joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405956
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
mov eax, dword [edi]
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp + 0x10]
push eax
push ebx
push str.ProxyServer
mov dword [edi], ebx
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4059c2
cmp dword [ebp + 0x10], 1
je 0x40599a
cmp dword [ebp + 0x10], 2
je 0x40599a
push 0xd
pop eax
jmp 0x4059c2
mov ecx, dword [ebp - 4]
test esi, esi
je 0x4059bc
test ecx, ecx
je 0x4059b7
test cl, 1
jne 0x405995
mov eax, ecx
shr eax, 1
cmp word [esi + eax*2 - 2], bx
je 0x4059bc
jmp 0x405995
xor eax, eax
mov word [esi], ax
shr ecx, 1
mov dword [edi], ecx
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x40b549
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x451c42
mov eax, dword fs:[0]
push eax
sub esp, 0xe4
mov eax, dword [0x46d978]
xor eax, esp
mov dword [esp + 0xdc], eax
push ebx
push esi
mov eax, dword [0x46d978]
xor eax, esp
push eax
lea eax, [esp + 0xf0]
mov dword fs:[0], eax
mov esi, ecx
push str.SetupController.cpp
lea ecx, [esp + 0x10]
call fcn.004012d4
push 0x1b
lea eax, [esp + 0x10]
xor ebx, ebx
push eax
push ebx
lea ecx, [esp + 0x30]
mov dword [esp + 0x104], ebx
call fcn.00419d97
lea ecx, [eax + 0x28]
mov edx, str.SetupController::Initialize
mov byte [esp + 0xf8], 1
call fcn.00405695
lea ecx, [esp + 0x24]
mov byte [esp + 0xf8], bl
call fcn.00419f5b
or dword [esp + 0xf8], 0xffffffff
lea ecx, [esp + 0xc]
call fcn.00401303
push 0x10
call fcn.0042dbe8
pop ecx
test eax, eax
je 0x40b5fd
mov ecx, eax
call fcn.0041bc84
mov ebx, eax
mov ecx, dword [esi + 0x10]
cmp ebx, ecx
je 0x40b60e
test ecx, ecx
je 0x40b60e
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, ebx
mov dword [esi + 0x10], ebx
call fcn.0041bcf4
mov ecx, dword [esp + 0xf0]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0xdc]
xor ecx, esp
call fcn.0042d3d2
mov esp, ebp
pop ebp
ret

Function at 0x40b63b
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x450a6a
mov eax, dword fs:[0]
push eax
sub esp, 0xe8
mov eax, dword [0x46d978]
xor eax, esp
mov dword [esp + 0xe0], eax
push esi
mov eax, dword [0x46d978]
xor eax, esp
push eax
lea eax, [esp + 0xf0]
mov dword fs:[0], eax
mov esi, ecx
push str.SetupController.cpp
lea ecx, [esp + 0x10]
call fcn.004012d4
and dword [esp + 0xf8], 0
push 0x23
lea eax, [esp + 0x10]
push eax
push 0
lea ecx, [esp + 0x30]
call fcn.00419d97
lea ecx, [eax + 0x28]
mov edx, str.SetupController::Uninitialize
mov byte [esp + 0xf8], 1
call fcn.00405695
lea ecx, [esp + 0x24]
mov byte [esp + 0xf8], 0
call fcn.00419f5b
or dword [esp + 0xf8], 0xffffffff
lea ecx, [esp + 0xc]
call fcn.00401303
mov ecx, dword [esi + 0x10]
call fcn.0041bd27
mov ecx, dword [esp + 0xf0]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0xe0]
xor ecx, esp
call fcn.0042d3d2
mov esp, ebp
pop ebp
ret
Function at 0x40b85e
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x451c42
mov eax, dword fs:[0]
push eax
sub esp, 0xe4
mov eax, dword [0x46d978]
xor eax, esp
mov dword [esp + 0xdc], eax
push ebx
push esi
mov eax, dword [0x46d978]
xor eax, esp
push eax
lea eax, [esp + 0xf0]
mov dword fs:[0], eax
mov esi, ecx
push str.SetupController.cpp
lea ecx, [esp + 0x10]
call fcn.004012d4
push 0x42
lea eax, [esp + 0x10]
xor ebx, ebx
push eax
push ebx
lea ecx, [esp + 0x30]
mov dword [esp + 0x104], ebx
call fcn.00419d97
lea ecx, [eax + 0x28]
mov edx, str.SetupController::EndProcess
mov byte [esp + 0xf8], 1
call fcn.00405695
lea ecx, [esp + 0x24]
mov byte [esp + 0xf8], bl
call fcn.00419f5b
or dword [esp + 0xf8], 0xffffffff
lea ecx, [esp + 0xc]
call fcn.00401303
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x40b909
mov eax, dword [ecx]
call dword [eax + 0x10]
push 0x10
mov byte [esi + 0xc], 1
call fcn.0042dbe8
mov edx, eax
pop ecx
test edx, edx
je 0x40b930
mov dword [edx], vtable.CallBack_0_void__class_SetupController_.0
mov dword [edx + 4], esi
mov dword [edx + 8], 0x40b96c
mov dword [edx + 0xc], ebx
jmp 0x40b932
mov edx, ebx
mov eax, dword [0x4717fc]
test eax, eax
je 0x40b93e
lea ebx, [eax - 4]
mov ecx, dword [ebx + 4]
push 0x64
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov ecx, dword [esp + 0xf0]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0xdc]
xor ecx, esp
call fcn.0042d3d2
mov esp, ebp
pop ebp
ret
Function at 0x40f341
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x451c42
mov eax, dword fs:[0]
push eax
sub esp, 0xe4
mov eax, dword [0x46d978]
xor eax, esp
mov dword [esp + 0xdc], eax
push ebx
push esi
mov eax, dword [0x46d978]
xor eax, esp
push eax
lea eax, [esp + 0xf0]
mov dword fs:[0], eax
mov esi, ecx
push str.SetupControllerVisualization.cpp
lea ecx, [esp + 0x10]
call fcn.004012d4
push 0x187
lea eax, [esp + 0x10]
xor ebx, ebx
push eax
push ebx
lea ecx, [esp + 0x30]
mov dword [esp + 0x104], ebx
call fcn.00419d97
lea ecx, [eax + 0x28]
mov edx, str.SetupControllerVisualization::OnClickInstall
mov byte [esp + 0xf8], 1
call fcn.00405695
lea ecx, [esp + 0x24]
mov byte [esp + 0xf8], bl
call fcn.00419f5b
or dword [esp + 0xf8], 0xffffffff
lea ecx, [esp + 0xc]
call fcn.00401303
lea eax, [esi + 0xac]
push eax
mov ecx, esi
call fcn.0040fc4c
push ebx
lea ecx, [esi + 8]
call fcn.0040ba3d
mov ecx, dword [esi + 0x74]
push ebx
push 2
mov dword [esi + 0x10], eax
call fcn.0041104b
mov ecx, esi
call fcn.0040f432
mov ecx, dword [esp + 0xf0]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0xdc]
xor ecx, esp
call fcn.0042d3d2
mov esp, ebp
pop ebp
ret

Function at 0x40f4c0
Capabilities:
Access peb ldr_data
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x450a6a
mov eax, dword fs:[0]
push eax
sub esp, 0xe8
mov eax, dword [0x46d978]
xor eax, esp
mov dword [esp + 0xe0], eax
push ebx
mov eax, dword [0x46d978]
xor eax, esp
push eax
lea eax, [esp + 0xf0]
mov dword fs:[0], eax
push str.SetupControllerVisualization.cpp
lea ecx, [esp + 0x10]
call fcn.004012d4
push 0x19d
lea eax, [esp + 0x10]
xor ebx, ebx
push eax
push ebx
lea ecx, [esp + 0x30]
mov dword [esp + 0x104], ebx
call fcn.00419d97
lea ecx, [eax + 0x28]
mov edx, str.SetupControllerVisualization::OnClickGotoHomePage
mov byte [esp + 0xf8], 1
call fcn.00405695
lea ecx, [esp + 0x24]
mov byte [esp + 0xf8], bl
call fcn.00419f5b
lea ecx, [esp + 0xc]
call fcn.00401303
push 5
push ebx
push ebx
push str.http:__www.liebao.cn
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [esp + 0xf0]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [esp + 0xe0]
xor ecx, esp
call fcn.0042d3d2
mov esp, ebp
pop ebp
ret
Function at 0x40f58e
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x450ae5
mov eax, dword fs:[0]
push eax
sub esp, 0x1d8
mov eax, dword [0x46d978]
xor eax, esp
mov dword [esp + 0x1d0], eax
push ebx
push esi
push edi
mov eax, dword [0x46d978]
xor eax, esp
push eax
lea eax, [esp + 0x1e8]
mov dword fs:[0], eax
push str.SetupControllerVisualization.cpp
lea ecx, [esp + 0x18]
call fcn.004012d4
push 0x1a3
lea eax, [esp + 0x18]
xor ebx, ebx
push eax
push ebx
lea ecx, [esp + 0x68]
mov dword [esp + 0x1fc], ebx
call fcn.00419d97
lea ecx, [eax + 0x28]
mov edx, str.SetupControllerVisualization::OnClickStartApp
mov byte [esp + 0x1f0], 1
call fcn.00405695
lea ecx, [esp + 0x5c]
mov byte [esp + 0x1f0], bl
call fcn.00419f5b
or dword [esp + 0x1f0], 0xffffffff
lea ecx, [esp + 0x14]
call fcn.00401303
push 0x46d258
lea ecx, [esp + 0x14]
call fcn.00404e8e
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x1f4], 2
call fcn.00410163
mov edi, eax
xor eax, eax
mov dword [esp + 0x40], 7
mov dword [esp + 0x3c], ebx
mov word [esp + 0x2c], ax
lea ecx, [esp + 0x2c]
mov byte [esp + 0x1f0], 3
call fcn.00414802
mov esi, dword [esp + 0x10]
cmp dword [esp + 0x3c], ebx
je 0x40f72d
mov ebx, str.liebao.exe
push ebx
call fcn.00401723
pop ecx
push eax
push ebx
lea ecx, [esp + 0x34]
call fcn.00405060
xor ebx, ebx
xor eax, eax
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], ebx
mov word [esp + 0x14], ax
mov byte [esp + 0x1f0], 4
call fcn.00414929
test al, al
je 0x40f6dc
mov ebx, str.runas
push ebx
call fcn.00401723
pop ecx
push eax
push ebx
lea ecx, [esp + 0x1c]
call fcn.00405103
xor ebx, ebx
push 5
lea ecx, [esp + 0x30]
lea eax, [esp + 0x18]
push ebx
test edi, edi
je 0x40f6ee
push esi
jmp 0x40f6ef
push ebx
cmp dword [esp + 0x4c], 8
cmovae ecx, dword [esp + 0x38]
cmp dword [esp + 0x34], 8
push ecx
cmovae eax, dword [esp + 0x24]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jle 0x40f71f
push 2
call fcn.0040a4ee
mov ecx, eax
call fcn.0040a56b
push ebx
push 1
lea ecx, [esp + 0x1c]
call fcn.00404e3f
jmp 0x40f799
push str.SetupControllerVisualization.cpp
lea ecx, [esp + 0x48]
call fcn.004012d4
push 0x1c3
lea eax, [esp + 0x48]
push eax
push 2
lea ecx, [esp + 0x128]
mov byte [esp + 0x1fc], 5
call fcn.00419d97
lea ecx, [eax + 0x28]
mov edx, str.SetupControllerVisualization::OnClickStartApp
mov byte [esp + 0x1f0], 6
call fcn.00405695
mov edx, str.__Install_dir_is_empty_
mov ecx, eax
call fcn.00405695
lea ecx, [esp + 0x11c]
mov byte [esp + 0x1f0], 5
call fcn.00419f5b
lea ecx, [esp + 0x44]
call fcn.00401303
push ebx
push 1
lea ecx, [esp + 0x34]
call fcn.00404e3f
lea ecx, [esi - 0x10]
call fcn.0040390b
mov ecx, dword [esp + 0x1e8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1d0]
xor ecx, esp
call fcn.0042d3d2
mov esp, ebp
pop ebp
ret
Function at 0x40fddc
Capabilities:
Access peb ldr_data
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x450a6a
mov eax, dword fs:[0]
push eax
sub esp, 0xe8
mov eax, dword [0x46d978]
xor eax, esp
mov dword [esp + 0xe0], eax
push ebx
mov eax, dword [0x46d978]
xor eax, esp
push eax
lea eax, [esp + 0xf0]
mov dword fs:[0], eax
push str.SetupControllerVisualization.cpp
lea ecx, [esp + 0x10]
call fcn.004012d4
push 0x210
lea eax, [esp + 0x10]
xor ebx, ebx
push eax
push ebx
lea ecx, [esp + 0x30]
mov dword [esp + 0x104], ebx
call fcn.00419d97
lea ecx, [eax + 0x28]
mov edx, str.SetupControllerVisualization::OnClickLicense
mov byte [esp + 0xf8], 1
call fcn.00405695
lea ecx, [esp + 0x24]
mov byte [esp + 0xf8], bl
call fcn.00419f5b
lea ecx, [esp + 0xc]
call fcn.00401303
push 5
push ebx
push ebx
push str.http:__www.liebao.cn_go_eula.html
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [esp + 0xf0]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [esp + 0xe0]
xor ecx, esp
call fcn.0042d3d2
mov esp, ebp
pop ebp
ret

Function at 0x411411
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0xf060
push esi
mov esi, ecx
je 0x411424
xor al, al
jmp 0x41145f
mov ecx, dword [esi + 0x18]
push dword [esi + 0xc]
mov eax, dword [ecx]
call dword [eax]
cmp eax, 1
jne 0x411458
lea ecx, [esi - 0x38]
mov eax, dword [ecx]
call dword [eax + 8]
mov esi, eax
push 0
mov ecx, dword [esi]
push dword [ecx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esi + 0x44]
lea eax, [esi + 0x18]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
jmp 0x41145d
cmp eax, 2
je 0x411420
mov al, 1
pop esi
pop ebp
ret 4
Function at 0x411c23
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], ebx
call fcn.004118ef
mov ecx, edi
mov esi, eax
call fcn.004118ef
cmp esi, eax
jne 0x411d7e
mov ecx, ebx
call fcn.00411914
mov ecx, edi
mov esi, eax
call fcn.00411914
cmp esi, eax
jne 0x411d7e
mov ecx, ebx
call fcn.00411939
mov ecx, edi
mov esi, eax
call fcn.00411939
cmp esi, eax
jne 0x411d7e
mov ecx, ebx
call fcn.00411914
mov ecx, ebx
mov esi, eax
call fcn.004118ef
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ecx
mov ecx, ebx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], esi
call fcn.00411939
mov esi, dword [sym.imp.gdiplus.dll_GdipBitmapLockBits]
lea ecx, [ebp - 0x3c]
push ecx
push eax
push 3
lea eax, [ebp - 0x24]
push eax
push dword [ebx + 4]
call esi
test eax, eax
je 0x411cc1
mov dword [ebx + 8], eax
mov ecx, edi
call fcn.00411939
lea ecx, [ebp - 0x54]
push ecx
push eax
push 3
lea eax, [ebp - 0x24]
push eax
push dword [edi + 4]
call esi
test eax, eax
je 0x411cdf
mov dword [edi + 8], eax
mov eax, dword [ebp - 0x34]
xor edx, edx
div dword [ebp - 0x3c]
mov edx, dword [ebp - 0x50]
mov dword [ebp - 8], eax
test edx, edx
jle 0x411d54
mov ebx, dword [ebp - 0x34]
mov edi, dword [ebp - 0x4c]
xor ecx, ecx
mov eax, ecx
mov esi, edi
imul eax, ebx
add eax, dword [ebp - 0x2c]
imul esi, ecx
add esi, dword [ebp - 0x44]
test edi, edi
jle 0x411d46
push 0xfffffffffffffffd
pop ecx
sub esi, eax
sub ecx, eax
lea ebx, [eax + 3]
mov dword [ebp - 0xc], ecx
movzx ecx, byte [ebx]
movzx eax, byte [esi + ebx]
imul eax, ecx
cdq
mov ecx, 0xff
idiv ecx
mov byte [ebx], al
add ebx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov edi, dword [ebp - 0x4c]
add eax, ebx
cmp eax, edi
jl 0x411d1a
mov edx, dword [ebp - 0x50]
mov ecx, dword [ebp - 4]
mov ebx, dword [ebp - 0x34]
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, edx
jl 0x411cf9
mov edi, dword [ebp - 0x10]
mov ebx, dword [ebp - 0x14]
mov esi, dword [sym.imp.gdiplus.dll_GdipBitmapUnlockBits]
lea eax, [ebp - 0x3c]
push eax
push dword [ebx + 4]
call esi
test eax, eax
je 0x411d6a
mov dword [ebx + 8], eax
lea eax, [ebp - 0x54]
push eax
push dword [edi + 4]
call esi
test eax, eax
je 0x411d7a
mov dword [edi + 8], eax
mov al, 1
jmp 0x411d80
xor al, al
pop edi
pop esi
pop ebx
leave
ret

Function at 0x414623
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x41467c
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x41466d
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [ebp + 8]
lea ecx, [esi + eax]
and edx, 0xf
jbe 0x414669
cmp esi, ecx
jae 0x41466d
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec edx
jne 0x414659
cmp esi, ecx
jb 0x414671
xor eax, eax
jmp 0x41467b
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x414731
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
mov edi, ecx
xor esi, esi
mov dword [ebp - 4], esi
cmp dword [edi], esi
je 0x4147ae
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 8]
push eax
push esi
push str.Install_Path_Dir
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 8], 1
jne 0x4147ae
mov ecx, dword [ebp + 0xc]
call fcn.0041038d
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
shr eax, 1
inc eax
push eax
call fcn.00404b9a
lea ecx, [ebp - 4]
push ecx
push eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
push esi
push str.Install_Path_Dir
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4147ae
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
shr eax, 1
xor edx, edx
mov word [ecx + eax*2], dx
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.004103d4
inc esi
pop edi
mov eax, esi
pop esi
leave
ret 8

Function at 0x414886
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1454
call fcn.0043eba0
mov eax, dword [0x46d978]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor eax, eax
push 0x144e
mov word [ebp - 0x1454], ax
xor edi, edi
lea eax, [ebp - 0x1452]
push edi
push eax
mov esi, ecx
call fcn.00435650
add esp, 0xc
call fcn.00414929
test al, al
lea eax, [ebp - 0x1454]
push eax
push edi
push edi
je 0x4148e4
push 0x1c
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jns 0x4148e8
xor al, al
jmp 0x41491b
push 0x26
jmp 0x4148d5
lea eax, [ebp - 0x1454]
push eax
call fcn.00401723
pop ecx
push eax
lea eax, [ebp - 0x1454]
push eax
mov ecx, esi
call fcn.00405103
mov edi, 0x460aec
push edi
call fcn.00401723
pop ecx
push eax
push edi
mov ecx, esi
call fcn.00405060
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0042d3d2
leave
ret

Function at 0x414929
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x46d978]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x118
lea eax, [ebp - 0x11c]
push 0
push eax
mov dword [ebp - 0x120], 0x11c
call fcn.00435650
add esp, 0xc
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x414971
xor al, al
jmp 0x41497b
cmp dword [ebp - 0x11c], 6
sbb eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042d3d2
leave
ret
Function at 0x414987
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x46d978]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor eax, eax
push 0x206
mov word [ebp - 0x20c], ax
xor ebx, ebx
lea eax, [ebp - 0x20a]
push ebx
push eax
mov esi, ecx
call fcn.00435650
add esp, 0xc
lea eax, [ebp - 0x20c]
push ebx
push 0x24
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x4149d8
sub ecx, edx
sar ecx, 1
je 0x414a02
push ecx
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.0042ef73
add esp, 0xc
test eax, eax
jne 0x414a02
mov al, 1
jmp 0x414a44
push ebx
push 0x26
lea eax, [ebp - 0x20c]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x414a1c
sub ecx, edx
sar ecx, 1
je 0x414a42
push ecx
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.0042ef73
add esp, 0xc
test eax, eax
je 0x4149fe
xor al, al
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0042d3d2
leave
ret

Function at 0x414a52
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x46d978]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor esi, esi
push 0x228
lea eax, [ebp - 0x22c]
push esi
push eax
mov dword [ebp - 0x230], esi
call fcn.00435650
add esp, 0xc
push esi
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x414b02
lea eax, [ebp - 0x230]
push eax
push edi
mov dword [ebp - 0x230], 0x22c
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x414afb
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, eax
mov ecx, dword [ebp - 0x228]
cmp ecx, ebx
je 0x414ae3
test ecx, ecx
je 0x414ae3
cmp ecx, 4
je 0x414ae3
lea eax, [ebp - 0x20c]
push str.liebao.exe
push eax
call fcn.0042ed85
pop ecx
pop ecx
test eax, eax
je 0x414af7
lea eax, [ebp - 0x230]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x414ab9
jmp 0x414afa
xor esi, esi
inc esi
pop ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0042d3d2
leave
ret
Function at 0x414e0d
Capabilities:
Create process on windows

Disassembly:
push 0x5c
mov eax, 0x4512f1
call fcn.00433618
mov esi, edx
mov ebx, ecx
push 0x40
lea eax, [ebp - 0x64]
push 0
push eax
call fcn.00435650
and dword [ebp - 0x20], 0
xor eax, eax
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
xor edi, edi
inc edi
push 0x46d258
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x68], 0x44
mov dword [ebp - 0x3c], edi
call fcn.00404e8e
and dword [ebp - 4], 0
push esi
push ebx
lea eax, [ebp - 0x10]
push str.__s___s
push eax
call fcn.00410566
add esp, 0x10
mov esi, dword [ebp - 0x10]
push 0xa
pop eax
mov word [ebp - 0x38], ax
lea eax, [ebp - 0x20]
push eax
xor ebx, ebx
lea eax, [ebp - 0x68]
push eax
push ebx
push ebx
push ebx
push edi
push ebx
push ebx
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
cmovne ebx, edi
cmp dword [ebp - 0x20], 0
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x414ea6
push dword [ebp - 0x20]
call edi
and dword [ebp - 0x20], 0
cmp dword [ebp - 0x1c], 0
je 0x414eb5
push dword [ebp - 0x1c]
call edi
and dword [ebp - 0x1c], 0
lea ecx, [esi - 0x10]
call fcn.0040390b
mov eax, ebx
call fcn.004335e6
ret
Function at 0x4150ab
Capabilities:
Create directory
Get common file path

Disassembly:
push 0x31c
mov eax, 0x451283
call fcn.0043364b
mov bl, dl
mov esi, ecx
xor eax, eax
push 0x206
mov word [ebp - 0x21c], ax
xor edi, edi
lea eax, [ebp - 0x21a]
push edi
push eax
call fcn.00435650
add esp, 0xc
lea eax, [ebp - 0x21c]
push 1
push 0x1c
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x234]
call fcn.00404a24
mov dword [ebp - 4], edi
cmp dword [ebp - 0x224], edi
jne 0x41516b
push str.SetupUtil.cpp
lea ecx, [ebp - 0x264]
call fcn.004012d4
push 0x1cf
lea eax, [ebp - 0x264]
push eax
xor ebx, ebx
push ebx
lea ecx, [ebp - 0x324]
mov byte [ebp - 4], 1
call fcn.00419d97
lea ecx, [eax + 0x28]
mov edx, str.Get_Special_floder_path_failed_
mov byte [ebp - 4], 2
call fcn.00405695
lea ecx, [ebp - 0x324]
mov byte [ebp - 4], 1
call fcn.00419f5b
lea ecx, [ebp - 0x264]
call fcn.00401303
jmp 0x415306
mov edi, 0x45f318
push edi
call fcn.00401723
pop ecx
push eax
push edi
lea ecx, [ebp - 0x234]
call fcn.00405060
mov edi, 0x460b78
push edi
call fcn.00401723
pop ecx
push eax
push edi
lea ecx, [ebp - 0x234]
call fcn.00405060
cmp dword [ebp - 0x220], 8
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [ebp - 0x234]
cmovae eax, dword [ebp - 0x234]
push 0
push eax
call edi
push str.Bootsetup
call fcn.00401723
pop ecx
push eax
push str.Bootsetup
lea ecx, [ebp - 0x234]
call fcn.00405060
cmp dword [ebp - 0x220], 8
lea eax, [ebp - 0x234]
cmovae eax, dword [ebp - 0x234]
push 0
push eax
call edi
test bl, bl
je 0x4152d6
push str.2.1.11.3341
lea ecx, [ebp - 0x24c]
call fcn.004012d4
mov byte [ebp - 4], 3
cmp dword [ebp - 0x238], 0x10
mov eax, dword [ebp - 0x23c]
push dword [ebp - 0x328]
lea ecx, [ebp - 0x24c]
cmovae ecx, dword [ebp - 0x24c]
add eax, ecx
cmp dword [ebp - 0x238], 0x10
lea ecx, [ebp - 0x24c]
cmovae ecx, dword [ebp - 0x24c]
push eax
xor edx, edx
push ecx
xor ebx, ebx
lea ecx, [ebp - 0x264]
mov dword [ebp - 0x250], 7
mov dword [ebp - 0x254], ebx
mov word [ebp - 0x264], dx
call fcn.00415a8d
push 0x45f318
mov byte [ebp - 4], 4
call fcn.00401723
pop ecx
push eax
push 0x45f318
lea ecx, [ebp - 0x234]
call fcn.00405060
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x264]
push eax
lea ecx, [ebp - 0x234]
call fcn.0040536b
cmp dword [ebp - 0x220], 8
lea eax, [ebp - 0x234]
cmovae eax, dword [ebp - 0x234]
push ebx
push eax
call edi
push ebx
push 1
lea ecx, [ebp - 0x264]
call fcn.00404e3f
lea ecx, [ebp - 0x24c]
mov byte [ebp - 4], bl
call fcn.00401303
jmp 0x4152d8
xor ebx, ebx
mov edi, 0x45f318
push edi
call fcn.00401723
pop ecx
push eax
push edi
lea ecx, [ebp - 0x234]
call fcn.00405060
lea eax, [ebp - 0x234]
cmp esi, eax
je 0x415306
push 0xffffffffffffffff
push ebx
push eax
mov ecx, esi
call fcn.00404dac
push ebx
push 1
lea ecx, [ebp - 0x234]
call fcn.00404e3f
call fcn.004335fa
ret