joyce8/EMBER2024-capa huggingface dataset:
Function at 0x466e70
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
push edi
push ecx
lea edi, [ebp - 0x3c]
mov ecx, 0xf
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 0x340], 0
je 0x466ec9
mov esi, esp
call dword [sym.imp.USER32.dll_ReleaseCapture]
cmp esi, esp
call fcn.004c39d6
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x340], 0
mov edx, dword [ebp - 4]
cmp dword [edx + 0x330], 0
je 0x466fb9
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x330]
push ecx
call fcn.00416b20
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x466fac
push 2
push 0
mov edx, dword [ebp - 0x10]
push edx
mov ecx, dword [ebp - 4]
call fcn.00468140
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov edx, dword [eax + 0x330]
cmp edx, dword [ecx + 0x32c]
jne 0x466fac
mov eax, dword [ebp + 0xc]
and eax, 0xffff
movzx ecx, ax
mov edx, dword [ebp + 0x10]
and edx, 0xffff
movzx eax, dx
shl eax, 0x10
or ecx, eax
push ecx
mov ecx, dword [ebp + 8]
push ecx
push 0x202
mov ecx, dword [ebp - 0x10]
call fcn.00416c00
mov ecx, dword [ebp - 0x10]
call fcn.00453820
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x466f8e
mov edx, dword [ebp - 0x14]
movzx eax, word [edx]
test eax, eax
je 0x466f8e
mov esi, esp
push 1
push 0
push 0
mov ecx, dword [ebp - 0x14]
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp esi, esp
call fcn.004c39d6
mov dword [ebp - 0x18], eax
jmp 0x466fac
mov ecx, dword [ebp - 0x10]
call fcn.00431af0
test eax, eax
je 0x466fac
mov dword [ebp - 8], 1
mov ecx, dword [ebp - 0x10]
call fcn.00431af0
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 4]
mov dword [edx + 0x330], 0
cmp dword [ebp - 8], 0
je 0x46702f
mov dword [ebp - 0x28], 1
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.00452970
mov dword [ebp - 0x2c], eax
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
mov esi, esp
mov ecx, dword [ebp - 0x10]
mov eax, dword [edx + 8]
call eax
cmp esi, esp
call fcn.004c39d6
mov dword [ebp - 0x20], eax
mov esi, esp
lea ecx, [ebp - 0x30]
push ecx
mov edx, dword [ebp - 0x2c]
push edx
push 0x4e
lea eax, [ebp - 0x3c]
push eax
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.004206d0
mov ecx, eax
call fcn.004636c0
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
cmp esi, esp
call fcn.004c39d6
mov dword [ebp - 0x38], eax
push edx
mov ecx, ebp
push eax
lea edx, [0x467054]
call fcn.004c39f9
pop eax
pop edx
pop edi
pop esi
add esp, 0x3c
cmp ebp, esp
call fcn.004c39d6
mov esp, ebp
pop ebp
ret 0xc
Function at 0x467bf0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov dword [ebp - 4], 0xcccccccc
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.00452930
test eax, eax
je 0x467c66
mov esi, esp
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
cmp esi, esp
call fcn.004c39d6
movsx eax, ax
test eax, eax
jl 0x467c5c
cmp dword [ebp + 8], 0x1b
jne 0x467c42
push 0
push 2
push 0x111
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.0040ead0
jmp 0x467c5c
cmp dword [ebp + 8], 0xd
jne 0x467c5c
push 0
push 1
push 0x111
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.0040ead0
push 0
mov ecx, dword [ebp - 4]
call fcn.004732a0
pop esi
add esp, 4
cmp ebp, esp
call fcn.004c39d6
mov esp, ebp
pop ebp
ret 0xc
Function at 0x46bf30
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c695b
mov eax, dword fs:[0]
push eax
sub esp, 0x288
push esi
push edi
push ecx
lea edi, [ebp - 0x294]
mov ecx, 0xa2
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x4f3280]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
mov word [ebp - 0x220], 0
push 0x206
push 0
lea eax, [ebp - 0x21e]
push eax
call fcn.004a1d00
add esp, 0xc
mov esi, esp
push 0x104
lea ecx, [ebp - 0x220]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp esi, esp
call fcn.004c39d6
mov esi, esp
lea edx, [ebp - 0x220]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
cmp esi, esp
call fcn.004c39d6
mov esi, esp
push str.QQPCFTSysShortTask.exe
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
cmp esi, esp
call fcn.004c39d6
lea ecx, [ebp - 0x22c]
call fcn.00417ee0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x220]
push ecx
push str.__s___Start_Restore_65535
lea edx, [ebp - 0x22c]
push edx
call fcn.0041b3f0
add esp, 0xc
mov dword [ebp - 0x244], 0
xor eax, eax
mov dword [ebp - 0x240], eax
mov dword [ebp - 0x23c], eax
mov dword [ebp - 0x238], eax
push 0x44
push 0
lea ecx, [ebp - 0x290]
push ecx
call fcn.004a1d00
add esp, 0xc
mov dword [ebp - 0x290], 0x44
mov dword [ebp - 0x264], 0x181
mov word [ebp - 0x260], 0
mov esi, esp
lea edx, [ebp - 0x244]
push edx
lea eax, [ebp - 0x290]
push eax
push 0
push 0
push 0x2000000
push 0
push 0
push 0
lea ecx, [ebp - 0x22c]
call fcn.004636c0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp esi, esp
call fcn.004c39d6
test eax, eax
je 0x46c0de
mov esi, esp
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x244]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp esi, esp
call fcn.004c39d6
mov esi, esp
mov edx, dword [ebp - 0x244]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.004c39d6
mov esi, esp
mov eax, dword [ebp - 0x240]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.004c39d6
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x22c]
call fcn.00403050
push edx
mov ecx, ebp
push eax
lea edx, [0x46c12c]
call fcn.004c39f9
pop eax
pop edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a1723
add esp, 0x294
cmp ebp, esp
call fcn.004c39d6
mov esp, ebp
pop ebp
ret
Function at 0x46ca70
Capabilities:
Check for time delay via gettickcount
Create thread
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
mov eax, 0xcccccccc
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov dword [ebp - 4], ecx
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp esi, esp
call fcn.004c39d6
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
call fcn.00471090
push 0
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.0046a130
call fcn.00433330
mov ecx, eax
call fcn.00433ef0
mov dword [ebp - 0xc], eax
push 1
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.0046a130
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.0046a170
cmp dword [ebp - 0xc], 0
jne 0x46caf1
jmp 0x46cc33
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp esi, esp
call fcn.004c39d6
sub eax, dword [ebp - 8]
mov dword [0x4f85dc], eax
push 0x7533
mov ecx, dword [ebp - 4]
call fcn.00472130
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x504], eax
push 0x7534
mov ecx, dword [ebp - 4]
call fcn.00472130
mov edx, dword [ebp - 4]
mov dword [edx + 0x508], eax
push 0x7535
mov ecx, dword [ebp - 4]
call fcn.00472130
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x50c], eax
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x504]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x50c]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x508]
push ecx
call fcn.00433330
mov ecx, eax
call fcn.00438230
mov ecx, dword [ebp - 4]
call fcn.0046c7d0
mov dword [ebp - 0x14], 0
lea edx, [ebp - 0x14]
push edx
push 0
mov eax, dword [ebp - 4]
push eax
push 0x46c960
push 0
push 0
call fcn.004a6932
add esp, 0x18
mov esi, esp
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp esi, esp
call fcn.004c39d6
mov ecx, dword [ebp - 4]
cmp eax, dword [ecx + 4]
je 0x46cc33
mov esi, esp
push 0
mov edi, esp
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp edi, esp
call fcn.004c39d6
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp esi, esp
call fcn.004c39d6
mov dword [ebp - 0x1c], eax
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp esi, esp
call fcn.004c39d6
mov dword [ebp - 0x20], eax
mov esi, esp
push 1
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
cmp esi, esp
call fcn.004c39d6
mov esi, esp
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
cmp esi, esp
call fcn.004c39d6
mov esi, esp
push 0
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.USER32.dll_AttachThreadInput]
cmp esi, esp
call fcn.004c39d6
push edx
mov ecx, ebp
push eax
lea edx, [0x46cc54]
call fcn.004c39f9
pop eax
pop edx
pop edi
pop esi
add esp, 0x20
cmp ebp, esp
call fcn.004c39d6
mov esp, ebp
pop ebp
ret
Function at 0x46e7c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c695b
mov eax, dword fs:[0]
push eax
sub esp, 0x288
push esi
push edi
push ecx
lea edi, [ebp - 0x294]
mov ecx, 0xa2
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x4f3280]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x14]
call fcn.00471090
mov ecx, dword [ebp - 0x14]
add ecx, 0x570
call fcn.00407210
push eax
push 0x201
call fcn.00433330
mov ecx, eax
call fcn.0043a3d0
mov word [ebp - 0x220], 0
push 0x206
push 0
lea eax, [ebp - 0x21e]
push eax
call fcn.004a1d00
add esp, 0xc
mov esi, esp
push 0x104
lea ecx, [ebp - 0x220]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp esi, esp
call fcn.004c39d6
mov esi, esp
lea edx, [ebp - 0x220]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
cmp esi, esp
call fcn.004c39d6
mov esi, esp
push 0x4d729c
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
cmp esi, esp
call fcn.004c39d6
lea ecx, [ebp - 0x22c]
call fcn.00417ee0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x220]
push ecx
push 0x4d72c0
lea edx, [ebp - 0x22c]
push edx
call fcn.0041b3f0
add esp, 0xc
mov dword [ebp - 0x244], 0
xor eax, eax
mov dword [ebp - 0x240], eax
mov dword [ebp - 0x23c], eax
mov dword [ebp - 0x238], eax
push 0x44
push 0
lea ecx, [ebp - 0x290]
push ecx
call fcn.004a1d00
add esp, 0xc
mov dword [ebp - 0x290], 0x44
mov dword [ebp - 0x264], 0x80
mov esi, esp
lea edx, [ebp - 0x244]
push edx
lea eax, [ebp - 0x290]
push eax
push 0
push 0
push 0x2000000
push 0
push 0
push 0
lea ecx, [ebp - 0x22c]
call fcn.004636c0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp esi, esp
call fcn.004c39d6
test eax, eax
je 0x46e975
mov esi, esp
mov ecx, dword [ebp - 0x244]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.004c39d6
mov esi, esp
mov edx, dword [ebp - 0x240]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.004c39d6
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp dword [eax + 0x568], 0
setne cl
add ecx, 0x99
push ecx
mov ecx, dword [ebp - 0x14]
call fcn.0046c190
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x22c]
call fcn.00403050
push edx
mov ecx, ebp
push eax
lea edx, [0x46e9e0]
call fcn.004c39f9
pop eax
pop edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a1723
add esp, 0x294
cmp ebp, esp
call fcn.004c39d6
mov esp, ebp
pop ebp
ret
Function at 0x46ea40
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c695b
mov eax, dword fs:[0]
push eax
sub esp, 0x288
push esi
push edi
push ecx
lea edi, [ebp - 0x294]
mov ecx, 0xa2
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x4f3280]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x14]
call fcn.00471090
push 0
push 0x1fd
call fcn.00433330
mov ecx, eax
call fcn.0043a3d0
mov word [ebp - 0x220], 0
push 0x206
push 0
lea eax, [ebp - 0x21e]
push eax
call fcn.004a1d00
add esp, 0xc
mov esi, esp
push 0x104
lea ecx, [ebp - 0x220]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp esi, esp
call fcn.004c39d6
mov esi, esp
lea edx, [ebp - 0x220]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
cmp esi, esp
call fcn.004c39d6
mov esi, esp
push 0x4d72cc
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
cmp esi, esp
call fcn.004c39d6
lea ecx, [ebp - 0x22c]
call fcn.00417ee0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x220]
push ecx
push str.__s____TAB_SYSSTARTUP__QuickScan__pcmgr
lea edx, [ebp - 0x22c]
push edx
call fcn.0041b3f0
add esp, 0xc
mov dword [ebp - 0x244], 0
xor eax, eax
mov dword [ebp - 0x240], eax
mov dword [ebp - 0x23c], eax
mov dword [ebp - 0x238], eax
push 0x44
push 0
lea ecx, [ebp - 0x290]
push ecx
call fcn.004a1d00
add esp, 0xc
mov dword [ebp - 0x290], 0x44
mov dword [ebp - 0x264], 0x80
mov esi, esp
lea edx, [ebp - 0x244]
push edx
lea eax, [ebp - 0x290]
push eax
push 0
push 0
push 0x2000000
push 0
push 0
push 0
lea ecx, [ebp - 0x22c]
call fcn.004636c0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp esi, esp
call fcn.004c39d6
test eax, eax
je 0x46ebe8
mov esi, esp
mov ecx, dword [ebp - 0x244]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.004c39d6
mov esi, esp
mov edx, dword [ebp - 0x240]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.004c39d6
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x568]
neg ecx
sbb ecx, ecx
and ecx, 0xa
add ecx, 0x85
push ecx
mov ecx, dword [ebp - 0x14]
call fcn.0046c190
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x22c]
call fcn.00403050
push edx
mov ecx, ebp
push eax
lea edx, [0x46ec54]
call fcn.004c39f9
pop eax
pop edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a1723
add esp, 0x294
cmp ebp, esp
call fcn.004c39d6
mov esp, ebp
pop ebp
ret
Function at 0x46f540
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov dword [ebp - 4], 0xcccccccc
mov dword [ebp - 4], ecx
mov esi, esp
push 0
push 0
push 0
push str.http:__guanjia.qq.com_
push 0x4d7468
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp esi, esp
call fcn.004c39d6
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x568]
neg eax
sbb eax, eax
and eax, 0xa
add eax, 0x68
push eax
mov ecx, dword [ebp - 4]
call fcn.0046c190
pop esi
add esp, 4
cmp ebp, esp
call fcn.004c39d6
mov esp, ebp
pop ebp
ret
Function at 0x46fd30
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c695b
mov eax, dword fs:[0]
push eax
sub esp, 0x288
push esi
push edi
push ecx
lea edi, [ebp - 0x294]
mov ecx, 0xa2
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x4f3280]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x14]
call fcn.00471090
mov ecx, dword [ebp - 0x14]
add ecx, 0x570
call fcn.00407350
push eax
push 0x204
call fcn.00433330
mov ecx, eax
call fcn.0043a3d0
mov word [ebp - 0x220], 0
push 0x206
push 0
lea eax, [ebp - 0x21e]
push eax
call fcn.004a1d00
add esp, 0xc
mov esi, esp
push 0x104
lea ecx, [ebp - 0x220]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp esi, esp
call fcn.004c39d6
mov esi, esp
lea edx, [ebp - 0x220]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
cmp esi, esp
call fcn.004c39d6
mov esi, esp
push 0x4d754c
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
cmp esi, esp
call fcn.004c39d6
lea ecx, [ebp - 0x22c]
call fcn.00417ee0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x220]
push ecx
push str.__s____IntoMode404__TAB_SYSCLEAN__SysScan__pcmgr__StartFromRecycleRight
lea edx, [ebp - 0x22c]
push edx
call fcn.0041b3f0
add esp, 0xc
mov dword [ebp - 0x244], 0
xor eax, eax
mov dword [ebp - 0x240], eax
mov dword [ebp - 0x23c], eax
mov dword [ebp - 0x238], eax
push 0x44
push 0
lea ecx, [ebp - 0x290]
push ecx
call fcn.004a1d00
add esp, 0xc
mov dword [ebp - 0x290], 0x44
mov dword [ebp - 0x264], 0x80
mov esi, esp
lea edx, [ebp - 0x244]
push edx
lea eax, [ebp - 0x290]
push eax
push 0
push 0
push 0x2000000
push 0
push 0
push 0
lea ecx, [ebp - 0x22c]
call fcn.004636c0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp esi, esp
call fcn.004c39d6
test eax, eax
je 0x46fee5
mov esi, esp
mov ecx, dword [ebp - 0x244]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.004c39d6
mov esi, esp
mov edx, dword [ebp - 0x240]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.004c39d6
push 0x9b
mov ecx, dword [ebp - 0x14]
call fcn.0046c190
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x22c]
call fcn.00403050
push edx
mov ecx, ebp
push eax
lea edx, [0x46ff40]
call fcn.004c39f9
pop eax
pop edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a1723
add esp, 0x294
cmp ebp, esp
call fcn.004c39d6
mov esp, ebp
pop ebp
ret
Function at 0x470ad0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c695b
mov eax, dword fs:[0]
push eax
sub esp, 0x288
push esi
push edi
push ecx
lea edi, [ebp - 0x294]
mov ecx, 0xa2
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x4f3280]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x14]
call fcn.00471090
mov ecx, dword [ebp - 0x14]
add ecx, 0x570
call fcn.00407350
push eax
push 0x20a
call fcn.00433330
mov ecx, eax
call fcn.0043a3d0
mov word [ebp - 0x220], 0
push 0x206
push 0
lea eax, [ebp - 0x21e]
push eax
call fcn.004a1d00
add esp, 0xc
mov esi, esp
push 0x104
lea ecx, [ebp - 0x220]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp esi, esp
call fcn.004c39d6
mov esi, esp
lea edx, [ebp - 0x220]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
cmp esi, esp
call fcn.004c39d6
mov esi, esp
push 0x4d773c
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
cmp esi, esp
call fcn.004c39d6
lea ecx, [ebp - 0x22c]
call fcn.00417ee0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x220]
push ecx
push str.__s___autofireTask
lea edx, [ebp - 0x22c]
push edx
call fcn.0041b3f0
add esp, 0xc
mov dword [ebp - 0x244], 0
xor eax, eax
mov dword [ebp - 0x240], eax
mov dword [ebp - 0x23c], eax
mov dword [ebp - 0x238], eax
push 0x44
push 0
lea ecx, [ebp - 0x290]
push ecx
call fcn.004a1d00
add esp, 0xc
mov dword [ebp - 0x290], 0x44
mov dword [ebp - 0x264], 0x80
mov esi, esp
lea edx, [ebp - 0x244]
push edx
lea eax, [ebp - 0x290]
push eax
push 0
push 0
push 0x2000000
push 0
push 0
push 0
lea ecx, [ebp - 0x22c]
call fcn.004636c0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp esi, esp
call fcn.004c39d6
test eax, eax
je 0x470c85
mov esi, esp
mov ecx, dword [ebp - 0x244]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.004c39d6
mov esi, esp
mov edx, dword [ebp - 0x240]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.004c39d6
push 0x1f6
mov ecx, dword [ebp - 0x14]
call fcn.0046c190
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x22c]
call fcn.00403050
push edx
mov ecx, ebp
push eax
lea edx, [0x470ce0]
call fcn.004c39f9
pop eax
pop edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a1723
add esp, 0x294
cmp ebp, esp
call fcn.004c39d6
mov esp, ebp
pop ebp
ret
Function at 0x470d40
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cbb23
mov eax, dword fs:[0]
push eax
sub esp, 0x2b4
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x2c0]
mov ecx, 0xad
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x4f3280]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
lea esi, [ebp - 0x34]
call fcn.0048d920
mov dword [ebp - 4], 0
push str.AdBlockuserconfig.dat
lea ebx, [ebp - 0x34]
call fcn.0048c140
lea ecx, [ebp - 0x34]
call fcn.0048bd10
mov dword [ebp - 0x3c], eax
mov esi, esp
mov eax, dword [ebp - 0x3c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp esi, esp
call fcn.004c39d6
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
je 0x470ddc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.004069c0
jmp 0x470f62
mov word [ebp - 0x24c], 0
push 0x206
push 0
lea ecx, [ebp - 0x24a]
push ecx
call fcn.004a1d00
add esp, 0xc
mov esi, esp
push 0x104
lea edx, [ebp - 0x24c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp esi, esp
call fcn.004c39d6
mov esi, esp
lea eax, [ebp - 0x24c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
cmp esi, esp
call fcn.004c39d6
mov esi, esp
push str.qqpcmgr.exe
lea ecx, [ebp - 0x24c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
cmp esi, esp
call fcn.004c39d6
lea ecx, [ebp - 0x258]
call fcn.00417ee0
mov byte [ebp - 4], 1
lea edx, [ebp - 0x24c]
push edx
push str.__s____PLUGIN_
lea eax, [ebp - 0x258]
push eax
call fcn.0041b3f0
add esp, 0xc
mov dword [ebp - 0x270], 0
xor ecx, ecx
mov dword [ebp - 0x26c], ecx
mov dword [ebp - 0x268], ecx
mov dword [ebp - 0x264], ecx
push 0x44
push 0
lea edx, [ebp - 0x2bc]
push edx
call fcn.004a1d00
add esp, 0xc
mov dword [ebp - 0x2bc], 0x44
mov dword [ebp - 0x290], 0x80
mov esi, esp
lea eax, [ebp - 0x270]
push eax
lea ecx, [ebp - 0x2bc]
push ecx
push 0
push 0
push 0x2000000
push 0
push 0
push 0
lea ecx, [ebp - 0x258]
call fcn.004636c0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp esi, esp
call fcn.004c39d6
test eax, eax
je 0x470f22
mov esi, esp
mov edx, dword [ebp - 0x270]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.004c39d6
mov esi, esp
mov eax, dword [ebp - 0x26c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.004c39d6
push 0
mov ecx, dword [ebp - 0x14]
add ecx, 0x570
call fcn.00407350
push eax
push 0x20c
call fcn.00433330
mov ecx, eax
call fcn.0043a460
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x258]
call fcn.00403050
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.004069c0
push edx
mov ecx, ebp
push eax
lea edx, [0x470f9c]
call fcn.004c39f9
pop eax
pop edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a1723
add esp, 0x2c0
cmp ebp, esp
call fcn.004c39d6
mov esp, ebp
pop ebp
ret