc ecx
movzx ebx, byte [ecx]
xor ebx, esi
and ebx, edx
shr esi, 8
xor esi, dword [ebx*4 + 0x4b3308]
inc ecx
movzx ebx, byte [ecx]
xor ebx, esi
and ebx, edx
shr esi, 8
xor esi, dword [ebx*4 + 0x4b3308]
inc ecx
sub eax, 8
dec edi
jne 0x46d82f
pop edi
test eax, eax
je 0x46d8e3
movzx ebx, byte [ecx]
xor ebx, esi
and ebx, edx
shr esi, 8
xor esi, dword [ebx*4 + 0x4b3308]
inc ecx
dec eax
jne 0x46d8ce
mov eax, esi
pop ebx
not eax
pop esi
ret

Function at 0x46d8ea
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov eax, dword [ecx]
xor edx, eax
push esi
mov esi, 0xff
and edx, esi
mov edx, dword [edx*4 + 0x4b3308]
shr eax, 8
xor edx, eax
mov eax, dword [ecx + 8]
mov dword [ecx], edx
movzx edx, dl
add edx, dword [ecx + 4]
imul edx, edx, 0x8088405
inc edx
mov dword [ecx + 4], edx
shr edx, 0x18
xor edx, eax
and edx, esi
shr eax, 8
xor eax, dword [edx*4 + 0x4b3308]
pop esi
mov dword [ecx + 8], eax
ret

Function at 0x46df5e
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 0xc]
imul edi, dword [ebp + 0x10]
cmp byte [esi], 0
je 0x46df8e
push 0
lea eax, [ebp + 0x10]
push eax
push edi
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x46df89
mov byte [esi + 8], 1
mov eax, dword [ebp + 0x10]
jmp 0x46dfb6
mov ecx, dword [esi + 0x1c]
mov eax, dword [esi + 0x18]
lea edx, [ecx + edi]
cmp edx, eax
jbe 0x46df9f
sub eax, ecx
mov edi, eax
mov eax, dword [esi + 0x14]
push edi
add eax, ecx
push eax
push dword [ebp + 8]
call sub.MSVCR80.dll_memcpy
add esp, 0xc
add dword [esi + 0x1c], edi
mov eax, edi
xor edx, edx
div dword [ebp + 0xc]
pop edi
pop ebp
ret
Function at 0x46ebb0
Capabilities:
Get common file path

Disassembly:
push ecx
push ebx
xor ebx, ebx
cmp dword [esi], ebx
push edi
jne 0x46ec37
cmp dword [esi + 4], 0xffffffff
jne 0x46ec37
lea edi, [esi + 0x244]
push edi
push 0x103
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push edi
call dword [sym.imp.MSVCR80.dll_wcslen]
lea eax, [esi + eax*2 + 0x242]
pop ecx
movzx ecx, word [eax]
cmp cx, 0x5c
je 0x46ebf9
cmp cx, 0x2f
je 0x46ebf9
mov word [eax + 2], 0x2f
mov word [eax + 4], bx
push 0x20
call sub.MSVCR80.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 0x14], ecx
mov ecx, dword [esp + 0x14]
push eax
mov byte [eax], bl
mov byte [eax + 1], 1
mov byte [eax + 0x10], bl
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ebx
mov dword [eax + 0xc], ebx
call fcn.0046e1d3
mov dword [esi], eax
neg eax
sbb eax, eax
and eax, 0xfffffe00
pop ecx
add eax, 0x200
jmp 0x46ec3c
mov eax, 0x1000000
pop edi
pop ebx
pop ecx
ret 8

Function at 0x46f380
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp + 8], 0x4645414b
and dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
jne 0x46f3a0
mov eax, dword [ebp - 4]
jmp 0x46f47b
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
shr ecx, 3
xor eax, 0xffffffff
test ecx, ecx
je 0x46f456
push ebp
mov ebp, ecx
xor edx, edx
xor ecx, ecx
mov edi, edi
mov ebx, dword [esi]
add esi, 4
mov dl, bl
mov cl, bh
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x4b1af0]
shr ebx, 0x10
xor eax, edi
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x4b1af0]
mov dl, bl
xor eax, edi
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x4b1af0]
mov cl, bh
xor eax, edi
mov ebx, dword [esi]
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x4b1af0]
add esi, 4
xor eax, edi
mov dl, bl
mov cl, bh
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x4b1af0]
shr ebx, 0x10
xor eax, edi
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x4b1af0]
mov dl, bl
xor eax, edi
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x4b1af0]
mov cl, bh
xor eax, edi
xor cl, al
shr eax, 8
xor eax, dword [ecx*4 + 0x4b1af0]
dec ebp
jne 0x46f3c0
pop ebp
mov ecx, dword [ebp + 0x10]
xor edx, edx
and ecx, 7
je 0x46f472
mov dl, byte [esi]
inc esi
xor dl, al
shr eax, 8
xor eax, dword [edx*4 + 0x4b1af0]
dec ecx
jne 0x46f460
xor eax, 0xffffffff
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x46feb3
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
mov ebx, eax
xor ebp, ebp
cmp ebx, ebp
push edi
mov edi, esi
jne 0x46fed0
push ebp
push ebp
push 2
xor ecx, ecx
pop eax
call fcn.00471336
xor al, al
jmp 0x46ff4d
call fcn.0046f78f
or dword [esi + 8], 0xffffffff
or dword [esi + 4], 0xffffffff
push 2
push ebp
mov ebp, dword [sym.imp.MSVCR80.dll_fseek]
push ebx
call ebp
push ebx
call dword [sym.imp.MSVCR80.dll_ftell]
push 0
push 0
push ebx
mov edi, eax
call ebp
add esp, 0x1c
test edi, edi
jne 0x46ff08
push edi
push edi
push 0xd
mov edi, esi
jmp 0x46fec4
lea eax, [edi + 1]
push eax
call fcn.004863d6
push ebx
push 1
mov ebp, eax
push edi
push ebp
mov byte [ebp], 0
call dword [sym.imp.MSVCR80.dll_fread]
add esp, 0x14
cmp eax, 1
je 0x46ff39
push ebp
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
pop ecx
push 0
push 0
push 2
jmp 0x46ff04
mov edx, ebp
mov ecx, esi
call fcn.0046ff51
push ebp
mov bl, al
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
pop ecx
mov al, bl
pop edi
pop ebp
pop ebx
ret

Function at 0x478393
Capabilities:
Read .ini file

Disassembly:
push ebp
lea ebp, [esp - 0x198]
sub esp, 0x218
mov eax, dword [0x4dc0a8]
xor eax, ebp
mov dword [ebp + 0x194], eax
push esi
lea eax, [ebp - 0x7c]
push eax
push 0x20019
xor esi, esi
push esi
push str.SOFTWAREkingsoft_antivirus
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x7c], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x478434
push ebx
mov ebx, dword [ebp - 0x7c]
push edi
push 0x208
lea eax, [ebp - 0x76]
push esi
push eax
mov dword [ebp - 0x7c], ebx
mov word [ebp - 0x78], si
call sub.MSVCR80.dll_memset
add esp, 0xc
push str.ProgramPath
lea eax, [ebp - 0x7c]
push eax
lea esi, [ebp - 0x80]
lea edi, [ebp - 0x78]
mov dword [ebp - 0x80], 0x104
call fcn.00408d6b
test ebx, ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x47841a
push ebx
call esi
xor ebx, ebx
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.MSVCR80.dll_wcslen]
test eax, eax
pop ecx
jne 0x478438
test ebx, ebx
je 0x478430
push ebx
call esi
xor eax, eax
jmp 0x478468
xor eax, eax
jmp 0x47846a
push str.ressrcchsuplive.svr
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x78]
push eax
push 0
push str.TryNo
push str.Common
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test ebx, ebx
mov edi, eax
je 0x478466
push ebx
call esi
mov eax, edi
pop edi
pop ebx
mov ecx, dword [ebp + 0x194]
xor ecx, ebp
pop esi
call fcn.00486d86
add ebp, 0x198
leave
ret
Function at 0x4788ab
Capabilities:
Create thread

Disassembly:
mov eax, esi
call fcn.00475368
test eax, eax
jne 0x478913
push 0x4ae5c8
lea eax, [esi + 8]
push eax
call fcn.004018e4
test eax, eax
je 0x478913
push edi
xor edi, edi
cmp dword [esi + 0x10], edi
je 0x478912
push ebx
push 0xc
call sub.MSVCR80.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, edi
pop ecx
jne 0x4788e1
xor ebx, ebx
jmp 0x478902
push edi
push edi
push eax
push 0x47645f
push edi
push edi
mov dword [eax], esi
mov dword [eax + 8], edi
mov dword [eax + 4], 0x478914
call dword [sym.imp.MSVCR80.dll__beginthreadex]
add esp, 0x18
mov ebx, eax
mov eax, dword [esi]
cmp eax, edi
je 0x47890f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], ebx
pop ebx
pop edi
ret

Function at 0x478a43
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x49d995
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4dc0a8]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov edi, dword [esp + 0x24]
xor ebp, ebp
lea esi, [edi + 4]
mov dword [edi], ebp
mov eax, vtable.KEvent.0
mov dword [esi], eax
mov dword [esi + 4], ebp
lea ebx, [edi + 0xc]
mov dword [ebx], eax
mov dword [ebx + 4], ebp
lea eax, [edi + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 1
push ebp
mov dword [edi + 0x30], ebp
mov dword [edi + 0x34], ebp
mov dword [edi + 0x38], ebp
call fcn.00429405
push ebp
push ebp
mov esi, ebx
call fcn.00429405
mov eax, edi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 4
Function at 0x4797b0
Capabilities:
Check if file exists

Disassembly:
push 0x18
mov eax, 0x4a3ed9
call fcn.004878f8
mov edi, ecx
xor ebx, ebx
lea ecx, [ebp - 0x14]
call fcn.00467016
lea eax, [ebp - 0x10]
push str.rcmdhelper.exe
push eax
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], ebx
call fcn.0040548e
pop ecx
pop ecx
mov byte [ebp - 4], 1
push dword [ebp - 0x10]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
call esi
test eax, eax
jne 0x479830
cmp dword [0x4e0da8], ebx
je 0x479813
push str.KDubaPushPop::_OpenUrlByRcmdHelper::rcmdhelper.exe_is_not_exsit
push ecx
call fcn.00422cfe
add esp, 4
call fcn.00422d46
mov esi, eax
call fcn.00422d9a
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.004012f9
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.004012f9
xor eax, eax
jmp 0x479943
lea eax, [ebp - 0x18]
push str.dataopen_url_tool_cfg.xml
push eax
lea ecx, [ebp - 0x14]
call fcn.0040548e
pop ecx
pop ecx
mov byte [ebp - 4], 2
push dword [ebp - 0x18]
call esi
test eax, eax
jne 0x47987f
cmp dword [0x4e0da8], ebx
je 0x479872
push str.KDubaPushPop::_OpenUrlByRcmdHelper::open_url_tool_cfg.xml_is_not_exsit
push ecx
call fcn.00422cfe
add esp, 4
call fcn.00422d46
mov esi, eax
call fcn.00422d9a
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.004012f9
jmp 0x479813
mov eax, dword [0x4e0530]
mov ecx, 0x4e0530
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 3
mov eax, dword [ebp + 8]
push dword [eax]
lea eax, [ebp - 0x1c]
push str._openurl:1__from:dbpushpop__url:__s_
call fcn.00401a22
mov esi, dword [ebp - 0x1c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x10]
mov edx, esi
call fcn.00468052
mov ebx, eax
test ebx, ebx
jne 0x479913
push 0x4ae5c8
lea eax, [ebp - 0x20]
push eax
call fcn.00405f0e
push str.rcmdhelper
lea eax, [ebp + 8]
push eax
mov byte [ebp - 4], 4
call fcn.00405f0e
lea eax, [ebp - 0x20]
push eax
push ebx
lea eax, [ebp + 8]
push eax
lea eax, [edi + 0x418]
push eax
add edi, 0x6ec
push edi
mov byte [ebp - 4], 5
call fcn.0047bf7e
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.004012f9
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff0
call fcn.004012f9
lea eax, [esi - 0x10]
call fcn.004012f9
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.004012f9
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.004012f9
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.004012f9
xor eax, eax
test ebx, ebx
sete al
call fcn.004879d0
ret 4
Function at 0x47a153
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x10
mov eax, 0x4a595b
call fcn.004878f8
mov edi, ecx
call fcn.00423604
mov eax, dword [eax]
xor esi, esi
cmp eax, esi
jne 0x47a178
xor eax, eax
call fcn.004879d0
ret 4
xor ebx, ebx
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x10], 5
call fcn.00467016
mov dword [ebp - 4], esi
call fcn.00423650
mov eax, dword [eax]
dec eax
dec eax
je 0x47a1be
sub eax, 3
je 0x47a1b5
dec eax
je 0x47a1ac
dec eax
dec eax
jne 0x47a1d3
mov dword [ebp - 0x10], 0x11
jmp 0x47a1d3
mov dword [ebp - 0x10], 0x13
jmp 0x47a1d3
mov dword [ebp - 0x10], 0xf
jmp 0x47a1d3
push str.ksoft_
lea eax, [ebp - 0x14]
push eax
call fcn.00405fe7
mov dword [ebp - 0x10], 9
push str.kminisitebox.exe
lea eax, [ebp - 0x14]
push eax
call fcn.00405fe7
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x47a1f3
test al, 0x10
je 0x47a205
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.004012f9
mov eax, esi
jmp 0x47a170
mov eax, dword [0x4e0530]
mov ecx, 0x4e0530
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 1
mov eax, dword [ebp + 8]
mov eax, dword [eax]
lea esi, [edi + 0x418]
push dword [esi]
push dword [ebp - 0x10]
push eax
push str._url:_s__from:_d__popid:_s
lea eax, [ebp - 0x18]
call fcn.00401a22
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
add esp, 0x10
mov edx, ebx
call fcn.004685af
test eax, eax
jne 0x47a2b0
push 0x4ae5c8
lea eax, [ebp - 0x1c]
push eax
call fcn.00405f0e
push 0x4be464
lea eax, [ebp + 8]
push eax
mov byte [ebp - 4], 2
call fcn.00405f0e
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x10]
lea eax, [ebp + 8]
push eax
push esi
add edi, 0x6ec
push edi
mov byte [ebp - 4], 3
call fcn.0047bf7e
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.004012f9
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
call fcn.004012f9
lea eax, [ebx - 0x10]
call fcn.004012f9
xor esi, esi
inc esi
jmp 0x47a1f3
lea eax, [ebx - 0x10]
call fcn.004012f9
xor esi, esi
jmp 0x47a1f3
Function at 0x47c0ab
Capabilities:
Create thread

Disassembly:
push 0xc
call sub.MSVCR80.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
xor ecx, ecx
cmp eax, ecx
jne 0x47c0bc
xor eax, eax
ret
mov edx, dword [esp + 4]
push ecx
push ecx
push eax
mov dword [eax], edx
mov edx, dword [esp + 0x18]
push 0x47645f
mov dword [eax + 8], edx
mov edx, dword [esp + 0x18]
push ecx
push ecx
mov dword [eax + 4], edx
call dword [sym.imp.MSVCR80.dll__beginthreadex]
add esp, 0x18
ret
Function at 0x47ceaf
Capabilities:
Check if file exists

Disassembly:
push 0x44
mov eax, 0x4a6194
call fcn.004878f8
mov edi, dword [ebp + 8]
xor esi, esi
cmp dword [edi + 0x6c8], esi
jne 0x47cedc
push dword [edi + 0x6b8]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x47cf83
mov eax, dword [edi + 0x6b4]
sub eax, 0x10
call fcn.00401311
add eax, 0x10
mov dword [ebp - 0x14], eax
lea ebx, [ebp - 0x14]
mov dword [ebp - 4], esi
call fcn.004242f5
lea eax, [ebp - 0x50]
push eax
call fcn.00452e3c
lea eax, [edi + 0x6b8]
lea edi, [ebp - 0x4c]
mov byte [ebp - 4], 1
call fcn.00404347
mov edi, dword [ebp - 0x14]
push edi
lea ecx, [ebp - 0x50]
call fcn.00452eb5
test eax, eax
jne 0x47cf41
mov eax, dword [ebp - 0x3c]
add eax, 0xfffffff0
call fcn.004012f9
mov eax, dword [ebp - 0x4c]
add eax, 0xfffffff0
call fcn.004012f9
lea eax, [edi - 0x10]
jmp 0x47cf7e
mov edi, dword [ebp + 0xc]
push esi
push esi
push esi
push esi
push edi
call dword [sym.imp.USER32.dll_SetRect]
lea ebx, [ebp - 0x50]
call fcn.0045356e
test eax, eax
mov esi, ebx
jne 0x47cf8d
call fcn.00453028
mov eax, dword [ebp - 0x3c]
add eax, 0xfffffff0
call fcn.004012f9
mov eax, dword [ebp - 0x4c]
add eax, 0xfffffff0
call fcn.004012f9
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.004012f9
xor al, al
call fcn.004879d0
ret 8
call fcn.00453028
mov eax, dword [edi + 8]
sub eax, dword [edi]
test eax, eax
jle 0x47cf62
mov eax, dword [edi + 0xc]
sub eax, dword [edi + 4]
test eax, eax
jle 0x47cf62
lea esi, [ebp - 0x1c]
call fcn.00452d37
test eax, eax
je 0x47cfc2
mov eax, dword [ebp - 0x1c]
add dword [edi], eax
add dword [edi + 8], eax
mov eax, dword [ebp - 0x18]
add dword [edi + 4], eax
add dword [edi + 0xc], eax
add dword [edi + 0xc], 0xfffffff1
push 0
push 0xfffffffffffffff1
push edi
call dword [sym.imp.USER32.dll_InflateRect]
fild dword [edi]
mov esi, dword [ebp + 8]
fdiv dword [esi + 0x6cc]
call fcn.00487300
fild dword [edi + 8]
mov dword [edi], eax
fdiv dword [esi + 0x6cc]
call fcn.00487300
fild dword [edi + 4]
mov dword [edi + 8], eax
fdiv dword [esi + 0x6cc]
call fcn.00487300
fild dword [edi + 0xc]
mov dword [edi + 4], eax
fdiv dword [esi + 0x6cc]
call fcn.00487300
mov dword [edi + 0xc], eax
mov eax, dword [ebp - 0x3c]
add eax, 0xfffffff0
call fcn.004012f9
mov eax, dword [ebp - 0x4c]
add eax, 0xfffffff0
call fcn.004012f9
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.004012f9
mov al, 1
jmp 0x47cf85