joyce8/EMBER2024-capa huggingface dataset:
Function at 0x468f70
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov dword [ebp - 0x44], ecx
mov eax, dword [ebp + 0x14]
mov dword [eax], 0
movzx ecx, byte [0x591050]
test ecx, ecx
je 0x468f97
mov eax, 1
jmp 0x469111
mov edx, dword [ebp + 0x10]
push edx
lea ecx, [ebp - 8]
call fcn.00468f30
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0x44]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_ScreenToClient]
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x44]
add ecx, 0x328
call fcn.004301c0
test eax, eax
jne 0x4690ca
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 4]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
mov ecx, dword [ebp - 0x44]
add ecx, 0x338
call fcn.004301c0
test eax, eax
jne 0x4690ca
mov edx, dword [ebp - 8]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0x20]
push edx
mov ecx, dword [ebp - 0x44]
add ecx, 0x2d8
call fcn.004301c0
test eax, eax
jne 0x4690ca
mov eax, dword [ebp - 8]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x24]
push edx
mov eax, dword [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x44]
add ecx, 0x2e8
call fcn.004301c0
test eax, eax
jne 0x4690ca
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp - 4]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x30]
push ecx
mov ecx, dword [ebp - 0x44]
add ecx, 0x2f8
call fcn.004301c0
test eax, eax
jne 0x4690ca
mov edx, dword [ebp - 8]
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 4]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x34]
push ecx
mov edx, dword [ebp - 0x38]
push edx
mov ecx, dword [ebp - 0x44]
add ecx, 0x308
call fcn.004301c0
test eax, eax
jne 0x4690ca
mov eax, dword [ebp - 8]
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x3c], ecx
mov edx, dword [ebp - 0x3c]
push edx
mov eax, dword [ebp - 0x40]
push eax
mov ecx, dword [ebp - 0x44]
add ecx, 0x318
call fcn.004301c0
test eax, eax
je 0x4690d1
mov eax, 1
jmp 0x469111
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x44]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_DefWindowProcW]
cmp eax, 1
jne 0x46910c
push 1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
je 0x46910c
mov ecx, dword [ebp + 0x14]
mov dword [ecx], 1
mov eax, 2
jmp 0x469111
mov eax, 1
mov esp, ebp
pop ebp
ret 0x10
Function at 0x46f470
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov dword [ebp - 0x38], ecx
mov dword [ebp - 4], 0
jmp 0x46f48b
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x38]
mov edx, dword [ecx + 0x2d8]
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 0x2d8]
mov edx, dword [edx]
mov eax, dword [edx + 0xc]
call eax
cmp dword [ebp - 4], eax
jge 0x46f694
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0x38]
mov eax, dword [edx + 0x2d8]
mov ecx, dword [ebp - 0x38]
mov ecx, dword [ecx + 0x2d8]
mov edx, dword [eax]
mov eax, dword [edx]
call eax
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x3c]
mov eax, dword [edx + 0x16c]
call eax
push eax
lea ecx, [ebp - 8]
call fcn.0041c880
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov ecx, dword [ebp + 8]
mov eax, dword [edx + 0x20]
call eax
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x40]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x40]
mov eax, dword [edx + 0x16c]
call eax
push eax
lea ecx, [ebp - 8]
push ecx
call fcn.0047e690
add esp, 8
movzx edx, al
test edx, edx
je 0x46f687
push 0x554518
push 0x55b344
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0xc]
push ecx
call fcn.0041ca60
add esp, 0xc
mov ecx, eax
call fcn.0041cb20
push eax
mov ecx, 0x59143c
call fcn.0047dd80
lea ecx, [ebp - 0xc]
call fcn.0040f740
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 0x2d8]
mov edx, dword [ebp - 0x38]
mov eax, dword [edx + 0x2d8]
mov edx, dword [ecx]
mov ecx, eax
mov eax, dword [edx + 0x1c]
call eax
push ecx
mov ecx, esp
push str.IDB_SkinSet_CustomBg
call fcn.0041c8a0
push ecx
mov ecx, esp
push 0x554518
call fcn.0041c8a0
mov ecx, dword [ebp - 0x38]
call fcn.0046af90
push ecx
mov ecx, esp
push 0x59143c
call fcn.0041c880
push ecx
mov ecx, esp
push str.Customimage
call fcn.0041c8a0
push ecx
mov ecx, esp
push str.DeskCalendar
call fcn.0041c8a0
mov ecx, 0x591448
call fcn.0045bf10
lea ecx, [ebp - 8]
push ecx
push str.plugimage_
push 0x591308
lea edx, [ebp - 0x24]
push edx
call fcn.0041ca60
add esp, 0xc
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.0041ca00
add esp, 0xc
mov ecx, eax
call fcn.0041cb20
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x28]
call fcn.0040f740
lea ecx, [ebp - 0x24]
call fcn.0040f740
lea ecx, [ebp - 8]
push ecx
push 0x591438
call fcn.0047e690
add esp, 8
movzx edx, al
test edx, edx
je 0x46f67d
push str.IDB_SkinSet_Desk_0
mov ecx, 0x591438
call fcn.0041cec0
push ecx
mov ecx, esp
push 0x591438
call fcn.0041c880
push ecx
mov ecx, esp
push str.SkinName
call fcn.0041c8a0
push ecx
mov ecx, esp
push str.DeskCalendar
call fcn.0041c8a0
mov ecx, 0x591448
call fcn.0045bf10
push 0
push 1
push 0x545
mov eax, dword [0x5912f8]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [ebp - 0x38]
call fcn.0046b290
lea ecx, [ebp - 8]
call fcn.0040f740
jmp 0x46f694
lea ecx, [ebp - 8]
call fcn.0040f740
jmp 0x46f482
mov esp, ebp
pop ebp
ret 0xc
Function at 0x46f9e0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov dword [ebp - 0x38], ecx
mov dword [ebp - 4], 0
jmp 0x46f9fb
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x38]
mov edx, dword [ecx + 0x2dc]
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 0x2dc]
mov edx, dword [edx]
mov eax, dword [edx + 0xc]
call eax
cmp dword [ebp - 4], eax
jge 0x46fc04
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0x38]
mov eax, dword [edx + 0x2dc]
mov ecx, dword [ebp - 0x38]
mov ecx, dword [ecx + 0x2dc]
mov edx, dword [eax]
mov eax, dword [edx]
call eax
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x3c]
mov eax, dword [edx + 0x16c]
call eax
push eax
lea ecx, [ebp - 8]
call fcn.0041c880
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov ecx, dword [ebp + 8]
mov eax, dword [edx + 0x20]
call eax
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x40]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x40]
mov eax, dword [edx + 0x16c]
call eax
push eax
lea ecx, [ebp - 8]
push ecx
call fcn.0047e690
add esp, 8
movzx edx, al
test edx, edx
je 0x46fbf7
push 0x554518
push 0x55b344
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0xc]
push ecx
call fcn.0041ca60
add esp, 0xc
mov ecx, eax
call fcn.0041cb20
push eax
mov ecx, 0x591444
call fcn.0047dd80
lea ecx, [ebp - 0xc]
call fcn.0040f740
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 0x2dc]
mov edx, dword [ebp - 0x38]
mov eax, dword [edx + 0x2dc]
mov edx, dword [ecx]
mov ecx, eax
mov eax, dword [edx + 0x1c]
call eax
push ecx
mov ecx, esp
push str.IDB_SkinSet_CustomBg
call fcn.0041c8a0
push ecx
mov ecx, esp
push 0x554518
call fcn.0041c8a0
mov ecx, dword [ebp - 0x38]
call fcn.0046b470
push ecx
mov ecx, esp
push 0x591444
call fcn.0041c880
push ecx
mov ecx, esp
push str.Customimage
call fcn.0041c8a0
push ecx
mov ecx, esp
push str.Skinset
call fcn.0041c8a0
mov ecx, 0x591448
call fcn.0045bf10
lea ecx, [ebp - 8]
push ecx
push str.plugimage_
push 0x591308
lea edx, [ebp - 0x24]
push edx
call fcn.0041ca60
add esp, 0xc
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.0041ca00
add esp, 0xc
mov ecx, eax
call fcn.0041cb20
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x28]
call fcn.0040f740
lea ecx, [ebp - 0x24]
call fcn.0040f740
lea ecx, [ebp - 8]
push ecx
push 0x591440
call fcn.0047e690
add esp, 8
movzx edx, al
test edx, edx
je 0x46fbed
push str.IDB_SkinSet_FlowWindow_0
mov ecx, 0x591440
call fcn.0041cec0
push ecx
mov ecx, esp
push 0x591440
call fcn.0041c880
push ecx
mov ecx, esp
push str.SkinName
call fcn.0041c8a0
push ecx
mov ecx, esp
push str.Skin
call fcn.0041c8a0
mov ecx, 0x591448
call fcn.0045bf10
push 0
push 4
push 0x558
mov eax, dword [0x5912f4]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [ebp - 0x38]
call fcn.0046b640
lea ecx, [ebp - 8]
call fcn.0040f740
jmp 0x46fc04
lea ecx, [ebp - 8]
call fcn.0040f740
jmp 0x46f9f2
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4706c0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov byte [eax + 0x4ad], 0
mov byte [0x59107c], 0
mov byte [0x59107d], 0
mov byte [0x59107b], 0
push 0
push 0
mov ecx, dword [ebp - 8]
call fcn.004cdeda
mov byte [0x59107f], 0
mov ecx, dword [ebp - 8]
cmp dword [ecx + 0x480], 0
je 0x47071c
push 0
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x480]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push str.calendar_UICalendar
mov ecx, dword [ebp - 8]
add ecx, 0x20
call fcn.004dd71b
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x47073d
mov ecx, dword [ebp - 4]
call fcn.00458000
mov eax, 1
mov esp, ebp
pop ebp
ret 0x10
Function at 0x470af0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
push 0
push ecx
mov ecx, esp
push 0x554518
call fcn.0041c8a0
push ecx
mov ecx, esp
push 0x55f9a8
call fcn.0041c8a0
mov ecx, 0x591ad8
call fcn.0042ab10
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x470cab
mov edx, dword [ebp - 0x10]
cmp dword [edx + 0x480], 0
je 0x470b73
push 5
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x480]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x480]
call fcn.00458370
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx + 0x480]
call fcn.00458340
movzx edx, byte [0x591035]
test edx, edx
je 0x470c49
push 0
mov ecx, dword [ebp - 0x10]
call fcn.00458880
push 0
push 5
mov ecx, dword [ebp - 0x10]
call fcn.004cdeda
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x4b4], 1
jne 0x470bd7
mov byte [0x59107d], 0
push 1
mov ecx, dword [ebp - 0x10]
call fcn.00458450
mov ecx, dword [ebp - 0x10]
cmp dword [ecx + 0x480], 0
je 0x470bd5
push 0
push 0
push 1
mov edx, dword [ebp - 0x10]
mov ecx, dword [edx + 0x480]
call fcn.00470d30
jmp 0x470c47
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x4b4], 3
jne 0x470c16
mov byte [0x59107b], 0
push 3
mov ecx, dword [ebp - 0x10]
call fcn.00458450
mov ecx, dword [ebp - 0x10]
cmp dword [ecx + 0x480], 0
je 0x470c14
push 1
push 0
push 0
mov edx, dword [ebp - 0x10]
mov ecx, dword [edx + 0x480]
call fcn.00470d30
jmp 0x470c47
mov byte [0x59107c], 0
push 2
mov ecx, dword [ebp - 0x10]
call fcn.00458450
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x480], 0
je 0x470c47
push 0
push 1
push 0
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx + 0x480]
call fcn.00470d30
jmp 0x470c88
push 2
mov ecx, dword [ebp - 0x10]
call fcn.00458450
mov edx, dword [ebp - 0x10]
cmp dword [edx + 0x480], 0
je 0x470c73
push 0
push 1
push 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x480]
call fcn.00470d30
mov byte [0x59107c], 1
mov byte [0x59107d], 0
mov byte [0x59107b], 0
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov byte [0x59107f], 1
jmp 0x470d1f
mov edx, dword [ebp - 0x10]
mov byte [edx + 0x4ad], 1
mov byte [0x59107c], 0
mov byte [0x59107d], 0
mov byte [0x59107b], 0
push 0
push 0
mov ecx, dword [ebp - 0x10]
call fcn.004cdeda
mov byte [0x59107f], 0
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x480], 0
je 0x470cfe
push 0
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x480]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push str.calendar_UICalendar
mov ecx, dword [ebp - 0x10]
add ecx, 0x20
call fcn.004dd71b
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x470d1f
mov ecx, dword [ebp - 4]
call fcn.00458000
mov eax, 1
mov esp, ebp
pop ebp
ret 0x10
Function at 0x470dd0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
push 0
push ecx
mov ecx, esp
push 0x554518
call fcn.0041c8a0
push ecx
mov ecx, esp
push 0x55f9c0
call fcn.0041c8a0
mov ecx, 0x591ad8
call fcn.0042ab10
mov eax, dword [ebp - 0x10]
mov byte [eax + 0x4a8], 1
mov byte [0x59107f], 0
mov byte [0x59107c], 0
mov byte [0x59107d], 0
mov byte [0x59107b], 0
push 0
push 0
mov ecx, dword [ebp - 0x10]
call fcn.004cdeda
push str.calendar_UICalendar
mov ecx, dword [ebp - 0x10]
add ecx, 0x20
call fcn.004dd71b
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x470e52
mov ecx, dword [ebp - 4]
call fcn.00458000
mov ecx, dword [ebp - 0x10]
cmp dword [ecx + 0x480], 0
je 0x470e73
push 0
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x480]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, 1
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4742f0
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov dword [ebp - 0x84], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
je 0x474320
mov ecx, dword [ebp - 0x40]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x40]
mov eax, dword [edx + 0x3ac]
call eax
mov byte [0x591034], al
lea ecx, [ebp - 0x38]
call fcn.0042e050
push 1
push ecx
mov ecx, esp
push str.SoftwareMicrosoftWindowsCurrentVersionRun
call fcn.0041c8a0
push SysReAllocString
lea ecx, [ebp - 0x38]
call fcn.0042e1a0
movzx ecx, byte [0x591034]
test ecx, ecx
je 0x4743e0
push 0x55fb0c
push 0x591300
lea edx, [ebp - 0x48]
push edx
call fcn.0041ca60
add esp, 0xc
push ecx
mov ecx, esp
push 0x554518
call fcn.0041c8a0
push ecx
mov ecx, esp
push str.mytime
call fcn.0041c8a0
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x38]
call fcn.0042e400
lea ecx, [ebp - 0x44]
call fcn.0041cb20
push eax
lea ecx, [ebp - 0x48]
call fcn.00430140
test eax, eax
je 0x4743ce
push ecx
mov ecx, esp
push 0x55fb0c
push 0x591300
push ecx
call fcn.0041ca60
add esp, 8
mov ecx, esp
push str.mytime
call fcn.0041c8a0
lea ecx, [ebp - 0x38]
call fcn.00452f50
lea ecx, [ebp - 0x44]
call fcn.0040f740
lea ecx, [ebp - 0x48]
call fcn.0040f740
jmp 0x4743f5
push ecx
mov ecx, esp
push str.mytime
call fcn.0041c8a0
lea ecx, [ebp - 0x38]
call fcn.00452e00
movzx edx, byte [0x591034]
test edx, edx
je 0x47440c
mov dword [ebp - 0x88], str.true
jmp 0x474416
mov dword [ebp - 0x88], str.false
push ecx
mov ecx, esp
mov eax, dword [ebp - 0x88]
push eax
call fcn.0041c8a0
push ecx
mov ecx, esp
push 0x55ca9c
call fcn.0041c8a0
push ecx
mov ecx, esp
push str.HaveSetAutoStart
call fcn.0041c8a0
mov ecx, 0x591448
call fcn.0045bf10
lea ecx, [ebp - 0x20]
call fcn.0042e050
push 1
push ecx
mov ecx, esp
push str.SoftwareRuanMeiPCMaster
call fcn.0041c8a0
push SysReAllocString
lea ecx, [ebp - 0x20]
call fcn.0042e1a0
push 0xffffffffffffffff
push ecx
mov ecx, esp
push str.appstart
call fcn.0041c8a0
lea ecx, [ebp - 0x20]
call fcn.00452ea0
mov dword [ebp - 8], eax
mov dword [ebp - 0x3c], 1
mov dword [ebp - 4], 2
movzx ecx, byte [0x591034]
test ecx, ecx
je 0x4744ab
mov edx, dword [ebp - 8]
or edx, 1
mov dword [ebp - 8], edx
jmp 0x4744b4
mov eax, dword [ebp - 8]
and eax, 0xfffffffe
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
push ecx
push ecx
mov ecx, esp
push str.appstart
call fcn.0041c8a0
lea ecx, [ebp - 0x20]
call fcn.004530b0
movzx edx, byte [0x591034]
test edx, edx
je 0x4744e4
mov dword [ebp - 0x8c], 0x558be0
jmp 0x4744ee
mov dword [ebp - 0x8c], 0x558be8
push 0
push ecx
mov ecx, esp
mov eax, dword [ebp - 0x8c]
push eax
call fcn.0041c8a0
push ecx
mov ecx, esp
push 0x560b00
call fcn.0041c8a0
mov ecx, 0x591ad8
call fcn.0042ab10
lea ecx, [ebp - 0x20]
call fcn.0042e110
lea ecx, [ebp - 0x38]
call fcn.0042e110
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4754d0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 5
push 0
push 0
push str.http:__bbs.ithome.com_thread_438650_1_1.html
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x475b20
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + 0x2d9]
test ecx, ecx
jne 0x475b52
mov edx, dword [ebp - 4]
mov byte [edx + 0x2d9], 1
mov eax, dword [ebp - 4]
push eax
push 0
push 0x475b60
call fcn.0051af0d
add esp, 0xc
mov esp, ebp
pop ebp
ret 0xc

Function at 0x476b90
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 5
push 0
push 0
push 0x560ff0
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x476c30
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x28], ecx
push 0
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov ecx, dword [ebp + 8]
mov eax, dword [edx + 0x180]
call eax
push str.advanceset_time_checktip
mov ecx, dword [ebp - 0x28]
add ecx, 0x20
call fcn.004dd71b
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call fcn.00421da0
add esp, 4
test eax, eax
jne 0x476d8c
push 0
push ecx
mov ecx, esp
push str._checktime
call fcn.0041c8a0
push ecx
mov ecx, esp
push 0x55fb0c
push 0x591300
push ecx
call fcn.0041ca60
add esp, 0xc
call fcn.00422ca0
add esp, 0xc
test eax, eax
je 0x476ccf
push 0x368700
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov ecx, dword [ebp - 4]
mov edx, dword [eax + 0x54]
call edx
push str.ck_W_fTek
mov eax, dword [ebp - 4]
mov edx, dword [eax]
mov ecx, dword [ebp - 4]
mov eax, dword [edx + 0x3c]
call eax
jmp 0x476d8a
push str._checktime
lea ecx, [ebp - 0x14]
call fcn.0041c8a0
lea ecx, [ebp - 0x14]
push ecx
push 0x55fb0c
push 0x591300
lea edx, [ebp - 0x18]
push edx
call fcn.0041ca60
add esp, 0xc
push eax
call fcn.00421e20
add esp, 8
neg eax
sbb eax, eax
add eax, 1
mov byte [ebp - 0xd], al
lea ecx, [ebp - 0x18]
call fcn.0040f740
lea ecx, [ebp - 0x14]
call fcn.0040f740
movzx eax, byte [ebp - 0xd]
test eax, eax
je 0x476d66
cmp dword [ebp - 4], 0
je 0x476d64
push 0xff0000
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov ecx, dword [ebp - 4]
mov eax, dword [edx + 0x54]
call eax
push 0x55d794
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov ecx, dword [ebp - 4]
mov eax, dword [edx + 0x3c]
call eax
push 0
push 0x7d0
push 0x204
mov ecx, dword [ebp - 0x28]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_SetTimer]
jmp 0x476d8a
push 0x368700
mov eax, dword [ebp - 4]
mov edx, dword [eax]
mov ecx, dword [ebp - 4]
mov eax, dword [edx + 0x54]
call eax
push str.ck_W_fTek
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov ecx, dword [ebp - 4]
mov eax, dword [edx + 0x3c]
call eax
jmp 0x476de9
push 5
push 0
push str._checktime
push 0x55fb0c
push 0x591300
lea ecx, [ebp - 0x1c]
push ecx
call fcn.0041ca60
add esp, 0xc
mov ecx, eax
call fcn.0041cb20
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x1c]
call fcn.0040f740
push 0x368700
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov ecx, dword [ebp - 4]
mov edx, dword [eax + 0x54]
call edx
push str.ck_W_fTek
mov eax, dword [ebp - 4]
mov edx, dword [eax]
mov ecx, dword [ebp - 4]
mov eax, dword [edx + 0x3c]
call eax
push 0
push ecx
mov ecx, esp
push 0x554518
call fcn.0041c8a0
push ecx
mov ecx, esp
push 0x56104c
call fcn.0041c8a0
mov ecx, 0x591ad8
call fcn.0042ab10
mov esp, ebp
pop ebp
ret 0xc
Function at 0x47c790
Capabilities:
Create a process with modified i/o handles and window
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov dword [ebp - 0x68], ecx
mov dword [ebp - 0x60], 0x44
lea eax, [ebp - 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
xor ecx, ecx
mov word [ebp - 0x30], cx
mov dword [ebp - 0x34], 0x101
push str.shutdown.exe__l
lea ecx, [ebp - 4]
call fcn.0041c8a0
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x60]
push eax
push 0
push 0
push 0
push 1
push 0
push 0
lea ecx, [ebp - 4]
call fcn.0041cc20
push eax
lea ecx, [ebp - 4]
call fcn.0041d580
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x64], 0
lea ecx, [ebp - 4]
call fcn.0040f740
mov eax, dword [ebp - 0x64]
mov esp, ebp
pop ebp
ret

Function at 0x47c950
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov dword [ebp - 0x3c], ecx
push 1
lea ecx, [ebp - 0xc]
call fcn.0047ca70
lea ecx, [ebp - 0x28]
call fcn.0042e670
push 4
push 0x554518
push 0x554518
push ecx
mov ecx, esp
push str.system32_tsdiscon.exe
call fcn.0041c8a0
push ecx
push esp
lea ecx, [ebp - 0x28]
call fcn.0047c9e0
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x28]
call fcn.0042e910
mov ecx, eax
call fcn.0041cb20
push eax
push 0x554518
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x34]
call fcn.0040f740
mov dword [ebp - 0x38], 0
lea ecx, [ebp - 0x28]
call fcn.0042e690
lea ecx, [ebp - 0xc]
call fcn.0047cae0
mov eax, dword [ebp - 0x38]
mov esp, ebp
pop ebp
ret

Function at 0x47c9e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x58f860]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x218], ecx
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.00512af0
add esp, 0xc
push 0x104
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x214]
call fcn.0041c8a0
lea ecx, [ebp - 0x214]
push ecx
mov ecx, dword [ebp + 8]
call fcn.0041c880
lea ecx, [ebp - 0x214]
call fcn.0040f740
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00512610
mov esp, ebp
pop ebp
ret 4

Function at 0x47cb50
Capabilities:
Create a process with modified i/o handles and window
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov dword [ebp - 0x68], ecx
mov dword [ebp - 0x60], 0x44
lea eax, [ebp - 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
xor ecx, ecx
mov word [ebp - 0x30], cx
mov dword [ebp - 0x34], 0x101
push str.shutdown.exe__r__t_0
lea ecx, [ebp - 4]
call fcn.0041c8a0
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x60]
push eax
push 0
push 0
push 0
push 1
push 0
push 0
lea ecx, [ebp - 4]
call fcn.0041cc20
push eax
lea ecx, [ebp - 4]
call fcn.0041d580
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x64], 0
lea ecx, [ebp - 4]
call fcn.0040f740
mov eax, dword [ebp - 0x64]
mov esp, ebp
pop ebp
ret
Function at 0x47cbd0
Capabilities:
Create a process with modified i/o handles and window
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov dword [ebp - 0x68], ecx
mov dword [ebp - 0x60], 0x44
lea eax, [ebp - 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
xor ecx, ecx
mov word [ebp - 0x30], cx
mov dword [ebp - 0x34], 0x101
push str.shutdown.exe__s__t_0
lea ecx, [ebp - 4]
call fcn.0041c8a0
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x60]
push eax
push 0
push 0
push 0
push 1
push 0
push 0
lea ecx, [ebp - 4]
call fcn.0041cc20
push eax
lea ecx, [ebp - 4]
call fcn.0041d580
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x64], 0
lea ecx, [ebp - 4]
call fcn.0040f740
mov eax, dword [ebp - 0x64]
mov esp, ebp
pop ebp
ret