joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b64bb
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x12c4
call fcn.005a41d0
mov eax, dword [0x61dc40]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1260], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x127c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1264], eax
mov eax, dword [ebp + 0x18]
push esi
and eax, 0x20
push edi
mov dword [ebp - 0x1268], eax
xor eax, eax
push 0x124e
mov word [ebp - 0x125c], ax
xor esi, esi
lea eax, [ebp - 0x125a]
push esi
push eax
mov edi, ecx
call fcn.00596530
mov eax, dword [ebx + 0x10]
add esp, 0xc
cmp dword [ebx + 0xc], 2
jne 0x4b6541
cmp edi, esi
je 0x4b6541
mov esi, edi
call fcn.0049e118
test eax, eax
je 0x4b653d
mov eax, dword [eax + 0x155c]
jmp 0x4b653f
xor eax, eax
xor esi, esi
movzx ecx, word [ebx + 0xc]
movzx eax, ax
shl eax, 0x10
or eax, ecx
push eax
push str.__set
push dword [ebp + 0x18]
lea eax, [ebp - 0x125c]
push str.__flag
push dword [ebp + 0x14]
push str.__type
push 1
push str.__class
push dword [edi + 0x663c]
push str.__param
push dword [ebp - 0x127c]
push str.__msgwnd
push dword [ebp - 0x1260]
push str.__parent
push dword [0x6394fc]
push str.__hostwnd
push 0x63c060
push 0x5f38f0
push 0x927
push eax
call fcn.0058f42f
push 0x40
lea eax, [ebp - 0x12c0]
push esi
push eax
call fcn.00596530
xor eax, eax
mov dword [ebp - 0x1278], esi
add esp, 0x5c
lea edi, [ebp - 0x1274]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x1278]
push eax
lea eax, [ebp - 0x12c4]
push eax
mov eax, dword [ebp - 0x1268]
push esi
neg eax
push esi
sbb eax, eax
and eax, 0x40
push eax
push 1
push esi
push esi
lea eax, [ebp - 0x125c]
push eax
push esi
mov dword [ebp - 0x12c4], 0x44
mov dword [ebp - 0x1298], 0x80
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x1260], eax
cmp eax, esi
je 0x4b663c
cmp dword [ebp - 0x1274], esi
je 0x4b663c
push dword [ebp - 0x1274]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x1274], esi
cmp dword [ebp + 0x14], 1
jne 0x4b6677
xor eax, eax
cmp dword [ebp - 0x1268], esi
sete al
mov dword [ebx + 0x430], eax
mov eax, dword [ebp - 0x1278]
mov dword [ebx + 0x424], eax
mov eax, dword [ebp - 0x1270]
mov dword [ebx + 0x428], eax
mov eax, dword [ebp - 0x126c]
mov dword [ebx + 0x42c], eax
cmp dword [ebp - 0x1264], esi
je 0x4b668f
mov edi, dword [ebp - 0x1264]
lea esi, [ebp - 0x1278]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x1260]
pop edi
xor ecx, ebp
pop esi
call fcn.0058f3cf
leave
ret 0x14

Function at 0x4b78c9
Capabilities:
Hide graphical window

Disassembly:
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4b7900
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x4b7900
cmp dword [esp + 4], 0
je 0x4b78f5
push dword [esi + 4]
call dword [sym.imp.USER32.dll_DestroyWindow]
jmp 0x4b7900
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
ret 4
Function at 0x4b7f76
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, eax
push dword [esi + 4]
mov dword [0x6ccc20], 1
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4b7fa8
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x4b7fa8
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push ecx
call fcn.004b77cb
pop ecx
mov esi, eax
call fcn.004b78c9
pop esi
ret

Function at 0x4b9190
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push 8
mov eax, 0x5b7d40
call fcn.00598f2b
mov eax, dword [ebp + 8]
call fcn.0045168e
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4b9292
push 0xd
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x4b928c
push 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
push eax
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x4b9283
cmp word [eax], 0
mov ebx, eax
je 0x4b9283
cmp word [eax], 0
je 0x4b9247
movzx ecx, word [ebx]
cmp cx, 0xd
je 0x4b91ff
cmp cx, 0xa
jne 0x4b923f
cmp ebx, eax
jbe 0x4b923c
mov edi, ebx
sub edi, eax
sar edi, 1
push eax
mov ecx, 0x63696c
lea esi, [ebp - 0x10]
call fcn.00408d0c
and dword [ebp - 4], 0
mov esi, dword [ebp - 0x10]
cmp dword [esi - 0xc], 0
je 0x4b9230
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp + 8]
call fcn.004402ba
or dword [ebp - 4], 0xffffffff
lea eax, [esi - 0x10]
call fcn.00407b6b
lea eax, [ebx + 2]
inc ebx
inc ebx
cmp word [ebx], 0
jne 0x4b91ea
cmp ebx, eax
jbe 0x4b9283
mov edi, ebx
sub edi, eax
sar edi, 1
push eax
mov ecx, 0x63696c
lea esi, [ebp - 0x10]
call fcn.00408d0c
mov dword [ebp - 4], 1
mov esi, dword [ebp - 0x10]
cmp dword [esi - 0xc], 0
je 0x4b927b
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp + 8]
call fcn.004402ba
lea eax, [esi - 0x10]
call fcn.00407b6b
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
call fcn.00599003
ret
Function at 0x4bb105
Capabilities:
Get common file path

Disassembly:
push 0x4a0
mov eax, 0x5b99a6
call fcn.00598f94
mov ebx, ecx
mov eax, dword [ebp + 8]
cmp word [eax], 0
mov dword [ebp - 0x4a8], eax
je 0x4bb306
call fcn.0049e596
mov ecx, ebx
mov esi, eax
call fcn.0049e9f7
mov esi, eax
test esi, esi
je 0x4bb306
push 0x125c
call fcn.0058f82d
mov edi, eax
pop ecx
test edi, edi
je 0x4bb306
mov dword [edi], ebx
mov eax, dword [esi + 0x6654]
mov ecx, esi
mov dword [edi + 4], eax
call fcn.004410b2
push eax
push 0x5db9e0
lea eax, [edi + 8]
push 0x824
push eax
call fcn.0058f42f
xor eax, eax
mov ebx, 0x206
push ebx
push eax
mov word [ebp - 0x4a0], ax
lea eax, [ebp - 0x49e]
push eax
call fcn.00596530
add esp, 0x1c
lea eax, [ebp - 0x4a0]
push eax
mov esi, 0x103
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [edi + 0x1052]
push eax
mov dword [ebp - 0x4ac], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push 0x5f3e20
lea eax, [ebp - 0x4a0]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
xor eax, eax
push ebx
push eax
mov word [ebp - 0x298], ax
lea eax, [ebp - 0x296]
push eax
call fcn.00596530
add esp, 0xc
push dword [ebp - 0x4a8]
lea eax, [ebp - 0x298]
push str.DHFT__s_DHTF
push esi
push eax
call fcn.0058f42f
lea eax, [ebp - 0x298]
add esp, 0x10
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x4bb212
sub eax, ecx
sar eax, 1
lea esi, [eax + eax]
xor eax, eax
push 0x7e
push eax
mov word [ebp - 0x90], ax
lea eax, [ebp - 0x8e]
push eax
call fcn.00596530
add esp, 0xc
push 0x3f
push esi
lea ebx, [ebp - 0x90]
lea ecx, [ebp - 0x298]
call fcn.0046fd60
pop ecx
pop ecx
test eax, eax
je 0x4bb306
mov eax, ebx
push eax
lea eax, [ebp - 0x4a4]
push eax
call fcn.0040be27
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x4a4]
mov ebx, dword [eax - 0xc]
push ebx
lea esi, [ebp - 0x4a4]
call fcn.0040c2c1
lea ecx, [ebx + 1]
push ecx
push eax
call fcn.005958b2
push eax
call fcn.004077ed
add esp, 0xc
mov eax, ebx
mov edx, esi
call fcn.0040c36a
mov eax, dword [0x63696c]
mov ecx, 0x63696c
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x4a8], eax
mov byte [ebp - 4], 1
push dword [ebp - 0x4a4]
lea eax, [ebp - 0x4a8]
push str.username_s
call fcn.0040c5ed
mov esi, dword [ebp - 0x4a8]
mov eax, dword [esi - 0xc]
pop ecx
pop ecx
push edi
push eax
push esi
push dword [ebp - 0x4ac]
call fcn.004437e7
mov edi, eax
call fcn.00443e4a
lea eax, [esi - 0x10]
call fcn.00407b6b
mov eax, dword [ebp - 0x4a4]
add eax, 0xfffffff0
call fcn.00407b6b
call fcn.00599017
ret 4
Function at 0x4bb35f
Capabilities:
Check if file exists

Disassembly:
push 0xf4
mov eax, 0x5bea0e
call fcn.00598fca
mov esi, ecx
mov dword [ebp - 0xe4], esi
test esi, esi
je 0x4bb56a
lea ebx, [esi + 8]
cmp word [ebx], 0
je 0x4bb56a
lea edi, [esi + 0x1052]
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4bb56a
call fcn.0049e596
mov ecx, dword [esi]
mov esi, eax
call fcn.0049e9f7
test eax, eax
je 0x4bb56a
push ebx
mov ecx, eax
call fcn.004410b2
push eax
call fcn.0058f69a
pop ecx
pop ecx
test eax, eax
jne 0x4bb56a
and dword [ebp - 4], eax
lea eax, [ebp - 0xd8]
push eax
call fcn.00548b11
lea eax, [ebp - 0x48]
push eax
xor ebx, ebx
mov byte [ebp - 4], 1
call fcn.0054af1d
mov edx, edi
lea ecx, [ebp - 0x100]
mov byte [ebp - 4], 2
call fcn.00426b05
lea ecx, [ebp - 0x48]
push ecx
push eax
lea ebx, [ebp - 0xd8]
mov byte [ebp - 4], 3
call fcn.00548b5a
xor edi, edi
push edi
push 1
lea ecx, [ebp - 0x100]
mov bl, al
mov byte [ebp - 4], 2
call fcn.00407567
test bl, bl
je 0x4bb553
cmp byte [ebp - 0x40], 0
je 0x4bb553
lea eax, [ebp - 0x48]
call fcn.0054bd37
test al, al
je 0x4bb553
mov edx, str.errno
lea ecx, [ebp - 0x48]
call fcn.0054b949
cmp byte [eax + 8], 1
jne 0x4bb553
mov ecx, eax
call fcn.0054b340
cmp eax, 1
jne 0x4bb553
mov edx, str.data
lea ecx, [ebp - 0x48]
call fcn.0054b949
mov esi, eax
cmp byte [esi + 8], 0
je 0x4bb553
call fcn.0054bd37
test al, al
je 0x4bb553
mov edx, 0x5f3eac
mov ecx, esi
call fcn.0054b949
mov cl, byte [eax + 8]
test cl, cl
je 0x4bb553
cmp cl, 4
jne 0x4bb553
mov eax, dword [eax]
cmp eax, edi
je 0x4bb553
push eax
lea eax, [ebp - 0xdc]
push eax
call fcn.0047f54f
pop ecx
pop ecx
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0xdc]
cmp dword [eax - 0xc], edi
je 0x4bb54b
mov edx, str.pass
mov ecx, esi
call fcn.0054b949
mov cl, byte [eax + 8]
test cl, cl
je 0x4bb545
cmp cl, 4
jne 0x4bb545
mov eax, dword [eax]
cmp eax, edi
je 0x4bb545
push eax
lea eax, [ebp - 0xe0]
push eax
call fcn.0047f54f
pop ecx
pop ecx
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0xe0]
cmp dword [eax - 0xc], edi
je 0x4bb53d
mov esi, dword [ebp - 0xdc]
mov ebx, eax
call fcn.004bb5b1
mov ecx, dword [ebp - 0xe4]
push ebx
push esi
push dword [ecx + 4]
call fcn.004bb62b
mov eax, dword [ebp - 0xe0]
add eax, 0xfffffff0
call fcn.00407b6b
mov eax, dword [ebp - 0xdc]
add eax, 0xfffffff0
call fcn.00407b6b
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 1
call fcn.0054b1a0
lea eax, [ebp - 0xd8]
call fcn.0040b0d5
call fcn.00599026
ret

Function at 0x4bb612
Capabilities:
Hide graphical window

Disassembly:
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4bb62a
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
ret
Function at 0x4bbcd7
Capabilities:
Check if file exists
Delete file
Get common file path

Disassembly:
push 0x224
mov eax, 0x5be9b2
call fcn.00598f94
mov esi, ecx
xor ebx, ebx
lea eax, [esi + 8]
mov dword [esi], ebx
call fcn.0045168e
lea edi, [esi + 0x20]
call fcn.0051562f
call fcn.00426146
test eax, eax
jne 0x4bbe03
call fcn.004bbe26
xor eax, eax
push 0x208
mov word [ebp - 0x220], ax
lea eax, [ebp - 0x21e]
push ebx
push eax
call fcn.00596530
add esp, 0xc
lea eax, [ebp - 0x220]
push eax
push 0x103
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x224], eax
mov eax, dword [0x63696c]
mov esi, 0x63696c
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x22c], eax
push dword [ebp - 0x224]
lea eax, [ebp - 0x220]
push eax
push 0x5f3fcc
lea eax, [ebp - 0x22c]
mov dword [ebp - 4], ebx
call fcn.00404f66
mov ebx, dword [ebp - 0x22c]
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0xc
push ebx
call edi
test eax, eax
je 0x4bbd9f
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
call edi
test eax, eax
jne 0x4bbdfb
mov eax, dword [0x63696c]
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x228], eax
push 0x6bad88
push str.http:__update.123juzi.net_getupdatej.php_tn_s
lea eax, [ebp - 0x228]
mov byte [ebp - 4], 1
call fcn.00404f66
mov esi, dword [ebp - 0x228]
pop ecx
pop ecx
push dword [ebp - 0x224]
push 0x4bbe09
push ebx
push esi
call fcn.004437e7
mov edi, eax
call fcn.00443d04
lea eax, [esi - 0x10]
call fcn.00407b6b
lea eax, [ebx - 0x10]
call fcn.00407b6b
call fcn.00599017
ret

Function at 0x4bc026
Capabilities:
Check if file exists
Delete file
Get common file path

Disassembly:
push 0x218
mov eax, 0x5be923
call fcn.00598f94
lea eax, [ebp - 0x218]
push eax
push 0x103
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov eax, dword [0x63696c]
mov esi, 0x63696c
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x220], eax
push dword [ebp + 8]
and dword [ebp - 4], 0
lea eax, [ebp - 0x218]
push eax
push 0x5f3fcc
lea eax, [ebp - 0x220]
call fcn.00404f66
mov edi, dword [ebp - 0x220]
add esp, 0xc
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4bc103
mov eax, dword [0x63696c]
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x21c]
push eax
push edi
mov byte [ebp - 4], 1
call fcn.00426a69
mov esi, dword [ebp - 0x21c]
push esi
lea ebx, [ebp - 0x224]
call fcn.0047f402
add esp, 0xc
push 0
mov byte [ebp - 4], 2
mov ebx, dword [ebp - 0x224]
push 0
push str.TNJDAT
mov edx, ebx
mov ecx, str.TNMGR
call fcn.00408282
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebx - 0x10]
call fcn.00407b6b
lea eax, [esi - 0x10]
call fcn.00407b6b
lea eax, [edi - 0x10]
call fcn.00407b6b
call fcn.00599017
ret 4
Function at 0x4bf8b1
Capabilities:
Inspect load icon resource

Disassembly:
push ebx
push ebp
push edi
push 0x7e2
push dword [0x639508]
call dword [sym.imp.USER32.dll_LoadIconW]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
mov ebp, eax
push ebp
push 0
mov ebx, 0x80
push ebx
push dword [esi + 4]
call edi
push ebp
push 1
push ebx
push dword [esi + 4]
call edi
mov eax, dword [esi + 0x2e4]
imul eax, eax, 0x3e8
push esi
mov dword [esi + 0x2c8], eax
call fcn.004bfe0e
mov ecx, esi
call fcn.004bfebd
mov eax, esi
call fcn.004c11b4
push dword [esi + 4]
call fcn.00501212
pop ecx
mov dword [esi + 0x2d4], eax
test eax, eax
je 0x4bf95c
lea ecx, [esi + 0x28]
mov dword [eax + 0x7c], ecx
mov eax, dword [esi + 0x2d4]
add eax, 0x6c
mov dword [eax + 8], 0x61f1f8
mov dword [eax + 0xc], 6
push dword [esi + 0x2e0]
push dword [esi + 0x2d4]
call fcn.005018f8
mov eax, dword [esi + 0x2d4]
push 4
push dword [eax + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x4c02a4
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x48
push esi
xor esi, esi
push edi
cmp dword [0x645910], esi
jne 0x4c0452
mov dword [0x645910], 1
cmp dword [ebx + 0x2d8], esi
jne 0x4c0452
push esi
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], esi
call dword [sym.imp.USER32.dll_MonitorFromRect]
mov edx, eax
cmp edx, esi
je 0x4c0326
push 9
pop ecx
xor eax, eax
mov dword [esp + 0x28], 0x28
lea edi, [esp + 0x2c]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x28]
push eax
push edx
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.USER32.dll_CopyRect]
jmp 0x4c034b
push esi
lea eax, [esp + 0x1c]
push eax
push esi
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
test eax, eax
jne 0x4c034b
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebx + 0x2e8]
call fcn.005138c4
mov dword [esp + 8], eax
mov eax, dword [ebx + 0x2ec]
call fcn.005138c4
mov edi, dword [esp + 0x20]
sub edi, dword [esp + 0x18]
mov dword [esp + 0xc], eax
push 3
pop eax
call fcn.005138c4
sub edi, dword [esp + 8]
mov esi, dword [ebx + 0xac]
sub edi, eax
mov eax, dword [ebx + 0x2d4]
mov dword [esp + 0x10], edi
mov edi, dword [esp + 0x24]
sub edi, dword [esp + 0x1c]
test eax, eax
je 0x4c03b6
push 0x210
push dword [esp + 0x10]
push dword [esp + 0x10]
push esi
push 0
push 0
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [esp + 0xc]
push 0x50
add esi, eax
push esi
push dword [esp + 0x10]
push edi
push dword [esp + 0x20]
push 0xffffffffffffffff
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SetWindowPos]
xor esi, esi
inc esi
mov dword [ebx + 0x2c0], esi
call dword [sym.imp.WINMM.dll_timeGetTime]
mov dword [ebx + 0x2c4], eax
mov eax, dword [ebx + 4]
lea edi, [ebx + 0x2b0]
push eax
mov dword [edi], eax
mov dword [edi + 4], 0x7b
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4c0411
push 0x1e
mov esi, edi
call fcn.0051a420
xor esi, esi
inc esi
mov eax, dword [ebx + 0x2f0]
push 4
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
push eax
push 4
push str.vbdver
push str.Softwarehao123JuziBrowser
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov dword [ebx + 0x2dc], esi
call fcn.0045f8eb
push esi
push 6
pop ecx
mov edx, str.hao123vbox
call fcn.0045f9b4
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4c0b1d
Capabilities:
Inspect load icon resource

Disassembly:
push 0x8c
mov eax, 0x5c0091
call fcn.00598f94
push 0x7e8
push dword [0x639508]
call dword [sym.imp.USER32.dll_LoadIconW]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x98], eax
push dword [ebp - 0x98]
mov eax, dword [esi + 4]
push 0
mov ebx, 0x80
push ebx
push eax
call edi
push dword [ebp - 0x98]
mov eax, dword [esi + 4]
push 1
push ebx
push eax
call edi
push esi
call fcn.004c0d92
mov ecx, esi
call fcn.004c0e4e
push 0x5f4798
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov eax, esi
call fcn.004c11b4
push dword [esi + 4]
call fcn.00501212
pop ecx
mov dword [esi + 0x2b0], eax
test eax, eax
je 0x4c0c61
lea ecx, [esi + 0x28]
mov dword [eax + 0x7c], ecx
mov eax, dword [esi + 0x2b0]
mov dword [eax + 0x74], 0x61f1c8
mov dword [eax + 0x78], 6
xor eax, eax
push 0x7e
push eax
mov word [ebp - 0x94], ax
lea eax, [ebp - 0x92]
push eax
call fcn.00596530
add esp, 0xc
lea eax, [ebp - 0x94]
push 0x3f
push eax
call fcn.0042e250
mov eax, dword [0x63696c]
pop ecx
pop ecx
mov ecx, 0x63696c
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x98], eax
and dword [ebp - 4], 0
xor eax, eax
cmp ax, word [0x63f288]
jne 0x4c0c16
call fcn.00404168
jmp 0x4c0c1b
mov eax, 0x63f288
lea ecx, [ebp - 0x94]
push ecx
push eax
push str.http:__www.hao123.com_vbox_ver_scid_sfrvbox
lea eax, [ebp - 0x98]
call fcn.00404f66
mov edi, dword [ebp - 0x98]
add esp, 0xc
push edi
push dword [esi + 0x2b0]
call fcn.005018f8
mov eax, dword [esi + 0x2b0]
push 4
push dword [eax + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, [edi - 0x10]
call fcn.00407b6b
xor eax, eax
call fcn.00599017
ret

Function at 0x4c1ce6
Capabilities:
Suspend thread
Terminate thread

Disassembly:
push ebx
mov ecx, esi
call fcn.004c2796
mov eax, dword [esi + 0x64]
xor ebx, ebx
cmp eax, ebx
je 0x4c1d42
push edi
push ebx
push ebx
push 0x12
push eax
call dword [sym.imp.USER32.dll_PostThreadMessageW]
push dword [esi + 0x64]
push ebx
push 0x1f03ff
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov edi, eax
cmp edi, ebx
je 0x4c1d3e
push 0x3e8
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4c1d37
push edi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x64], ebx
pop edi
pop ebx
ret
Function at 0x4c35cf
Capabilities:
Enumerate files on windows

Disassembly:
push 0x688
mov eax, 0x5b6655
call fcn.00598f94
mov eax, dword [ebp + 8]
mov dword [ebp - 0x678], eax
xor eax, eax
mov esi, 0x206
xor edi, edi
push esi
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push edi
push eax
mov dword [ebp - 0x674], edi
call fcn.00596530
add esp, 0xc
push edi
lea eax, [ebp - 0x218]
call fcn.00404119
xor eax, eax
push esi
mov word [ebp - 0x420], ax
lea eax, [ebp - 0x41e]
push edi
push eax
call fcn.00596530
add esp, 0xc
push str.Cookies
lea eax, [ebp - 0x218]
push eax
push str._s_s.
lea eax, [ebp - 0x420]
push 0x103
push eax
call fcn.0058f42f
add esp, 0x14
push 0x24c
lea eax, [ebp - 0x66c]
push edi
push eax
mov dword [ebp - 0x670], edi
call fcn.00596530
add esp, 0xc
lea eax, [ebp - 0x670]
push eax
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4c3696
xor eax, eax
jmp 0x4c3734
lea eax, [ebp - 0x644]
push 0x5e23ec
push eax
call fcn.0058f69a
pop ecx
pop ecx
test eax, eax
je 0x4c3711
lea eax, [ebp - 0x644]
push 0x5ed394
push eax
call fcn.0058f69a
pop ecx
pop ecx
test eax, eax
je 0x4c3711
test byte [ebp - 0x670], 0x10
je 0x4c3711
lea esi, [ebp - 0x644]
call fcn.0047f2c2
test eax, eax
je 0x4c3711
mov eax, esi
push eax
lea esi, [ebp - 0x694]
call fcn.0040863b
mov eax, esi
push eax
mov eax, dword [ebp - 0x678]
mov dword [ebp - 4], edi
call fcn.00408726
or dword [ebp - 4], 0xffffffff
push edi
push 1
call fcn.00404eaf
mov dword [ebp - 0x674], 1
lea eax, [ebp - 0x670]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4c3696
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x674]
call fcn.00599017
ret 4
Function at 0x4c77eb
Capabilities:
Log keystrokes via polling

Disassembly:
push 0x10
mov eax, 0x5c2227
call fcn.00598f2b
mov eax, dword [0x63696c]
mov esi, 0x63696c
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x18], eax
xor edi, edi
mov dword [ebp - 4], edi
mov eax, dword [0x63696c]
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0xc]
mov byte [ebp - 4], 1
push dword [ebp + 0x10]
lea ebx, [ebp - 0x14]
push 0x63cc98
mov dword [ebp - 0x14], edi
call fcn.0040dfc1
test eax, eax
je 0x4c78c4
cmp dword [ebp - 0x14], edi
jne 0x4c78c4
mov esi, dword [ebp + 8]
push dword [ebp + 0xc]
lea eax, [ebp + 0x10]
mov ecx, esi
mov dword [ebp + 0x10], edi
call fcn.004cee03
push dword [ebp + 0x10]
lea ebx, [esi + 0x9ac]
mov eax, ebx
call fcn.0053b9ae
cmp eax, edi
je 0x4c7879
cmp dword [eax + 0x24], 0xffffffff
jne 0x4c789a
push 1
push ecx
push edi
push edi
push edi
push edi
push dword [ebp - 0x10]
xor ecx, ecx
call fcn.0042598d
add esp, 0x18
push eax
push dword [ebp - 0x10]
push dword [ebp + 0x10]
push ebx
call fcn.0053b8f7
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
mov edx, dword [ebp - 0x10]
add esi, 0x1428
shr eax, 8
movzx eax, al
mov ecx, eax
or ecx, dword [ebp + 0x18]
or eax, dword [ebp + 0x14]
push ecx
push eax
push esi
push 3
pop ecx
call fcn.004ba26b
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00407b6b
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.00407b6b
call fcn.00599003
ret 0x14
Function at 0x4d62be
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5c175e
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x61dc40]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
lea eax, [esp + 0x14]
push eax
call fcn.00440517
lea eax, [esp + 0x14]
xor edi, edi
push eax
mov dword [esp + 0x3c], edi
call fcn.004ab9aa
mov ebx, eax
call fcn.004ac52f
mov eax, dword [esp + 0x24]
sub eax, dword [esp + 0x20]
sar eax, 2
test eax, eax
jbe 0x4d6360
xor ebx, ebx
inc ebx
lea esi, [esp + 0x14]
call fcn.004750c1
mov esi, dword [eax]
lea ecx, [esi + 0x9ac]
mov eax, dword [ecx]
call dword [eax + 0x18]
push ebx
push 0
push 0xffffffffffffffff
push esi
call fcn.004ceb4a
mov dword [esi + 0x1518], ebx
mov dword [esi + 0x151c], ebx
mov dword [esi + 0x1520], ebx
mov eax, dword [esp + 0x24]
sub eax, dword [esp + 0x20]
inc edi
sar eax, 2
cmp edi, eax
jb 0x4d631d
cmp dword [ebp + 8], 0
jne 0x4d6376
inc dword [0x63ccd0]
call fcn.0044612c
call fcn.0044868b
call fcn.004ab9aa
mov eax, dword [eax + 0x9c]
test eax, eax
je 0x4d6397
push 0
push 0x64
push 0x100f
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SetTimer]
lea esi, [esp + 0x14]
call fcn.0047509e
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret