joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401874
Capabilities:
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0xa4
mov eax, dword [0x4d0620]
xor eax, ebp
mov dword [ebp + 0x70], eax
mov eax, dword [ebp + 0x7c]
push esi
xor esi, esi
push esi
push 0x80
push 3
push esi
push 1
push closesocket
mov dword [edi], esi
push eax
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x2c], esi
mov dword [ebx], esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x30], eax
je 0x4018f1
push esi
lea ecx, [ebp - 0x2c]
push ecx
mov esi, 0x94
push esi
lea ecx, [ebp - 0x24]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4018e8
cmp dword [ebp - 0x2c], esi
jne 0x4018e8
mov eax, dword [ebp + 0x18]
mov dword [edi], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebx], eax
mov dword [ebp - 0x28], 1
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0x70]
mov eax, dword [ebp - 0x28]
xor ecx, ebp
pop esi
call fcn.0047b9fe
add ebp, 0x74
leave
ret

Function at 0x401904
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x188
mov eax, dword [0x4d0620]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 1
push closesocket
mov dword [edi], ebx
push eax
mov dword [ebp - 0x180], ebx
mov dword [ebp - 0x184], ebx
mov dword [esi], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x188], eax
je 0x4019f5
push ebx
lea ecx, [ebp - 0x184]
push ecx
push 0x170
lea ecx, [ebp - 0x17c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4019e9
cmp dword [ebp - 0x184], 0x170
jne 0x4019e9
push str.Kingsoft_AntiVirus_Database.
call fcn.0047be60
push eax
lea eax, [ebp - 0x17c]
push str.Kingsoft_AntiVirus_Database.
push eax
call fcn.0047beeb
add esp, 0x10
test eax, eax
jne 0x4019e9
mov eax, dword [ebp - 0x128]
mov ecx, dword [ebp - 0x128]
shr eax, 8
and eax, 0xff
and ecx, 0xffff0000
add eax, ecx
mov dword [edi], eax
movzx eax, byte [ebp - 0x128]
shl eax, 0x10
cmp word [ebp - 0x12e], bx
mov dword [esi], eax
je 0x4019df
movzx ecx, word [ebp - 0x12e]
add ecx, eax
mov dword [esi], ecx
mov dword [ebp - 0x180], 1
push dword [ebp - 0x188]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x180]
xor ecx, ebp
pop ebx
call fcn.0047b9fe
leave
ret
Function at 0x401bd8
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
xor esi, esi
cmp dword [ebp + 8], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
je 0x401c76
mov eax, dword [ebp + 0xc]
cmp eax, esi
je 0x401c76
cmp ebx, esi
je 0x401c76
mov dword [eax], esi
push edi
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
mov dword [ebx], esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
cmp edi, esi
je 0x401c75
push edi
call fcn.0045d840
cmp eax, esi
pop ecx
mov dword [ebp - 0x10], eax
je 0x401c75
push eax
push edi
push dword [ebp - 4]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x401c6c
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x4ac26c
push dword [ebp - 0x10]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x401c6c
cmp dword [ebp - 8], esi
jbe 0x401c65
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 8]
mov edx, dword [ebp + 0xc]
mov dword [edx], ecx
mov eax, dword [eax + 0xc]
mov dword [ebx], eax
mov dword [ebp - 0x14], 1
push dword [ebp - 0x10]
call fcn.0045d845
pop ecx
pop edi
mov eax, dword [ebp - 0x14]
pop esi
leave
ret

Function at 0x401c8a
Capabilities:
Check if file exists
Get file size

Disassembly:
push ebx
push esi
mov esi, eax
or ebx, 0xffffffff
test esi, esi
je 0x401cd8
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x401caa
push 2
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x401cd8
push 0
push 0
push 3
push 0
push 3
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, ebx
je 0x401cd8
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov eax, ebx
pop ebx
ret
Function at 0x401dad
Capabilities:
Create process on windows

Disassembly:
push 0x5c
mov eax, 0x49f767
call fcn.00481d3a
push 0x4efd98
lea ecx, [ebp - 0x10]
call fcn.0040144c
xor esi, esi
mov dword [ebp - 4], esi
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], esi
jne 0x401de3
lea ecx, [eax - 0x10]
call fcn.00401325
xor eax, eax
call fcn.00481e12
ret
push 0x40
lea eax, [ebp - 0x64]
push esi
push eax
call fcn.0047e7d0
mov dword [ebp - 0x20], esi
xor eax, eax
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
push str.KULANSyn.exe
lea ecx, [ebp - 0x10]
stosd dword es:[edi], eax
mov dword [ebp - 0x68], 0x44
call fcn.00401250
cmp dword [ebp + 8], esi
jne 0x401e1d
push str.__Quit
jmp 0x401e35
cmp dword [ebp + 0xc], 1
jne 0x401e2a
push str.__ShowSuccessInfo
jmp 0x401e35
cmp dword [ebp + 0xc], 2
jne 0x401e3d
push str.__ShowSuccessAndNeedToRestartInfo
lea ecx, [ebp - 0x10]
call fcn.00401250
mov ebx, dword [ebp - 0x10]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x68]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x401e69
lea ecx, [ebx - 0x10]
call fcn.00401325
mov eax, esi
jmp 0x401ddd
cmp dword [ebp - 0x20], esi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x401e79
push dword [ebp - 0x20]
call edi
cmp dword [ebp - 0x1c], esi
je 0x401e83
push dword [ebp - 0x1c]
call edi
xor esi, esi
inc esi
jmp 0x401e5a

Function at 0x401fbe
Capabilities:
Read file on windows

Disassembly:
push 0x18
push 0x4c6d78
call fcn.00481f00
xor edi, edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 4], edi
push edi
push 0x80
push 3
push edi
push 3
push closesocket
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x1c], eax
cmp eax, 0xffffffff
jne 0x402018
push 0xfffffffffffffffe
lea eax, [ebp - 0x10]
push eax
push 0x4d0620
call fcn.0048bc10
add esp, 0xc
mov eax, dword [ebp - 0x28]
call fcn.00481f45
ret
mov esi, 0x25800
push esi
call fcn.0047dc09
pop ecx
mov ebx, eax
mov dword [ebp - 0x20], ebx
cmp ebx, edi
je 0x40206e
push edi
lea eax, [ebp - 0x24]
push eax
push esi
push ebx
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, edi
je 0x40206e
cmp dword [ebp - 0x24], edi
je 0x40206e
push dword [ebp - 0x24]
push ebx
push dword [ebp - 0x28]
call fcn.00435ecb
add esp, 0xc
mov dword [ebp - 0x28], eax
cmp dword [0x4eef64], edi
je 0x402029
push dword [0x4efc68]
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x402029
mov dword [ebp - 4], 0xfffffffe
call fcn.0040207e
jmp 0x40200f
Function at 0x402191
Capabilities:
Set registry value

Disassembly:
push 0x220
mov eax, 0x4a0002
call fcn.00481da3
xor ebx, ebx
mov dword [ebp - 0x224], ecx
mov dword [ebp - 0x22c], ebx
call fcn.00401607
xor esi, esi
inc esi
mov dword [ebp - 0x22c], esi
mov dword [ebp - method.CKANRegisterKey.virtual_0], vtable.CKANRegisterKey.0
mov dword [ebp - 0x21c], ebx
push 0x206
lea eax, [ebp - 0x216]
push ebx
mov dword [ebp - 4], esi
push eax
mov word [ebp - 0x218], bx
call fcn.0047e7d0
add esp, 0xc
push ebx
push str.SOFTWAREKingsoftAntivirusUpdate
push reloc.WS2_32.dll_accept
lea eax, [ebp - 0x220]
push eax
call fcn.00428b67
cmp dword [ebp + 8], ebx
mov dword [ebp - 0x228], eax
je 0x402234
lea eax, [ebp - 0x220]
push eax
lea edi, [ebp - 0x218]
mov ecx, str.ZhaiYao
call fcn.00428bff
mov ecx, dword [ebp - 0x224]
mov eax, edi
push eax
call fcn.004014c5
jmp 0x402261
cmp dword [ebp - 0x21c], ebx
je 0x402261
mov edi, 0x4ac888
push edi
call fcn.0047ba0d
pop ecx
lea eax, [eax + eax + 2]
push eax
push edi
push esi
push ebx
push str.ZhaiYao
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp dword [ebp - 0x228], ebx
je 0x402274
lea esi, [ebp - 0x220]
call fcn.00428ba8
lea ecx, [ebp - 0x220]
call fcn.00428b57
mov eax, dword [ebp - 0x224]
call fcn.00481e26
ret

Function at 0x40228b
Capabilities:
Shutdown system

Disassembly:
push 0x24
mov eax, 0x49f2dc
call fcn.00481d3a
call fcn.00428e38
xor esi, esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
lea eax, [ebp - 0x14]
push eax
push 0x28
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x402316
lea eax, [ebp - 0x20]
push eax
push str.SeShutdownPrivilege
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x402316
mov eax, dword [ebp - 0x20]
push esi
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
push esi
push esi
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x30]
push eax
push esi
push dword [ebp - 0x14]
xor edi, edi
inc edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x24], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x402316
push esi
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
je 0x402316
mov dword [0x4efc3c], edi
mov dword [ebp - 0x18], edi
call fcn.00428e69
cmp dword [ebp - 0x14], esi
je 0x402329
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x18]
call fcn.00481e12
ret
Function at 0x402470
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push ebx
push esi
push edi
push 0x44
pop edi
push edi
xor esi, esi
lea eax, [ebp - 0x58]
push esi
push eax
call fcn.0047e7d0
push 0x10
lea eax, [ebp - 0x10]
push esi
push eax
mov dword [ebp - 0x58], edi
call fcn.0047e7d0
add esp, 0x18
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x58]
push ecx
push esi
push esi
push esi
xor eax, eax
inc eax
push eax
push esi
push esi
push dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
push dword [ebp + 8]
mov word [ebp - 0x28], 5
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x4024cf
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x4024d1
xor ebx, ebx
cmp dword [ebp - 0x10], esi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x4024e4
push dword [ebp - 0x10]
call edi
mov dword [ebp - 0x10], esi
cmp dword [ebp - 0xc], esi
je 0x4024ee
push dword [ebp - 0xc]
call edi
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x4025a8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x14
mov eax, 0x4a0f7f
call fcn.00481d3a
xor esi, esi
call fcn.0045db7e
push eax
lea ecx, [ebp - 0x14]
call fcn.0040161b
push esi
push str.InstallPath
push 0xb
lea ebx, [ebp - 0x14]
mov ecx, str.SoftwareKingsoftKACksaduba
mov dword [ebp - 4], esi
call fcn.00435d3e
mov eax, dword [ebp - 0x14]
cmp dword [eax - 0xc], esi
jle 0x4026e6
mov eax, ebx
push eax
lea ecx, [ebp - 0x10]
call fcn.0040144c
mov byte [ebp - 4], 1
call fcn.0045db7e
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040161b
mov byte [ebp - 4], 2
call fcn.0045db7e
push eax
lea ecx, [ebp - 0x18]
call fcn.0040161b
mov byte [ebp - 4], 3
mov edi, dword [ebp - 0x10]
push edi
call fcn.0047ba0d
dec eax
pop ecx
js 0x402723
cmp eax, dword [edi - 0xc]
jg 0x402723
movzx eax, word [edi + eax*2]
cmp ax, 0x5c
je 0x40264f
push 0x4ac26c
lea ecx, [ebp - 0x10]
call fcn.00401250
mov edi, dword [ebp - 0x10]
push str.ksamain.exe
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.00402dca
add esp, 0xc
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 4
call fcn.004015ba
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.00401325
push str.ksaengine.dll
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.00402dca
add esp, 0xc
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 5
call fcn.004015ba
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.00401325
mov ebx, dword [ebp - 0x1c]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push ebx
call esi
cmp eax, 0xffffffff
je 0x4026f9
push dword [ebp - 0x18]
call esi
cmp eax, 0xffffffff
je 0x4026f9
mov ecx, dword [ebp - 0x18]
xor esi, esi
add ecx, 0xfffffff0
inc esi
call fcn.00401325
lea ecx, [ebx - 0x10]
call fcn.00401325
lea ecx, [edi - 0x10]
call fcn.00401325
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00401325
mov eax, esi
call fcn.00481e12
ret
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00401325
lea ecx, [ebx - 0x10]
call fcn.00401325
lea ecx, [edi - 0x10]
call fcn.00401325
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00401325
xor eax, eax
jmp 0x4026f3
push 0x80070057
call fcn.0040130c
int3
Function at 0x402a47
Capabilities:
Check if file exists
Delete file
Set file attributes

Disassembly:
push ebp
sub esp, 0x20c
lea ebp, [esp - 4]
mov eax, dword [0x4d0620]
xor eax, ebp
mov dword [ebp + 0x20c], eax
push 0x24
mov eax, 0x4a0f27
call fcn.00481d3a
xor esi, esi
push 0x20a
lea eax, [ebp + 2]
push esi
push eax
mov edi, ecx
mov word [ebp], si
call fcn.0047e7d0
add esp, 0xc
call fcn.0045db7e
push eax
lea ecx, [ebp - 0x10]
call fcn.0040161b
mov dword [ebp - 4], esi
mov eax, dword [edi]
cmp dword [eax - 0xc], 0x104
jg 0x402b31
push edi
lea ecx, [ebp - 0x10]
call fcn.004015ba
push 0x5c
push 0x2f
lea ebx, [ebp - 0x10]
call fcn.00402ce3
mov ebx, dword [ebp - 0x10]
push dword [ebx - 0xc]
lea eax, [ebp]
push ebx
push eax
call fcn.0047d58d
add esp, 0xc
lea eax, [ebp]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x402b2c
push 0x80
lea eax, [ebp]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x402b2c
push 6
pop ecx
lea edi, [ebp - 0x2c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x30]
push eax
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], 3
mov dword [ebp - 0x24], esi
mov word [ebp - 0x20], 0x414
mov dword [ebp - 0x1e], esi
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
jne 0x402b34
xor esi, esi
inc esi
jmp 0x402b34
mov ebx, dword [ebp - 0x10]
lea ecx, [ebx - 0x10]
call fcn.00401325
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x20c]
xor ecx, ebp
call fcn.0047b9fe
add ebp, 0x210
leave
ret

Function at 0x403a40
Capabilities:
Create process on windows

Disassembly:
push 0x5c
mov eax, 0x4a0f04
call fcn.00481d3a
push 0x4ed5e8
lea ecx, [ebp - 0x14]
call fcn.00401640
push str.UpLiveSelf.DAT
push eax
lea eax, [ebp - 0x10]
xor esi, esi
push eax
mov dword [ebp - 4], esi
call fcn.00402dca
add esp, 0xc
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00401325
cmp dword [0x4efc38], esi
je 0x403acb
call fcn.00428e38
lea eax, [ebp - 0x68]
push eax
mov dword [ebp - 0x68], 0x44
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x68]
push eax
push esi
push esi
push 0x20
push esi
push esi
push esi
push esi
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push dword [ebp - 0x20]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x24]
call esi
call fcn.00428e69
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00401325
call fcn.00481e12
ret

Function at 0x404798
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x4047ab
push 0x80004005
call fcn.0040130c
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
add eax, eax
push eax
push dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push 1
push 0
push dword [ebp + 0x10]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop ebp
ret 0xc
Function at 0x4047e8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp edi, ebx
jne 0x4047fd
push 0x80004005
call fcn.0040130c
push edi
push esi
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 4], ebx
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp esi, ebx
je 0x404855
mov ecx, dword [edi]
cmp ecx, ebx
jbe 0x404852
cmp dword [ebp - 4], ebx
jbe 0x40484f
cmp dword [ebp - 4], 2
jbe 0x40485a
cmp dword [ebp - 4], 7
jne 0x40484f
test cl, 1
jne 0x40484f
shr ecx, 1
cmp ecx, 1
jb 0x40484f
cmp word [esi + ecx*2 - 2], bx
jne 0x40484f
cmp ecx, 1
jbe 0x404855
cmp word [esi + ecx*2 - 4], bx
je 0x404855
push 0xd
pop eax
mov word [esi], bx
pop ebx
leave
ret 8
test cl, 1
jne 0x40484f
shr ecx, 1
cmp word [esi + ecx*2 - 2], bx
jmp 0x40484d
Function at 0x40541c
Capabilities:
Read .ini file

Disassembly:
push 0x228
mov eax, 0x4a29fd
call fcn.00481da3
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x234], eax
mov eax, dword [ebp + 0x10]
xor ebx, ebx
push 0x206
mov dword [ebp - 0x228], eax
lea eax, [ebp - 0x216]
push ebx
push eax
mov edi, ecx
mov esi, edx
mov dword [ebp - 0x224], ebx
mov word [ebp - 0x218], bx
call fcn.0047e7d0
add esp, 0xc
call fcn.0045db7e
push eax
lea ecx, [ebp - 0x22c]
call fcn.0040161b
mov dword [ebp - 4], ebx
call fcn.0045db7e
push eax
lea ecx, [ebp - 0x230]
call fcn.0040161b
mov byte [ebp - 4], 1
call fcn.0045db7e
push eax
lea ecx, [ebp - 0x21c]
call fcn.0040161b
push edi
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 2
call fcn.004014c5
push dword [esi]
push 1
push 0x4acd34
push dword [ebp - 0x21c]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
je 0x40564b
push 0x9a0
call fcn.0045d815
cmp eax, ebx
pop ecx
je 0x4054e6
mov esi, eax
call fcn.0040644d
mov esi, eax
jmp 0x4054e8
xor esi, esi
cmp esi, ebx
je 0x40565c
lea eax, [esi + 4]
push edi
push eax
call fcn.0040466f
pop ecx
pop ecx
push dword [ebp - 0x228]
mov edi, esi
push dword [ebp - 0x234]
push dword [ebp + 8]
call fcn.00404ad1
test eax, eax
je 0x405657
call fcn.00405a4c
cmp eax, ebx
je 0x405646
cmp dword [ebp + 8], ebx
push dword [esi + 0x760]
jne 0x405587
lea eax, [ebp - 0x218]
push eax
call fcn.0040464f
lea eax, [ebp - 0x218]
push 0x5c
push eax
call fcn.0047ebd0
add esp, 0x10
cmp eax, ebx
je 0x405556
mov word [eax], bx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x220]
call fcn.00401640
lea ecx, [ebp - 0x220]
mov byte [ebp - 4], 3
call fcn.0042e810
mov ecx, dword [ebp - 0x220]
add ecx, 0xfffffff0
call fcn.00401325
jmp 0x4055f7
lea eax, [esi + 0x738]
push eax
call fcn.0047eb2f
pop ecx
push edx
push eax
call fcn.004020a7
add esp, 0xc
test eax, eax
je 0x4055ae
mov dword [esi + 0x310], 3
jmp 0x4055f7
cmp dword [0x4ef1d8], ebx
je 0x4055c3
push dword [esi + 0x760]
push 0x191
jmp 0x4055ea
mov dword [esi + 0x310], 2
cmp dword [0x4efddc], ebx
jne 0x4055df
mov dword [0x4efddc], 1
push dword [esi + 0x760]
push 0x802b
push 0x4ef184
call fcn.0042a517
add esp, 0xc
cmp dword [esi + 0x998], ebx
je 0x405611
cmp dword [0x4efc34], ebx
jne 0x405611
mov dword [0x4efc34], 1
mov eax, dword [0x4efdd8]
cmp eax, ebx
je 0x40561c
mov dword [esi], eax
mov dword [0x4efdd8], esi
cmp dword [esi + 0x764], ebx
je 0x40564b
cmp dword [esi + 0x768], ebx
je 0x40564b
cmp dword [0x4efdec], ebx
je 0x40564b
mov dword [0x4efde4], 1
jmp 0x40564b
call fcn.00405322
mov dword [ebp - 0x224], 1
jmp 0x40565c
call fcn.00405322
mov ecx, dword [ebp - 0x21c]
add ecx, 0xfffffff0
call fcn.00401325
mov ecx, dword [ebp - 0x230]
add ecx, 0xfffffff0
call fcn.00401325
mov ecx, dword [ebp - 0x22c]
add ecx, 0xfffffff0
call fcn.00401325
mov eax, dword [ebp - 0x224]
call fcn.00481e26
ret 0xc
Function at 0x4057fa
Capabilities:
Read .ini file

Disassembly:
push 0x808
mov eax, 0x4a0ea1
call fcn.00481da3
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push ebx
push 0
push str.NewUpdateSelfFirstFlag
mov esi, str.COMMENT
push esi
call edi
and word [ebp - 0x810], 0
push 0x7fe
mov dword [0x4efdec], eax
lea eax, [ebp - 0x80e]
push 0
push eax
call fcn.0047e7d0
add esp, 0xc
push ebx
push 0x400
lea eax, [ebp - 0x810]
push eax
push 0x4ac888
push str.Readme
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [ebp - 0x810], 0
je 0x40588f
lea eax, [ebp - 0x810]
push eax
mov ecx, 0x4efe18
call fcn.004014c5
push 0x4ace84
push 0x4ace8c
push 0x4efe18
call fcn.00406220
push ebx
push 0
push 0x4ace90
push esi
call edi
push ebx
lea ecx, [ebp - 0x814]
mov dword [0x4efdf8], eax
call fcn.00401640
and dword [ebp - 4], 0
push ebx
mov ecx, 0x4efe1c
call fcn.004014c5
push ebx
push 0
push str.SupportResume
push esi
call edi
mov ecx, dword [ebp - 0x814]
add ecx, 0xfffffff0
mov dword [0x4ef864], eax
call fcn.00401325
xor eax, eax
inc eax
call fcn.00481e26
ret

Function at 0x405e71
Capabilities:
Read .ini file

Disassembly:
push 8
mov eax, 0x4a29b6
call fcn.00481d3a
xor ebx, ebx
call fcn.0045db7e
push eax
lea ecx, [ebp - 0x10]
call fcn.0040161b
push dword [ebp + 8]
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], ebx
call fcn.004014c5
mov eax, dword [ebp + 0x14]
push dword [eax]
push 1
push 0x4acd34
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
je 0x405f07
push 0x9a0
call fcn.0045d815
cmp eax, ebx
pop ecx
je 0x405ece
mov esi, eax
call fcn.0040644d
mov esi, eax
jmp 0x405ed0
xor esi, esi
cmp esi, ebx
je 0x405f11
push dword [ebp + 8]
lea eax, [esi + 4]
push eax
call fcn.0040466f
pop ecx
pop ecx
push dword [ebp + 0x18]
mov edi, esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00404ad1
test eax, eax
je 0x405f0c
mov eax, dword [0x4efde0]
cmp eax, ebx
je 0x405f01
mov dword [esi], eax
mov dword [0x4efde0], esi
xor ebx, ebx
inc ebx
jmp 0x405f11
call fcn.00405322
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00401325
mov eax, ebx
call fcn.00481e12
ret 0x14
Function at 0x405f26
Capabilities:
Read .ini file

Disassembly:
push 0
mov eax, 0x49f6af
call fcn.00481d3a
xor ebx, ebx
mov dword [ebp - 4], 1
cmp dword [0x4efe28], ebx
je 0x40600c
push dword [ebp + 8]
push ebx
push 0x4aced4
push str.COMMENT
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea edi, [ebp + 0xc]
mov dword [0x4efe24], eax
call fcn.00406399
push 0x4acef4
xor ecx, ecx
mov esi, edi
call fcn.0040444f
or edi, 0xffffffff
cmp eax, edi
je 0x405f89
mov dword [0x4efe20], 2
jmp 0x405fe4
push str.lang
xor ecx, ecx
lea esi, [ebp + 0xc]
call fcn.0040444f
cmp eax, edi
je 0x405fa8
mov dword [0x4efe20], 3
jmp 0x405fe4
push str.engine
xor ecx, ecx
lea esi, [ebp + 0xc]
call fcn.0040444f
cmp eax, edi
je 0x405fc7
mov dword [0x4efe20], 4
jmp 0x405fe4
push str.data
xor ecx, ecx
lea esi, [ebp + 0xc]
call fcn.0040444f
cmp eax, edi
je 0x405ffd
mov dword [0x4efe20], 5
push ebx
push 0x4efe20
push 0x453
push dword [0x4efe28]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x40600c
push 0x4acf24
xor ecx, ecx
lea esi, [ebp + 0xc]
call fcn.0040444f
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00401325
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.00401325
call fcn.00481e12
ret 8

Function at 0x40607f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
push 0x4acf54
call fcn.004014c5
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
mov ebx, 0x20019
push ebx
push 0
mov edi, str.SoftwareKingsoftAntivirus
push edi
push reloc.WS2_32.dll_accept
call esi
test eax, eax
je 0x4060e3
lea eax, [ebp - 4]
push eax
push ebx
xor ebx, ebx
push ebx
push edi
push reloc.WS2_32.dll_bind
call esi
test eax, eax
je 0x4060e5
mov ecx, dword [ebp + 8]
push 0x4ac810
call fcn.00401250
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret
xor ebx, ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push ebx
mov edi, 0x4acf94
push edi
push dword [ebp - 4]
mov dword [ebp - 8], 0x64
call esi
test eax, eax
jne 0x406142
push dword [ebp - 8]
mov ecx, dword [ebp + 8]
call fcn.0040133f
lea ecx, [ebp - 8]
push ecx
push eax
push ebx
push ebx
push edi
push dword [ebp - 4]
call esi
test eax, eax
mov ecx, dword [ebp + 8]
push 0xffffffffffffffff
jne 0x406130
call fcn.00402fd4
jmp 0x406142
call fcn.00402fd4
mov ecx, dword [ebp + 8]
push 0x4acf54
call fcn.004014c5
cmp dword [ebp - 4], ebx
je 0x406150
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
inc ebx
jmp 0x4060cf