joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4536d0
Capabilities:
Create process on windows
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4605ea
mov eax, dword fs:[0]
push eax
sub esp, 0xaa4
mov eax, dword [0x48200c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xaa4], ecx
push 0x4735e4
lea ecx, [ebp - 0xaa0]
call fcn.00406d40
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0xaa4]
cmp dword [eax + 0xcec], 0
je 0x453761
mov ecx, dword [ebp - 0xaa4]
add ecx, 0x94e
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x45375f
mov edx, dword [ebp - 0xaa4]
add edx, 0x94e
push edx
push str.explorer__s_r_n
lea eax, [ebp - 0xaa0]
push eax
call fcn.004075a0
add esp, 0xc
jmp 0x453771
push str.explorer_http:__hofosoft.cn_r_n
lea ecx, [ebp - 0xaa0]
call fcn.00406c50
push 0x4736ac
push 0x4736b0
call fcn.00423385
add esp, 8
mov dword [ebp - 0xaac], eax
cmp dword [ebp - 0xaac], 0
jne 0x4537a9
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xaa0]
call fcn.00406d00
jmp 0x453940
push 0x208
push 0
lea ecx, [ebp - 0x218]
push ecx
call fcn.0041fb70
add esp, 0xc
push 0x104
lea edx, [ebp - 0x218]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [ebp - 0xaa8]
call fcn.00406e20
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0xaa4]
add eax, 0x178
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jg 0x45381c
mov ecx, dword [ebp - 0xaa0]
push ecx
lea edx, [ebp - 0x218]
push edx
push str.__echo_off_r_ntaskkill__im_Uninstall.exe__f_r_ndel___s__r_n_sdel___0
lea eax, [ebp - 0xaa8]
push eax
call fcn.004075a0
add esp, 0x10
jmp 0x45384b
mov ecx, dword [ebp - 0xaa0]
push ecx
mov edx, dword [ebp - 0xaa4]
add edx, 0x178
push edx
lea eax, [ebp - 0x218]
push eax
push str.__echo_off_r_ntaskkill__im_Uninstall.exe__f_r_ndel___s__r_nrd__S__Q___s__r_n_sdel___0
lea ecx, [ebp - 0xaa8]
push ecx
call fcn.004075a0
add esp, 0x14
push 0x800
push 0
lea edx, [ebp - 0xa18]
push edx
call fcn.0041fb70
add esp, 0xc
lea ecx, [ebp - 0xaa8]
call fcn.00406e70
push eax
lea ecx, [ebp - 0xa9c]
call fcn.0040fca0
mov dword [ebp - 0xab0], eax
mov ecx, dword [ebp - 0xab0]
call fcn.0040a080
push eax
lea eax, [ebp - 0xa18]
push eax
call fcn.0042b210
add esp, 8
lea ecx, [ebp - 0xa9c]
call fcn.0040fc70
mov ecx, dword [ebp - 0xaac]
push ecx
lea edx, [ebp - 0xa18]
push edx
call fcn.00428e40
add esp, 4
push eax
push 1
lea eax, [ebp - 0xa18]
push eax
call fcn.00428dde
add esp, 0x10
mov ecx, dword [ebp - 0xaac]
push ecx
call fcn.0042370f
add esp, 4
push 0x80
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push 0xf
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push 0
push 0x4737dc
push 0
push str.c:clear.bat
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041e140
mov esp, ebp
pop ebp
ret
Function at 0x453b40
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ebp + 8], 0
je 0x453b61
cmp dword [ebp + 0xc], 0
je 0x453b61
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x1e
jl 0x453b66
jmp 0x453c04
push 0x294
call fcn.0041e68d
add esp, 4
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 4], ecx
push 0x294
push 0
mov edx, dword [ebp - 4]
push edx
call fcn.0041fb70
add esp, 0xc
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 4]
add eax, 0x190
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp dword [ebp + 0x10], 0
je 0x453bd8
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x64
jge 0x453bd8
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 4]
add eax, 0x1cc
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea ecx, [ebp - 0x10]
push ecx
push 0
mov edx, dword [ebp - 4]
push edx
push 0x453960
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x453c04
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret
Function at 0x457190
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, 4
shl eax, 0
mov ecx, dword [ebp + 8]
mov dword [ecx + eax + 0x10], 0
mov edx, 4
imul eax, edx, 0
mov ecx, dword [ebp + 8]
mov dword [ecx + eax + 0x10], 0
mov edx, 4
imul eax, edx, 0
mov ecx, dword [ebp + 8]
mov dword [ecx + eax], 0x67452301
mov edx, 4
shl edx, 0
mov eax, dword [ebp + 8]
mov dword [eax + edx], 0xefcdab89
mov ecx, 4
shl ecx, 1
mov edx, dword [ebp + 8]
mov dword [edx + ecx], 0x98badcfe
mov eax, 4
imul ecx, eax, 3
mov edx, dword [ebp + 8]
mov dword [edx + ecx], 0x10325476
mov esp, ebp
pop ebp
ret 4
Function at 0x4585a0
Capabilities:
Get http response content encoding

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46091a
mov eax, dword fs:[0]
push eax
sub esp, 0x614
mov eax, dword [0x48200c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x620], ecx
push 0x200
push 0
lea eax, [ebp - 0x210]
push eax
call fcn.0041fb70
add esp, 0xc
mov dword [ebp - 0x618], 0x200
push 0
lea ecx, [ebp - 0x618]
push ecx
lea edx, [ebp - 0x210]
push edx
push 0x1d
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
je 0x4586b6
push 0x200
lea ecx, [ebp - 0x610]
push ecx
push 0xffffffffffffffff
lea edx, [ebp - 0x210]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [ebp - 0x610]
push eax
lea ecx, [ebp - 0x614]
call fcn.00406d40
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x614]
call fcn.0040f7b0
push 0x475364
lea ecx, [ebp - 0x614]
call fcn.0041d580
test eax, eax
je 0x458680
push 0x475370
lea ecx, [ebp - 0x614]
call fcn.0041d580
test eax, eax
jne 0x4586a4
mov dword [ebp - 0x61c], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x614]
call fcn.00406d00
mov eax, dword [ebp - 0x61c]
jmp 0x4586b8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x614]
call fcn.00406d00
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041e140
mov esp, ebp
pop ebp
ret 4

Function at 0x4586e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x48200c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x214], ecx
push 0x1ac
push 0
mov eax, dword [ebp - 0x214]
push eax
call fcn.0041fb70
add esp, 0xc
lea ecx, [ebp - 0x20c]
push ecx
call sym.Uninstall_adv.exe_void___cdecl_GetCurPath_wchar_t__
add esp, 4
push str.proxy.dat
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x47535c
lea eax, [ebp - 0x20c]
push eax
call fcn.00423327
add esp, 8
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0
je 0x458770
mov ecx, dword [ebp - 0x210]
push ecx
push 1
push 0x1ac
mov edx, dword [ebp - 0x214]
push edx
call fcn.00423568
add esp, 0x10
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041e140
mov esp, ebp
pop ebp
ret
Function at 0x45a750
Capabilities:
Get http response content encoding

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x460aeb
mov eax, dword fs:[0]
push eax
sub esp, 0x614
mov eax, dword [0x48200c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x620], ecx
push 0x200
push 0
lea eax, [ebp - 0x210]
push eax
call fcn.0041fb70
add esp, 0xc
mov dword [ebp - 0x618], 0x200
push 0
lea ecx, [ebp - 0x618]
push ecx
lea edx, [ebp - 0x210]
push edx
push 0x1d
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
je 0x45a866
push 0x200
lea ecx, [ebp - 0x610]
push ecx
push 0xffffffffffffffff
lea edx, [ebp - 0x210]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [ebp - 0x610]
push eax
lea ecx, [ebp - 0x614]
call fcn.00406d40
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x614]
call fcn.0040f7b0
push str.gzip
lea ecx, [ebp - 0x614]
call fcn.0041d580
test eax, eax
je 0x45a830
push 0x475a28
lea ecx, [ebp - 0x614]
call fcn.0041d580
test eax, eax
jne 0x45a854
mov dword [ebp - 0x61c], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x614]
call fcn.00406d00
mov eax, dword [ebp - 0x61c]
jmp 0x45a868
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x614]
call fcn.00406d00
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041e140
mov esp, ebp
pop ebp
ret 4
Function at 0x45ad50
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x48200c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x214], ecx
push 0x1ac
push 0
mov eax, dword [ebp - 0x214]
push eax
call fcn.0041fb70
add esp, 0xc
lea ecx, [ebp - 0x20c]
push ecx
call sym.Uninstall_adv.exe_void___cdecl_GetCurPath_wchar_t__
add esp, 4
push 0x475988
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x47599c
lea eax, [ebp - 0x20c]
push eax
call fcn.00423327
add esp, 8
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0
je 0x45ade0
mov ecx, dword [ebp - 0x210]
push ecx
push 1
push 0x1ac
mov edx, dword [ebp - 0x214]
push edx
call fcn.00423568
add esp, 0x10
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041e140
mov esp, ebp
pop ebp
ret
Function at 0x45c080
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x460c89
mov eax, dword fs:[0]
push eax
sub esp, 0x8a8
mov eax, dword [0x48200c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ebp + 8]
call sym.Uninstall_adv.exe_private:_bool___thiscall_CNsLog::isLog_void_
movzx eax, al
test eax, eax
jne 0x45c0bf
jmp 0x45c23f
lea ecx, [ebp - 0x8b0]
call fcn.00406e20
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x8b0]
push ecx
mov ecx, dword [ebp + 8]
call sym.Uninstall_adv.exe_private:_void___thiscall_CNsLog::GetLogFileName_class_ATL::CStringT_wchar_t__class_ATL::StrTraitATL_wchar_t__class_ATL::ChTraitsCRT_wchar_t_____
push 0x4760dc
lea ecx, [ebp - 0x8b0]
call fcn.00406e70
push eax
call fcn.00423327
add esp, 8
mov dword [ebp - 0x8a8], eax
cmp dword [ebp - 0x8a8], 0
je 0x45c22d
lea edx, [ebp + 0x10]
mov dword [ebp - 0x8b4], edx
push 0x800
push 0
lea eax, [ebp - 0x810]
push eax
call fcn.0041fb70
add esp, 0xc
mov ecx, dword [ebp - 0x8b4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 0x400
lea eax, [ebp - 0x810]
push eax
call fcn.0041d790
add esp, 0x10
mov dword [ebp - 0x8b4], 0
lea ecx, [ebp - 0x820]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
lea ecx, [ebp - 0x8ac]
call fcn.00406e20
mov byte [ebp - 4], 1
lea edx, [ebp - 0x810]
push edx
movzx eax, word [ebp - 0x814]
push eax
movzx ecx, word [ebp - 0x816]
push ecx
movzx edx, word [ebp - 0x818]
push edx
movzx eax, word [ebp - 0x81a]
push eax
movzx ecx, word [ebp - 0x81e]
push ecx
movzx edx, word [ebp - 0x820]
push edx
push 0x4760e8
lea eax, [ebp - 0x8ac]
push eax
call fcn.004075a0
add esp, 0x24
lea ecx, [ebp - 0x8ac]
call fcn.00406e70
push eax
lea ecx, [ebp - 0x8a4]
call fcn.0040fca0
mov ecx, dword [ebp - 0x8a8]
push ecx
lea ecx, [ebp - 0x8a4]
call fcn.0040a080
push eax
call fcn.00428e40
add esp, 4
push eax
push 1
lea ecx, [ebp - 0x8a4]
call fcn.0040a080
push eax
call fcn.00428dde
add esp, 0x10
mov edx, dword [ebp - 0x8a8]
push edx
call fcn.0042370f
add esp, 4
lea ecx, [ebp - 0x8a4]
call fcn.0040fc70
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x8ac]
call fcn.00406d00
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8b0]
call fcn.00406d00
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041e140
mov esp, ebp
pop ebp
ret
Function at 0x45c450
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x460cc7
mov eax, dword fs:[0]
push eax
sub esp, 0xa8
mov eax, dword [0x48200c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xb4], ecx
mov ecx, dword [ebp - 0xb4]
call sym.Uninstall_adv.exe_private:_bool___thiscall_CNsLog::isLog_void_
movzx eax, al
test eax, eax
jne 0x45c498
jmp 0x45c5bb
lea ecx, [ebp - 0xb0]
call fcn.00406e20
mov dword [ebp - 4], 0
lea ecx, [ebp - 0xb0]
push ecx
mov ecx, dword [ebp - 0xb4]
call sym.Uninstall_adv.exe_private:_void___thiscall_CNsLog::GetLogFileName_class_ATL::CStringT_wchar_t__class_ATL::StrTraitATL_wchar_t__class_ATL::ChTraitsCRT_wchar_t_____
push 0x476090
lea ecx, [ebp - 0xb0]
call fcn.00406e70
push eax
call fcn.00423327
add esp, 8
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0
je 0x45c5a9
lea edx, [ebp - 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
lea ecx, [ebp - 0xac]
call fcn.00406e20
mov byte [ebp - 4], 1
mov eax, dword [ebp + 8]
push eax
movzx ecx, word [ebp - 0x14]
push ecx
movzx edx, word [ebp - 0x16]
push edx
movzx eax, word [ebp - 0x18]
push eax
movzx ecx, word [ebp - 0x1a]
push ecx
movzx edx, word [ebp - 0x1e]
push edx
movzx eax, word [ebp - 0x20]
push eax
push 0x476098
lea ecx, [ebp - 0xac]
push ecx
call fcn.004075a0
add esp, 0x24
lea ecx, [ebp - 0xac]
call fcn.00406e70
push eax
lea ecx, [ebp - 0xa4]
call fcn.0040fca0
mov edx, dword [ebp - 0xa8]
push edx
lea ecx, [ebp - 0xa4]
call fcn.0040a080
push eax
call fcn.00428e40
add esp, 4
push eax
push 1
lea ecx, [ebp - 0xa4]
call fcn.0040a080
push eax
call fcn.00428dde
add esp, 0x10
mov eax, dword [ebp - 0xa8]
push eax
call fcn.0042370f
add esp, 4
lea ecx, [ebp - 0xa4]
call fcn.0040fc70
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xac]
call fcn.00406d00
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb0]
call fcn.00406d00
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041e140
mov esp, ebp
pop ebp
ret 4
Function at 0x45d680
Capabilities:
Delete registry value
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x48200c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x218], ecx
lea eax, [ebp - 0x210]
push eax
push 0xf003f
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x45d6c7
xor eax, eax
jmp 0x45d786
cmp dword [ebp + 0xc], 0
je 0x45d763
push 0x208
push 0
lea ecx, [ebp - 0x20c]
push ecx
call fcn.0041fb70
add esp, 0xc
cmp dword [ebp + 0x10], 0
jne 0x45d703
push 0x104
lea edx, [ebp - 0x20c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
jmp 0x45d714
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 1
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
push eax
lea ecx, [ebp - 0x20c]
push ecx
push 1
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x210]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x45d761
mov ecx, dword [ebp - 0x210]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x45d786
jmp 0x45d774
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x210]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ecx, dword [ebp - 0x210]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041e140
mov esp, ebp
pop ebp
ret 0xc

Function at 0x45d7c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], ecx
push 0x26c
call fcn.0041e68d
add esp, 4
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov dword [ecx], edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 4]
add ecx, 4
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 0x10]
mov dword [edx + 0x25c], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0x14]
mov dword [ecx + 0x260], edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0x18]
mov dword [eax + 0x264], ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
mov dword [edx + 0x268], eax
mov ecx, dword [ebp - 8]
mov dword [ecx], 0
lea edx, [ebp - 0x14]
push edx
push 0
mov eax, dword [ebp - 4]
push eax
push sym.Uninstall_adv.exe_public:_static_unsigned_long_int___stdcall_CNsReg::MonitorThread_void__
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x45d85d
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret 0x14
Function at 0x45db40
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x48200c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x224], ecx
mov dword [ebp - 0x220], 7
mov dword [ebp - 0x214], 0xf003f
cmp dword [ebp + 0x14], 0
je 0x45db86
mov eax, dword [ebp - 0x214]
or eax, 0x100
mov dword [ebp - 0x214], eax
jmp 0x45dba1
call sym.Uninstall_adv.exe_int___cdecl_isWow64_void_
test eax, eax
je 0x45dba1
mov ecx, dword [ebp - 0x214]
or ecx, 0x200
mov dword [ebp - 0x214], ecx
lea edx, [ebp - 0x218]
push edx
mov eax, dword [ebp - 0x214]
push eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x45dc41
mov dword [ebp - 0x21c], 0x104
push 0x20a
push 0
lea eax, [ebp - 0x210]
push eax
call fcn.0041fb70
add esp, 0xc
lea ecx, [ebp - 0x21c]
push ecx
lea edx, [ebp - 0x210]
push edx
lea eax, [ebp - 0x220]
push eax
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x218]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x45dc34
lea eax, [ebp - 0x210]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edx, dword [ebp - 0x218]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x45dc43
mov eax, dword [ebp - 0x218]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041e140
mov esp, ebp
pop ebp
ret 0x14
Function at 0x401090
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
mov eax, dword [0x5c6a38]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
call fcn.00407d10
mov ebx, eax
xor edi, edi
cmp ebx, edi
je 0x4010c3
call fcn.00407e00
test eax, eax
je 0x4010d6
mov edi, ebx
call fcn.00407e70
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00543417
mov esp, ebp
pop ebp
ret
xor eax, eax
mov dword [ebp - 0x138], eax
mov byte [ebp - 0x134], al
mov dword [ebp - 0x10], edi
cmp dword [ebx], 1
je 0x4010f8
mov dword [0x5d1008], 0x80000
jmp 0x4010bc
mov esi, dword [ebx + 4]
mov ecx, dword [esi]
or edx, 0xffffffff
cmp dword [ecx + 4], edx
jg 0x40110c
mov ecx, 0x10000
jmp 0x40114f
cmp dword [esi + 4], edx
je 0x40111d
mov edi, ecx
call fcn.00407050
or edx, 0xffffffff
xor edi, edi
mov eax, dword [esi]
mov dword [esi + 4], edx
mov eax, dword [eax + 4]
mov dword [ebp - 0x138], eax
mov byte [ebp - 0x134], 0
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], edi
xor ecx, ecx
mov dword [0x5d1008], ecx
cmp ecx, edi
jne 0x4010bc
xor ecx, ecx
mov esi, eax
cmp eax, ecx
jle 0x401229
lea esp, [esp]
mov dword [ebp - 0x138], ecx
mov byte [ebp - 0x134], 0
mov dword [ebp - 0x10], ecx
cmp dword [ebx], 1
je 0x401191
mov dword [0x5d1008], 0x80000
jmp 0x4011a5
mov ecx, dword [ebx + 4]
push edi
lea edx, [ebp - 0x138]
call fcn.00407240
mov dword [0x5d1008], eax
cmp dword [ebx], 1
jne 0x4011cb
mov ecx, dword [ebx + 4]
push edi
lea edx, [ebp - 0x134]
call fcn.00407970
mov dword [0x5d1008], eax
test eax, eax
jne 0x4011d5
inc edi
cmp edi, esi
jge 0x401229
xor ecx, ecx
jmp 0x401170
mov dword [0x5d1008], 0x80000
cmp dword [ebx], 1
je 0x4011f7
mov dword [0x5d1008], 0x80000
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00543417
mov esp, ebp
pop ebp
ret
mov esi, dword [ebx + 4]
call fcn.00407cb0
mov dword [0x5d1008], eax
test esi, esi
je 0x40120d
call fcn.00407db0
push ebx
call fcn.00445d1f
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00543417
mov esp, ebp
pop ebp
ret
cmp dword [ebx], 1
je 0x40123a
mov dword [0x5d1008], 0x80000
jmp 0x401259
mov esi, dword [ebx + 4]
call fcn.00407cb0
mov dword [0x5d1008], eax
test esi, esi
je 0x401250
call fcn.00407db0
push ebx
call fcn.00445d1f
add esp, 4
push str.C:UsersPublic371.zip
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.00543417
mov esp, ebp
pop ebp
ret
Function at 0x401ad0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov esi, eax
lea eax, [ebp - 4]
push eax
push str.SoftwareYUVPlayer_latelee.orgSetting
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov eax, dword [esi]
cmp dword [eax - 4], 1
mov edi, dword [eax - 0xc]
jle 0x401aff
push edi
mov ecx, esi
call fcn.00403580
mov edx, dword [esi]
mov eax, dword [ebp - 4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push edi
push edx
push 1
push 0
push str.AddedSize
push eax
call esi
mov edx, dword [ebp - 4]
push 4
lea ecx, [ebp + 8]
push ecx
push 4
push 0
push str.FrameWidth
push edx
call esi
mov ecx, dword [ebp - 4]
push 4
lea eax, [ebp + 0xc]
push eax
push 4
push 0
push str.FrameHeight
push ecx
call esi
mov eax, dword [ebp - 4]
push 4
lea edx, [ebp + 0x10]
push edx
push 4
push 0
push str.FrameRate
push eax
call esi
mov edx, dword [ebp - 4]
push 4
lea ecx, [ebp + 0x14]
push ecx
push 4
push 0
push str.CurrentPixelFormat
push edx
call esi
mov ecx, dword [ebp - 4]
push 4
lea eax, [ebp + 0x18]
push eax
push 4
push 0
push str.Loop
push ecx
call esi
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x14