joyce8/EMBER2024-capa huggingface dataset:
Function at 0x468273
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, ecx
mov dword [ebp - 0xc], edx
push esi
push edi
mov eax, dword [ebx]
mov esi, dword [ebx + 0x334]
mov dword [ebp - 8], esi
mov dword [ebp - 4], eax
mov edi, dword [eax + 0x9c]
test edi, edi
jne 0x4682a9
mov eax, dword [eax + 0x98]
mov edi, 0x12c
test eax, eax
cmovne edi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
imul eax, edi, 0x3e8
push eax
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esi + 0x14]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [esi + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
mov eax, dword [ebp - 8]
push dword [eax + 0x18]
and dword [eax + 0x14], 0
call esi
mov esi, dword [ebp - 8]
and dword [esi + 0x18], 0
test edi, edi
jne 0x468309
push 0x1388
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x468351
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
lea edi, [esi + 8]
mov byte [ebx + 0x32c], 1
or dword [edi], 0xffffffff
mov ecx, dword [ebp - 0xc]
test ecx, ecx
je 0x468325
mov eax, dword [ebx + 0x328]
mov dword [ecx], eax
xor esi, esi
cmp dword [ebx + 0x328], esi
jne 0x4683bc
push 0x1b
pop esi
cmp dword [edi], esi
jne 0x46836b
push str.out_of_memory
push str.Could_not_resolve_host:__s
push dword [ebp - 4]
call fcn.0045dab8
add esp, 0xc
jmp 0x4683bc
push dword [ebx + 0x330]
call dword [sym.imp.WS2_32.dll_WSASetLastError]
lea edi, [esi + 8]
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
jmp 0x468316
cmp dword [edi], 0xffffffff
je 0x4683a6
mov edx, dword [ebx + 0x330]
cmp edx, 0x2afc
je 0x4683a6
cmp byte [ebx + 0x32c], 0
je 0x4683b9
mov ecx, ebx
call fcn.0046a99b
push eax
push dword [ebx + 0x34]
push str.Could_not_resolve_host:__s___s
push dword [ebp - 4]
call fcn.0045dab8
add esp, 0x10
push 6
jmp 0x4683bb
push dword [ebx + 0x34]
push str.Resolving_host_timed_out:__s
push dword [ebp - 4]
call fcn.0045dab8
add esp, 0xc
push 0x1c
pop esi
lea ecx, [ebx + 0x320]
call fcn.00468042
cmp dword [ebx + 0x328], 0
jne 0x4683d7
mov byte [ebx + 0xe4], 1
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x468413
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
mov esi, edx
and dword [ebx], 0
push esi
mov eax, dword [edi]
mov dword [ebp - 4], eax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov edx, esi
cmp eax, 0xffffffff
je 0x468444
push dword [ebp + 8]
mov ecx, eax
call fcn.0046927f
pop ecx
jmp 0x4684ba
push ecx
push dword [ebp + 8]
mov ecx, edi
call fcn.00468108
pop ecx
pop ecx
test al, al
je 0x46845f
mov dword [ebx], 1
xor eax, eax
jmp 0x4684ba
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov ecx, edi
call fcn.0046a99b
mov ebx, dword [ebp - 4]
push eax
push esi
push str.init_resolve_thread___failed_for__s___s_n
push ebx
call fcn.0045da49
add esp, 0x10
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x4684b0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
mov ecx, edi
call fcn.0046a99b
push eax
push dword [ebp + 8]
push esi
push str.gethostbyname_2__failed_for__s:_d___s_n
push ebx
call fcn.0045da49
add esp, 0x14
jmp 0x46845b
mov edx, dword [ebp + 8]
mov ecx, eax
call fcn.004692e4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x468870
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, ecx
push esi
push edi
push 0x5c
mov eax, dword [ebx + 0x16c]
mov dword [ebp - 8], ebx
mov dword [ebp - 4], eax
push dword [eax]
call fcn.0047e9b0
mov ebx, dword [ebx]
xorps xmm0, xmm0
mov dword [ebp - 0x18], eax
pop ecx
pop ecx
lea eax, [ebx + 0x2f4]
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], eax
movlpd qword [ebp - 0x10], xmm0
call fcn.00468cba
mov ecx, dword [ebx + 0x80]
mov edi, edx
mov edx, dword [ebp - 8]
mov esi, eax
mov dword [edx + 0x200], ecx
mov eax, dword [ebx + 0x28]
mov dword [edx + 0x204], eax
lea eax, [ebx + 0x2f4]
mov dword [edx + 0x1fc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x4688e7
push 0x25
pop eax
jmp 0x4689e1
cmp byte [eax + 1], 0
je 0x4688df
mov eax, dword [ebp - 4]
push 0x4b86c0
push dword [eax]
call fcn.0047d398
mov dword [ebp - 0x18], eax
pop ecx
pop ecx
test eax, eax
jne 0x46891c
mov eax, dword [ebp - 4]
push dword [eax]
push str.Cant_open__s_for_writing
push ebx
call fcn.0045dab8
add esp, 0xc
push 0x17
jmp 0x4688e1
mov ecx, dword [ebx + 0xa8]
mov eax, dword [ebx + 0xac]
cmp ecx, 0xffffffff
jne 0x468931
cmp eax, ecx
je 0x46893d
push eax
push ecx
mov ecx, ebx
call fcn.00467741
add esp, 8
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 8]
lea eax, [ebp - 4]
push eax
mov edx, 0x4000
call fcn.0045a2a1
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x4689d6
cmp dword [ebp - 4], eax
jbe 0x4689c6
push dword [ebp - 0x18]
push dword [ebp - 4]
push 1
push dword [ebp - 0x1c]
call fcn.0047d221
add esp, 0x10
cmp eax, dword [ebp - 4]
jne 0x4689c1
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
adc eax, ebx
mov dword [ebp - 0xc], ecx
mov ebx, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
mov dword [ebx + 0x200], ecx
mov ecx, dword [ebp - 8]
mov dword [ebx + 0x204], eax
call fcn.00467772
test eax, eax
jne 0x4689bd
push edi
push esi
mov ecx, ebx
call fcn.00469754
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x468949
jmp 0x4689d6
push 0x2a
jmp 0x4689c3
push 0x37
pop ebx
jmp 0x4689d6
mov ecx, dword [ebp - 8]
call fcn.00467772
push 0x2a
test eax, eax
pop ecx
cmovne ebx, ecx
push dword [ebp - 0x18]
call fcn.0047c8d3
pop ecx
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x468e1c
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x338
mov eax, dword [0x4d3a00]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov ebx, ecx
xor esi, esi
push edi
mov edi, edx
mov dword [ebp - 0x32c], ebx
cdq
mov ecx, 0x3e8
idiv ecx
or ecx, 0xffffffff
mov dword [ebp - 0x324], esi
mov dword [ebp - 0x334], eax
imul eax, edx, 0x3e8
mov edx, esi
mov dword [ebp - 0x114], edx
mov dword [ebp - 0x330], eax
xor eax, eax
inc eax
cmp ebx, 0xffffffff
je 0x468e90
mov edx, eax
mov dword [ebp - 0x320], ebx
mov dword [ebp - 0x324], eax
mov ecx, ebx
mov dword [ebp - 0x110], ebx
mov dword [ebp - 0x114], edx
mov dword [ebp - 0x21c], esi
cmp edi, 0xffffffff
je 0x468ed6
mov dword [ebp - 0x21c], eax
mov eax, esi
mov dword [ebp - 0x218], edi
test edx, edx
je 0x468ebb
cmp dword [ebp + eax*4 - 0x110], edi
je 0x468ebb
inc eax
cmp eax, edx
jb 0x468ead
cmp eax, edx
jne 0x468ed1
cmp edx, 0x40
jae 0x468ed1
mov dword [ebp + eax*4 - 0x110], edi
inc dword [ebp - 0x114]
cmp edi, ecx
cmova ecx, edi
lea ebx, [ecx + 1]
lea eax, [ebp - 0x334]
push eax
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x324]
push eax
push ebx
call dword [sym.imp.WS2_32.dll_select]
mov dword [ebp - 0x328], eax
cmp eax, 0xffffffff
jne 0x468f18
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 4
je 0x468ed9
mov eax, dword [ebp - 0x328]
mov ebx, dword [ebp - 0x32c]
test eax, eax
jns 0x468f27
or eax, 0xffffffff
jmp 0x468f8e
jne 0x468f2d
xor eax, eax
jmp 0x468f8e
cmp ebx, 0xffffffff
je 0x468f5d
lea eax, [ebp - 0x324]
push eax
push ebx
call dword [sym.imp.WS2_32.dll___WSAFDIsSet]
push 1
test eax, eax
pop eax
cmovne esi, eax
lea eax, [ebp - 0x114]
push eax
push ebx
call dword [sym.imp.WS2_32.dll___WSAFDIsSet]
test eax, eax
je 0x468f5d
or esi, 4
cmp edi, 0xffffffff
je 0x468f8c
lea eax, [ebp - 0x21c]
push eax
push edi
call dword [sym.imp.WS2_32.dll___WSAFDIsSet]
test eax, eax
je 0x468f77
or esi, 2
lea eax, [ebp - 0x114]
push eax
push edi
call dword [sym.imp.WS2_32.dll___WSAFDIsSet]
test eax, eax
je 0x468f8c
or esi, 4
mov eax, esi
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047aabf
mov esp, ebp
pop ebp
ret
Function at 0x46a410
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x4d3a00]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x54], 0
and dword [ebp - 0x58], 0
push esi
push edi
mov esi, edx
mov dword [ebp - 0x68], 0x67452301
push esi
mov edi, ecx
mov dword [ebp - 0x64], 0xefcdab89
mov dword [ebp - 0x60], 0x98badcfe
mov dword [ebp - 0x5c], 0x10325476
call fcn.00483680
push eax
mov edx, esi
lea ecx, [ebp - 0x68]
call fcn.00469c31
push 8
lea edx, [ebp - 0x58]
lea ecx, [ebp - 0xc]
call fcn.0046a3da
mov edx, dword [ebp - 0x58]
push 0x38
pop ecx
shr edx, 3
and edx, 0x3f
push 0x78
sub ecx, edx
pop eax
sub eax, edx
cmp edx, 0x38
mov edx, 0x4b4800
cmovb eax, ecx
lea ecx, [ebp - 0x68]
push eax
call fcn.00469c31
push 8
lea edx, [ebp - 0xc]
lea ecx, [ebp - 0x68]
call fcn.00469c31
push 0x10
lea edx, [ebp - 0x68]
mov ecx, edi
call fcn.0046a3da
push 0x58
lea eax, [ebp - 0x68]
push 0
push eax
call fcn.00482250
mov ecx, dword [ebp - 4]
add esp, 0x24
xor ecx, ebp
pop edi
pop esi
call fcn.0047aabf
mov esp, ebp
pop ebp
ret
Function at 0x46b113
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
mov edi, edx
cmp dword [esi + 8], 0
jne 0x46b13f
mov eax, dword [esi]
push 0x4b9c70
push dword [eax + 8]
call fcn.0047d398
mov dword [esi + 8], eax
pop ecx
pop ecx
test eax, eax
jne 0x46b13f
or eax, 0xffffffff
jmp 0x46b16c
push dword [esi + 8]
push dword [ebp + 8]
push 1
push edi
call fcn.0047e04c
mov edi, eax
add esp, 0x10
cmp edi, dword [ebp + 8]
je 0x46b16a
push dword [esi + 8]
call fcn.0047c8d3
and dword [esi + 8], 0
pop ecx
mov ecx, dword [esi]
mov ecx, dword [ecx]
mov dword [esi], ecx
mov eax, edi
pop edi
pop esi
pop ebp
ret
Function at 0x46c3a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x4d3a00]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x14], 0x10
mov dword [esi + 0x10], 0
jb 0x46c3c8
mov eax, dword [esi]
jmp 0x46c3ca
mov eax, esi
mov byte [eax], 0
lea eax, [ebp - 0x107]
push 0x103
push 0
push eax
mov byte [ebp - 0x108], 0
call fcn.00482250
add esp, 0xc
mov dword [ebp - 0x114], 0x104
lea eax, [ebp - 0x114]
mov dword [ebp - 0x110], 1
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x110]
push eax
push 0x4a9a80
push str.SoftwareClasses9B7A98EC_7EF9_468c_ACC8_37C793DBD7E0Implemented_CategoriesA5F7140E_4311_4ef9_AABC_F55941B5EBE5
push reloc.WS2_32.dll_accept
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x46c4b3
cmp dword [ebp - 0x110], 1
jne 0x46c4b3
cmp byte [ebp - 0x108], al
jne 0x46c445
xor ecx, ecx
jmp 0x46c459
lea ecx, [ebp - 0x108]
lea edx, [ecx + 1]
mov edi, edi
mov al, byte [ecx]
inc ecx
test al, al
jne 0x46c450
sub ecx, edx
push ecx
lea eax, [ebp - 0x108]
mov ecx, esi
push eax
call fcn.004015b6
cmp dword [esi + 0x10], 0
jbe 0x46c4b3
push 1
push 0
lea eax, [ebp - 0x10c]
mov byte [ebp - 0x10c], 0xa
push eax
mov ecx, esi
call fcn.00415d66
cmp eax, 0xffffffff
je 0x46c49f
push 1
push eax
mov ecx, esi
call fcn.004016a7
push esi
call fcn.0046d3e0
add esp, 4
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047aabf
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.0047aabf
mov esp, ebp
pop ebp
ret
Function at 0x46c4d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a715b
mov eax, dword fs:[0]
push eax
sub esp, 0x298
mov eax, dword [0x4d3a00]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x216]
push 0x206
push 0
push eax
call fcn.00482250
add esp, 0xc
mov dword [ebp - 0x2a4], 0x208
xor eax, eax
mov dword [ebp - 0x2a0], 1
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x2a4]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x2a0]
push eax
push str.firstinstalltime
push str.SOFTWAREliebao
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov ax, word [ebp - 0x218]
test ax, ax
je 0x46c56e
cmp ax, 0x30
jne 0x46c5bc
xor eax, eax
mov dword [ebp - 0x2a0], 1
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x2a4]
push eax
lea eax, [ebp - 0x218]
mov dword [ebp - 0x2a4], 0x208
push eax
lea eax, [ebp - 0x2a0]
push eax
push str.firstinstalltime
push str.SoftwareKingsoftKBROWSER
push reloc.WS2_32.dll_accept
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov ax, word [ebp - 0x218]
test ax, ax
je 0x46c616
cmp ax, 0x30
je 0x46c616
lea eax, [ebp - 0x298]
mov dword [ebp - 0x29c], eax
lea ecx, [ebp - 0x29c]
push 3
lea eax, [ebp - 0x218]
push eax
call fcn.00455a9a
push dword [ebp - 0x29c]
mov ecx, esi
mov dword [ebp - 4], 0
call fcn.00415946
mov eax, dword [ebp - 0x29c]
lea ecx, [ebp - 0x298]
cmp eax, ecx
je 0x46c624
push eax
call fcn.0047b62c
add esp, 4
jmp 0x46c624
push 1
push 0x4b8fbc
mov ecx, esi
call fcn.004015b6
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047aabf
mov esp, ebp
pop ebp
ret
Function at 0x46c640
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x4d3a00]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x4d6620]
test al, 1
jne 0x46c68d
or eax, 1
mov dword [0x4d661c], 7
mov dword [0x4d6620], eax
xor eax, eax
push 0x4a7f70
mov dword [0x4d6618], 0
mov word [0x4d6608], ax
call fcn.0047b48c
add esp, 4
cmp dword [0x4d6618], 0
jne 0x46c764
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.00482250
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x46c764
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call fcn.0047ca89
add esp, 8
xor ecx, ecx
mov word [eax + 2], cx
lea eax, [ebp - 0x210]
push ecx
push ecx
push ecx
push ecx
push eax
push ecx
push ecx
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x46c764
push dword [ebp - 0x210]
lea eax, [ebp - 0x20c]
push 0x4a9a30
push 0x104
push eax
call fcn.00410a62
add esp, 0x10
cmp word [ebp - 0x20c], 0
jne 0x46c73a
xor ecx, ecx
jmp 0x46c752
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x46c743
sub ecx, edx
sar ecx, 1
push ecx
lea ecx, [ebp - 0x20c]
push ecx
mov ecx, 0x4d6608
call fcn.00403190
mov ecx, dword [ebp - 4]
mov eax, 0x4d6608
xor ecx, ebp
call fcn.0047aabf
mov esp, ebp
pop ebp
ret
Function at 0x46c780
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a715b
mov eax, dword fs:[0]
push eax
sub esp, 0x298
mov eax, dword [0x4d3a00]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x216]
push 0x206
push 0
push eax
call fcn.00482250
add esp, 0xc
mov dword [ebp - 0x2a4], 0x208
xor eax, eax
mov dword [ebp - 0x2a0], 1
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x2a4]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x2a0]
push eax
push str.installtime
push str.SOFTWAREliebao
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov ax, word [ebp - 0x218]
test ax, ax
je 0x46c81e
cmp ax, 0x30
jne 0x46c86c
xor eax, eax
mov dword [ebp - 0x2a0], 1
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x2a4]
push eax
lea eax, [ebp - 0x218]
mov dword [ebp - 0x2a4], 0x208
push eax
lea eax, [ebp - 0x2a0]
push eax
push str.installtime
push str.SoftwareKingsoftKBROWSER
push reloc.WS2_32.dll_accept
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov ax, word [ebp - 0x218]
test ax, ax
je 0x46c8c6
cmp ax, 0x30
je 0x46c8c6
lea eax, [ebp - 0x298]
mov dword [ebp - 0x29c], eax
lea ecx, [ebp - 0x29c]
push 3
lea eax, [ebp - 0x218]
push eax
call fcn.00455a9a
push dword [ebp - 0x29c]
mov ecx, esi
mov dword [ebp - 4], 0
call fcn.00415946
mov eax, dword [ebp - 0x29c]
lea ecx, [ebp - 0x298]
cmp eax, ecx
je 0x46c8d4
push eax
call fcn.0047b62c
add esp, 4
jmp 0x46c8d4
push 1
push 0x4b8fbc
mov ecx, esi
call fcn.004015b6
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047aabf
mov esp, ebp
pop ebp
ret
Function at 0x46c8f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a719b
mov eax, dword fs:[0]
push eax
sub esp, 0x298
mov eax, dword [0x4d3a00]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call fcn.00482250
add esp, 0xc
mov dword [ebp - 0x2a4], 0x208
lea eax, [ebp - 0x2a4]
mov dword [ebp - 0x2a0], 1
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x2a0]
push eax
push 0x4b9a60
push str.SOFTWAREliebao
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp word [ebp - 0x218], 0
jne 0x46c996
push 1
push 0x4b8fbc
mov ecx, esi
call fcn.004015b6
jmp 0x46c9fc
lea eax, [ebp - 0x298]
mov dword [ebp - 0x29c], eax
lea ecx, [ebp - 0x29c]
push 3
lea eax, [ebp - 0x218]
push eax
call fcn.00455a9a
mov edx, dword [ebp - 0x29c]
mov dword [ebp - 4], 0
cmp byte [edx], 0
jne 0x46c9cc
xor ecx, ecx
jmp 0x46c9da
mov ecx, edx
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x46c9d1
sub ecx, edi
push ecx
push edx
mov ecx, esi
call fcn.004015b6
mov eax, dword [ebp - 0x29c]
lea ecx, [ebp - 0x298]
cmp eax, ecx
je 0x46c9fc
push eax
call fcn.0047b62c
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047aabf
mov esp, ebp
pop ebp
ret

Function at 0x46ca20
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a719b
mov eax, dword fs:[0]
push eax
sub esp, 0x298
mov eax, dword [0x4d3a00]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call fcn.00482250
add esp, 0xc
mov dword [ebp - 0x2a4], 0x208
lea eax, [ebp - 0x2a4]
mov dword [ebp - 0x2a0], 1
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x2a0]
push eax
push str.spid
push str.SOFTWAREliebao
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp word [ebp - 0x218], 0
jne 0x46cac6
push 1
push 0x4b8fbc
mov ecx, esi
call fcn.004015b6
jmp 0x46cb2c
lea eax, [ebp - 0x298]
mov dword [ebp - 0x29c], eax
lea ecx, [ebp - 0x29c]
push 3
lea eax, [ebp - 0x218]
push eax
call fcn.00455a9a
mov edx, dword [ebp - 0x29c]
mov dword [ebp - 4], 0
cmp byte [edx], 0
jne 0x46cafc
xor ecx, ecx
jmp 0x46cb0a
mov ecx, edx
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x46cb01
sub ecx, edi
push ecx
push edx
mov ecx, esi
call fcn.004015b6
mov eax, dword [ebp - 0x29c]
lea ecx, [ebp - 0x298]
cmp eax, ecx
je 0x46cb2c
push eax
call fcn.0047b62c
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047aabf
mov esp, ebp
pop ebp
ret
Function at 0x46d2b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a719b
mov eax, dword fs:[0]
push eax
sub esp, 0x298
mov eax, dword [0x4d3a00]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call fcn.00482250
add esp, 0xc
mov dword [ebp - 0x2a4], 0x208
lea eax, [ebp - 0x2a4]
mov dword [ebp - 0x2a0], 1
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x2a0]
push eax
push 0x4b9a4c
push str.SOFTWAREliebao
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp word [ebp - 0x218], 0
jne 0x46d356
push 1
push 0x4b8fbc
mov ecx, esi
call fcn.004015b6
jmp 0x46d3bc
lea eax, [ebp - 0x298]
mov dword [ebp - 0x29c], eax
lea ecx, [ebp - 0x29c]
push 3
lea eax, [ebp - 0x218]
push eax
call fcn.00455a9a
mov edx, dword [ebp - 0x29c]
mov dword [ebp - 4], 0
cmp byte [edx], 0
jne 0x46d38c
xor ecx, ecx
jmp 0x46d39a
mov ecx, edx
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x46d391
sub ecx, edi
push ecx
push edx
mov ecx, esi
call fcn.004015b6
mov eax, dword [ebp - 0x29c]
lea ecx, [ebp - 0x298]
cmp eax, ecx
je 0x46d3bc
push eax
call fcn.0047b62c
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047aabf
mov esp, ebp
pop ebp
ret
Function at 0x46d420
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a72a8
mov eax, dword fs:[0]
push eax
mov eax, 0x1020
call fcn.00482980
mov eax, dword [0x4d3a00]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x102c], edi
call fcn.00417af1
mov byte [edi + 0xc4], 0
xor ecx, ecx
mov dword [edi + 0xdc], 7
mov dword [edi + 0xd8], 0
mov dword [ebp - 4], 0
mov word [edi + 0xc8], cx
mov word [edi + 0xe0], cx
lea ecx, [edi + 0xe4]
push 6
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push str.h_lvse
mov byte [ebp - 4], 1
mov byte [ecx], 0
call fcn.004015b6
mov dword [ebp - 0x1024], 0
mov dword [ebp - 0x1020], 0
mov dword [ebp - 0x101c], 0
push 1
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push reloc.WS2_32.dll_accept
lea ecx, [ebp - 0x1024]
mov byte [ebp - 4], 3
mov dword [ebp - 0x1028], 0
call fcn.004020cc
test eax, eax
jne 0x46d690
mov esi, dword [ebp - 0x1024]
lea eax, [ebp - 0x1014]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push eax
lea eax, [ebp - 0x1028]
mov dword [ebp - 0x1014], 4
push eax
lea eax, [ebp - 0x1018]
push eax
push 0
push str.ProxyEnable
push esi
call ebx
test eax, eax
jne 0x46d696
cmp dword [ebp - 0x1018], 4
jne 0x46d696
cmp dword [ebp - 0x1028], eax
je 0x46d696
test esi, esi
je 0x46d56e
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1024], 0
push 1
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push reloc.WS2_32.dll_accept
lea ecx, [ebp - 0x1024]
mov dword [ebp - 0x1020], 0
call fcn.004020cc
test eax, eax
jne 0x46d690
push 0xffe
push eax
mov word [ebp - 0x1010], ax
lea eax, [ebp - 0x100e]
push eax
call fcn.00482250
mov esi, dword [ebp - 0x1024]
lea eax, [ebp - 0x1014]
add esp, 0xc
mov dword [ebp - 0x1014], 0x1000
push eax
lea eax, [ebp - 0x1010]
push eax
lea eax, [ebp - 0x1018]
push eax
push 0
push str.ProxyServer
push esi
call ebx
test eax, eax
jne 0x46d696
mov eax, dword [ebp - 0x1018]
cmp eax, 1
je 0x46d5fe
cmp eax, 2
jne 0x46d696
mov ecx, dword [ebp - 0x1014]
test ecx, ecx
je 0x46d622
test cl, 1
jne 0x46d696
mov eax, ecx
shr eax, 1
cmp word [ebp + eax*2 - 0x1012], 0
je 0x46d62b
jmp 0x46d696
xor eax, eax
mov word [ebp - 0x1010], ax
shr ecx, 1
add ecx, ecx
cmp ecx, 0x1000
jae 0x46d68b
xor eax, eax
mov word [ebp + ecx - 0x1010], ax
cmp word [ebp - 0x1010], ax
jne 0x46d64e
xor ecx, ecx
jmp 0x46d666
lea ecx, [ebp - 0x1010]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x46d657
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x1010]
push eax
lea ecx, [edi + 0xc8]
call fcn.00403190
cmp dword [edi + 0xd8], 0
je 0x46d696
mov byte [edi + 0xc4], 1
jmp 0x46d696
call fcn.0047c0a0
mov esi, dword [ebp - 0x1024]
test esi, esi
je 0x46d6a1
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047aabf
mov esp, ebp
pop ebp
ret