joyce8/EMBER2024-capa huggingface dataset:
Function at 0x439880
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x61cfd7
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x6f7654]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x238], ecx
push 0xd3
push 0x644564
push 0x644584
lea ecx, [ebp - 0x234]
call fcn.00455c30
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
jne 0x439917
push str.pWindow
push 0x6445a0
push 2
push 0x6445ac
push 0xd4
push str.IGImeManager::UpdateImeNameText
push 0x6445d4
call fcn.004563b0
add esp, 0x1c
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x234]
call fcn.00455c90
jmp 0x4399a8
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov dword [ebp - 0x220], eax
mov ecx, dword [ebp + 8]
call fcn.0043e110
push eax
call sub.IMM32.dll_ImmGetContext
mov dword [ebp - 0x224], eax
xor eax, eax
mov word [ebp - 0x21c], ax
push 0x206
push 0
lea ecx, [ebp - 0x21a]
push ecx
call fcn.005eb2a0
add esp, 0xc
lea edx, [ebp - 0x21c]
push edx
push 0x1006
mov eax, dword [ebp - 0x224]
push eax
mov ecx, dword [ebp - 0x220]
push ecx
call sub.IMM32.dll_ImmEscapeW
mov edx, dword [ebp - 0x238]
cmp dword [edx], 0
je 0x439996
lea eax, [ebp - 0x21c]
push eax
mov ecx, dword [ebp - 0x238]
mov ecx, dword [ecx]
call fcn.00439030
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x234]
call fcn.00455c90
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005ea848
mov esp, ebp
pop ebp
ret 4
Function at 0x439c20
Capabilities:
Log keystrokes via input method manager

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x61d04d
mov eax, dword fs:[0]
push eax
sub esp, 0x820
mov eax, dword [0x6f7654]
xor eax, ebp
mov dword [ebp - 0x24], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x82c], ecx
push 0x139
push str.IGImeManager::OnImeComposition
push 0x64466c
lea ecx, [ebp - 0x20]
call fcn.00455c30
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
call fcn.0043e110
push eax
call sub.IMM32.dll_ImmGetContext
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
and eax, 8
jne 0x439c90
mov ecx, dword [ebp + 0x10]
and ecx, 1
je 0x439ce5
xor edx, edx
mov word [ebp - 0x824], dx
push 0x7fe
push 0
lea eax, [ebp - 0x822]
push eax
call fcn.005eb2a0
add esp, 0xc
push 0x400
lea ecx, [ebp - 0x824]
push ecx
push 8
mov edx, dword [ebp - 0x10]
push edx
call sub.IMM32.dll_ImmGetCompositionStringW
mov eax, dword [ebp - 0x82c]
cmp dword [eax], 0
je 0x439ce5
lea ecx, [ebp - 0x824]
push ecx
mov edx, dword [ebp - 0x82c]
mov ecx, dword [edx]
call fcn.00439070
mov ecx, dword [ebp + 0x10]
and ecx, 0x800
je 0x439d0d
mov edx, dword [ebp - 0x82c]
cmp dword [edx], 0
je 0x439d0d
push 0x644680
mov eax, dword [ebp - 0x82c]
mov ecx, dword [eax]
call fcn.00439070
mov ecx, dword [ebp - 0x10]
push ecx
mov ecx, dword [ebp + 8]
call fcn.0043e110
push eax
call sub.IMM32.dll_ImmReleaseContext
mov dword [ebp - 0x828], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00455c90
mov eax, dword [ebp - 0x828]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x24]
xor ecx, ebp
call fcn.005ea848
mov esp, ebp
pop ebp
ret 0xc
Function at 0x43e410
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x24], ecx
call fcn.00440220
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x4c]
mov byte [ecx + 0x4d0], 1
push 1
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 0x4c]
mov ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x1c], 0
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 0x4c]
mov ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x43e52b
push 0
push 0
push 0
lea edx, [ebp - 0x1c]
push edx
call fcn.00436c30
add esp, 0x10
test eax, eax
je 0x43e52b
cmp dword [ebp - 0x18], 0x10
jne 0x43e4f6
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x4c]
mov edx, dword [ebp - 0x1c]
cmp edx, dword [ecx + 0xc]
jne 0x43e4f6
push 1
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_EnableWindow]
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
lea ecx, [ebp - 0x1c]
push ecx
call dword [sym.imp.duilib.dll_public:_static_bool___cdecl_DuiLib::CPaintManagerUI::TranslateMessage_struct_tagMSG__const_]
add esp, 4
movzx edx, al
test edx, edx
jne 0x43e4f4
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea ecx, [ebp - 0x1c]
push ecx
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x43e51e
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.duilib.dll_public:_static_bool___cdecl_DuiLib::CPaintManagerUI::TranslateMessage_struct_tagMSG__const_]
add esp, 4
movzx eax, al
test eax, eax
jne 0x43e51e
lea ecx, [ebp - 0x1c]
push ecx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp dword [ebp - 0x18], 0x12
jne 0x43e526
jmp 0x43e52b
jmp 0x43e46a
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x4c]
mov byte [ecx + 0x4d0], 0
cmp dword [ebp - 0x18], 0x12
jne 0x43e54c
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov al, 1
jmp 0x43e56a
push 1
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_EnableWindow]
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x4429f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x61d714
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x6f7654]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x28], ecx
push 0x4c
push 0x646710
push 0x646730
lea ecx, [ebp - 0x1c]
call fcn.00455c30
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x28]
cmp dword [eax + 4], 0
je 0x442a5c
mov ecx, dword [ebp - 0x28]
cmp dword [ecx + 4], 0
je 0x442a5c
mov edx, dword [ebp - 0x28]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x28]
mov dword [ecx + 4], 0
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov edx, dword [ebp - 0x28]
mov dword [edx + 4], eax
push 0
push 0
push 0
push 0x442b80
push 0
push 0
call fcn.005ed7ec
add esp, 0x18
push 0x3e8
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x442adb
push str.__SL_LSM_I___startup_thread_timeout.
push 3
push 0x646770
push 0x58
push str.CLoginStateManager::Initialize
push 0x646798
call fcn.004563b0
add esp, 0x18
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00455c90
mov eax, dword [ebp - 0x20]
jmp 0x442af4
mov dword [ebp - 0x24], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00455c90
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x4450b0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x61dbb5
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x6f7654]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x4c], ecx
lea eax, [ebp - 0x48]
push eax
call fcn.0042df70
mov ecx, eax
call fcn.004957e0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x48]
call fcn.0045e920
test eax, eax
jne 0x44510b
push 0x647bdc
lea ecx, [ebp - 0x48]
call fcn.00404b50
lea ecx, [ebp - 0x48]
call fcn.00402aa0
push eax
lea ecx, [ebp - 0x2c]
push ecx
call fcn.00446600
add esp, 8
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2c]
call fcn.00402aa0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.00403b10
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.00403b10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005ea848
mov esp, ebp
pop ebp
ret
Function at 0x445170
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x61dbe2
mov eax, dword fs:[0]
push eax
sub esp, 0x238
mov eax, dword [0x6f7654]
xor eax, ebp
mov dword [ebp - 0x20], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x244], ecx
push 0x25b
push 0x647bfc
push 0x647c20
lea ecx, [ebp - 0x1c]
call fcn.00455c30
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x244]
call fcn.00445450
test eax, eax
jne 0x4452cd
xor eax, eax
mov word [ebp - 0x22c], ax
push 0x206
push 0
lea ecx, [ebp - 0x22a]
push ecx
call fcn.005eb2a0
add esp, 0xc
lea edx, [ebp - 0x22c]
push edx
call fcn.00445560
add esp, 4
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 0
jne 0x445233
mov dword [ebp - 0x238], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00455c90
mov eax, dword [ebp - 0x238]
jmp 0x4452ec
lea eax, [ebp - 0x22c]
push eax
push str.__SL_LSM_GA____s_n
push 5
push 0x647c5c
push 0x267
push 0x647c64
push 0x647c88
call fcn.00456680
add esp, 0x1c
push 0
push 0
push str._SDOLOGIN
lea ecx, [ebp - 0x22c]
push ecx
push 0x647cb4
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 0x20
ja 0x4452cd
push str.__SL_LSM_GA___ShellExecute_failed._n
push 3
push 0x647ce4
push 0x26b
push str.CLoginStateManager::_StartService
push 0x647d10
call fcn.004563b0
add esp, 0x18
mov dword [ebp - 0x23c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00455c90
mov eax, dword [ebp - 0x23c]
jmp 0x4452ec
mov dword [ebp - 0x240], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00455c90
mov eax, dword [ebp - 0x240]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x20]
xor ecx, ebp
call fcn.005ea848
mov esp, ebp
pop ebp
ret
Function at 0x445560
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x61dc7b
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x6f7654]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x29a
push 0x647efc
push 0x647f24
lea ecx, [ebp - 0x24]
call fcn.00455c30
mov dword [ebp - 4], 0
push str.MainProg
push str.Softwaredaoyuloginguard
mov eax, dword [ebp + 8]
push eax
call fcn.00445670
add esp, 0xc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4455d2
mov ecx, dword [ebp + 8]
push ecx
call fcn.005ea8fb
add esp, 4
test eax, eax
jne 0x4455ed
mov dword [ebp - 0x28], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.00455c90
mov eax, dword [ebp - 0x28]
jmp 0x44565d
mov edx, dword [ebp + 8]
push edx
push 0x647f3c
push 5
push 0x647f44
push 0x2a2
push str.CLoginStateManager::_GetServiceExeName
push 0x647f74
call fcn.00456680
add esp, 0x1c
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
and ecx, 0x10
je 0x445644
mov dword [ebp - 0x2c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.00455c90
mov eax, dword [ebp - 0x2c]
jmp 0x44565d
mov dword [ebp - 0x30], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.00455c90
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x445670
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [ebp + 0xc], 0
je 0x445688
cmp dword [ebp + 8], 0
je 0x445688
cmp dword [ebp + 0x10], 0
jne 0x44568c
xor eax, eax
jmp 0x4456e2
mov dword [ebp - 8], 1
mov dword [ebp - 0xc], 0x104
lea eax, [ebp - 4]
push eax
push 1
push 0
mov ecx, dword [ebp + 0xc]
push ecx
push reloc.SdoBaseClient.dll_Ordinal_2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4456e0
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
push 0
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x4456e2
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4481d0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x6f7654]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x258], 0
push 0x24c
push 0
lea eax, [ebp - 0x254]
push eax
call fcn.005eb2a0
add esp, 0xc
lea ecx, [ebp - 0x258]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00402aa0
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0xffffffff
jne 0x44825d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x260], eax
mov edx, dword [ebp - 0x260]
push edx
push str.CC____d.t.f____target_file_to_be_deleted_not_found_:__d
push 4
push 0x6486d8
push 0x1f
push 0x6486e0
push 0x6486f4
call fcn.004563b0
add esp, 0x1c
jmp 0x4482b0
mov ecx, dword [ebp + 8]
call fcn.00402aa0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4482a3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x264], eax
mov eax, dword [ebp - 0x264]
push eax
push str.CC____d.t.f____trying_to_delete_target_file_error_:__d
push 3
push 0x648748
push 0x26
push str.DeleteTargetFile
push 0x648764
call fcn.004563b0
add esp, 0x1c
mov ecx, dword [ebp - 0x25c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005ea848
mov esp, ebp
pop ebp
ret

Function at 0x4482c0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
call fcn.0042aea0
movzx eax, al
test eax, eax
jne 0x4482e2
mov ecx, dword [ebp + 0xc]
call fcn.0042aea0
movzx ecx, al
test ecx, ecx
je 0x4482e4
jmp 0x44832d
mov ecx, dword [ebp + 0xc]
call fcn.00402aa0
push eax
mov ecx, dword [ebp + 8]
call fcn.00402aa0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x44832d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
push edx
push str.CC____m.tf____move_file_error_:__d
push 3
push 0x6487a4
push 0x36
push str.MoveTargetFile
push 0x6487bc
call fcn.004563b0
add esp, 0x1c
mov esp, ebp
pop ebp
ret
Function at 0x454e50
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x61ef28
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x6f7654]
xor eax, ebp
mov dword [ebp - 0x18], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x68], ecx
mov eax, dword [ebp - 0x68]
cmp dword [eax + 0x3c], 0
je 0x454e90
mov ecx, dword [ebp - 0x68]
movzx edx, byte [ecx + 0x41]
test edx, edx
jne 0x454e9c
mov al, 1
jmp 0x45503f
mov dword [ebp - 0x10], 8
call fcn.00407c80
push eax
mov eax, dword [ebp - 0x68]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x68]
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 0x3c], eax
call fcn.00407c80
mov dword [ebp - 0x40], eax
lea ecx, [ebp - 0x3c]
push ecx
lea edx, [ebp - 0x40]
push edx
call fcn.00407c60
add esp, 8
movzx eax, al
test eax, eax
je 0x454edf
xor al, al
jmp 0x45503f
push 0
push 8
lea ecx, [ebp - 0x34]
call fcn.0040ff60
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x48]
push edx
lea ecx, [ebp - 0x34]
call fcn.004145f0
mov ecx, eax
call fcn.00414800
mov esi, eax
lea ecx, [ebp - 0x34]
call fcn.0045e920
add esi, eax
push esi
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x34]
call fcn.004145f0
mov ecx, eax
call fcn.00414800
push eax
mov ecx, dword [ebp - 0x68]
add ecx, 0x44
push ecx
mov edx, dword [ebp - 0x68]
mov ecx, dword [edx + 0x3c]
call fcn.00455280
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0
je 0x454f5a
cmp dword [ebp - 0x6c], 1
je 0x454f61
cmp dword [ebp - 0x6c], 3
je 0x454ffb
jmp 0x455013
mov eax, dword [ebp - 0x68]
mov byte [eax + 0x41], 0
lea ecx, [ebp - 0x58]
push ecx
lea ecx, [ebp - 0x34]
call fcn.004145f0
mov ecx, eax
call fcn.00414800
mov edx, dword [ebp - 0x14]
sub edx, eax
mov dword [ebp - 0x38], edx
je 0x454fc4
mov eax, dword [ebp - 0x68]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x38]
push edx
push 1
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebp - 0x34]
call fcn.004145f0
mov ecx, eax
call fcn.00414800
push eax
call fcn.005ee27f
add esp, 0x10
cmp dword [ebp - 0x38], eax
je 0x454fc4
mov byte [ebp - 0x61], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00402e00
mov al, byte [ebp - 0x61]
jmp 0x45503f
mov ecx, dword [ebp - 0x68]
movzx edx, byte [ecx + 0x41]
test edx, edx
jne 0x454fe7
mov byte [ebp - 0x62], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00402e00
mov al, byte [ebp - 0x62]
jmp 0x45503f
cmp dword [ebp - 0x38], 0
jne 0x454ff9
push 0
push 8
lea ecx, [ebp - 0x34]
call fcn.00409090
jmp 0x45502b
mov byte [ebp - 0x63], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00402e00
mov al, byte [ebp - 0x63]
jmp 0x45503f
mov byte [ebp - 0x64], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00402e00
mov al, byte [ebp - 0x64]
jmp 0x45503f
jmp 0x454ef2
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.005ea848
mov esp, ebp
pop ebp
ret
Function at 0x456dc0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x456de8
cmp dword [ebp - 4], 2
je 0x456df0
mov ecx, dword [ebp - 8]
and ecx, 0x10
jne 0x456dfc
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov esp, ebp
pop ebp
ret

Function at 0x480400
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 1
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x480425
xor eax, eax
jmp 0x4804d3
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edx, dword [ebp - 8]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 8]
cmp dword [eax + 0xc], 0
jne 0x480445
xor eax, eax
jmp 0x4804d3
cmp dword [ebp - 4], 1
jne 0x4804b3
push str.GetMid
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
push str.GetM2
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 8]
mov dword [ecx + 4], eax
push str.GetMAC
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 8]
mov dword [ecx + 8], eax
mov edx, dword [ebp - 8]
cmp dword [edx], 0
je 0x4804ac
mov eax, dword [ebp - 8]
cmp dword [eax + 4], 0
je 0x4804ac
mov ecx, dword [ebp - 8]
cmp dword [ecx + 8], 0
jne 0x4804b3
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 1
je 0x4804d0
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 8]
mov dword [ecx + 0xc], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4
Function at 0x486ad0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x6f7654]
xor eax, ebp
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x230], ecx
lea ecx, [ebp - 0x14]
call fcn.00401310
mov eax, dword [ebp - 0x230]
mov ecx, dword [eax + 4]
or ecx, 0x2001f
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x230]
mov ecx, dword [eax]
push ecx
lea ecx, [ebp - 0x14]
call fcn.004013b0
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x486b3b
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x224], edx
lea ecx, [ebp - 0x14]
call fcn.00401340
mov eax, dword [ebp - 0x224]
jmp 0x486bcc
mov dword [ebp - 4], 0x100
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x220]
push edx
push 0
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x486ba1
lea ecx, [ebp - 0x220]
push ecx
lea ecx, [ebp - 0x14]
call fcn.00486ad0
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x486b98
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x228], edx
lea ecx, [ebp - 0x14]
call fcn.00401340
mov eax, dword [ebp - 0x228]
jmp 0x486bcc
mov dword [ebp - 4], 0x100
jmp 0x486b42
lea ecx, [ebp - 0x14]
call fcn.00401360
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x230]
call fcn.00486990
mov dword [ebp - 0x22c], eax
lea ecx, [ebp - 0x14]
call fcn.00401340
mov eax, dword [ebp - 0x22c]
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.005ea848
mov esp, ebp
pop ebp
ret 4
Function at 0x4871c0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
xor eax, eax
jne 0x4871c9
xor ecx, ecx
jne 0x4871c9
xor edx, edx
cmp dword [ebp + 0xc], 0
setne dl
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0
jne 0x4871ea
mov eax, 0xd
jmp 0x487245
xor eax, eax
jne 0x4871d1
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
lea edx, [ecx + eax*2]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax*2]
mov dword [ebp - 4], edx
cmp dword [ebp - 0xc], 1
jne 0x4871fb
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 7
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esp, ebp
pop ebp
ret 8
Function at 0x48c410
Capabilities:
Create process on windows
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6231a3
mov eax, dword fs:[0]
push eax
sub esp, 0x94
mov eax, dword [0x6f7654]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
xor eax, eax
mov word [ebp - 0x7c], ax
push 0x4a
push 0
lea ecx, [ebp - 0x7a]
push ecx
call fcn.005eb2a0
add esp, 0xc
push 0
push 0x26
lea edx, [ebp - 0x7c]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov dword [ebp - 0x80], eax
lea eax, [ebp - 0x7c]
push eax
lea ecx, [ebp - 0xa0]
call fcn.00404af0
mov byte [ebp - 4], 1
push str.Internet_Exploreriexplore.exe
lea ecx, [ebp - 0xa0]
push ecx
lea edx, [ebp - 0x2c]
push edx
call fcn.00406510
add esp, 0xc
mov byte [ebp - 4], 2
push 0
push 0
push 3
push 0
push 1
push Ordinal_2
lea ecx, [ebp - 0x2c]
call fcn.00402aa0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0xffffffff
jne 0x48c4f0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.iexplore_is_not_exist.___d_
push 2
push 0x6627ec
push 0x6b
push str.BusinessHelper::IEOpenUrl
push str..BusinessHelper.cpp
call fcn.004563b0
add esp, 0x1c
jmp 0x48c513
push 1
push 0
lea ecx, [ebp + 8]
call fcn.00402aa0
push eax
lea ecx, [ebp - 0x2c]
call fcn.00402aa0
push eax
push 0x662828
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [ebp - 0x84]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2c]
call fcn.00403b10
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xa0]
call fcn.00403b10
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00403b10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005ea848
mov esp, ebp
pop ebp
ret