joyce8/EMBER2024-capa huggingface dataset:
Function at 0x496dca
Capabilities:
Check if file exists
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x5afee0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
and dword [ebp - 0x41c], 0
push ebx
mov ebx, ecx
mov dword [ebp - 0x420], eax
mov dword [ebp - 0x418], ebx
test eax, eax
je 0x496f31
test ebx, ebx
je 0x496f31
push esi
push edi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push eax
call fcn.00537010
push ebx
push 0x57cb68
mov edi, 0x103
lea eax, [ebp - 0x414]
push edi
push eax
call fcn.00532a01
add esp, 0x1c
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp - 0x414]
push eax
call esi
test eax, eax
jne 0x496e84
lea ebx, [ebp - 0x414]
call fcn.0049699b
test eax, eax
je 0x496f27
mov ebx, dword [ebp - 0x418]
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.00537010
push ebx
push str._s.df.bak
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.00532a01
add esp, 0x1c
lea eax, [ebp - 0x20c]
push eax
call esi
test eax, eax
je 0x496ecd
lea ecx, [ebp - 0x20c]
call fcn.00496aa0
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileW]
lea eax, [ebp - 0x20c]
push eax
push ebx
call edi
push ebx
mov dword [ebp - 0x418], eax
call esi
test eax, eax
jne 0x496efe
push ebx
push dword [ebp - 0x420]
call fcn.00496d1b
pop ecx
pop ecx
mov dword [ebp - 0x41c], eax
cmp dword [ebp - 0x418], 0
je 0x496f27
cmp dword [ebp - 0x41c], 0
jne 0x496f1c
push ebx
lea eax, [ebp - 0x20c]
push eax
call edi
jmp 0x496f27
lea ecx, [ebp - 0x20c]
call fcn.00496aa0
mov eax, dword [ebp - 0x41c]
pop edi
pop esi
jmp 0x496f33
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0052f7d0
leave
ret

Function at 0x497329
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
mov eax, edx
push esi
xor ebx, ebx
lea ecx, [eax + 2]
mov si, word [eax]
inc eax
inc eax
test si, si
jne 0x497338
sub eax, ecx
sar eax, 1
jne 0x49734c
xor eax, eax
jmp 0x497398
lea esi, [edx + eax*2 - 2]
cmp word [esi], 0x5c
jne 0x49735e
xor eax, eax
xor ebx, ebx
mov word [esi], ax
inc ebx
push edi
push 7
xor eax, eax
pop ecx
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, 0x414
mov word [ebp - 0x10], ax
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], 3
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
neg eax
sbb eax, eax
inc eax
pop edi
test ebx, ebx
je 0x497398
push 0x5c
pop ecx
mov word [esi], cx
pop esi
pop ebx
leave
ret
Function at 0x49739c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x5afee0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
mov dword [ebp - 0x424], esi
mov dword [ebp - 0x41c], edi
call fcn.00537010
mov eax, dword [ebp + 0x10]
push esi
add eax, eax
push str.CLSID_sInprocServer32
mov dword [ebp - 0x418], eax
mov ebx, 0x103
lea eax, [ebp - 0x20c]
push ebx
push eax
mov dword [ebp - 0x420], 1
call fcn.00532a01
mov esi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
add esp, 0x1c
lea eax, [ebp - 0x418]
push eax
push edi
lea eax, [ebp - 0x420]
push eax
push str.CodeBase
lea eax, [ebp - 0x20c]
push eax
mov edi, 0x80000000
push edi
call esi
test eax, eax
jne 0x497444
xor eax, eax
inc eax
jmp 0x49753c
lea eax, [ebp - 0x418]
push eax
push dword [ebp - 0x41c]
lea eax, [ebp - 0x420]
push eax
push 0
lea eax, [ebp - 0x20c]
push eax
push edi
call esi
test eax, eax
je 0x49743c
push dword [ebp - 0x424]
lea eax, [ebp - 0x20c]
push str.CLSID_sLocalServer32
push ebx
push eax
call fcn.00532a01
mov eax, dword [ebp + 0x10]
add eax, eax
add esp, 0x10
mov dword [ebp - 0x418], eax
lea eax, [ebp - 0x418]
push eax
push dword [ebp - 0x41c]
lea eax, [ebp - 0x420]
push eax
push 0
lea eax, [ebp - 0x20c]
push eax
push edi
call esi
test eax, eax
je 0x49743c
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push eax
call fcn.00537010
push dword [ebp - 0x424]
lea eax, [ebp - 0x20c]
push str.CLSID_sTreatAs
push ebx
push eax
call fcn.00532a01
add esp, 0x1c
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x420]
push eax
push 0
lea eax, [ebp - 0x20c]
push eax
push edi
mov dword [ebp - 0x418], 0x208
call esi
test eax, eax
jne 0x497531
push dword [ebp + 0x10]
lea eax, [ebp - 0x414]
push dword [ebp - 0x41c]
push eax
call fcn.0049739c
add esp, 0xc
jmp 0x49753c
mov ecx, dword [ebp - 0x41c]
xor eax, eax
mov word [ecx], ax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0052f7d0
leave
ret
Function at 0x49797d
Capabilities:
Delete directory
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x674
mov eax, dword [0x5afee0]
xor eax, esp
mov dword [esp + 0x670], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
push 0x24c
lea eax, [esp + 0x20]
push edi
push eax
mov dword [esp + 0x1c], esi
mov dword [esp + 0x24], edi
call fcn.00537010
xor eax, eax
mov ebx, 0x206
push ebx
mov word [esp + 0x480], ax
lea eax, [esp + 0x482]
push edi
push eax
call fcn.00537010
push 0x588e08
push esi
mov edi, 0x57c6a4
push edi
mov esi, 0x103
lea eax, [esp + 0x494]
push esi
push eax
call fcn.00532a01
add esp, 0x2c
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x474]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esp + 0x14], eax
cmp eax, 0xffffffff
jne 0x497a1a
xor eax, eax
jmp 0x497b23
mov ecx, 0x583f04
lea eax, [esp + 0x44]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x497a49
test dx, dx
je 0x497a45
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x497a49
add eax, 4
add ecx, 4
test dx, dx
jne 0x497a23
xor eax, eax
jmp 0x497a4e
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x497aec
mov ecx, 0x583f08
lea eax, [esp + 0x44]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x497a85
test dx, dx
je 0x497a81
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x497a85
add eax, 4
add ecx, 4
test dx, dx
jne 0x497a5f
xor eax, eax
jmp 0x497a8a
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x497aec
xor eax, eax
push ebx
push eax
mov word [esp + 0x270], ax
lea eax, [esp + 0x272]
push eax
call fcn.00537010
test byte [esp + 0x24], 0x10
lea eax, [esp + 0x50]
push eax
push dword [esp + 0x20]
lea eax, [esp + 0x27c]
push edi
push esi
push eax
je 0x497ad8
call fcn.00532a01
lea eax, [esp + 0x288]
push eax
call fcn.0049797d
add esp, 0x24
jmp 0x497aec
call fcn.00532a01
add esp, 0x20
lea ecx, [esp + 0x268]
call fcn.00496aa0
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x497a1a
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x20
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ecx, dword [esp + 0x67c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0052f7d0
mov esp, ebp
pop ebp
ret
Function at 0x498bbb
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x149c
call fcn.005482e0
mov eax, dword [0x5afee0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
xor edi, edi
mov dword [ebp - 0x1460], eax
cmp ebx, edi
je 0x498d38
xor ecx, ecx
cmp cx, word [ebx]
je 0x498d38
cmp eax, edi
je 0x498d38
xor eax, eax
mov esi, 0x206
push esi
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push edi
push eax
call fcn.00537010
xor eax, eax
push esi
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push edi
push eax
call fcn.00537010
push 0x38
lea eax, [ebp - 0x1498]
push edi
push eax
call fcn.00537010
lea eax, [ebp - 0x414]
mov dword [ebp - 0x1498], eax
mov eax, 0x104
lea ecx, [ebp - 0x20c]
mov dword [ebp - 0x1494], eax
mov dword [ebp - 0x1488], eax
mov eax, ebx
mov dword [ebp - 0x148c], ecx
add esp, 0x24
mov dword [ebp - 0x149c], 0x3c
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, di
jne 0x498c77
mov esi, dword [sym.imp.WININET.dll_InternetCrackUrlW]
sub eax, ecx
lea ecx, [ebp - 0x149c]
push ecx
push edi
sar eax, 1
push eax
push ebx
call esi
cmp eax, edi
jne 0x498cfd
xor eax, eax
push 0x1046
mov word [ebp - 0x145c], ax
lea eax, [ebp - 0x145a]
push edi
push eax
call fcn.00537010
push ebx
push str.http:___s_
lea eax, [ebp - 0x145c]
push 0x823
push eax
call fcn.00532a01
lea eax, [ebp - 0x145c]
add esp, 0x1c
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x498cd9
lea ecx, [ebp - 0x149c]
push ecx
sub eax, edx
sar eax, 1
push edi
push eax
lea eax, [ebp - 0x145c]
push eax
call esi
cmp eax, edi
je 0x498d38
mov esi, dword [ebp + 0xc]
lea eax, [esi + esi]
push eax
push edi
push dword [ebp - 0x1460]
call fcn.00537010
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
push str._s:___s_favicon.ico
dec esi
push esi
push dword [ebp - 0x1460]
call fcn.00532a01
xor eax, eax
add esp, 0x20
inc eax
jmp 0x498d3a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0052f7d0
leave
ret
Function at 0x49945d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x5afee0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, 0xe52f
mov word [ebp - 0x30], ax
mov eax, 0x467c
mov word [ebp - 0x2e], ax
mov eax, 0x9614
mov word [ebp - 0x10], ax
mov eax, 0x4f35
mov word [ebp - 0xe], ax
mov eax, 0x4d5e
mov word [ebp - 0x20], ax
push esi
mov eax, 0x40bb
mov word [ebp - 0x1e], ax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x14]
push eax
push 1
xor esi, esi
push esi
lea eax, [ebp - 0x34]
push eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], 0xbcde0395
mov byte [ebp - 0x2c], 0x8e
mov byte [ebp - 0x2b], 0x3d
mov byte [ebp - 0x2a], 0xc4
mov byte [ebp - 0x29], 0x57
mov byte [ebp - 0x28], 0x92
mov byte [ebp - 0x27], 0x91
mov byte [ebp - 0x26], 0x69
mov byte [ebp - 0x25], 0x2e
mov dword [ebp - 0x14], 0xa95664d2
mov byte [ebp - 0xc], 0xa7
mov byte [ebp - 0xb], 0x46
mov byte [ebp - 0xa], 0xde
mov byte [ebp - 9], 0x8d
mov byte [ebp - 8], 0xb6
mov byte [ebp - 7], 0x36
mov byte [ebp - 6], 0x17
mov byte [ebp - 5], 0xe6
mov dword [ebp - 0x24], 0xbfa971f1
mov byte [ebp - 0x1c], 0x93
mov byte [ebp - 0x1b], 0x5e
mov byte [ebp - 0x1a], 0x96
mov byte [ebp - 0x19], 0x70
mov byte [ebp - 0x18], 0x39
mov byte [ebp - 0x17], 0xbf
mov byte [ebp - 0x16], 0xbe
mov byte [ebp - 0x15], 0xe4
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x4995d3
mov eax, dword [ebp - 0x38]
cmp eax, esi
je 0x4995d3
lea edx, [ebp - 0x3c]
push edx
push 1
push esi
mov dword [ebp - 0x3c], esi
mov ecx, dword [eax]
push eax
call dword [ecx + 0x10]
test eax, eax
jl 0x4995ca
mov eax, dword [ebp - 0x3c]
cmp eax, esi
je 0x4995ca
lea edx, [ebp - 0x40]
push edx
push esi
push 1
lea edx, [ebp - 0x24]
push edx
mov dword [ebp - 0x40], esi
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
test eax, eax
jl 0x4995c1
mov eax, dword [ebp - 0x40]
cmp eax, esi
je 0x4995c1
lea edx, [ebp - 0x44]
push edx
push esi
push 0x58b6f4
mov dword [ebp - 0x44], esi
mov ecx, dword [eax]
push eax
call dword [ecx + 0x10]
test eax, eax
jl 0x4995b8
mov eax, dword [ebp - 0x44]
cmp eax, esi
je 0x4995b8
mov ecx, dword [eax]
push esi
push dword [ebp + 8]
push eax
call dword [ecx + 0x14]
mov esi, eax
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax]
neg esi
sbb esi, esi
push eax
inc esi
call dword [ecx + 8]
mov eax, dword [ebp - 0x40]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0052f7d0
leave
ret
Function at 0x4995e2
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x5afee0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
push 0x206
xor esi, esi
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push esi
push eax
call fcn.00537010
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
push 2
mov dword [ebp - 0x210], 0x103
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
je 0x499644
cmp word [ebp - 0x20c], si
je 0x499644
inc esi
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0052f7d0
leave
ret

Function at 0x49970c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x105c
call fcn.005482e0
mov eax, dword [0x5afee0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor edi, edi
push edi
push edi
push str.ProxyEnable
mov esi, str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push esi
call dword [sym.imp.SHLWAPI.dll_SHRegGetBoolUSValueW]
mov dword [ebp - 0x1058], eax
xor eax, eax
push 0x1046
mov word [ebp - 0x104c], ax
xor ebx, ebx
lea eax, [ebp - 0x104a]
push edi
inc ebx
push eax
mov dword [ebp - 0x1054], ebx
call fcn.00537010
add esp, 0xc
push edi
push 0x577458
push edi
lea eax, [ebp - 0x105c]
push eax
lea eax, [ebp - 0x104c]
push eax
lea eax, [ebp - 0x1054]
push eax
push str.AutoConfigURL
push esi
mov dword [ebp - 0x105c], 0x823
mov dword [ebp - 0x1050], edi
call sub.SHLWAPI.dll_SHRegGetUSValueW
test eax, eax
jne 0x4997b2
cmp word [ebp - 0x104c], di
je 0x4997b2
mov dword [ebp - 0x1050], ebx
cmp dword [ebp - 0x1058], edi
jne 0x4997c6
cmp dword [ebp - 0x1050], edi
jne 0x4997c6
xor eax, eax
jmp 0x4997c8
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0052f7d0
leave
ret
Function at 0x499d78
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
push esi
push 0x20
push 3
push esi
push 1
push 0x80000000
push dword [ebp + 8]
mov dword [ebp - 0xc], esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
je 0x499e0e
push edi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, esi
je 0x499e04
lea eax, [edi + 2]
push ebx
push eax
call fcn.0052f69b
mov ebx, eax
pop ecx
cmp ebx, esi
je 0x499e03
lea eax, [edi + 2]
push eax
push esi
push ebx
call fcn.00537010
add esp, 0xc
push esi
lea eax, [ebp - 4]
push eax
push edi
push ebx
push dword [ebp - 8]
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x499dfc
cmp edi, dword [ebp - 4]
jne 0x499dfc
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 0xc], 1
call fcn.004295f8
push ebx
call fcn.00530cbd
pop ecx
pop ebx
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, dword [ebp - 0xc]
pop esi
leave
ret

Function at 0x499f7a
Capabilities:
Check if file exists
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x499fc0
push esi
push 0x57fd5c
push dword [ebp + 8]
call fcn.00532206
mov esi, eax
pop ecx
pop ecx
mov dword [ebp - 4], 0xfeff
test esi, esi
je 0x499fbf
push esi
push 1
lea eax, [ebp - 4]
push 2
push eax
call fcn.005303c1
push esi
call fcn.0052fd5d
add esp, 0x14
pop esi
leave
ret

Function at 0x49a154
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
test ebx, ebx
je 0x49a1f5
xor eax, eax
cmp ax, word [ebx]
je 0x49a1f5
push esi
push 0x2214
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x49a1f4
push esi
mov edx, ebx
mov ecx, 0x104
call fcn.00408533
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x49a1b1
xor eax, eax
cmp ax, word [edx]
je 0x49a1b1
lea eax, [esi + 0x208]
push eax
mov ecx, 0x1000
call fcn.00408533
mov eax, dword [ebp + 8]
and dword [esi + 0x2210], 0
push 0
push 4
push esi
push 0x499fc2
mov dword [esi + 0x2208], eax
mov eax, dword [ebp + 0x10]
push 0
push 0
mov dword [esi + 0x220c], eax
call fcn.0053364a
mov esi, eax
add esp, 0x18
test esi, esi
je 0x49a1f4
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebp
ret
Function at 0x49a354
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x5afee0]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
test edi, edi
jne 0x49a372
xor eax, eax
jmp 0x49a3ed
cmp word [0x5e0868], 0
push esi
mov esi, 0x5e0868
jne 0x49a38e
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor eax, eax
push 0x208
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.00537010
push edi
push esi
push 0x57c6a4
push 0x105
lea edi, [ebp - 0x210]
call fcn.00403d4f
add esp, 0x1c
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
jne 0x49a3ea
mov eax, edi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x49a3ea
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0052f7d0
leave
ret

Function at 0x49a5eb
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0x5d78a8], 0
push ebx
mov ebx, eax
je 0x49a605
test ebx, ebx
jne 0x49a6b4
push esi
push edi
push 4
pop eax
push 0x64
pop edi
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x58b658
push str.Control_PanelDesktopWindowMetrics
push 0x80000001
mov dword [ebp - 4], edi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov esi, dword [sym.imp.KERNEL32.dll_MulDiv]
test eax, eax
jne 0x49a683
mov eax, dword [ebp - 4]
sub eax, 0x60
je 0x49a680
sub eax, 0x18
je 0x49a677
sub eax, 0x18
je 0x49a66e
sub eax, 0x30
je 0x49a665
push 0x60
push edi
push dword [ebp - 4]
call esi
mov dword [ebp - 4], eax
jmp 0x49a683
mov dword [ebp - 4], 0xc8
jmp 0x49a683
mov dword [ebp - 4], 0x96
jmp 0x49a683
mov dword [ebp - 4], 0x7d
jmp 0x49a683
mov dword [ebp - 4], edi
mov eax, dword [ebp - 4]
test ebx, ebx
jne 0x49a696
test eax, eax
je 0x49a692
cmp eax, edi
jne 0x49a6b2
mov eax, edi
jmp 0x49a6b2
test eax, eax
jbe 0x49a6b0
cmp eax, edi
je 0x49a6b0
cmp byte [ebp + 8], 0
je 0x49a6a9
push eax
push ebx
push edi
jmp 0x49a6ac
push edi
push ebx
push eax
call esi
mov ebx, eax
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x49a6b7
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe0
mov eax, dword [0x5afee0]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
push esi
push edi
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0xd0], ebx
cmp eax, ebx
je 0x49a813
push 0x7e
pop esi
xor eax, eax
push esi
mov word [ebp - 0xcc], ax
lea eax, [ebp - 0xca]
push ebx
push eax
call fcn.00537010
add esp, 0xc
mov dword [ebp - 0xe0], esi
mov dword [ebp - 0xd8], 1
mov edi, str.Software_shouxin
mov esi, 0x80000001
cmp dword [ebp + 0x10], ebx
jne 0x49a755
lea eax, [ebp - 0xe0]
push eax
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp - 0xd8]
push eax
push 0x577458
push edi
push esi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x49a755
cmp word [ebp - 0xcc], bx
jne 0x49a7e4
push 0x3f
lea eax, [ebp - 0x4b]
push ebx
push eax
mov byte [ebp - 0x4c], bl
call fcn.00537010
add esp, 0xc
lea ecx, [ebp - 0x4c]
call fcn.00404b88
cmp byte [ebp - 0x4c], bl
je 0x49a7db
lea eax, [ebp - 0x4c]
push eax
lea ebx, [ebp - 0xd4]
call fcn.004a3b06
mov ebx, dword [ebp - 0xd4]
pop ecx
push ebx
push 0x57cb68
lea eax, [ebp - 0xcc]
push 0x40
push eax
call fcn.00532a01
lea eax, [ebp - 0xcc]
add esp, 0x10
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x49a7aa
sub eax, ecx
sar eax, 1
add eax, eax
push eax
lea eax, [ebp - 0xcc]
push eax
push 1
push 0x577458
push edi
push esi
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
lea eax, [ebx - 0x10]
call fcn.00407d09
xor ebx, ebx
cmp word [ebp - 0xcc], bx
je 0x49a80b
lea eax, [ebp - 0xcc]
push eax
push 0x57cb68
push dword [ebp + 0xc]
push dword [ebp - 0xdc]
call fcn.00532a01
add esp, 0x10
mov dword [ebp - 0xd0], 1
mov eax, dword [ebp - 0xd0]
jmp 0x49a815
xor eax, eax
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0052f7d0
leave
ret

Function at 0x49a8b5
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 4], 0
push esi
mov esi, dword [0x5dbc40]
push edi
mov dword [ebp - 0xc], 0x433be5
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edi, eax
lea eax, [ebp - 4]
push eax
mov eax, dword [esi]
push 0x40
push 4
add eax, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
and dword [ebp - 8], 0
lea eax, [ebp - 4]
push eax
push 4
lea eax, [ebp - 8]
push eax
mov eax, dword [esi]
add eax, 0xc
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x49a936
mov eax, dword [ebp - 8]
cmp dword [ebp - 0xc], eax
je 0x49a936
mov dword [0x5d2994], eax
lea eax, [ebp - 4]
push eax
push 4
lea eax, [ebp - 0xc]
push eax
mov eax, dword [esi]
add eax, 0xc
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x49a936
xor eax, eax
inc eax
jmp 0x49a938
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x49ae22
Capabilities:
Accept command line arguments

Disassembly:
push 0xc
mov eax, 0x564912
call fcn.005399db
mov eax, dword [ebp + 8]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x49ae34
sub eax, edx
sar eax, 1
mov esi, eax
xor ecx, ecx
push 2
lea edi, [esi + 1]
pop edx
mov eax, edi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0052f69b
mov ebx, eax
pop ecx
test ebx, ebx
je 0x49ae82
lea eax, [esi + esi + 2]
push eax
push 0
push ebx
call fcn.00537010
add esp, 0xc
push esi
push dword [ebp + 8]
push edi
push ebx
call fcn.00531bbd
add esp, 0x10
call fcn.004a3522
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x49ae8c
sub eax, edx
sar eax, 1
je 0x49aefd
lea eax, [ebp - 0x10]
push eax
xor edi, edi
push ebx
mov dword [ebp - 0x10], edi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [ebp - 0x10], edi
mov dword [ebp - 0x18], eax
jle 0x49aefd
xor esi, esi
cmp dword [ebp - 0x10], edi
jbe 0x49aef4
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + esi*4]
cmp word [eax], di
je 0x49aeee
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00408273
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], edi
call fcn.00425ce4
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.00407d09
inc esi
cmp esi, dword [ebp - 0x10]
jb 0x49aebb
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push ebx
call fcn.0052f7c5
pop ecx
call fcn.00539ab3
ret

Function at 0x49dda7
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x5d7880], 0
push 4
pop eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], 1
mov eax, str.SoftwareMicrosoftInternet_ExplorerInternationalScripts26
je 0x49ddd0
mov eax, str.SoftwareMicrosoftInternet_ExplorerInternational
lea ecx, [ebp - 4]
push ecx
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x49de09
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push str.AutoDetect
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
leave
ret