joyce8/EMBER2024-capa huggingface dataset:
Function at 0x460785
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x4eb664]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
xor esi, esi
lea edx, [edi + 2]
mov dword [ebp - 0x210], esi
mov ax, word [edi]
add edi, 2
cmp ax, si
jne 0x4607ae
sub edi, edx
mov edx, dword [ebp + 0xc]
sar edi, 1
cmp edx, edi
lea eax, [ebp - 0x218]
lea esi, [ebp - 0x214]
cmovae eax, esi
mov dword [ebp - 0x218], edx
mov dword [ebp - 0x214], edi
push dword [eax]
push ecx
push ebx
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
je 0x4607f2
xor eax, eax
jmp 0x4608a7
xor ecx, ecx
push ecx
push dword [ebp + 0x14]
lea eax, [ebp - 0x20c]
push eax
push ecx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x4607eb
push 0x4d3c8c
push 0x104
lea eax, [ebp - 0x20c]
push eax
call fcn.0040bc2f
lea esi, [ebp - 0x20c]
xor edx, edx
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, dx
jne 0x46082b
sub esi, ecx
mov ecx, ebx
sar esi, 1
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x210]
jne 0x46083f
sub ecx, edx
sar ecx, 1
mov edx, ecx
sub edx, edi
lea eax, [edx + esi]
mov dword [ebp - 0x210], eax
lea eax, [ecx + esi]
cmp eax, edi
jbe 0x4607eb
lea eax, [esi + 1]
add eax, edx
cmp eax, dword [ebp + 0xc]
jae 0x4607eb
lea eax, [edx + edx]
push eax
lea eax, [ebx + edi*2]
add esi, esi
push eax
lea eax, [esi + ebx]
push eax
call fcn.0048f550
push esi
lea eax, [ebp - 0x20c]
push eax
push ebx
call fcn.00491b80
mov eax, dword [ebp - 0x210]
xor ecx, ecx
mov word [ebx + eax*2], cx
xor eax, eax
add esp, 0x18
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0048f059
leave
ret

Function at 0x465cea
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
lea ecx, [ebp - 4]
call fcn.00406b6a
push dword [ebp + 8]
lea ecx, [ebp - 8]
call fcn.00406b6a
lea eax, [ebp - 8]
push eax
call fcn.00468709
mov edi, dword [ebp - 8]
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ebx, ebx
cmp eax, 0xffffffff
je 0x465d28
mov esi, dword [ebp - 4]
jmp 0x465d80
push ebx
push edi
call fcn.0046845c
pop ecx
pop ecx
test eax, eax
jne 0x465d7b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x465d7b
lea eax, [ebp - 4]
push eax
call fcn.00468787
mov esi, dword [ebp - 4]
pop ecx
cmp dword [esi - 0xc], ebx
je 0x465d81
push esi
call fcn.00465cea
pop ecx
test eax, eax
je 0x465d81
push ebx
push edi
call fcn.0046845c
pop ecx
pop ecx
test eax, eax
jne 0x465d7e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x465d7e
jmp 0x465d81
mov esi, dword [ebp - 4]
xor ebx, ebx
inc ebx
lea ecx, [edi - 0x10]
call fcn.00404f8d
lea ecx, [esi - 0x10]
call fcn.00404f8d
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x46603a
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
push str.CreateShellLink_start...
mov esi, 0x4eee98
push esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
call fcn.004738c9
pop ecx
pop ecx
lea eax, [ebp - 4]
push eax
push 0x4c8190
push 1
push ebx
push 0x4c81e0
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov edi, eax
test edi, edi
jns 0x466094
push edi
push str.CoCreateInstance__0x_x
push esi
call fcn.004738c9
mov esi, dword [ebp + 0xc]
add esp, 0xc
jmp 0x466183
mov eax, dword [ebp - 4]
push dword [ebp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x50]
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x4660b6
cmp word [edx], bx
je 0x4660b6
mov eax, dword [ebp - 4]
push edx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x2c]
mov esi, dword [ebp + 0x14]
test esi, esi
je 0x4660cc
cmp word [esi], bx
je 0x4660cc
mov eax, dword [ebp - 4]
push esi
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
mov eax, dword [ebp - 4]
push 5
mov ecx, dword [eax]
push eax
call dword [ecx + 0x3c]
test esi, esi
je 0x466115
call fcn.0046855b
test eax, eax
je 0x466115
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
mov dword [ebp - 8], ebx
mov ecx, dword [eax]
push 0x4c1198
push eax
call dword [ecx]
cmp dword [ebp - 8], ebx
je 0x466115
push esi
push dword [ebp - 8]
call fcn.0047b619
mov eax, dword [ebp - 8]
pop ecx
pop ecx
test eax, eax
je 0x466115
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 4]
lea edx, [ebp - 0xc]
mov ecx, dword [eax]
push edx
push 0x4c8210
push eax
call dword [ecx]
mov esi, dword [ebp + 0xc]
test eax, eax
js 0x466173
push dword [ebp + 0x10]
mov ebx, 0x4eee98
push esi
push dword [ebp + 8]
push str.Save_szFilePath_ws_szCmdLine_ws_szLinkPath_ws_r_n
push ebx
call fcn.004738c9
mov eax, dword [ebp - 0xc]
add esp, 0x14
mov ecx, dword [eax]
push 1
push dword [ebp + 0x10]
push eax
call dword [ecx + 0x18]
mov edi, eax
test edi, edi
jns 0x46616a
push edi
push str.Save__0x_x
push ebx
call fcn.004738c9
add esp, 0xc
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
xor ebx, ebx
test edi, edi
setns bl
push dword [ebp + 0x10]
push esi
push dword [ebp + 8]
push ebx
push str.CreateShellLink_return:_d__file:_ws__cmd:_ws__link:_ws
push 0x4eee98
call fcn.004738c9
add esp, 0x18
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4661e8
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x4eb664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x408]
push eax
push 0xf003f
xor esi, esi
push esi
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x46629d
lea eax, [ebp - 0x414]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x404]
push eax
push esi
jmp 0x46626f
lea eax, [ebp - 0x404]
push eax
push dword [ebp - 0x408]
call fcn.004661e8
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x4662ac
lea eax, [ebp - 0x414]
push eax
xor ecx, ecx
push ecx
push ecx
push ecx
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x404]
push eax
push ecx
push dword [ebp - 0x408]
mov dword [ebp - 0x40c], 0x200
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x46623a
push dword [ebp - 0x408]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0048f059
leave
ret
push dword [ebp - 0x408]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x46629d

Function at 0x466635
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push dword [ebp + 8]
mov esi, dword [sym.imp.USER32.dll_EnumWindows]
push 0x466484
call esi
mov eax, dword [0x4eeddc]
cmp eax, dword [0x4eede0]
je 0x46665c
xor eax, eax
inc eax
jmp 0x4666c6
push dword [ebp + 8]
push 0x466520
call esi
mov eax, dword [0x4eedd4]
mov ecx, dword [0x4eedd0]
sub eax, ecx
sar eax, 2
xor esi, esi
test eax, eax
je 0x4666af
push dword [ecx + esi*4]
call dword [sym.imp.USER32.dll_GetParent]
mov dword [ebp - 4], eax
test eax, eax
je 0x46669a
lea eax, [ebp - 4]
push eax
mov ecx, 0x4eeddc
call fcn.00469f57
mov eax, dword [0x4eedd4]
mov ecx, dword [0x4eedd0]
sub eax, ecx
inc esi
sar eax, 2
cmp esi, eax
jb 0x46667c
mov dword [0x4eedd4], ecx
mov ecx, dword [0x4eeddc]
xor eax, eax
cmp ecx, dword [0x4eede0]
setne al
pop esi
leave
ret
Function at 0x4667d9
Capabilities:
Acquire debug privileges

Disassembly:
push 0x2c
push 0x4dfe98
call fcn.004951a0
xor esi, esi
mov ebx, esi
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x2c], esi
xor eax, eax
lea edi, [ebp - 0x28]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 4], esi
lea eax, [ebp - 0x30]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x46686d
lea eax, [ebp - 0x3c]
push eax
push str.SeDebugPrivilege
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x46686d
xor edi, edi
inc edi
mov dword [ebp - 0x2c], edi
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 2
push esi
push esi
push esi
lea eax, [ebp - 0x2c]
push eax
push esi
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x46686d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x514
cmovne ebx, edi
mov dword [ebp - 0x34], ebx
mov dword [ebp - 4], 0xfffffffe
call fcn.00466886
mov eax, ebx
call fcn.004951e8
ret

Function at 0x466c98
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x4eb664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
push edi
xor esi, esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x466d58
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x210]
push eax
push edi
mov dword [ebp - 0x210], esi
mov dword [ebp - 0x214], esi
call fcn.00466d69
add esp, 0xc
test al, al
je 0x466d58
xor eax, eax
push 0x206
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push esi
push eax
call fcn.004921d0
mov ecx, dword [ebp - 0x214]
movzx eax, cx
push eax
shr ecx, 0x10
push ecx
mov ecx, dword [ebp - 0x210]
movzx eax, cx
push eax
shr ecx, 0x10
push ecx
push str._d._d._d._d
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.004933e0
lea eax, [ebp - 0x20c]
push eax
call fcn.0040481a
add esp, 0x2c
mov ecx, ebx
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.004047a1
inc esi
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0048f059
leave
ret
Function at 0x466d69
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
push esi
xor esi, esi
mov dword [eax], esi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], esi
mov dword [eax], esi
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x466def
push edi
push ebx
call fcn.0048eb44
pop ecx
mov edi, eax
push edi
push ebx
push dword [ebp - 4]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x466de3
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x4d3c8c
push edi
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x466de3
cmp dword [ebp - 8], esi
je 0x466de3
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 0xc]
mov eax, dword [ecx + 8]
mov dword [edx], eax
mov eax, dword [ecx + 0xc]
mov ecx, dword [ebp + 0x10]
inc esi
mov dword [ecx], eax
test edi, edi
je 0x466dee
push edi
call fcn.0048eb4d
pop ecx
pop edi
test esi, esi
pop esi
setne al
pop ebx
leave
ret

Function at 0x466fef
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4eb664]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathGetDriveNumberW]
add eax, 0x41
push 0x3a
mov word [ebp - 0xc], ax
pop eax
mov word [ebp - 0xa], ax
push 0x5c
pop eax
mov word [ebp - 8], ax
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x10]
cmp eax, dword [ecx + 4]
jb 0x467053
ja 0x46704e
mov eax, dword [ebp - 0x14]
cmp eax, dword [ecx]
jb 0x467053
xor eax, eax
inc eax
jmp 0x467055
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048f059
leave
ret
Function at 0x4670f6
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x4eb664]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor edi, edi
push eax
lea ecx, [ebp - 0x228]
inc edi
call fcn.00406b6a
lea eax, [ebp - 0x228]
push eax
call fcn.00468709
mov esi, str.LBBrowser
push esi
call fcn.0040481a
pop ecx
pop ecx
push eax
push esi
lea ecx, [ebp - 0x228]
call fcn.0041e1c3
lea eax, [ebp - 0x228]
push eax
call fcn.00468709
mov esi, str.liebao.exe
push esi
call fcn.0040481a
pop ecx
pop ecx
push eax
push esi
lea ecx, [ebp - 0x228]
call fcn.0041e1c3
push edi
call fcn.004662bc
mov esi, dword [ebp - 0x228]
pop ecx
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor ebx, ebx
test eax, eax
je 0x467249
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x22c]
push eax
push esi
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x228], ebx
call fcn.00466d69
add esp, 0xc
test al, al
je 0x467249
lea eax, [ebp - 0x224]
push ebx
push eax
call fcn.00466b7c
xor eax, eax
push 0x206
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push ebx
push eax
call fcn.004921d0
mov ecx, dword [ebp - 0x228]
movzx eax, cx
push eax
shr ecx, 0x10
push ecx
mov ecx, dword [ebp - 0x22c]
movzx eax, cx
push eax
shr ecx, 0x10
push ecx
push str._d._d._d._d
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.004933e0
cmp dword [ebp - 0x210], 8
lea eax, [ebp - 0x224]
cmovae eax, dword [ebp - 0x224]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.00465bc5
add esp, 0x38
cmp eax, edi
je 0x467239
test eax, eax
jne 0x46723b
mov edi, ebx
push ebx
push 1
lea ecx, [ebp - 0x224]
call fcn.00405ac5
push ebx
call fcn.004662bc
pop ecx
lea ecx, [esi - 0x10]
call fcn.00404f8d
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0048f059
leave
ret

Function at 0x467269
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x4eb664]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
xor esi, esi
push 0x228
mov dword [ebp - 0x234], eax
lea eax, [ebp - 0x22c]
push esi
push eax
mov dword [ebp - 0x230], esi
call fcn.004921d0
add esp, 0xc
push esi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
je 0x467320
lea eax, [ebp - 0x230]
push eax
push edi
mov dword [ebp - 0x230], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x467319
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, eax
mov ecx, dword [ebp - 0x228]
cmp ecx, ebx
je 0x467302
test ecx, ecx
je 0x467302
cmp ecx, 4
je 0x467302
push dword [ebp - 0x234]
lea eax, [ebp - 0x20c]
push eax
call fcn.0048fb94
pop ecx
pop ecx
test eax, eax
je 0x467315
lea eax, [ebp - 0x230]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4672d7
jmp 0x467318
xor esi, esi
inc esi
pop ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0048f059
leave
ret
Function at 0x467d10
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
mov eax, dword [0x4eb664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push str.LockDefaultViaDuba_Begin_r_n
mov ebx, 0x4eee98
push ebx
call fcn.004738c9
pop ecx
pop ecx
call fcn.0046708e
test al, al
jne 0x467d51
push str.LockDefaultViaDuba_KDubaDetectLockLiebao_no_IsModuleSupport_r_n
push ebx
call fcn.004738c9
pop ecx
pop ecx
jmp 0x467f20
push esi
push 0x20019
xor esi, esi
push str.SoftwarekingsoftKISCommon
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x230], esi
mov dword [ebp - 0x22c], esi
mov dword [ebp - 0x228], esi
call fcn.0040cf2b
test eax, eax
je 0x467d9e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.LockDefaultViaDuba_Open_SoftwarekingsoftKISCommon_errcode_d_r_n
push ebx
call fcn.004738c9
add esp, 0xc
jmp 0x467efc
xor eax, eax
push 0x206
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push esi
push eax
call fcn.004921d0
add esp, 0xc
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x20c]
push eax
push str.ProgramPath
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x234], 0x104
call fcn.0040ce63
test eax, eax
je 0x467e09
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x20c]
push eax
push str.LockDefaultViaDuba_QueryStringValue_ws_errcode_d_r_n
push ebx
call fcn.004738c9
add esp, 0x10
jmp 0x467efc
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x467e2f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x20c]
push eax
push str.LockDefaultViaDuba_PathFileExists_ws_errcode_d_r_n
jmp 0x467dfb
push edi
lea edi, [ebp - 0x20c]
sub edi, 2
mov ax, word [edi + 2]
add edi, 2
cmp ax, si
jne 0x467e39
push 6
pop ecx
mov esi, str.kismain.exe
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x20c]
push eax
movsw word es:[edi], word [esi]
call dword [sym.imp.SHLWAPI.dll_PathQuoteSpacesW]
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x224]
call fcn.0040513a
mov esi, str.__defendmon:lockliebao
push esi
call fcn.00405113
pop ecx
push eax
push esi
lea ecx, [ebp - 0x224]
call fcn.004046dd
cmp dword [ebp - 0x210], 8
lea eax, [ebp - 0x224]
cmovae eax, dword [ebp - 0x224]
push eax
push str.LockDefaultViaDuba_cmdline_ws_r_n
push ebx
call fcn.004738c9
xor eax, eax
cmp dword [ebp - 0x210], 8
lea edi, [ebp - 0x244]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x224]
cmovae eax, dword [ebp - 0x224]
xor esi, esi
push esi
push esi
push esi
push esi
lea ecx, [ebp - 0x244]
push ecx
push esi
push eax
push esi
call fcn.00406263
push eax
push str.LockDefaultViaDuba_ExecuteAsDesktopUserEx3_hr0x_x_r_n
push ebx
call fcn.004738c9
add esp, 0x38
lea ecx, [ebp - 0x224]
push esi
push 1
call fcn.00405ac5
pop edi
lea ecx, [ebp - 0x230]
call fcn.0040cf80
push str.LockDefaultViaDuba_End_r_n
push ebx
call fcn.004738c9
pop ecx
pop ecx
lea ecx, [ebp - 0x230]
call fcn.0040cf80
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0048f059
leave
ret
Function at 0x46845c
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push 0
push 0x3000010
push 1
push 0
push 3
push 1
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
xor ebx, ebx
cmp eax, 0xffffffff
setne bl
test ebx, ebx
je 0x46848f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
jmp 0x46849a
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
pop ebx
pop ebp
ret

Function at 0x4684f2
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x4eb664]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x118
lea eax, [ebp - 0x11c]
push 0
push eax
mov dword [ebp - 0x120], 0x11c
call fcn.004921d0
add esp, 0xc
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x46854d
cmp dword [ebp - 0x11c], 6
jne 0x46854d
cmp dword [ebp - 0x118], 0
jne 0x46854d
xor eax, eax
inc eax
jmp 0x46854f
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048f059
leave
ret

Function at 0x46855b
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x4eb664]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x118
lea eax, [ebp - 0x11c]
push 0
push eax
mov dword [ebp - 0x120], 0x11c
call fcn.004921d0
add esp, 0xc
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4685a9
cmp dword [ebp - 0x11c], 6
sbb eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048f059
leave
ret

Function at 0x4685b5
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x4eb664]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x118
lea eax, [ebp - 0x11c]
push 0
push eax
mov dword [ebp - 0x120], 0x11c
call fcn.004921d0
add esp, 0xc
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x468610
cmp dword [ebp - 0x11c], 6
jb 0x468610
cmp dword [ebp - 0x118], 2
jb 0x468610
xor eax, eax
inc eax
jmp 0x468612
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048f059
leave
ret

Function at 0x4687d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
mov edi, ecx
xor esi, esi
mov dword [ebp - 4], esi
cmp dword [edi], esi
je 0x468850
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 8]
push eax
push esi
push dword [ebp + 8]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 8], 1
mov dword [edi + 4], eax
jne 0x468850
mov ecx, dword [ebp + 0xc]
call fcn.00404ec4
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
shr eax, 1
inc eax
push eax
call fcn.00404e61
lea ecx, [ebp - 4]
push ecx
push eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
push esi
push dword [ebp + 8]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [edi + 4], eax
test eax, eax
jne 0x468850
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
shr eax, 1
xor edx, edx
mov word [ecx + eax*2], dx
mov ecx, dword [ebp + 0xc]
push 0xffffffffffffffff
call fcn.004070cc
inc esi
pop edi
mov eax, esi
pop esi
leave
ret 8
Function at 0x468858
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
push str.RunApp_szPath_ws_szCmd_ws_dwWaitTime_d_bShow_d_bWaitTimeTermination_d_r_n
push 0x4eee98
call fcn.004738c9
xor esi, esi
push 0x40
lea eax, [ebp - 0x58]
push esi
push eax
mov dword [ebp - 8], esi
call fcn.004921d0
mov dword [ebp - 0x18], esi
xor eax, eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0x28
xor edi, edi
inc edi
push 0x4eb630
lea ecx, [ebp - 4]
mov dword [ebp - 0x5c], 0x44
mov dword [ebp - 0x30], edi
call fcn.004044ee
lea eax, [ebp - 4]
push dword [ebp + 0xc]
push dword [ebp + 8]
push str.__s___s
push eax
call fcn.00404994
add esp, 0x10
cmp dword [ebp + 0x14], esi
je 0x4688da
push 0xa
pop eax
jmp 0x4688dc
xor eax, eax
mov word [ebp - 0x2c], ax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x5c]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
mov esi, dword [ebp - 4]
push esi
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x468926
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.KFunction::RunApp_CreateProcessW_error:_d__wait:_d__show:_d__path:_ws__cmd:_ws
push 0x4eee98
call fcn.004738c9
mov ebx, dword [ebp - 8]
add esp, 0x1c
jmp 0x468968
test ebx, ebx
je 0x468966
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x468966
cmp dword [ebp + 0x18], 0
je 0x468966
push 0
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x468966
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.TerminateProcess_errcode_d_r_n
push 0x4eee98
call fcn.004738c9
add esp, 0xc
mov ebx, edi
cmp dword [ebp - 0x18], 0
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x46897d
push dword [ebp - 0x18]
call edi
and dword [ebp - 0x18], 0
cmp dword [ebp - 0x14], 0
je 0x46898c
push dword [ebp - 0x14]
call edi
and dword [ebp - 0x14], 0
lea ecx, [esi - 0x10]
call fcn.00404f8d
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret