joyce8/EMBER2024-capa huggingface dataset:
Function at 0x448b00
Capabilities:
Get local ipv4 addresses
Get mac address on windows
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x56edfa
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
mov eax, dword [0x5d7050]
xor eax, esp
mov dword [esp + 0x78], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5d7050]
xor eax, esp
push eax
lea eax, [esp + 0x90]
mov dword fs:[0], eax
mov ebp, dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov esi, ecx
mov edi, dword [esi + 8]
cmp dword [esi + 4], edi
jbe 0x448b47
call ebp
mov ebx, dword [esi + 4]
cmp ebx, dword [esi + 8]
jbe 0x448b51
call ebp
push edi
push esi
push ebx
push esi
lea eax, [esp + 0x2c]
push eax
push esi
call fcn.00449280
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x178
push 0
mov dword [esp + 0x20], 0x178
call ebp
mov edi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
call edi
lea ecx, [esp + 0x18]
push ecx
mov ebx, eax
push ebx
push 0
push 0x10
push 2
call sub.iphlpapi.dll_GetAdaptersAddresses
cmp eax, 0x6f
jne 0x448bb2
push ebx
push 0
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edx, dword [esp + 0x18]
push edx
push 0
call ebp
push eax
call edi
mov ebx, eax
test ebx, ebx
je 0x448c67
lea eax, [esp + 0x18]
push eax
push ebx
push 0
push 0x10
push 2
call sub.iphlpapi.dll_GetAdaptersAddresses
test eax, eax
jne 0x448c67
mov edi, ebx
cmp dword [edi + 0x40], 0x18
je 0x448c5c
lea ecx, [esp + 0x24]
push ecx
call fcn.004486a0
mov dword [esp + 0x98], 0
mov edx, dword [edi + 0xc]
push edx
lea ecx, [esp + 0x54]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_char_const__]
mov eax, dword [edi + 0x24]
push eax
lea ecx, [esp + 0x38]
call dword [0x582408]
mov ecx, dword [edi + 0x28]
push ecx
lea ecx, [esp + 0x70]
call dword [0x582408]
mov eax, dword [edi + 0x3c]
mov edx, dword [edi + 4]
mov ecx, dword [edi + 0xa8]
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], edx
mov edx, dword [edi + 0x40]
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], edx
call fcn.00448fc0
lea ecx, [esp + 0x24]
push ecx
mov dword [esp + 0x9c], 0xffffffff
call fcn.00448100
mov edi, dword [edi + 8]
test edi, edi
jne 0x448bd5
push ebx
push 0
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
mov ecx, dword [esp + 0x90]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x78]
xor ecx, esp
call fcn.00569ed6
add esp, 0x88
ret
Function at 0x44b180
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x14
mov eax, dword [esp + 0x24]
push ebx
mov ebx, dword [esp + 0x24]
push ebp
mov ebp, dword [esp + 0x20]
sub eax, dword [ebp + 0x18]
sub ebx, dword [ebp + 0x14]
mov edx, dword [ebp]
push esi
push edi
push 1
push eax
xor esi, esi
mov dword [esp + 0x3c], eax
mov eax, dword [edx + 0x6c]
push ebx
mov ecx, ebp
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x20], esi
mov dword [esp + 0x34], esi
mov dword [esp + 0x1c], esi
call eax
mov edi, dword [ebp + 0xe0]
cmp edi, esi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], edi
je 0x44b30a
call fcn.0046bdd0
mov esi, eax
test esi, esi
je 0x44b2be
mov ecx, dword [esi + 0x10]
mov edx, dword [esi]
mov eax, dword [edx + 0x28]
push 2
mov dword [esp + 0x18], ecx
push 0
mov ecx, esi
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0x34]
mov ecx, esi
call eax
test eax, eax
je 0x44b20f
lea ebx, [esi + 0x14]
call fcn.0045f250
mov ebx, dword [esp + 0x30]
movzx edi, word [esp + 0x34]
mov edx, dword [esi]
mov edx, dword [edx + 0x4c]
xor eax, eax
movzx ecx, bx
mov dword [esp + 0x18], eax
mov dword [esi + 0xa4], eax
lea eax, [esp + 0x18]
push eax
shl edi, 0x10
or edi, ecx
mov ecx, dword [esp + 0x30]
push edi
push ecx
push 0x202
push 0
mov ecx, esi
call edx
mov eax, dword [esp + 0x1c]
cmp dword [ebp + 0xe0], eax
jne 0x44b282
mov eax, dword [esi + 0x40]
test eax, eax
je 0x44b272
cmp word [eax], 0
je 0x44b272
push 1
push 0
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x44b2be
cmp dword [esi + 0x10], 0
je 0x44b2be
mov dword [esp + 0x28], 1
jmp 0x44b2be
mov edx, dword [esi]
mov eax, dword [edx + 0x28]
push 1
push 0
mov ecx, esi
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0x34]
mov ecx, esi
call eax
test eax, eax
je 0x44b2a4
lea ebx, [esi + 0x14]
call fcn.0045f250
mov ecx, dword [esp + 0x2c]
push edi
push ecx
push 0x2a3
mov ecx, esi
call fcn.0046c070
mov dword [esp + 0x10], 1
xor eax, eax
cmp dword [esp + 0x28], eax
mov dword [ebp + 0xe0], eax
je 0x44b2e1
mov ebx, esi
push 0x67
mov esi, ebp
call fcn.0044acc0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0x10
cmp dword [esp + 0x10], eax
je 0x44b30a
cmp dword [esp + 0x14], eax
je 0x44b30a
mov edx, dword [esp + 0x20]
cmp edx, dword [ebp + 0xdc]
jne 0x44b2ff
mov dword [ebp + 0xdc], eax
mov ebx, esi
push 0x6a
mov esi, ebp
call fcn.0044acc0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0x10
Function at 0x44d470
Capabilities:
Print debug messages

Disassembly:
push 0xffffffffffffffff
push 0x574b28
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push edi
mov eax, dword [0x5d7050]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
lea eax, [esp + 0xc]
push eax
call fcn.0040ff50
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx edx, word [esp + 0x1e]
movzx eax, word [esp + 0x1c]
movzx ecx, word [esp + 0x1a]
push edx
movzx edx, word [esp + 0x1c]
push eax
push ecx
push edx
push str.__02d__02d__02d__03d__n
lea edi, [esp + 0x20]
call fcn.00410c20
mov eax, dword [esp + 0x20]
add esp, 0x14
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [esp + 0x28], 0xffffffff
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x44d50d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
add esp, 0x24
ret

Function at 0x44ece0
Capabilities:
Check os version

Disassembly:
sub esp, 0x120
mov eax, dword [0x5d7050]
xor eax, esp
mov dword [esp + 0x11c], eax
push esi
push edi
push 0x11c
xor esi, esi
lea eax, [esp + 0xc]
push esi
push eax
call sub.MSVCR80.dll_memset
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
add esp, 0xc
lea ecx, [esp + 8]
push ecx
mov dword [esp + 0xc], 0x11c
call edi
test eax, eax
jne 0x44ed3b
lea edx, [esp + 8]
push edx
mov dword [esp + 0xc], 0x114
call edi
test eax, eax
je 0x44edec
mov eax, dword [esp + 0x18]
mov ecx, 1
sub eax, ecx
je 0x44edd9
sub eax, ecx
je 0x44ed57
xor esi, esi
jmp 0x44edec
mov eax, dword [esp + 0xc]
cmp eax, 6
jne 0x44ed93
mov eax, dword [esp + 0x10]
cmp eax, ecx
jne 0x44ed7b
xor eax, eax
cmp byte [esp + 0x122], cl
setne al
add eax, 8
mov esi, eax
jmp 0x44edec
test eax, eax
jne 0x44edc6
xor edx, edx
cmp byte [esp + 0x122], cl
setne dl
lea edx, [edx + edx + 7]
mov esi, edx
jmp 0x44edec
cmp eax, 5
jne 0x44edba
mov eax, dword [esp + 0x10]
cmp eax, 2
jne 0x44eda6
lea esi, [eax + 3]
jmp 0x44edec
cmp eax, ecx
jne 0x44edb1
mov esi, 6
jmp 0x44edec
test eax, eax
jne 0x44edec
lea esi, [eax + 3]
jmp 0x44edec
cmp eax, 4
ja 0x44edec
mov esi, 4
jmp 0x44edec
cmp eax, 2
jne 0x44edec
cmp byte [esp + 0x122], cl
jne 0x44edec
lea esi, [eax + 8]
jmp 0x44edec
mov eax, dword [esp + 0x14]
and eax, 0xffff0000
cmp eax, 0x45a0000
sbb esi, esi
add esi, 2
mov ecx, dword [esp + 0x124]
pop edi
mov eax, esi
pop esi
xor ecx, esp
call fcn.00569ed6
add esp, 0x120
ret
Function at 0x44f610
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
call fcn.0049e940
call fcn.00456410
add eax, 0x90
push eax
mov ecx, 0x591ae8
call fcn.004133e0
add esp, 4
test al, al
jne 0x44f668
call fcn.00456410
add eax, 0x90
push eax
mov ecx, str.Microsoft_YaHei
call fcn.004133e0
add esp, 4
test al, al
jne 0x44f668
push 0x591f2c
push 0x12e
lea eax, [ebx + 0x24]
push eax
mov ecx, str.110_52__0_66
call fcn.0044fd30
mov ecx, dword [ebx + 4]
push 3
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push ecx
call dword [sym.imp.USER32.dll_SetWindowPos]
mov edx, dword [ebx + 4]
push 5
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebx
ret

Function at 0x451360
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword [ebx + 0x28]
mov edx, dword [eax + 0x30]
sub esp, 0x18
push ebp
mov ebp, dword [esp + 0x28]
push esi
mov esi, dword [esp + 0x28]
push edi
push 1
lea ecx, [ebx + 0x28]
push ebp
push esi
call edx
mov edi, eax
test edi, edi
jne 0x4513b5
mov eax, dword [ebx + 0xf4]
mov edx, dword [eax + 0x30]
push 1
lea ecx, [ebx + 0xf4]
push ebp
push esi
call edx
mov edi, eax
test edi, edi
jne 0x4513b5
mov eax, dword [ebx + 0x1c0]
mov edx, dword [eax + 0x30]
push 1
lea ecx, [ebx + 0x1c0]
push ebp
push esi
call edx
mov edi, eax
cmp dword [ebx + 0x2a8], 0
je 0x451455
cmp dword [ebx + 0x2b4], 0
je 0x4513db
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov dword [ebx + 0x2b4], 0
cmp dword [ebx + 0x2a8], edi
jne 0x45144b
call fcn.0046bdd0
movzx edi, word [esp + 0x2c]
lea ecx, [esp + 0xc]
push ecx
movzx ecx, bp
shl ecx, 0x10
or ecx, edi
push ecx
mov ecx, dword [esp + 0x30]
mov esi, eax
mov edx, dword [esi]
mov edx, dword [edx + 0x4c]
push ecx
xor eax, eax
push 0x205
push eax
mov ecx, esi
mov dword [esp + 0x20], eax
mov dword [esi + 0xa4], eax
call edx
mov eax, dword [ebx + 4]
lea edx, [esp + 0x10]
push edx
push 0xffffffffffffffff
mov dword [esp + 0x20], 0xd
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], 0xffffffff
mov ecx, dword [esi + 0x10]
push 0x4e
push eax
mov dword [esp + 0x2c], ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebx + 0x2a8], 0
pop edi
pop esi
pop ebp
add esp, 0x18
ret 0xc
Function at 0x455c70
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
cmp byte [ebx + 0xd], 0
je 0x455cc8
and byte [ebx + 0x14], 1
push 0xfffffffffffffff0
push esi
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x10000000
je 0x455ca1
or byte [ebx + 0x14], 4
test eax, 0x20000000
mov cl, byte [ebx + 0x14]
jne 0x455ca1
or cl, 2
mov byte [ebx + 0x14], cl
test byte [ebx + 0x14], 2
je 0x455cbc
mov ecx, esi
call fcn.00455cd0
mov eax, dword [ebx + 8]
push 8
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebx
ret
mov ecx, dword [ebx + 8]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebx
ret

Function at 0x456a80
Capabilities:
Hide graphical window

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
cmp byte [ebx + 0xd], 0
push ebp
push esi
push edi
mov ebp, 1
je 0x456bcd
cmp eax, 0xf
ja 0x456b41
je 0x456b1a
sub eax, 2
je 0x456ae9
sub eax, ebp
je 0x456ace
sub eax, 2
jne 0x456b52
mov eax, dword [esp + 0x1c]
push eax
push edx
mov edi, ecx
mov esi, ebx
call fcn.00456c40
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
cmp byte [ebx + 0xc], 0
jne 0x456bcd
mov esi, ebx
call fcn.00456be0
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
mov ecx, dword [ebx + 8]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [ebx + 8]
push edx
call dword [sym.imp.USER32.dll_DestroyWindow]
or eax, 0xffffffff
mov dword [ebx + 8], eax
mov dword [ebx + 4], eax
mov byte [ebx + 0xd], 0
mov byte [ebx + 0xc], 0
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
cmp byte [ebx + 0xc], 0
jne 0x456bcd
cmp byte [ebx + 0x1c], 0
je 0x456bcd
call fcn.00455cd0
mov byte [ebx + 0x1c], 0
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
sub eax, 0x18
je 0x456bb4
sub eax, 0x1fe
je 0x456b90
sub eax, 0x1c
je 0x456b5e
xor ebp, ebp
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
cmp byte [ebx + 0xc], 0
je 0x456b7b
mov esi, ecx
mov eax, ebx
call fcn.00455c70
mov byte [ebx + 0xc], 0
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
test byte [ebx + 0x14], 2
je 0x456bcd
call fcn.00455cd0
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
cmp byte [ebx + 0xc], 0
jne 0x456bcd
mov eax, dword [ebx + 8]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
and byte [ebx + 0x14], 0xfd
mov byte [ebx + 0xc], 1
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
test byte [ebx + 0x14], 1
je 0x456bcd
test edx, edx
jne 0x456bcd
mov ecx, dword [ebx + 8]
push edx
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
and byte [ebx + 0x14], 0xf9
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
pop ecx
ret 8
Function at 0x456be0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x14
test byte [esi + 0x14], 2
je 0x456c3a
lea eax, [esp]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 4]
sub edx, eax
je 0x456c2a
mov edx, dword [esp + 8]
mov ecx, dword [esp]
sub edx, ecx
je 0x456c2a
mov edx, dword [esi + 0x10]
push 0x11
push 0
push 0
sub eax, edx
push eax
mov eax, dword [esi + 8]
sub ecx, edx
push ecx
push 0
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
add esp, 0x14
ret
mov ecx, dword [esi + 8]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
and byte [esi + 0x14], 0xfd
add esp, 0x14
ret

Function at 0x456c40
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x14
push ebx
mov ebx, 1
cmp dword [esp + 0x1c], ebx
push ebp
mov ebp, dword [esp + 0x24]
jne 0x456c6f
mov eax, dword [esi + 8]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
and byte [esi + 0x14], 0xfd
mov dword [esi + 0x18], ebp
pop ebp
pop ebx
add esp, 0x14
ret 8
lea ecx, [esp + 8]
push ecx
push edi
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [esp + 0x14]
sub edx, dword [esp + 0xc]
je 0x456ce2
mov eax, dword [esp + 0x10]
sub eax, dword [esp + 8]
je 0x456ce2
push 0xfffffffffffffff0
push edi
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x10000000
je 0x456cd7
or byte [esi + 0x14], 4
mov al, byte [esi + 0x14]
test al, 2
jne 0x456ccf
or al, 2
mov ecx, edi
mov ebx, esi
mov byte [esi + 0x14], al
call fcn.00455cd0
mov ecx, dword [esi + 8]
push 8
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [esi + 0x18], ebp
pop ebp
pop ebx
add esp, 0x14
ret 8
cmp dword [esi + 0x18], ebp
je 0x456cd7
mov byte [esi + 0x1c], bl
mov dword [esi + 0x18], ebp
pop ebp
pop ebx
add esp, 0x14
ret 8
mov edx, dword [esi + 8]
push 0
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
and byte [esi + 0x14], 0xfd
pop ebp
pop ebx
add esp, 0x14
ret 8
Function at 0x460400
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x574dd0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5d7050]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov eax, dword [0x5e736c]
mov edx, dword [eax + 0xc]
mov ecx, 0x5e736c
call edx
lea ebx, [eax + 0x10]
mov dword [esp + 0x14], ebx
mov eax, dword [esp + 0x34]
xor ebp, ebp
push 0x50
push ebp
push eax
mov dword [esp + 0x34], ebp
call sub.MSVCR80.dll_memset
mov ecx, dword [esp + 0x3c]
add esp, 0xc
add ecx, 0xd4
mov dword [esp + 0x18], ebp
mov dword [esp + 0x30], ecx
mov eax, dword [esp + 0x30]
lea edx, [esp + 0x1c]
push edx
push eax
lea edi, [esp + 0x20]
call fcn.00460560
mov byte [esp + 0x28], 1
mov ecx, dword [eax]
lea eax, [ecx - 0x10]
lea esi, [ebx - 0x10]
cmp eax, esi
je 0x4604cf
cmp dword [esi + 0xc], 0
lea edi, [esi + 0xc]
jl 0x4604be
mov edx, dword [eax]
cmp edx, dword [esi]
jne 0x4604be
call fcn.00410660
mov ebx, eax
or eax, 0xffffffff
lock xadd dword [edi], eax
dec eax
test eax, eax
jg 0x4604b5
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
add ebx, 0x10
mov dword [esp + 0x14], ebx
jmp 0x4604cf
mov ebx, dword [ecx - 0xc]
push ecx
lea eax, [esp + 0x18]
call fcn.00410570
mov ebx, dword [esp + 0x14]
mov byte [esp + 0x28], 0
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4604f4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp dword [ebx - 0xc], 0
je 0x460513
cmp ebp, 0x14
jae 0x46051e
push ebx
call dword [sym.imp.MSVCR80.dll__wtoi]
mov ecx, dword [esp + 0x38]
add esp, 4
mov dword [ecx + ebp*4], eax
add ebp, 1
cmp dword [esp + 0x18], 0
jg 0x460465
lea eax, [ebx - 0x10]
mov dword [esp + 0x28], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x460542
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 8
Function at 0x46a910
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x572158
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x5d7050]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x20]
xor esi, esi
mov dword [esp + 0x18], esi
mov dword [ebx], vtable.CBkWindow.0
call fcn.0046aa20
mov dword [ebx + 4], eax
mov dword [ebx + 8], esi
mov dword [ebx + 0xc], esi
mov dword [ebx + 0x10], esi
lea edi, [ebx + 0x14]
mov dword [edi], esi
mov dword [edi + 4], esi
mov dword [edi + 8], esi
mov dword [edi + 0xc], esi
mov dword [ebx + 0x24], esi
mov eax, dword [0x5e736c]
mov edx, dword [eax + 0xc]
mov ecx, 0x5e736c
call edx
add eax, 0x10
mov dword [ebx + 0x28], eax
mov dword [ebx + 0x2c], esi
mov dword [ebx + 0x30], esi
mov dword [ebx + 0x34], esi
mov dword [ebx + 0x38], esi
mov dword [ebx + 0x3c], esi
mov eax, dword [0x5e736c]
mov edx, dword [eax + 0xc]
mov ecx, 0x5e736c
call edx
add eax, 0x10
mov dword [ebx + 0x40], eax
mov dword [ebx + 0x44], esi
mov eax, dword [0x5e736c]
mov edx, dword [eax + 0xc]
mov ecx, 0x5e736c
call edx
add eax, 0x10
mov dword [ebx + 0x48], eax
mov eax, dword [0x5e736c]
mov edx, dword [eax + 0xc]
mov ecx, 0x5e736c
call edx
add eax, 0x10
mov dword [ebx + 0x4c], eax
or eax, 0xffffffff
push edi
mov dword [ebx + 0x50], eax
mov dword [ebx + 0x54], eax
mov dword [ebx + 0x58], esi
mov dword [ebx + 0x5c], esi
mov dword [ebx + 0x60], eax
mov dword [ebx + 0x64], esi
mov dword [ebx + 0x9c], esi
mov dword [ebx + 0xa0], esi
mov dword [ebx + 0xa4], esi
mov dword [ebx + 0xa8], esi
call dword [sym.imp.USER32.dll_SetRectEmpty]
mov eax, ebx
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 4
Function at 0x46c150
Capabilities:
Hide graphical window
Shutdown system

Disassembly:
push ebx
push esi
push edi
mov edi, eax
mov eax, dword [ecx + 8]
cmp eax, 1
jne 0x46c300
mov ecx, dword [ecx + 0xc]
cmp ecx, 0x64
jne 0x46c179
mov esi, edi
call fcn.0046d5e0
mov eax, 1
pop edi
pop esi
pop ebx
ret
cmp ecx, 0x157c
jne 0x46c1a5
mov eax, dword [edi + 4]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
lea eax, [edi + 0x24]
mov ecx, 0x1518
call fcn.0046ebd0
mov eax, 1
pop edi
pop esi
pop ebx
ret
cmp ecx, 0x6a4
jne 0x46c1bb
call fcn.0046d650
mov eax, 1
pop edi
pop esi
pop ebx
ret
cmp ecx, 0x640
jne 0x46c1dd
mov ebx, 1
mov eax, edi
call fcn.0046ca70
push 2
push edi
call fcn.0046e450
mov eax, ebx
pop edi
pop esi
pop ebx
ret
cmp ecx, 0x9c4
jne 0x46c1f5
mov ebx, edi
call fcn.0046d750
mov eax, 1
pop edi
pop esi
pop ebx
ret
cmp ecx, 0xa28
jne 0x46c20d
mov ebx, edi
call fcn.0046d7e0
mov eax, 1
pop edi
pop esi
pop ebx
ret
cmp ecx, 0xa8c
jne 0x46c225
mov ebx, edi
call fcn.0046d870
mov eax, 1
pop edi
pop esi
pop ebx
ret
cmp ecx, 0xaf0
jne 0x46c23d
mov ebx, edi
call fcn.0046d900
mov eax, 1
pop edi
pop esi
pop ebx
ret
cmp ecx, 0xc80
jne 0x46c255
mov esi, edi
call fcn.0046d6b0
mov eax, 1
pop edi
pop esi
pop ebx
ret
cmp ecx, 0xce4
jne 0x46c279
mov esi, str.http:__bbs.liebao.cn_thread_300474_1_1.html
call fcn.0051d060
push 2
mov ecx, edi
call fcn.0046e600
mov eax, 1
pop edi
pop esi
pop ebx
ret
cmp ecx, 0x11c6
jb 0x46c299
cmp ecx, 0x122a
ja 0x46c299
mov eax, edi
call fcn.0046d990
mov eax, 1
pop edi
pop esi
pop ebx
ret
cmp ecx, 0x1324
jne 0x46c2b1
mov ecx, edi
call fcn.0046d9e0
mov eax, 1
pop edi
pop esi
pop ebx
ret
cmp ecx, 0x1388
je 0x46c1ad
cmp ecx, 0x1af4
je 0x46c169
cmp ecx, 0x1b58
jne 0x46c300
push 4
push edi
call fcn.0046e750
push 1
mov ecx, str.repair_reset
call fcn.0046ffc0
add esp, 4
call fcn.00415a70
push 0
push 6
call dword [sym.imp.USER32.dll_ExitWindowsEx]
mov eax, 1
pop edi
pop esi
pop ebx
ret
mov dword [edi + 0x370], 0
pop edi
pop esi
xor eax, eax
pop ebx
ret

Function at 0x46c930
Capabilities:
Hide graphical window

Disassembly:
push ecx
push ebx
push edi
mov ebx, eax
mov eax, dword [esi + 4]
lea edi, [esi + 4]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
cmp eax, 1
jne 0x46c960
mov ecx, dword [edi]
push 0
push 0xf120
push 0x112
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop ebx
pop ecx
ret
cmp ebx, 1
mov dword [esi + 0x3b0], ebx
jne 0x46c986
mov eax, dword [esi + 0x374]
cmp eax, 5
je 0x46c97a
test eax, eax
jne 0x46c9aa
mov dword [esi + 0x374], 1
jmp 0x46c9aa
cmp ebx, 2
je 0x46c9a0
cmp ebx, 3
jne 0x46c9aa
mov eax, dword [esi + 0x374]
cmp eax, 5
je 0x46c9a0
cmp eax, 1
jne 0x46c9aa
mov dword [esi + 0x374], 0
mov ebx, dword [esi + 0x374]
mov eax, esi
call fcn.0046ca70
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push edi
call fcn.00456dc0
mov edx, dword [edi]
push 5
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [edi]
push 0
push 0
push 0xf
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [edi]
push 3
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push ecx
call dword [sym.imp.USER32.dll_SetWindowPos]
pop edi
pop ebx
pop ecx
ret
Function at 0x46d5e0
Capabilities:
Hide graphical window

Disassembly:
push ecx
cmp dword [esi + 0x3b0], 2
jne 0x46d604
cmp dword [esi + 0x374], 0
je 0x46d604
push 1
lea eax, [esi + 0x24]
mov ecx, 0x1518
call fcn.0046ebd0
jmp 0x46d610
mov eax, dword [esi + 4]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 0x374]
test eax, eax
jne 0x46d624
push 3
push esi
call fcn.0046e450
pop ecx
ret
cmp eax, 1
jne 0x46d634
push 3
mov ecx, esi
call fcn.0046e600
pop ecx
ret
cmp eax, 5
je 0x46d63e
cmp eax, 4
jne 0x46d646
push 3
push esi
call fcn.0046e750
pop ecx
ret

Function at 0x46d650
Capabilities:
Hide graphical window

Disassembly:
cmp dword [edi + 0x3b0], 2
push esi
jne 0x46d674
cmp dword [edi + 0x374], 0
je 0x46d674
push 1
lea eax, [edi + 0x24]
mov ecx, 0x1518
call fcn.0046ebd0
jmp 0x46d680
mov eax, dword [edi + 4]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov esi, str.http:__service.weibo.com_share_share.php_urlhttp:__wifi.liebao.cn__sinatypebuttonlanguagezh_cnappkey562027542title_23_e7_8c_8e_e8_b1_b9_e5_85_8d_e8_b4_b9WiFi5.1_e6_96_b0_e7_89_88_e5_8f_91_e5_b8_83_e5_95_a6_23_e4_ba_ae_e7_82_b9_e4_b8_80_ef_bc_9a_e3_80_90_e5_bc_80_e5_ad_a6_e7_a5_9e_e5_99_a8_e3_80_91__e7_aa_81_e7_a0_b4_e6_a0_a1_e5_9b_ad_e7_bd_91_e5_85_b1_e4_ba_ab_e9_99_90_e5_88_b6_ef_bc_8c_e6_94_af_e6_8c_8199.5_25_e6_a0_a1_e5_9b_ad_e5_ae_a2_e6_88_b7_e7_ab_af_ef_bc_9b_e4_ba_ae_e7_82_b9_e4_ba_8c_ef_bc_9a_e3_80_90_e6_b2_a1_e7_bd_91_e4_b9_9f_e8_83_bd_e7_8e_a9_e7_9a_84WiFi_e3_80_91__e4_b8_80_e9_94_ae_e5_bc_80_e5_90_af_e5_b1_80_e5_9f_9f_e7_bd_91_ef_bc_8c_e4_b8_8d_e8_81_94_e7_bd_91_e4_b9_9f_e7_8e_a9_e9_ad_94_e5_85_bd_e3_80_81CS_ef_bc_9b_e8_bf_98_e6_9c_89_e5_8d_87_e7_ba_a7_e7_89_88_e9_81_a5_e6_8e_a7_e7_94_b5_e8_84_91_e3_80_81WiFi_e6_ac_a2_e8_bf_8e_e9_a1_b5_e7_ad_89_e5_8a_9f_e8_83_bd_e9_82_80_e6_82_a8_e4_bd_93_e9_aa_8c_ef_bc_81pichttp:__dl.liebao.cn_kw_312055.pngsearchPictruestylenumberretcode6102
call fcn.0051d060
cmp dword [edi + 0x374], 0
push 1
push edi
jne 0x46d69d
call fcn.0046e450
pop esi
ret
call fcn.0046e750
pop esi
ret

Function at 0x46d6b0
Capabilities:
Read .ini file

Disassembly:
cmp dword [esi + 0x378], 0
push ebx
push ebp
push edi
je 0x46d748
cmp dword [esi + 0x438], 8
lea ebp, [esi + 0x420]
jb 0x46d6d4
mov eax, dword [ebp + 4]
jmp 0x46d6d7
lea eax, [ebp + 4]
push eax
push 0
push str.devdriveupdate
push str.softtip
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, 1
jbe 0x46d705
mov ecx, 1
mov ebx, str.devdriveupdate
mov edi, str.softtip
mov edx, ebp
call fcn.0040b800
xor ecx, ecx
push ecx
mov eax, 0x46da90
push eax
push esi
call fcn.004f8fd0
add esp, 0xc
push 0
push 0x3e8
mov dword [esi + 0x384], eax
mov eax, dword [esi + 4]
push 0x3e8
push eax
call dword [sym.imp.USER32.dll_SetTimer]
mov ebx, 2
mov eax, esi
call fcn.0046ca70
push 1
mov ecx, esi
call fcn.0046e600
pop edi
pop ebp
pop ebx
ret