joyce8/EMBER2024-capa huggingface dataset:
Function at 0x492248
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x1c]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
mov eax, dword [sym.imp.MSVCP80.dll_unsigned_int_const_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::npos]
push dword [eax]
lea ecx, [ebp - 0x1c]
push 0x5c
call dword [sym.imp.MSVCP80.dll_public:_unsigned_int___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::rfind_wchar_t__unsigned_int_const]
mov ecx, dword [sym.imp.MSVCP80.dll_unsigned_int_const_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::npos]
cmp dword [ecx], eax
je 0x49232c
push edi
push eax
xor edi, edi
push edi
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x1c]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::substr_unsigned_int__unsigned_int_]
cmp dword [eax + 0x18], 8
jb 0x492298
mov eax, dword [eax + 4]
jmp 0x49229b
add eax, 4
push edi
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
lea ecx, [ebp - 0x38]
mov esi, eax
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
cmp esi, edi
je 0x4922e1
cmp esi, 0x50
je 0x4922e1
cmp esi, 0xb7
je 0x4922e1
cmp esi, edi
jle 0x4922d0
and esi, 0xffff
or esi, 0x80070000
pop edi
lea ecx, [ebp - 0x1c]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov eax, esi
pop esi
leave
ret 4
cmp dword [ebp - 4], 8
mov eax, dword [ebp - 0x18]
jae 0x4922ed
lea eax, [ebp - 0x18]
push edi
push 0x80
push 1
push edi
push 3
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x492321
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x49231d
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
jmp 0x4922d0
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
jmp 0x4922d0
mov esi, 0x80070057
jmp 0x4922d1
Function at 0x49238f
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2fc
push ebx
push esi
push edi
xor edi, edi
push 0xd2
lea eax, [ebp - 0xe6]
push edi
push eax
mov word [ebp - 0xe8], di
call sub.MSVCR80.dll_memset
add esp, 0xc
lea eax, [ebp - 0xe8]
push eax
push 0x69
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
cmp eax, edi
jne 0x4923d3
xor eax, eax
jmp 0x492485
cdq
and edx, 3
add eax, edx
mov esi, eax
push 0x208
lea eax, [ebp - 0x2f6]
push edi
push eax
sar esi, 2
mov word [ebp - 0x2f8], di
call sub.MSVCR80.dll_memset
mov word [ebp - 0xf0], di
lea eax, [ebp - 0xe8]
mov edi, 0x54542c
add esp, 0xc
mov ebx, edi
mov dword [ebp - 4], eax
call fcn.00435596
test esi, esi
jle 0x492482
mov eax, dword [ebp - 4]
and word [eax + 4], 0
push 0x104
lea ecx, [ebp - 0x2f8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x49247b
lea eax, [ebp - 0x2f8]
push eax
lea eax, [ebp - 0xc]
call fcn.004014ce
lea eax, [ebp - 0xc]
push eax
call fcn.0043553a
mov eax, dword [ebp - 0xc]
add eax, 0xfffffff0
call fcn.00401239
push dword [ebp - 4]
lea eax, [ebp - 8]
call fcn.004014ce
lea eax, [ebp - 8]
push eax
call fcn.0043553a
mov eax, dword [ebp - 8]
add eax, 0xfffffff0
call fcn.00401239
add dword [ebp - 4], 8
dec esi
jne 0x49241a
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x492695
Capabilities:
Create thread

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0xe8
push ebx
xor eax, eax
push esi
push edi
xor ebx, ebx
mov byte [ebp + 0x54], bl
lea edi, [ebp + 0x55]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov dword [ebp + 0x68], ebx
lea edi, [ebp + 0x6c]
stosd dword es:[edi], eax
push 0xc6
stosd dword es:[edi], eax
lea eax, [ebp - 0x72]
push ebx
push eax
mov word [ebp - 0x74], bx
call sub.MSVCR80.dll_memset
push str.Chinese_simplified
push ebx
call dword [sym.imp.MSVCR80.dll_setlocale]
add esp, 0x14
call fcn.0049290b
push dword [ebp + 0x7c]
mov dword [0x54547c], eax
push 0x545454
call fcn.0040127c
call fcn.00492b77
xor edi, edi
inc edi
push edi
lea eax, [ebp + 0x54]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push ebx
push ebx
push edi
lea eax, [ebp + 0x54]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
lea eax, [ebp + 0x54]
mov dword [ebp + 0x68], 0xc
mov dword [ebp + 0x6c], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [ebp - 0x74]
push str.Global75AFC8EA_7E8D_4acf_A630_2A20C90CBE1B__d
push eax
call fcn.00492c46
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventW]
add esp, 0xc
lea eax, [ebp - 0x74]
push eax
push ebx
push edi
lea eax, [ebp + 0x68]
push eax
call esi
push ebx
push ebx
push edi
push ebx
mov dword [0x545448], eax
call esi
cmp dword [0x545448], ebx
mov dword [0x54544c], eax
je 0x49278e
cmp eax, ebx
je 0x49278e
push ebx
push ebx
push 0x545440
push 0x492986
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
cmp eax, ebx
setne cl
mov dword [0x545450], eax
mov eax, ecx
jmp 0x492790
xor eax, eax
pop edi
pop esi
pop ebx
add ebp, 0x74
leave
ret 4

Function at 0x492b2e
Capabilities:
Get file size

Disassembly:
push esi
push 0
push 0x80
push 3
push 0
push 3
push SysReAllocStringLen
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x492b56
xor eax, eax
jmp 0x492b73
push edi
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x492b69
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
ret 4
Function at 0x492b77
Capabilities:
Delete file
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
push dword [0x545454]
call dword [sym.imp.MSVCR80.dll__waccess]
test eax, eax
pop ecx
pop ecx
je 0x492b96
call fcn.00492c04
jmp 0x492bff
push dword [0x545454]
call fcn.00492b2e
cmp eax, 0x100000
jb 0x492bff
mov eax, dword [0x545454]
push ebx
push esi
push edi
add eax, 0xfffffff0
call fcn.0042a0e1
add eax, 0x10
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
call fcn.0046e6bc
mov edi, dword [ebp - 4]
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ebx, dword [0x545454]
push 0
push edi
call esi
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push ebx
call esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
call fcn.00492c04
lea eax, [edi - 0x10]
call fcn.00401239
pop edi
pop esi
pop ebx
xor eax, eax
inc eax
leave
ret

Function at 0x492c04
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0x520c48
push dword [0x545454]
call dword [sym.imp.MSVCR80.dll__wfopen]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x492c43
push esi
push 2
lea eax, [ebp - 4]
push 1
push eax
mov byte [ebp - 4], 0xff
mov byte [ebp - 3], 0xfe
call dword [sym.imp.MSVCR80.dll_fwrite]
push esi
call dword [sym.imp.MSVCR80.dll_fclose]
add esp, 0x14
pop esi
leave
ret

Function at 0x492cf2
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push esi
push edi
push 0xa
pop ecx
push str.NtQuerySystemInformation
xor esi, esi
xor eax, eax
mov dword [ebp - 0x30], esi
lea edi, [ebp - 0x2c]
push str.ntdll
mov dword [ebp - 4], 1
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, esi
je 0x492d3d
push esi
push 0x2c
lea ecx, [ebp - 0x30]
push ecx
push esi
call eax
test eax, eax
movzx eax, byte [ebp - 8]
je 0x492d40
mov eax, dword [ebp - 4]
push esi
push 1
push esi
push esi
lea esi, [ebx + 0x24]
mov dword [ebx + 0x20], eax
call fcn.00444aff
push 0xc
call sub.MSVCR80.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
xor ecx, ecx
cmp eax, ecx
jne 0x492d62
xor eax, eax
jmp 0x492d81
push ecx
push ecx
push eax
push 0x45681e
push ecx
push ecx
mov dword [eax], ebx
mov dword [eax + 8], ecx
mov dword [eax + 4], 0x492db6
call dword [sym.imp.MSVCR80.dll__beginthreadex]
add esp, 0x18
push eax
lea esi, [ebx + 0x2c]
call fcn.00444aa9
pop edi
xor eax, eax
pop esi
leave
ret
Function at 0x492dec
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea edi, [ebp - 0xc]
stosd dword es:[edi], eax
mov dword [ebp - 0x18], ecx
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
mov dword [ebp - 0x20], ecx
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
or ebx, 0xffffffff
call sub.KERNEL32.dll_GetSystemTimes
test eax, eax
je 0x492ec5
cmp dword [esi + 8], 0
jne 0x492e38
cmp dword [esi + 4], 0
je 0x492ea1
mov ecx, dword [esi + 0x10]
mov edi, dword [esi + 0x14]
mov eax, dword [esi + 0xc]
mov dword [ebp - 0x24], ecx
mov ecx, dword [esi + 0x18]
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp - 0x18]
xor edx, edx
xor ebx, ebx
sub ecx, edi
mov edi, dword [ebp - 0x20]
sbb edx, ebx
mov dword [ebp - 8], ecx
mov ecx, dword [esi + 8]
mov dword [ebp - 0x24], ecx
xor ecx, ecx
mov dword [ebp - 4], edx
mov edx, dword [esi + 4]
sub edi, edx
sbb ecx, ebx
mov dword [ebp - 0x24], ecx
mov ebx, dword [ebp - 0x24]
xor ecx, ecx
xor edx, edx
sub eax, dword [ebp - 0x10]
push edx
sbb ecx, edx
add eax, edi
adc ecx, ebx
add eax, dword [ebp - 8]
push 0x64
adc ecx, dword [ebp - 4]
push ecx
push eax
call fcn.004d5f30
add edi, dword [ebp - 8]
adc ebx, dword [ebp - 4]
push ebx
push edi
push edx
push eax
call fcn.004d5e80
mov ebx, eax
mov eax, dword [ebp - 0x10]
mov dword [esi + 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x10], eax
mov eax, dword [ebp - 0x18]
mov dword [esi + 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [esi + 0x18], eax
mov eax, dword [ebp - 0x20]
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x1c]
mov dword [esi + 8], eax
mov eax, dword [0x5438cc]
mov ecx, 0x5438cc
call dword [eax + 0xc]
add eax, 0x10
push ebx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push str.cpu_usage:_d_n
push eax
call fcn.0042a016
mov esi, dword [ebp - 4]
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea eax, [esi - 0x10]
call fcn.00401239
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x4943a1
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x5438cc]
push ebx
xor ebx, ebx
push esi
mov ecx, 0x5438cc
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ebx
call dword [eax + 0xc]
mov esi, eax
add esi, 0x10
cmp dword [ebp + 0xc], ebx
mov dword [ebp - 8], esi
je 0x494452
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocStringLen
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp + 0xc], eax
je 0x494452
push edi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 4], eax
inc eax
push eax
call fcn.004ce6ea
mov edi, eax
cmp edi, ebx
pop ecx
je 0x494448
push ebx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push edi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x494441
mov eax, dword [ebp - 4]
mov byte [edi + eax], bl
lea eax, [ebp - 8]
push eax
mov eax, edi
call fcn.00494463
mov esi, dword [ebp - 8]
mov ebx, dword [ebp + 8]
pop ecx
push esi
call fcn.00494247
mov dword [ebp - 0xc], eax
push edi
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
pop ecx
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
lea eax, [esi - 0x10]
call fcn.00401239
mov eax, dword [ebp - 0xc]
pop esi
pop ebx
leave
ret 8

Function at 0x49502e
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
and dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
jne 0x495047
mov eax, dword [ebp - 4]
jmp 0x495121
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
shr ecx, 3
xor eax, 0xffffffff
test ecx, ecx
je 0x4950fc
push ebp
mov ebp, ecx
xor edx, edx
xor ecx, ecx
nop
mov ebx, dword [esi]
add esi, 4
mov dl, bl
mov cl, bh
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x4e8c98]
shr ebx, 0x10
xor eax, edi
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x4e8c98]
mov dl, bl
xor eax, edi
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x4e8c98]
mov cl, bh
xor eax, edi
mov ebx, dword [esi]
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x4e8c98]
add esi, 4
xor eax, edi
mov dl, bl
mov cl, bh
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x4e8c98]
shr ebx, 0x10
xor eax, edi
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x4e8c98]
mov dl, bl
xor eax, edi
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x4e8c98]
mov cl, bh
xor eax, edi
xor cl, al
shr eax, 8
xor eax, dword [ecx*4 + 0x4e8c98]
dec ebp
jne 0x495066
pop ebp
mov ecx, dword [ebp + 0x10]
xor edx, edx
and ecx, 7
je 0x495118
mov dl, byte [esi]
inc esi
xor dl, al
shr eax, 8
xor eax, dword [edx*4 + 0x4e8c98]
dec ecx
jne 0x495106
xor eax, 0xffffffff
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x495126
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x140
push esi
push edi
mov esi, 0x11c
push esi
xor edi, edi
lea eax, [ebp - 0xa4]
push edi
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
lea eax, [ebp - 0xa4]
mov dword [ebp - 0xa4], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push eax
call esi
test eax, eax
jne 0x495186
lea eax, [ebp - 0xa4]
push eax
mov dword [ebp - 0xa4], 0x114
call esi
test eax, eax
jne 0x495186
mov dword [0x545818], edi
jmp 0x49530f
mov eax, dword [ebp - 0x94]
dec eax
je 0x4952ca
dec eax
je 0x4951a5
mov dword [0x545818], 1
jmp 0x49530c
cmp dword [ebp - 0xa0], 6
jb 0x495217
cmp byte [ebp + 0x76], 1
jne 0x4951f5
mov eax, dword [ebp - 0x9c]
sub eax, edi
je 0x4951e9
dec eax
je 0x4951d4
dec eax
jne 0x495217
call fcn.00495318
neg eax
sbb eax, eax
neg eax
add eax, 0x10
jmp 0x4951e2
call fcn.00495318
neg eax
sbb eax, eax
neg eax
add eax, 0xc
mov dword [0x545818], eax
jmp 0x495217
mov dword [0x545818], 0xb
jmp 0x495217
cmp byte [ebp + 0x76], 3
jne 0x49520d
cmp dword [ebp - 0x9c], edi
mov dword [0x545818], 0xe
je 0x495217
mov dword [0x545818], 0xf
push 5
pop esi
cmp dword [ebp - 0xa0], esi
jne 0x4952b9
cmp dword [ebp - 0x9c], 2
jne 0x495294
push str.GetNativeSystemInfo
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, edi
je 0x495253
lea ecx, [ebp - 0xc8]
push ecx
call eax
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x49526b
mov dword [0x545818], 0xa
jmp 0x49528c
cmp byte [ebp + 0x76], 1
push 9
pop eax
jne 0x495287
cmp word [ebp - 0xc8], ax
mov dword [0x545818], 8
je 0x49528c
mov dword [0x545818], eax
cmp dword [ebp - 0xa0], esi
jne 0x4952b9
cmp dword [ebp - 0x9c], 1
jne 0x4952a7
mov dword [0x545818], 7
cmp dword [ebp - 0x9c], edi
jne 0x49530c
mov dword [0x545818], 6
cmp dword [ebp - 0xa0], 4
ja 0x49530c
mov dword [0x545818], esi
jmp 0x49530c
push 4
pop eax
cmp dword [ebp - 0xa0], eax
jne 0x49530c
cmp dword [ebp - 0x9c], edi
je 0x495302
cmp dword [ebp - 0x9c], 0xa
je 0x4952f6
cmp dword [ebp - 0x9c], 0x5a
jne 0x49530c
mov dword [0x545818], eax
jmp 0x49530c
mov dword [0x545818], 3
jmp 0x49530c
mov dword [0x545818], 2
xor edi, edi
inc edi
mov eax, edi
pop edi
pop esi
add ebp, 0x78
leave
ret

Function at 0x4953da
Capabilities:
Create thread

Disassembly:
push ebx
push ebp
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventW]
xor ebx, ebx
push ebx
push ebx
push 1
push ebx
mov ebp, 0x80004005
call edi
cmp eax, ebx
mov dword [esi + 8], eax
je 0x495428
push ebx
push ebx
push 1
push ebx
call edi
cmp eax, ebx
mov dword [esi + 0xc], eax
je 0x495428
cmp dword [esi], ebx
jne 0x495428
lea eax, [esi + 4]
push eax
push ebx
push esi
push 0x4954ae
push ebx
push ebx
call dword [sym.imp.MSVCR80.dll__beginthreadex]
add esp, 0x18
cmp eax, ebx
mov dword [esi], eax
je 0x495428
xor ebp, ebp
pop edi
mov eax, ebp
pop ebp
pop ebx
ret
Function at 0x495657
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
xor ecx, ecx
cmp eax, ecx
mov dword [ebp - 8], ecx
je 0x49571b
cmp dword [ebp + 0xc], ecx
je 0x49571b
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea edx, [ebp - 4]
push edx
push dword [ebp + 0x10]
lea edx, [ebp - 0xc]
push edx
push ecx
push dword [ebp + 0xc]
lea esi, [ebx + ebx]
push eax
mov dword [ebp - 4], esi
call edi
xor ecx, ecx
inc ecx
cmp dword [ebp - 0xc], ecx
jne 0x495719
test eax, eax
jne 0x4956b3
mov eax, dword [ebp + 0x10]
and word [esi + eax - 2], 0
mov dword [ebp - 8], ecx
jmp 0x495719
mov eax, dword [ebp - 4]
add eax, 2
push eax
call dword [sym.imp.MSVCR80.dll_malloc]
test eax, eax
pop ecx
mov dword [ebp - 0x10], eax
je 0x495719
lea ecx, [ebp - 4]
push ecx
push eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp + 8]
push 0
push dword [ebp + 0xc]
push dword [eax + 4]
call edi
test eax, eax
jne 0x49570f
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
mov edi, dword [ebp + 0x10]
shr ecx, 1
and word [eax + ecx*2], 0
lea ecx, [ebx - 1]
push ecx
push eax
push ebx
push edi
call dword [sym.imp.MSVCR80.dll_wcsncpy_s]
add esp, 0x10
and word [esi + edi - 2], 0
mov dword [ebp - 8], 1
push dword [ebp - 0x10]
call dword [sym.imp.MSVCR80.dll_free]
pop ecx
pop edi
pop esi
mov eax, dword [ebp - 8]
leave
ret 0xc

Function at 0x49582d
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
push 0xc
mov dword [esi + 8], eax
call sub.MSVCR80.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
xor ecx, ecx
cmp eax, ecx
jne 0x495845
xor eax, eax
jmp 0x495864
push ecx
push ecx
push eax
push 0x45681e
push ecx
push ecx
mov dword [eax], esi
mov dword [eax + 8], ecx
mov dword [eax + 4], 0x4958a2
call dword [sym.imp.MSVCR80.dll__beginthreadex]
add esp, 0x18
push eax
add esi, 4
call fcn.00444aa9
xor eax, eax
pop esi
ret
Function at 0x496388
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push edi
lea eax, [ebp - 4]
push eax
xor ebx, ebx
push 1
push ebx
mov edi, str.SOFTWAREKingsoftKISCommonKXEngine
push edi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], 3
mov dword [ebp - 8], ebx
call esi
cmp eax, ebx
je 0x4963d4
lea eax, [ebp - 4]
push eax
push 1
push ebx
push edi
push SysReAllocStringLen
call esi
cmp eax, ebx
jne 0x496446
cmp dword [ebp - 4], ebx
je 0x496454
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 8]
push eax
push ebx
lea eax, [ebp - 0x10]
push eax
push ebx
mov edi, 0x513918
push edi
push dword [ebp - 4]
call esi
test eax, eax
jne 0x496446
mov eax, dword [ebp - 8]
cmp eax, 4
ja 0x496403
push 4
pop eax
push eax
call fcn.004ce6ea
pop ecx
lea ecx, [ebp - 8]
push ecx
push eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
push ebx
push edi
push dword [ebp - 4]
call esi
push dword [ebp - 0xc]
push 0x104
push dword [ebp + 8]
call dword [sym.imp.MSVCR80.dll_wcscpy_s]
add esp, 0xc
cmp dword [ebp - 0xc], ebx
mov dword [ebp - 0x14], 1
je 0x496446
push dword [ebp - 0xc]
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
pop ecx
cmp dword [ebp - 4], ebx
je 0x496454
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x496a69
Capabilities:
Check if file exists
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
push ebx
push esi
push edi
xor ebx, ebx
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
push 0x208
lea eax, [ebp - 0x226]
push ebx
push eax
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov word [ebp - 0x228], bx
call sub.MSVCR80.dll_memset
add esp, 0xc
push str._deskduba123
lea eax, [ebp - 0x18]
call fcn.004014ce
lea eax, [ebp - 8]
push eax
call fcn.00496c30
mov esi, dword [ebp - 8]
add esi, 0xfffffff0
mov eax, esi
mov dword [ebp - 0x1c], esi
call fcn.0042a0e1
add eax, 0x10
mov dword [ebp - 4], eax
mov eax, esi
call fcn.0042a0e1
add eax, 0x10
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
mov dword [esp], 0x5214a4
push eax
call fcn.00407371
mov esi, 0x513684
push esi
lea eax, [ebp - 4]
push eax
call fcn.00407371
mov edi, 0x513674
push edi
lea eax, [ebp - 8]
push eax
call fcn.00407371
push esi
lea eax, [ebp - 8]
push eax
call fcn.00407371
push dword [ebp - 4]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
call esi
test eax, eax
je 0x496bdf
push dword [ebp - 8]
call esi
test eax, eax
je 0x496b3e
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x496bdf
lea eax, [ebp - 0xc]
push eax
push 0x4da47c
xor esi, esi
inc esi
push esi
push ebx
push 0x4da52c
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x496bdf
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
lea edx, [ebp - 0x10]
push edx
push 0x4da53c
push eax
call dword [ecx]
test eax, eax
jl 0x496bdf
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push ebx
push dword [ebp - 4]
push eax
call dword [ecx + 0x14]
test eax, eax
jl 0x496bdf
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
push 0x104
lea edx, [ebp - 0x228]
push edx
push eax
call dword [ecx + 0x28]
mov eax, dword [ebp - 0x18]
push dword [eax - 0xc]
push eax
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.MSVCR80.dll_wcsncmp]
add esp, 0xc
test eax, eax
jne 0x496bdf
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
push edi
push eax
call dword [ecx + 0x1c]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push esi
push dword [ebp - 4]
push eax
call dword [ecx + 0x18]
test eax, eax
jl 0x496bdf
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov dword [ebp - 0x14], esi
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [ebp - 8]
add eax, 0xfffffff0
call fcn.00401239
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.00401239
mov eax, dword [ebp - 0x1c]
call fcn.00401239
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.00401239
mov eax, dword [ebp - 0x10]
cmp eax, ebx
je 0x496c1b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0xc]
pop edi
pop esi
cmp eax, ebx
pop ebx
je 0x496c2b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x14]
leave
ret