joyce8/EMBER2024-capa huggingface dataset:
Function at 0x484ec7
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
call fcn.00404190
xor ebx, ebx
lea ecx, [ebp + 8]
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp + 8], ebx
call fcn.0042f912
test eax, eax
je 0x484f64
mov dword [ebp - 4], ebx
cmp dword [ebp + 8], ebx
je 0x484f73
lea eax, [ebp - 4]
push eax
push ebx
lea eax, [ebp - 8]
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 8], 1
je 0x484f1e
cmp dword [ebp - 8], 2
jne 0x484f64
mov ecx, esi
call fcn.004041c0
mov eax, dword [ebp - 4]
mov ecx, esi
shr eax, 1
inc eax
push eax
call fcn.004047c0
mov ebx, eax
lea eax, [ebp - 4]
push eax
push ebx
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x484f5b
mov eax, dword [ebp - 4]
shr eax, 1
xor ecx, ecx
mov word [ebx + eax*2], cx
push 0xffffffffffffffff
mov ecx, esi
call fcn.0040e311
cmp dword [ebp + 8], 0
je 0x484f73
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x486f11
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
lea ecx, [ebp - 4]
push dword [edi + 0xc]
call fcn.004040f0
push str.knewvip.exe
lea ecx, [ebp - 4]
call fcn.00412004
mov esi, dword [ebp - 4]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x486f96
cmp byte [ebp + 0x20], 0
je 0x486f69
mov ecx, edi
call fcn.00488a80
test eax, eax
je 0x486f5b
mov ecx, edi
call fcn.004889e3
test eax, eax
je 0x486f69
mov ecx, dword [ebp + 0xc]
cmp ecx, 0x28
push 6
pop eax
cmovne ecx, eax
jmp 0x486f6c
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
xor edx, edx
push edx
push dword [ebp + 0x14]
mov dword [ebp + 0x20], eax
lea eax, [ebp + 0x20]
push dword [ebp + 0x10]
push dword [ebp + 0x1c]
push edx
push edx
push edx
push dword [ebp + 0x18]
push edx
push eax
push edx
push edx
push edx
push ecx
push esi
call fcn.004868db
add esp, 0x3c
lea ecx, [esi - 0x10]
call fcn.004023e0
pop edi
pop esi
leave
ret 0x1c

Function at 0x486fa4
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
lea ecx, [ebp - 4]
push dword [edi + 0xc]
call fcn.004040f0
push str.kvipgui.exe
lea ecx, [ebp - 4]
call fcn.00412004
mov esi, dword [ebp - 4]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x487011
cmp byte [ebp + 0x18], 0
je 0x486ff3
mov ecx, edi
call fcn.00488a80
test eax, eax
je 0x486fee
mov ecx, edi
call fcn.004889e3
test eax, eax
je 0x486ff3
xor eax, eax
inc eax
jmp 0x486ff6
mov eax, dword [ebp + 0xc]
push dword [ebp + 0x14]
xor ecx, ecx
push dword [ebp + 0x10]
push ecx
push dword [edi + 8]
push ecx
push ecx
push esi
push dword [ebp + 8]
push eax
call fcn.0048668a
add esp, 0x24
lea ecx, [esi - 0x10]
call fcn.004023e0
pop edi
pop esi
leave
ret 0x14
Function at 0x487bd1
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
mov edi, ecx
lea eax, [ebp - 4]
push str.feedbackwin.exe
push eax
mov dword [edi + 0x598], 4
call fcn.00413914
pop ecx
push eax
lea eax, [ebp - 8]
push eax
call fcn.00413eaa
mov ecx, dword [ebp - 4]
add esp, 0xc
lea ecx, [ecx - 0x10]
call fcn.004023e0
mov esi, dword [ebp - 8]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x487c2f
xor ecx, ecx
push ecx
push 1
push ecx
push str._from:27
push esi
call fcn.0047b127
add esp, 0x14
jmp 0x487c63
lea eax, [ebp - 8]
push 0x61d8d8
push eax
call fcn.004343dc
mov ecx, eax
call fcn.00434bd3
push 1
xor ecx, ecx
push ecx
push ecx
push dword [eax]
push 0x61594c
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 8]
lea ecx, [ecx - 0x10]
call fcn.004023e0
mov ecx, edi
call fcn.00489bc2
push 2
mov ecx, edi
call fcn.00465154
lea ecx, [esi - 0x10]
call fcn.004023e0
pop edi
pop esi
leave
ret

Function at 0x48832b
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
lea ecx, [ebp - 4]
push 0x698774
call fcn.004040f0
mov esi, dword [esi]
call fcn.00413302
lea ecx, [ebp - 4]
push ecx
push esi
mov ecx, eax
call fcn.0041320f
lea eax, [ebp - 4]
push eax
call fcn.00413b37
mov esi, str.ressrcchsuplive.svr
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
pop ecx
pop ecx
push eax
push esi
lea ecx, [ebp - 4]
call fcn.0040c36b
push dword [ebp - 4]
push 0
push str.TryNo
push str.Common
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [ebp - 4]
mov esi, eax
add ecx, 0xfffffff0
call fcn.004023e0
mov eax, esi
pop esi
leave
ret

Function at 0x4885f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 4], 0
lea eax, [ebp - 4]
and dword [ebp - 8], 0
push eax
push str.SoftwareKingsoftKVip
push reloc.WS2_32.dll_accept
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x488639
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push str.vip_version
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 4], 0
je 0x488648
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
leave
ret
Function at 0x488aa6
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
lea ecx, [ebp - 8]
call fcn.00404190
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push str.SoftwareKingsoft_antiviruscustominstallcfg
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x488b79
mov eax, dword [ebp - 4]
xor esi, esi
and dword [ebp - 0xc], esi
test eax, eax
je 0x488b7c
lea ecx, [ebp - 0xc]
push ecx
push esi
lea ecx, [ebp - 0x10]
push ecx
push esi
push str.custom_version
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor edi, edi
inc edi
cmp dword [ebp - 0x10], edi
je 0x488b0a
cmp dword [ebp - 0x10], 2
jne 0x488b79
lea ecx, [ebp - 8]
call fcn.004041c0
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 8]
shr eax, 1
inc eax
push eax
call fcn.004047c0
lea ecx, [ebp - 0xc]
mov dword [ebp - 0x14], eax
push ecx
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push str.custom_version
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x488b51
mov eax, dword [ebp - 0xc]
mov esi, edi
mov ecx, dword [ebp - 0x14]
shr eax, 1
xor edx, edx
mov word [ecx + eax*2], dx
push 0xffffffffffffffff
lea ecx, [ebp - 8]
call fcn.0040e311
test esi, esi
je 0x488b79
mov esi, dword [ebp - 8]
push str.young
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
pop ecx
test eax, eax
mov eax, dword [ebp - 4]
pop ecx
je 0x488b81
jmp 0x488b7f
mov eax, dword [ebp - 4]
mov esi, dword [ebp - 8]
xor edi, edi
test eax, eax
je 0x488b8c
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 4], 0
lea ecx, [esi - 0x10]
call fcn.004023e0
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x48916f
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
lea eax, [ebp - 4]
mov edi, ecx
push 0x62376c
push eax
call fcn.00413914
pop ecx
push eax
lea eax, [ebp - 8]
push eax
call fcn.00413eaa
mov ecx, dword [ebp - 4]
add esp, 0xc
lea ecx, [ecx - 0x10]
call fcn.004023e0
mov esi, dword [ebp - 8]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4891c1
push 0
push 1
push 0
push str._func_showmainwin:10
push esi
call fcn.0047b127
add esp, 0x14
mov ecx, edi
mov dword [edi + 0x67c], 1
call fcn.00489bc2
push 2
mov ecx, edi
call fcn.00465154
lea ecx, [esi - 0x10]
call fcn.004023e0
pop edi
pop esi
leave
ret

Function at 0x489519
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
lea eax, [ebp - 4]
mov edi, ecx
push 0x613718
push eax
call fcn.00413914
pop ecx
push eax
lea eax, [ebp - 8]
push eax
call fcn.00413eaa
mov ecx, dword [ebp - 4]
add esp, 0xc
lea ecx, [ecx - 0x10]
call fcn.004023e0
mov esi, dword [ebp - 8]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x48956b
push 0
push 1
push 0
push str._lite_acc
push esi
call fcn.0047b127
add esp, 0x14
lea ecx, [esi - 0x10]
mov dword [edi + 0x644], 2
call fcn.004023e0
pop edi
pop esi
leave
ret
Function at 0x489851
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
lea eax, [ebp - 4]
mov ebx, ecx
push str.knewvip.exe
push eax
call fcn.00413914
pop ecx
push eax
lea eax, [ebp - 8]
push eax
call fcn.00413eaa
mov ecx, dword [ebp - 4]
add esp, 0xc
lea ecx, [ecx - 0x10]
call fcn.004023e0
mov edi, dword [ebp - 8]
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4898ed
push esi
lea ecx, [ebp - 4]
call fcn.00404190
lea eax, [ebp - 8]
push str.http:__newvip.ijinshan.com
push eax
call fcn.004343dc
mov ecx, eax
call fcn.00434bd3
push dword [0x6b39ac]
push dword [eax]
lea eax, [ebp - 4]
push str._open_opction1__url__s_1509__activity_id_s___from1007
push eax
call fcn.0040c593
mov ecx, dword [ebp - 8]
add esp, 0x10
lea ecx, [ecx - 0x10]
call fcn.004023e0
mov esi, dword [ebp - 4]
push 0
push 1
push 0
push esi
push edi
call fcn.0047b127
add esp, 0x14
lea ecx, [esi - 0x10]
call fcn.004023e0
pop esi
mov ecx, ebx
mov dword [ebx + 0x680], 1
call fcn.00489bc2
push 2
mov ecx, ebx
call fcn.00465154
lea ecx, [edi - 0x10]
call fcn.004023e0
pop edi
pop ebx
leave
ret

Function at 0x48a0a6
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
push edi
push 0x44
pop esi
push esi
xor ebx, ebx
lea eax, [ebp - 0x54]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
xor eax, eax
mov dword [ebp - 0x54], esi
add esp, 0xc
mov dword [ebp - 0x28], 1
cmp dword [ebp + 0x1c], 8
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
lea ecx, [ebp - 0x10]
push 0xa
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop eax
push ecx
lea ecx, [ebp - 0x54]
mov word [ebp - 0x24], ax
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
setne bl
cmp dword [ebp - 0xc], 0
je 0x48a117
push dword [ebp - 0xc]
call esi
and dword [ebp - 0xc], 0
cmp dword [ebp - 0x10], 0
je 0x48a126
push dword [ebp - 0x10]
call esi
and dword [ebp - 0x10], 0
lea ecx, [ebp + 8]
call fcn.00407870
pop edi
pop esi
mov al, bl
pop ebx
leave
ret

Function at 0x48a39a
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push 0x613718
push eax
call fcn.00413914
pop ecx
push eax
lea eax, [ebp - 8]
push eax
call fcn.00413eaa
mov ecx, dword [ebp - 4]
add esp, 0xc
lea ecx, [ecx - 0x10]
call fcn.004023e0
mov esi, dword [ebp - 8]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x48a3e9
push 0
push 1
push 0
push 0x623978
push esi
call fcn.0047b127
add esp, 0x14
lea ecx, [esi - 0x10]
call fcn.004023e0
pop esi
leave
ret
Function at 0x48be07
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push str.ressrcchsweathercache.ini
lea eax, [ebp - 4]
push eax
call fcn.0048bfc1
push dword [ebp - 4]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x48be44
mov ecx, dword [ebp + 8]
push 0x698774
call fcn.004040f0
mov ecx, dword [ebp - 4]
add ecx, 0xfffffff0
call fcn.004023e0
mov eax, dword [ebp + 8]
jmp 0x48be9f
push esi
push edi
lea ecx, [ebp - 8]
call fcn.00404190
push dword [ebp - 4]
push 0xffffffffffffffff
push str.curcitynum
push str.curweather
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push eax
lea eax, [ebp - 8]
push 0x612dc4
push eax
call fcn.0040c593
mov esi, dword [ebp - 8]
add esi, 0xfffffff0
push esi
call fcn.00404b40
mov edi, dword [ebp + 8]
add esp, 0x10
add eax, 0x10
mov ecx, esi
mov dword [edi], eax
call fcn.004023e0
mov ecx, dword [ebp - 4]
add ecx, 0xfffffff0
call fcn.004023e0
mov eax, edi
pop edi
pop esi
leave
ret 4

Function at 0x48c299
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push str.ressrcchsuplive.svr
lea eax, [ebp - 4]
push eax
call fcn.0048bfc1
push dword [ebp - 4]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x48c2d6
mov ecx, dword [ebp + 8]
push 0x698774
call fcn.004040f0
mov ecx, dword [ebp - 4]
add ecx, 0xfffffff0
call fcn.004023e0
mov eax, dword [ebp + 8]
jmp 0x48c331
push esi
push edi
lea ecx, [ebp - 8]
call fcn.00404190
push dword [ebp - 4]
push 0
push str.TryNo
push str.common
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push eax
lea eax, [ebp - 8]
push 0x612dc4
push eax
call fcn.0040c593
mov esi, dword [ebp - 8]
add esi, 0xfffffff0
push esi
call fcn.00404b40
mov edi, dword [ebp + 8]
add esp, 0x10
add eax, 0x10
mov ecx, esi
mov dword [edi], eax
call fcn.004023e0
mov ecx, dword [ebp - 4]
add ecx, 0xfffffff0
call fcn.004023e0
mov eax, edi
pop edi
pop esi
leave
ret 4

Function at 0x4903e6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, edi
lea eax, [ebx - 1]
mov dword [ebp - 8], edi
mov dword [ebp - 4], eax
sar eax, 1
mov dword [ebp + 0xc], eax
cmp edi, eax
jge 0x49044e
mov ebx, eax
mov ecx, dword [ebp + 8]
add esi, esi
lea eax, [esi + 2]
shl eax, 5
add ecx, eax
lea eax, [ecx - 0x20]
push eax
push ecx
mov ecx, dword [ebp + 0x18]
call fcn.0049716e
mov ecx, dword [ebp + 8]
movzx eax, al
xor eax, 1
shl edi, 5
inc eax
add esi, eax
mov eax, esi
shl eax, 5
add eax, ecx
add ecx, edi
push eax
call fcn.00496fec
mov edi, esi
cmp esi, ebx
jl 0x49040a
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x490470
test bl, 1
jne 0x490470
mov ecx, dword [ebp + 8]
shl ebx, 5
shl edi, 5
lea eax, [ecx - 0x20]
add ecx, edi
add eax, ebx
push eax
call fcn.00496fec
mov edi, dword [ebp - 4]
push dword [ebp + 0x18]
mov ecx, dword [ebp + 8]
push dword [ebp + 0x14]
push dword [ebp - 8]
push edi
push ecx
call fcn.004904fd
add esp, 0x14
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4962aa
Capabilities:
Create tcp socket
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x6a9a60]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x190
lea eax, [ebp - 0x194]
mov esi, ecx
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x194]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x49630a
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
push str.localhost
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004b3004
leave
ret

Function at 0x496c6a
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 8], 0
je 0x496c94
push 0xffffffffffffffff
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x496c90
push 0
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
and dword [esi + 8], 0
pop esi
ret
Function at 0x49a446
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push dword [ebp + 0x10]
mov esi, ecx
mov dword [ebp - 4], esi
call fcn.004aae93
mov ebx, dword [ebp + 0x14]
mov ecx, esi
push ebx
call fcn.004abb8b
movaps xmm0, xmmword [0x6296a0]
lea ecx, [esi + 0x34]
mov edi, ecx
lea esi, [ebp - 0x14]
movups xmmword [ebp - 0x14], xmm0
xor edx, edx
push edx
movsd dword es:[edi], dword [esi]
push ecx
mov eax, esp
push 0x88
movsd dword es:[edi], dword [esi]
push SysReAllocString
push edx
push ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp - 4]
mov dword [eax], edx
mov eax, esp
push esi
mov dword [eax], ecx
mov ecx, edi
call fcn.00499983
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x50], eax
mov dword [edi + 0x24], esi
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [edi + 0x5c], eax
mov eax, dword [ebp + 8]
mov dword [edi + 0x64], eax
mov eax, dword [ebx + 4]
mov ecx, dword [ebx]
sub eax, ecx
sar eax, 2
test eax, eax
je 0x49a504
mov eax, dword [ecx]
mov ecx, dword [edi + 0x38]
push 0x40
mov eax, dword [eax - 0xc]
sub eax, 2
imul eax, eax, 0xc
add dword [edi + 0x3c], eax
mov eax, dword [edi + 0x2c]
sub eax, dword [edi + 0x28]
sar eax, 2
imul eax, dword [edi + 0x68]
add eax, ecx
push eax
push dword [edi + 0x3c]
mov dword [edi + 0x40], eax
push ecx
push dword [edi + 0x34]
push 0xffffffffffffffff
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetWindowPos]
push 0
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
leave
ret 0x14

Function at 0x49a5e0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
lea ecx, [ebp - 4]
call fcn.00404190
lea eax, [ebp - 4]
push eax
lea ecx, [edi + 0x38]
call fcn.004a00b8
mov esi, dword [ebp - 4]
cmp dword [esi - 0xc], 0
jne 0x49a610
push 0
push dword [edi + 0x38]
call dword [sym.imp.USER32.dll_ShowWindow]
lea ecx, [esi - 0x10]
call fcn.004023e0
pop edi
pop esi
leave
ret
Function at 0x49e2a2
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, ecx
push esi
push edi
xor edi, edi
and dword [ebp - 8], edi
lea esi, [ebx + 0x1a64]
push esi
call fcn.00477ec8
mov eax, dword [esi]
pop ecx
cmp dword [eax - 0xc], edi
jne 0x49e2cc
inc edi
jmp 0x49e366
lea ecx, [ebp - 4]
call fcn.00404190
lea eax, [ebp - 0xc]
push 0
push eax
call fcn.00413a13
pop ecx
pop ecx
push eax
lea ecx, [ebp - 4]
call fcn.004048f0
mov ecx, dword [ebp - 0xc]
lea ecx, [ecx - 0x10]
call fcn.004023e0
mov esi, str.kfeedbackreport.dll
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
pop ecx
push eax
push esi
lea ecx, [ebp - 4]
call fcn.0040c36b
mov esi, dword [ebp - 4]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x49e31e
push 2
jmp 0x49e35d
push esi
lea ecx, [ebx + 0x1a6c]
call fcn.004a18bc
test eax, eax
jne 0x49e332
push 3
jmp 0x49e35d
mov ecx, dword [ebx + 0x1a70]
test ecx, ecx
jne 0x49e341
and dword [ebp - 8], edi
jmp 0x49e35b
mov eax, dword [ecx]
push 0x698774
push dword [ebx + 0x1a64]
push 0x64
push ecx
call dword [eax + 0xc]
mov dword [ebp - 8], eax
test eax, eax
jne 0x49e35e
push 4
pop edi
lea ecx, [esi - 0x10]
call fcn.004023e0
lea eax, [ebx + 0x1a64]
lea esi, [ebx + 0x1a7c]
push eax
mov ecx, esi
call fcn.004048f0
and dword [esi + 0xc], 0
mov ecx, esi
push edi
push 1
mov dword [esi + 4], 2
mov dword [esi + 8], 0x64
call fcn.004a9524
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x49eeab
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
mov ecx, esi
call fcn.00404190
cmp dword [edi + 8], ebx
je 0x49eed9
lea eax, [edi + 0xc]
mov ecx, esi
push eax
call fcn.004048f0
jmp 0x49ef5c
push ebx
push str.SOFTWAREKingsoftAntivirusKFlag
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 4]
call fcn.0042f912
test eax, eax
je 0x49ef5c
mov dword [ebp + 8], ebx
cmp dword [ebp - 4], ebx
je 0x49ef6b
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp + 8]
push eax
push ebx
lea eax, [ebp - 8]
push eax
push ebx
push str.KPacketName
push dword [ebp - 4]
call edi
cmp dword [ebp - 8], 1
jne 0x49ef5c
mov ecx, esi
call fcn.004041c0
mov eax, dword [ebp + 8]
mov ecx, esi
shr eax, 1
inc eax
push eax
call fcn.004047c0
mov ebx, eax
lea eax, [ebp + 8]
push eax
push ebx
lea eax, [ebp - 8]
push eax
push 0
push str.KPacketName
push dword [ebp - 4]
call edi
test eax, eax
jne 0x49ef5c
mov eax, dword [ebp + 8]
xor ecx, ecx
shr eax, 1
push 0xffffffffffffffff
mov word [ebx + eax*2], cx
mov ecx, esi
call fcn.0040e311
cmp dword [ebp - 4], 0
je 0x49ef6b
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 4
Function at 0x49f631
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
lea ecx, [ebp - 0x10]
xor esi, esi
call fcn.00431b42
lea eax, [ebp - 4]
push esi
push eax
call fcn.00413a13
mov edi, str.cloudctrl.config
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
add esp, 0xc
lea ecx, [ebp - 4]
push eax
push edi
call fcn.0040c36b
push dword [ebp - 4]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x49f699
push 1
push dword [ebp - 4]
lea ecx, [ebp - 0x10]
call fcn.00431ce0
test eax, eax
je 0x49f699
push esi
push 0x626cf0
push 0x626d00
lea ecx, [ebp - 0x10]
call fcn.0043209a
mov esi, eax
mov ecx, dword [ebp - 4]
add ecx, 0xfffffff0
call fcn.004023e0
lea ecx, [ebp - 0x10]
call fcn.00431b56
pop edi
mov eax, esi
pop esi
leave
ret

Function at 0x49f7f4
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ecx, edi
call fcn.004041c0
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 4]
xor esi, esi
push eax
mov dword [ebx], esi
call fcn.00413914
mov eax, dword [ebp - 4]
pop ecx
cmp dword [eax - 0xc], esi
je 0x49f85b
push str.datakbootnf.dat
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 0xc]
push eax
call fcn.00413eaa
add esp, 0xc
mov ecx, edi
push eax
call fcn.004048f0
mov ecx, dword [ebp + 0xc]
lea ecx, [ecx - 0x10]
call fcn.004023e0
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
shr eax, 4
inc esi
not eax
and eax, esi
mov dword [ebx], eax
mov eax, dword [ebp - 4]
lea ecx, [eax - 0x10]
call fcn.004023e0
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x4a03d8
Capabilities:
Hide graphical window

Disassembly:
push 0
push dword [ecx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
call dword [sym.imp.USER32.dll_ReleaseCapture]
xor eax, eax
inc eax
ret