joyce8/EMBER2024-capa huggingface dataset:
Function at 0x456c09
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a0
mov eax, dword [0x4ec06c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov dword [ebp - 0x190], edx
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
lea eax, [ebp - 0x198]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push dword [ebp - 0x194]
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x84]
push dword [ebp - 0x198]
push str._I64d
push eax
call esi
movzx ecx, byte [ebp - 0x7d]
xor edx, edx
cmp eax, 7
lea eax, [ebp - 0x84]
push eax
cmova ecx, edx
mov byte [ebp - 0x7d], cl
call fcn.00473b92
mov ecx, eax
mov dword [ebp - 0x18c], 0x3e8
xor edx, edx
mov eax, edi
div dword [ebp - 0x18c]
xor edx, edx
sub ecx, eax
mov eax, ecx
mov ecx, 0xe10
div ecx
push edi
lea ecx, [ebp - 0x84]
mov dword [ebp - 0x18c], eax
push ecx
push eax
lea eax, [ebp - 0x188]
push str.lotus::_starttime_is__d__filetime_is__s______d
push eax
call esi
add esp, 0x28
lea eax, [ebp - 0x188]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor edi, edi
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocString
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x456d26
push edi
push edi
lea eax, [ebp - 0x1a0]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x19c]
push dword [ebp - 0x1a0]
push dword [ebp - 0x18c]
push str.i_d_I64d
push dword [ebp - 0x190]
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
jmp 0x456d28
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004690ca
mov esp, ebp
pop ebp
ret

Function at 0x456d93
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 8
mov eax, 0x4b9509
call fcn.00469bd4
mov esi, ecx
mov dword [ebp - 0x14], esi
xor edi, edi
mov dword [esi], edi
lea ebx, [esi + 8]
mov dword [ebp - 4], edi
mov ecx, ebx
mov dword [esi + 4], edi
call fcn.0040fa20
movzx eax, word [ebp + 8]
push 0x4d6448
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 8], eax
test eax, eax
je 0x456e04
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x456e04
push dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x456e04
mov edx, dword [ebp - 0x10]
push ecx
push ecx
mov ecx, eax
call fcn.0042b332
pop ecx
pop ecx
mov edi, eax
push edi
mov ecx, esi
call 0x42b569
push ebx
mov ecx, esi
call fcn.0042d871
cmp byte [ebp + 0xc], 0
je 0x456e23
mov dword [esi + 4], 1
jmp 0x456e36
mov eax, dword [ebx]
test eax, eax
jle 0x456e36
cmp dword [esi + 0xc], 0
jle 0x456e36
cdq
idiv dword [esi + 0xc]
mov dword [esi + 4], eax
mov eax, esi
call fcn.00469b9d
ret 8
Function at 0x4580cd
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
mov esi, ecx
call fcn.0045811f
mov eax, dword [ebp + 8]
xor edi, edi
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x458111
lea ecx, [ebp - 8]
mov dword [ebp - 8], edi
push ecx
push eax
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push edi
push dword [ebp - 8]
push dword [ebp - 4]
push 2
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [esi + 4], eax
mov byte [esi + 8], 1
cmp dword [esi + 4], edi
pop edi
setne al
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x458ab0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x458ac5
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0041451a
add esp, 4
lea ecx, [ebp - 0x10]
push eax
call fcn.00498698
push 0x4e71f8
lea eax, [ebp - 0x10]
push eax
call fcn.0046dc85
int3

Function at 0x458b10
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x458b2a
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0041451a
add esp, 4
lea ecx, [ebp - 0x10]
push eax
call fcn.00498698
push 0x4e71f8
lea eax, [ebp - 0x10]
push eax
call fcn.0046dc85
int3

Function at 0x458fe0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x459120
Capabilities:
Hash data with md5

Disassembly:
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x10], 0
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret

Function at 0x45cd32
Capabilities:
Parse pe header

Disassembly:
push 0x24
push 0x4e48e0
call fcn.0046a1c0
mov edi, edx
push 0x1c
lea eax, [ebp - 0x34]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
and dword [ebp - 4], 0
mov eax, 0x5a4d
mov ecx, dword [ebp - 0x30]
cmp word [ecx], ax
jne 0x45cd99
mov edx, dword [ecx + 0x3c]
cmp dword [edx + ecx], 0x4550
jne 0x45cd99
mov esi, dword [edx + ecx + 0xd8]
lea eax, [esi + ecx]
cmp edi, eax
jb 0x45cd99
mov eax, dword [edx + ecx + 0xdc]
add eax, esi
add eax, ecx
cmp edi, eax
jae 0x45cd99
mov dword [ebp - 4], 0xfffffffe
mov al, 1
jmp 0x45cda2
mov dword [ebp - 4], 0xfffffffe
xor al, al
call fcn.0046a206
ret
Function at 0x46056a
Capabilities:
Enumerate process modules

Disassembly:
push 0x434
mov eax, 0x4b9bfb
call fcn.00469c08
mov edi, edx
mov dword [ebp - 0x440], ecx
push 0x2801
mov dword [ebp - 0x43c], 0x2800
call fcn.0046949c
pop ecx
mov ecx, dword [ebp - 0x43c]
mov ebx, eax
lea eax, [ebp - 0x43c]
inc ecx
push eax
push ecx
push ebx
push edi
call dword [sym.imp.PSAPI.DLL_EnumProcessModules]
test eax, eax
je 0x46063d
xor esi, esi
test dword [ebp - 0x43c], 0xfffffffc
jbe 0x46063d
push 0x208
lea eax, [ebp - 0x420]
push eax
push dword [ebx + esi*4]
push edi
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
cmp eax, 4
jbe 0x46062f
lea eax, [ebp + eax*2 - 0x428]
push str..tmp
push eax
call fcn.00471ed1
pop ecx
pop ecx
test eax, eax
jne 0x46062f
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x438]
call fcn.0041185a
mov ecx, dword [ebp - 0x440]
lea eax, [ebp - 0x438]
and dword [ebp - 4], 0
push eax
call fcn.0040c372
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x438]
call fcn.004123b1
mov eax, dword [ebp - 0x43c]
inc esi
shr eax, 2
cmp esi, eax
jb 0x4605c5
push 1
push ebx
call fcn.004690db
pop ecx
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00469bb2
ret
Function at 0x46297b
Capabilities:
Enumerate processes

Disassembly:
push 0x2a0
mov eax, 0x4b9e24
call fcn.00469c08
mov ebx, edx
mov dword [ebp - 0x2ac], ebx
mov edi, ecx
mov dword [ebp - 0x2a8], edi
push 0x228
lea eax, [ebp - 0x2a0]
mov dword [ebp - 0x2a4], 0x22c
push 0
push eax
call fcn.0046d6f0
add esp, 0xc
lea eax, [ebp - 0x2a4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
jmp 0x462afe
push 0xfde9
push 0xffffffffffffffff
lea edx, [ebp - 0x280]
lea ecx, [ebp - 0x60]
call fcn.0042218f
mov ebx, eax
and dword [ebp - 4], 0
mov esi, dword [ebp - 0x29c]
push str._____
push edi
call fcn.00412821
push 0xa
mov edi, eax
lea eax, [ebp - 0x30]
push 0x20
push eax
push esi
call fcn.0046f4ee
lea eax, [ebp - 0x30]
push eax
push edi
call fcn.00412821
add esp, 0x28
push ebx
push 0x4d7314
push eax
call fcn.00412821
pop ecx
pop ecx
push eax
call fcn.004126ba
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
lea ecx, [ebp - 0x60]
call fcn.0041207b
cmp dword [ebp - 0x29c], 0
je 0x462ad7
push dword [ebp - 0x29c]
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x462ad7
mov edx, esi
lea ecx, [ebp - 0x78]
call fcn.004252fb
push 0xfde9
push eax
lea eax, [ebp - 0x48]
mov dword [ebp - 4], 1
push eax
call fcn.00412653
add esp, 0xc
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 3
call fcn.004123b1
lea ecx, [ebp - 0x48]
call fcn.0040c5b7
test al, al
jne 0x462ac4
push 0x4d7318
lea eax, [ebp - 0x48]
push eax
push 0x4d6f28
push dword [ebp - 0x2a8]
call fcn.00412821
pop ecx
pop ecx
push eax
call fcn.004126ba
pop ecx
pop ecx
push eax
call fcn.00412821
pop ecx
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.0041207b
mov edi, dword [ebp - 0x2a8]
push 0x4d558c
push edi
call fcn.00412821
mov ebx, dword [ebp - 0x2ac]
lea eax, [ebp - 0x2a4]
pop ecx
pop ecx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x4629cd
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
call fcn.00469bb2
ret
Function at 0x46377a
Capabilities:
Get graphical window text

Disassembly:
push 0x430
mov eax, 0x4b9eba
call fcn.00469c08
mov esi, ecx
mov dword [ebp - 0x434], esi
mov dword [ebp - 0x438], esi
mov eax, dword [ebp + 8]
lea edi, [esi + 4]
mov ecx, edi
mov dword [ebp - 0x43c], esi
mov dword [esi], eax
call fcn.0041fa5c
and dword [ebp - 4], 0
lea ebx, [esi + 0x1c]
mov ecx, ebx
call fcn.0041fa5c
lea eax, [esi + 0x34]
mov ecx, eax
mov dword [ebp - 0x438], eax
call fcn.00412607
xor eax, eax
mov dword [esi + 0x58], eax
mov dword [esi + 0x5c], eax
mov dword [esi + 0x60], eax
mov byte [ebp - 4], 3
push dword [esi]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
setne al
mov byte [esi + 0x54], al
add esi, 0x4c
mov eax, dword [ebp - 0x434]
push esi
push dword [eax]
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ecx, dword [ebp - 0x434]
push 0x80
mov dword [ecx + 0x50], eax
lea eax, [ebp - 0x110]
push eax
push dword [ecx]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0x80
lea eax, [ebp - 0x210]
push eax
mov eax, dword [ebp - 0x434]
push dword [eax]
call dword [sym.imp.USER32.dll_GetClassNameW]
push 0xfde9
push 0xffffffffffffffff
lea edx, [ebp - 0x110]
lea ecx, [ebp - 0x430]
call fcn.0042218f
pop ecx
pop ecx
push eax
mov ecx, edi
call fcn.00426fae
lea ecx, [ebp - 0x430]
call fcn.0041207b
push 0xfde9
push 0xffffffffffffffff
lea edx, [ebp - 0x210]
lea ecx, [ebp - 0x430]
call fcn.0042218f
pop ecx
pop ecx
push eax
mov ecx, ebx
call fcn.00426fae
lea ecx, [ebp - 0x430]
call fcn.0041207b
push dword [esi]
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x4638eb
push 0x104
lea eax, [ebp - 0x418]
push eax
push 0
push edi
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
test eax, eax
je 0x4638e4
lea eax, [ebp - 0x418]
push 0x5c
push eax
call fcn.00415412
pop ecx
test eax, eax
lea esi, [ebp - 0x418]
pop ecx
mov ecx, dword [ebp - 0x438]
lea edx, [eax + 2]
cmovne esi, edx
push esi
call fcn.00416cc5
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x434]
call fcn.00469bb2
ret 4
Function at 0x4638f9
Capabilities:
Enumerate gui resources

Disassembly:
push 0x22c
mov eax, 0x4b9f03
call fcn.00469c08
mov esi, edx
mov dword [ebp - 0x22c], ecx
cmp dword [esi + 0x1c], 0
je 0x463a67
lea ecx, [ebp - 0x238]
call fcn.0040c090
and dword [ebp - 4], 0
lea eax, [ebp - 0x238]
mov ecx, dword [esi + 0x1c]
push SysReAllocString
push 0x7c
push eax
call fcn.00421a5f
and dword [ebp - 0x228], 0
add esp, 0xc
and dword [ebp - 0x224], 0
and dword [ebp - 0x220], 0
lea eax, [ebp - 0x228]
mov byte [ebp - 4], 1
push eax
push 0x463ad1
call dword [sym.imp.USER32.dll_EnumWindows]
test eax, eax
je 0x463a51
lea ecx, [ebp - 0x21c]
call fcn.00411071
mov byte [ebp - 4], 2
xor edi, edi
mov eax, dword [ebp - 0x224]
sub eax, dword [ebp - 0x228]
sar eax, 2
test eax, eax
je 0x463a18
lea ecx, [ebp - 0x238]
xor ebx, ebx
call fcn.0040c30a
test eax, eax
je 0x463a04
mov esi, dword [ebp - 0x228]
lea ecx, [ebp - 0x238]
push ebx
call fcn.0040c2ed
mov ecx, eax
call fcn.00412374
mov ecx, dword [esi + edi*4]
push eax
add ecx, 0x34
call fcn.00412374
push eax
call fcn.00471ed1
pop ecx
pop ecx
test eax, eax
je 0x4639ed
lea ecx, [ebp - 0x238]
inc ebx
call fcn.0040c30a
cmp ebx, eax
jb 0x4639aa
jmp 0x463a04
mov edx, dword [ebp - 0x228]
lea ecx, [ebp - 0x21c]
push 0
mov edx, dword [edx + edi*4]
call fcn.00463b25
pop ecx
mov eax, dword [ebp - 0x224]
inc edi
sub eax, dword [ebp - 0x228]
sar eax, 2
cmp edi, eax
jb 0x463999
lea ecx, [ebp - 0x21c]
call fcn.0040c535
lea ecx, [ebp - 0x21c]
mov esi, eax
call fcn.0041298e
push ecx
mov ecx, dword [ebp - 0x22c]
mov edx, str.wndinfo.txt
push esi
push eax
call fcn.00464a4e
add esp, 0xc
lea ecx, [ebp - 0x21c]
call fcn.0041104c
lea ecx, [ebp - 0x228]
call fcn.0042d5d2
lea ecx, [ebp - 0x238]
call fcn.0040c335
call fcn.00469bb2
ret

Function at 0x48216f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00481e2e

Function at 0x48217a
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00481fb1
Function at 0x48816e
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00487e08
Function at 0x4a9c86
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bba55
mov eax, dword fs:[0]
push eax
sub esp, 0x410
mov eax, dword [0x4ec06c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x41c]
call fcn.00411071
and dword [ebp - 4], 0
push 0x4cb490
call fcn.0044dd23
add eax, 0x20
mov ecx, eax
call fcn.00412374
push eax
lea eax, [ebp - 0x41c]
push eax
call fcn.00411005
pop ecx
pop ecx
push eax
call fcn.00411005
pop ecx
pop ecx
lea ecx, [ebp - 0x41c]
call fcn.00412324
xor dl, dl
mov ecx, eax
call fcn.0041fbdc
movzx eax, al
test eax, eax
je 0x4a9d18
lea ecx, [ebp - 0x41c]
call fcn.00412324
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x41c]
call fcn.0041104c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004690ca
mov esp, ebp
pop ebp
ret

Function at 0x4ab11a
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0x4ab13e
push 0x100000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebp
ret
Function at 0x4adc5b
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bc365
mov eax, dword fs:[0]
push eax
sub esp, 0x2cc
mov eax, dword [0x4ec06c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2d8], ecx
and dword [ebp - 0x2c0], 0
push 0x24c
push 0
lea eax, [ebp - 0x2bc]
push eax
call fcn.0046d6f0
add esp, 0xc
push str.Thumbnails
call fcn.0044dd23
add eax, 0x20
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.0040e762
add esp, 0xc
and dword [ebp - 4], 0
push str..jpg
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.0040e762
add esp, 0xc
mov byte [ebp - 4], 1
lea eax, [ebp - 0x2c0]
push eax
lea ecx, [ebp - 0x58]
call fcn.00412374
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x2c4], eax
cmp dword [ebp - 0x2c4], 0xffffffff
je 0x4ade75
mov eax, dword [ebp - 0x2c0]
and eax, 0x10
je 0x4add1e
jmp 0x4ade5c
push 0x4cd1d8
lea eax, [ebp - 0x294]
push eax
call fcn.00471ed1
pop ecx
pop ecx
test eax, eax
jne 0x4add3f
jmp 0x4ade5c
push 0x4cd1dc
lea eax, [ebp - 0x294]
push eax
call fcn.00471ed1
pop ecx
pop ecx
test eax, eax
jne 0x4add60
jmp 0x4ade5c
push str.backgorund.jpg
lea eax, [ebp - 0x294]
push eax
call fcn.00471ed1
pop ecx
pop ecx
test eax, eax
jne 0x4add81
jmp 0x4ade5c
push str.background.jpg
lea eax, [ebp - 0x294]
push eax
call fcn.00471ed1
pop ecx
pop ecx
test eax, eax
jne 0x4adda2
jmp 0x4ade5c
push 0x4cd224
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.0040e762
add esp, 0xc
mov dword [ebp - 0x2cc], eax
mov eax, dword [ebp - 0x2cc]
mov dword [ebp - 0x2d0], eax
mov byte [ebp - 4], 2
lea eax, [ebp - 0x294]
push eax
push dword [ebp - 0x2d0]
lea eax, [ebp - 0x28]
push eax
call fcn.0040e80d
add esp, 0xc
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x70]
call fcn.004123b1
push 0
push 0x80
push 3
push 0
push 0
lea ecx, [ebp - 0x28]
call fcn.00412374
mov edx, SysReAllocString
mov ecx, eax
call fcn.00454ef9
mov dword [ebp - 0x2c8], eax
push 0
push dword [ebp - 0x2c8]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x2d4], eax
mov ecx, dword [ebp - 0x2c8]
call fcn.00454f9f
cmp dword [ebp - 0x2d4], 0
jne 0x4ade50
lea ecx, [ebp - 0x28]
call fcn.00412374
mov ecx, eax
call fcn.00454f7f
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.004123b1
lea edx, [ebp - 0x2c0]
mov ecx, dword [ebp - 0x2c4]
call fcn.00454fbf
test eax, eax
jne 0x4add09
mov ecx, dword [ebp - 0x2c4]
call fcn.00454fe4
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x58]
call fcn.004123b1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.004123b1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004690ca
mov esp, ebp
pop ebp
ret

Function at 0x4ae84b
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push str.Event_UnCompress
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x4f4fb0], eax
push 0
push 0
push dword [0x4f4fb0]
push 0x4ae824
push 0x100000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebp
ret
Function at 0x4ae889
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
mov eax, dword [0x4ec06c]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
call fcn.0040bcd5
mov ecx, eax
call fcn.004ac3e3
call fcn.0044dd23
movzx eax, byte [eax + 0x6c]
test eax, eax
jne 0x4ae97c
call fcn.0044dd23
movzx eax, byte [eax + 0x6d]
test eax, eax
je 0x4ae97c
call fcn.0044e4cd
xor eax, eax
mov word [ebp - 0x20c], ax
push 0x206
push 0
lea eax, [ebp - 0x20a]
push eax
call fcn.0046d6f0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [ebp - 0x248], 0x3c
mov dword [ebp - 0x244], 0x40
and dword [ebp - 0x240], 0
mov dword [ebp - 0x23c], str.runas
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x238], eax
mov dword [ebp - 0x234], 0x4cd780
and dword [ebp - 0x230], 0
mov dword [ebp - 0x22c], 5
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x228]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x4ae971
xor al, al
jmp 0x4ae97e
mov eax, dword [ebp - 0x210]
mov dword [0x4f4fb4], eax
mov al, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004690ca
mov esp, ebp
pop ebp
ret
Function at 0x4b00d8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
add ecx, 0x3ac
call fcn.00413352
cmp eax, dword [ebp + 8]
jne 0x4b00fe
push 1
mov ecx, dword [ebp - 4]
call fcn.004afd33
jmp 0x4b0156
mov ecx, dword [ebp - 4]
add ecx, 0x3b4
call fcn.00413352
cmp eax, dword [ebp + 8]
jne 0x4b012b
push 5
push 0
push 0
push str.http:__ie.sogou.com_installprotocol_
push 0x4cf57c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x4b0156
mov ecx, dword [ebp - 4]
add ecx, 0x3b8
call fcn.00413352
cmp eax, dword [ebp + 8]
jne 0x4b0156
push 5
push 0
push 0
push str.http:__corp.sogou.com_private.html
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
inc eax
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4b2b8d
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push dword [ebp + 8]
mov ecx, 0x4f569c
call fcn.0040c704
mov byte [0x4f56b4], 0
mov ecx, 0x4f56b8
call fcn.0041d23a
mov byte [ebp - 2], 0
mov byte [ebp - 1], 1
push 0
push 0
push 0
push 0x4b280c
push 0x100000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4b2c13
push 0xbb8
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4b2c0a
mov al, byte [0x4f56b4]
mov byte [ebp - 1], al
push 0x4f56b8
mov ecx, dword [ebp + 0xc]
call fcn.0040c704
mov byte [ebp - 2], 1
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, byte [ebp - 2]
test eax, eax
jne 0x4b2c27
mov byte [ebp - 1], 1
mov ecx, dword [ebp + 0xc]
call fcn.0041d23a
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret
Function at 0x4b2dc2
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x4ec06c]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
xor eax, eax
inc eax
imul eax, eax, 0
movsx eax, byte [eax + 0x4faf28]
test eax, eax
jne 0x4b2ee8
and dword [ebp - 0x54], 0
mov dword [ebp - 0x50], 0x40
push 0xfde9
push 0xffffffffffffffff
mov edx, 0x4cf738
lea ecx, [ebp - 0x2c]
call fcn.0042218f
pop ecx
pop ecx
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x50]
push eax
push 0x4faf28
lea eax, [ebp - 0x54]
push eax
push 0x4cf734
mov ecx, dword [ebp - 0x58]
call fcn.004122e7
push eax
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
je 0x4b2e3f
mov dword [ebp - 0x4c], 1
jmp 0x4b2e43
and dword [ebp - 0x4c], 0
mov al, byte [ebp - 0x4c]
mov byte [ebp - 0x45], al
lea ecx, [ebp - 0x2c]
call fcn.0041207b
movzx eax, byte [ebp - 0x45]
test eax, eax
je 0x4b2ee8
and dword [ebp - 0x14], 0
xor eax, eax
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0
xor edx, edx
lea ecx, [ebp - 0x14]
call fcn.0042b729
pop ecx
movzx eax, al
test eax, eax
je 0x4b2e9b
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push 0x4cf768
push 0x4faf28
call fcn.0041e8d9
add esp, 0x18
push 0xfde9
push 0xffffffffffffffff
mov edx, 0x4cf780
lea ecx, [ebp - 0x44]
call fcn.0042218f
pop ecx
pop ecx
mov dword [ebp - 0x5c], eax
push 0x4faf28
call fcn.0046f210
pop ecx
push eax
push 0x4faf28
push 1
push 0x4cf77c
mov ecx, dword [ebp - 0x5c]
call fcn.004122e7
push eax
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
lea ecx, [ebp - 0x44]
call fcn.0041207b
mov eax, 0x4faf28
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004690ca
mov esp, ebp
pop ebp
ret

Function at 0x4b383e
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x4ec06c]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x28], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x20], 6
jl 0x4b38b8
push 5
push str._dump
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x24]
push dword [ecx + eax]
call fcn.00472046
add esp, 0xc
test eax, eax
jne 0x4b38b8
push str.SE_Install
lea ecx, [ebp - 0x1c]
call fcn.0041185a
push dword [ebp - 0x20]
mov edx, dword [ebp - 0x24]
lea ecx, [ebp - 0x1c]
call fcn.00457d92
pop ecx
lea ecx, [ebp - 0x1c]
call fcn.004123b1
xor eax, eax
jmp 0x4b38d8
call fcn.00457f5c
push 0
push 0
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push dword [ebp + 8]
call fcn.004aef2b
add esp, 0x14
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004690ca
mov esp, ebp
pop ebp
ret 0x10