joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e2450
Capabilities:
Get file size
Read file on windows

Disassembly:
push ecx
mov eax, dword [eax]
test eax, eax
mov dword [esp], 0
je 0x4e24d8
push edi
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocStringLen
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x4e24d7
push esi
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esp + 8], eax
add eax, 1
push eax
call fcn.00548a37
mov esi, eax
add esp, 4
test esi, esi
je 0x4e24cf
mov edx, dword [esp + 8]
push 0
lea ecx, [esp + 0xc]
push ecx
push edx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4e24c6
mov eax, dword [esp + 8]
mov edx, esi
mov byte [esi + eax], 0
call fcn.00479660
push esi
call fcn.005649af
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop edi
xor eax, eax
pop ecx
ret
Function at 0x4e4470
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x596568
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebp
push esi
mov eax, dword [0x5eb3c0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x38]
lea eax, [esp + 0xc]
push eax
mov ecx, str.toolbarhidenotice
mov dword [ebp + 0x380], 0
call fcn.00481430
lea ecx, [esp + 0x38]
push ecx
mov ecx, str.SoftwareKingsoftKVip
mov dword [esp + 0x34], 0
call fcn.00481430
lea edx, [esp + 0x38]
push edx
lea eax, [esp + 0x18]
push eax
mov ecx, SysReAllocStringLen
mov byte [esp + 0x38], 1
call fcn.0047b9d0
push str.kybox
mov byte [esp + 0x34], 2
mov ecx, dword [0x5f8cb8]
push 0x5aeb8c
push ecx
push 0x5aebdc
mov esi, eax
call fcn.00479130
add esp, 8
mov esi, eax
call fcn.00479130
mov esi, eax
add esp, 8
test esi, esi
je 0x4e451e
mov eax, dword [esi + 0x10]
test eax, eax
jne 0x4e4526
mov dword [esi], 0xd
jmp 0x4e4547
mov ecx, dword [esp + 0xc]
push 4
lea edx, [esp + 0x14]
push edx
push 4
push 0
push ecx
push eax
mov dword [esp + 0x28], 1
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [esi], eax
mov byte [esp + 0x30], 1
mov eax, dword [esp + 0x24]
test eax, eax
je 0x4e4563
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x24], 0
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4e4583
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x30], 0
mov eax, dword [esp + 0x38]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4e45a8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x30], 0xffffffff
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4e45d0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp + 4]
push 0
push 0x2710
push 0x4e21
push ecx
call dword [sym.imp.USER32.dll_SetTimer]
push ebp
call fcn.004e4960
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
add esp, 0x28
ret 4

Function at 0x4e4660
Capabilities:
Hide graphical window

Disassembly:
cmp dword [esp + 4], 0x4e21
jne 0x4e4692
mov eax, dword [esi + 4]
push 0x4e21
push eax
call dword [sym.imp.USER32.dll_KillTimer]
mov ecx, dword [esi + 4]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [esi + 4]
mov dword [esp + 4], edx
jmp dword [sym.imp.USER32.dll_DestroyWindow]
ret 4

Function at 0x4e4ba0
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, eax
push 0
push 0x3e9
lea eax, [esi + 0x50]
push eax
mov dword [esi + 0x384], 0
call fcn.004b7fc0
call fcn.004e4bf0
mov ecx, dword [esi + 4]
push 0
push 0x64
push 0x4e21
push ecx
call dword [sym.imp.USER32.dll_SetTimer]
mov edx, dword [esi + 4]
push 5
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
ret
Function at 0x4e4c60
Capabilities:
Hide graphical window

Disassembly:
cmp dword [esp + 4], 0x4e21
jne 0x4e4cb9
add dword [esi + 0x384], 1
mov eax, dword [esi + 0x384]
cmp eax, 6
jge 0x4e4c94
push eax
push 0x3e9
lea eax, [esi + 0x50]
push eax
call fcn.004b7fc0
mov dword [esp + 4], esi
jmp fcn.004e4960
mov ecx, dword [esi + 4]
push 0x4e21
push ecx
call dword [sym.imp.USER32.dll_KillTimer]
mov edx, dword [esi + 4]
push 0
push edx
mov dword [esi + 0x384], 0
call dword [sym.imp.USER32.dll_ShowWindow]
ret 4
Function at 0x4e79f0
Capabilities:
Inspect load icon resource

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, eax
mov eax, dword [edi + 4]
push 0xfffffffffffffff0
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov ecx, eax
or ecx, 0x2000000
cmp eax, ecx
je 0x4e7a1b
push ecx
mov ecx, dword [edi + 4]
push 0xfffffffffffffff0
push ecx
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov esi, dword [sym.imp.USER32.dll_LoadIconW]
push 1
push 0x400000
call esi
mov edx, dword [edi + 4]
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push eax
push 1
push 0x80
push edx
call ebx
push 1
push 0x400000
call esi
push eax
mov eax, dword [edi + 4]
push 0
push 0x80
push eax
call ebx
push edi
call fcn.004eede0
push edi
call fcn.004f00d0
push edi
call fcn.004f0410
test eax, eax
je 0x4e7a7e
push 1
call fcn.004efc50
mov eax, 1
pop edi
pop esi
pop ebx
pop ecx
ret 4
mov dword [edi + 0x324], 0
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 4
Function at 0x4e7f10
Capabilities:
Hide graphical window

Disassembly:
push 0xffffffffffffffff
push 0x5962ad
mov eax, dword fs:[0]
push eax
sub esp, 0x3c8
push ebx
push esi
push edi
mov eax, dword [0x5eb3c0]
xor eax, esp
push eax
lea eax, [esp + 0x3d8]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [esp + 0x14]
push eax
call fcn.004f9840
mov dword [esp + 0x3e0], 0
call fcn.004e63c0
test eax, eax
je 0x4e7f6e
mov eax, dword [edi + 4]
lea ecx, [esp + 0x14]
push ecx
call fcn.004f96c0
cmp eax, 1
jne 0x4e7fc2
call fcn.004e6520
test eax, eax
je 0x4e7fab
call fcn.004f48b0
sub esp, 0x20
mov ebx, eax
mov esi, esp
mov dword [esp + 0x30], esp
mov eax, 0x4d1b70
push ebx
push eax
call fcn.0050a5f0
call fcn.004d1a60
mov eax, dword [edi + 4]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
lea ecx, [esp + 0x14]
push ecx
jmp 0x4e7fc7
call fcn.004e6c40
test eax, eax
je 0x4e7fbd
mov esi, edi
call fcn.004ef8a0
jmp 0x4e7fc2
call fcn.004e7ff0
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x3e4], 0xffffffff
call fcn.004f98d0
mov ecx, dword [esp + 0x3d8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x3d4
ret

Function at 0x4e7ff0
Capabilities:
Hide graphical window

Disassembly:
push ecx
mov eax, dword [edi + 4]
push ebx
push esi
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [edi + 0x2b48]
cmp dword [ecx - 0xc], 0
lea eax, [edi + 0x2b48]
je 0x4e801e
mov edx, dword [edi + 4]
push eax
push edx
call fcn.004f9af0
add esp, 8
mov esi, dword [edi + 4]
call fcn.00517020
call fcn.004e8080
call fcn.004f48b0
sub esp, 0x20
mov ebx, eax
mov esi, esp
mov dword [esp + 0x28], esp
mov eax, 0x4d1ba0
push ebx
push eax
call fcn.0050a5f0
call fcn.004d1a60
push 0
push 0
push 0
mov dword [edi + 0x338], 0
mov dword [edi + 0x334], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_PostThreadMessageW]
pop esi
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x4e8b50
Capabilities:
Hide graphical window

Disassembly:
push ecx
cmp eax, 0x1e8481
push ebx
push ebp
push esi
push edi
mov esi, ecx
jb 0x4e8c79
add eax, 0xffe17b7f
push eax
lea edi, [esi + 0x420]
push edi
call fcn.004cd9f0
push edi
call fcn.004ce5c0
test eax, eax
jne 0x4e8c35
lea ecx, [esi + 0x424]
call fcn.004cbf20
cmp dword [esi + 0x3b3c], 0
mov ebp, dword [sym.imp.USER32.dll_IsWindow]
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
je 0x4e8bff
lea edi, [esi + 0x24]
push 1
mov ecx, 0xc8
mov eax, edi
call fcn.004f3420
push 1
mov ecx, 0x321
mov eax, edi
call fcn.004f3420
push 0x4a
call fcn.004c6130
push 0x5ae504
push 0xdbba0
push edi
mov ecx, str.78__32__260__0
call fcn.004f3220
mov eax, dword [esi + 0xf4c]
test eax, eax
je 0x4e8bff
mov eax, dword [eax + 4]
push eax
call ebp
test eax, eax
je 0x4e8bff
mov ecx, dword [esi + 0xf4c]
mov edx, dword [ecx + 4]
push 0
push edx
call ebx
mov eax, dword [esi + 0x2090]
push eax
call ebp
test eax, eax
je 0x4e8c35
mov ecx, dword [esi + 0x2090]
push ecx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x4e8c35
mov edx, dword [esi + 0x2090]
push 0
push edx
call ebx
mov eax, dword [esi + 0x2090]
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
lea ebx, [esi + 0x424]
mov ecx, ebx
call fcn.004cbe60
push eax
mov edi, esi
call fcn.004ee110
mov ecx, ebx
call fcn.004cbe60
push eax
mov ecx, esi
call fcn.004e8c80
mov ecx, ebx
call fcn.004cbe60
test eax, eax
jg 0x4e8c79
call fcn.0046b3e0
mov ecx, eax
call fcn.00468ef0
mov edi, eax
mov eax, esi
call fcn.004e8920
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x4e91f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x597e38
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push edi
mov eax, dword [0x5eb3c0]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov eax, dword [0x5f7780]
mov edx, dword [eax + 0xc]
mov ecx, 0x5f7780
call edx
add eax, 0x10
mov dword [esp + 8], eax
lea eax, [esp + 0x14]
push eax
mov ecx, str.db_yxhz
mov dword [esp + 0x28], 0
call fcn.00481430
lea ecx, [esp + 0x10]
push ecx
mov ecx, str.hzsy_cqby
mov byte [esp + 0x28], 1
call fcn.00481430
lea edx, [esp + 0xc]
push edx
mov ecx, str.http:__ac.wan.liebao.cn_s_1_1239_2552.html_frmhzsy_cqby
mov byte [esp + 0x28], 2
call fcn.00481430
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], 3
call fcn.00479300
add esp, 0xc
lea edi, [esp + 8]
mov byte [esp + 0x24], 4
call fcn.00480f90
mov byte [esp + 0x24], 3
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4e92bc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x24], 2
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4e92e1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x24], 1
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4e9306
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x24], 0
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4e932b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x2c]
push ecx
lea ecx, [esp + 0xc]
call fcn.004e8390
mov dword [esp + 0x24], 0xffffffff
mov eax, dword [esp + 8]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4e9361
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
add esp, 0x20
ret 4
Function at 0x4e9a10
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x14
push ebx
push esi
push 0
call dword [sym.imp.USER32.dll_GetDC]
mov ebx, dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov esi, eax
push 0xa
push esi
call ebx
push 8
push esi
call ebx
mov eax, dword [edi + 4]
push esi
push eax
call dword [sym.imp.USER32.dll_ReleaseDC]
mov edx, dword [edi + 4]
lea ecx, [edi + 0x3b54]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetWindowRect]
lea esi, [esp + 8]
mov eax, edi
call fcn.004eeab0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push 0x44
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x10]
sub edx, ecx
push edx
push eax
mov eax, dword [edi + 4]
push ecx
push 0
push eax
mov dword [edi + 0x3b50], 1
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [edi + 0x1d0c]
push ecx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x4e9aaf
push 1
mov esi, edi
call fcn.004c6270
push 0
lea eax, [edi + 0x24]
mov ecx, 0x1f4
call fcn.004f3420
mov edx, dword [edi + 0x1d0c]
push 0
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
lea esi, [edi + 0x2f08]
call fcn.004dd720
mov eax, dword [edi + 4]
push 0xfffffffffffffff0
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov ecx, eax
and ecx, 0xfffbffff
cmp eax, ecx
je 0x4e9aee
push ecx
mov ecx, dword [edi + 4]
push 0xfffffffffffffff0
push ecx
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov edx, dword [edi + 4]
push edx
lea esi, [edi + 0x2b5c]
call fcn.0052ae90
pop esi
pop ebx
add esp, 0x14
ret

Function at 0x4e9b10
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, eax
mov dword [esi + 0x3b50], 0
mov eax, dword [esi + 4]
push 0xfffffffffffffff0
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov ecx, eax
or ecx, 0x40000
cmp eax, ecx
je 0x4e9b42
push ecx
mov ecx, dword [esi + 4]
push 0xfffffffffffffff0
push ecx
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov eax, dword [esi + 0x3b58]
mov edx, dword [esi + 0x3b60]
mov ecx, dword [esi + 0x3b54]
push 0x44
sub edx, eax
push edx
mov edx, dword [esi + 0x3b5c]
sub edx, ecx
push edx
push eax
mov eax, dword [esi + 4]
push ecx
push 0
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
cmp dword [esi + 0x3b4c], 0
je 0x4e9ba0
push 0x23
call fcn.004c6270
push 1
lea eax, [esi + 0x24]
mov ecx, 0x1f4
call fcn.004f3420
mov ecx, dword [esi + 0x1d0c]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
ret
push 1
call fcn.004c6270
push 0
lea eax, [esi + 0x24]
mov ecx, 0x1f4
call fcn.004f3420
add esi, 0x1d08
call fcn.004e3d10
mov edx, dword [esi + 4]
push 5
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
ret
Function at 0x4e9ea0
Capabilities:
Hide graphical window
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x593b88
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5eb3c0]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x44]
cmp dword [ebp + 0x3b3c], 0
jne 0x4e9f48
push 0x133
lea edi, [ebp + 0xf00]
push edi
mov esi, 0x4ea9e0
xor ebx, ebx
call fcn.004ff840
push ebx
push esi
push 0x133
mov ebx, 0xa
call fcn.004ff7e0
mov eax, dword [ebp + 0x2090]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4e9f3b
mov ecx, dword [ebp + 0x2090]
push ecx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x4e9f3b
mov edx, dword [ebp + 0x2090]
push 0
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp + 0x2090]
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov ebx, 1
mov dword [ebp + 0x3b3c], ebx
jmp 0x4e9f8f
push 1
lea eax, [ebp + 0x24]
mov ecx, 0xc8
call fcn.004f3420
push 0x132
lea edi, [ebp + 0xf00]
push edi
mov esi, 0x4ea860
xor ebx, ebx
call fcn.004ff840
push ebx
push esi
push 0x132
mov ebx, 0xa
call fcn.004ff7e0
mov dword [ebp + 0x3b3c], 0
mov ebx, 1
lea ecx, [esp + 0x18]
push ecx
mov ecx, str.hidetoolbar
call fcn.00481430
lea edx, [esp + 0x44]
xor edi, edi
push edx
mov ecx, str.SoftwareKingsoftKVip
mov dword [esp + 0x40], edi
call fcn.00481430
lea eax, [esp + 0x44]
push eax
lea ecx, [esp + 0x24]
push ecx
mov ecx, SysReAllocStringLen
mov byte [esp + 0x44], bl
call fcn.0047b9d0
push str.kybox
mov byte [esp + 0x40], 2
mov edx, dword [0x5f8cb8]
mov ebp, dword [ebp + 0x3b3c]
push 0x5aeb8c
push edx
push 0x5aebdc
mov esi, eax
call fcn.00479130
add esp, 8
mov esi, eax
call fcn.00479130
mov esi, eax
add esp, 8
cmp esi, edi
je 0x4ea00d
mov eax, dword [esi + 0x10]
cmp eax, edi
jne 0x4ea015
mov dword [esi], 0xd
jmp 0x4ea031
mov edx, dword [esp + 0x18]
push 4
lea ecx, [esp + 0x20]
push ecx
push 4
push edi
push edx
push eax
mov dword [esp + 0x34], ebp
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [esi], eax
mov byte [esp + 0x3c], bl
mov eax, dword [esp + 0x30]
cmp eax, edi
je 0x4ea048
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x30], edi
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4ea068
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x3c], 0
mov eax, dword [esp + 0x44]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4ea08d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x3c], 0xffffffff
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4ea0b5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 4
Function at 0x4ea540
Capabilities:
Hide graphical window

Disassembly:
push esi
push 0x130
lea esi, [edi + 0xf00]
push esi
call fcn.004ff840
push 0x131
push esi
call fcn.004ff840
push 1
mov esi, edi
call fcn.004c6270
push 0
lea eax, [edi + 0x24]
mov ecx, 0x1f4
call fcn.004f3420
lea esi, [edi + 0x1d08]
call fcn.004e3d10
mov eax, dword [esi + 4]
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
lea esi, [edi + 0x2f08]
call fcn.004dd720
pop esi
ret

Function at 0x4eab70
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x58d908
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
mov eax, dword [0x5eb3c0]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov eax, dword [esp + 0x34]
test edi, edi
push 3
push 0
push 0
push 0
push 0
je 0x4eabae
mov eax, dword [eax + 4]
push 0xffffffffffffffff
push eax
jmp 0x4eabb4
mov ecx, dword [eax + 4]
push 0xfffffffffffffffe
push ecx
call dword [sym.imp.USER32.dll_SetWindowPos]
lea edx, [esp + 8]
push edx
mov ecx, str.topmost
call fcn.00481430
lea eax, [esp + 0x34]
push eax
mov ecx, str.SoftwareKingsoftKVip
mov dword [esp + 0x30], 0
call fcn.00481430
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x14]
push edx
mov ecx, SysReAllocStringLen
mov byte [esp + 0x34], 1
call fcn.0047b9d0
push str.kybox
mov byte [esp + 0x30], 2
mov ecx, dword [0x5f8cb8]
push 0x5aeb8c
push ecx
push 0x5aebdc
mov esi, eax
call fcn.00479130
add esp, 8
mov esi, eax
call fcn.00479130
mov esi, eax
add esp, 8
test esi, esi
je 0x4eac35
mov eax, dword [esi + 0x10]
test eax, eax
jne 0x4eac3d
mov dword [esi], 0xd
jmp 0x4eac5a
mov ecx, dword [esp + 8]
push 4
lea edx, [esp + 0x10]
push edx
push 4
push 0
push ecx
push eax
mov dword [esp + 0x24], edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [esi], eax
mov byte [esp + 0x2c], 1
mov eax, dword [esp + 0x20]
test eax, eax
je 0x4eac76
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x20], 0
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4eac96
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x2c], 0
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4eacbb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x2c], 0xffffffff
mov eax, dword [esp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4eace3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x28
ret 4
Function at 0x4eb140
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, eax
mov eax, dword [esi + 0x2b4c]
cmp eax, dword [esp + 8]
push edi
jne 0x4eb1d8
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x4eb187
mov edx, dword [esi + 4]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 2
push edx
call edi
mov eax, dword [esi + 4]
push 0
push eax
call edi
mov esi, dword [esi + 4]
call fcn.00517020
xor eax, eax
pop edi
pop esi
ret 4
mov ecx, dword [esi + 4]
push 9
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.004ef8a0
cmp dword [esi + 0x3b50], 1
jne 0x4eb1c6
mov edx, dword [esi + 4]
push 0xfffffffffffffff0
push edx
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov ecx, eax
and ecx, 0xfffbffff
cmp eax, ecx
je 0x4eb1c6
mov eax, dword [esi + 4]
push ecx
push 0xfffffffffffffff0
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 1
push esi
call fcn.004ece30
pop edi
xor eax, eax
pop esi
ret 4
Function at 0x4ef9b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5939e0
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebp
push edi
mov eax, dword [0x5eb3c0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
lea eax, [esp + 0x14]
push eax
mov ecx, 0x5adcfc
call fcn.00481430
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x30], 0
call fcn.0047a2f0
add esp, 8
mov byte [esp + 0x28], 2
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
or ebp, 0xffffffff
lea ecx, [eax + 0xc]
mov edx, ebp
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4efa25
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x10]
cmp dword [eax - 0xc], 0
je 0x4efa63
mov dword [esp + 0x28], ebp
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], ebp
dec ebp
test ebp, ebp
jg 0x4efa4c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
add esp, 0x20
ret
mov ecx, dword [esi + 4]
push ecx
lea edi, [esi + 0xf14]
call fcn.00516c30
lea edx, [esp + 0x18]
push edx
mov ecx, 0x5adcfc
call fcn.00481430
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x20]
push ecx
mov byte [esp + 0x30], 3
call fcn.0047a2f0
add esp, 8
lea edi, [esp + 0x10]
mov byte [esp + 0x28], 4
call fcn.00480f90
mov byte [esp + 0x28], 3
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
mov ecx, ebp
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4efaca
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x28], 2
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov edx, ebp
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4efaee
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x10]
cmp dword [eax - 0xc], 0
je 0x4efb1f
mov edx, dword [esi + 0x404]
mov eax, dword [edx]
lea ecx, [esi + 0x404]
mov dword [esi + 0x2b54], 0
call eax
mov dword [esp + 0x28], ebp
mov eax, dword [esp + 0x10]
jmp 0x4efa33
add eax, 0xfffffff0
mov dword [esp + 0x28], ebp
lea ecx, [eax + 0xc]
lock xadd dword [ecx], ebp
dec ebp
test ebp, ebp
jg 0x4efb3c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
add esp, 0x20
ret

Function at 0x4efe70
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esi + 4]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0
push 0
mov dword [esi + 0x338], 0
mov dword [esi + 0x334], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_PostThreadMessageW]
xor eax, eax
ret