joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48fb7a
Capabilities:
Delete registry key

Disassembly:
push 0xc
mov eax, 0x4e2c85
call fcn.004beaa5
and dword [ebp - 0x14], 0
call fcn.0048f2da
test eax, eax
jne 0x48fb98
call fcn.0048f357
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x18]
push eax
push 0x2001f
push 0
push 0x4ef7d8
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x48fbee
lea esi, [ebp - 0x14]
call fcn.0041bb70
test eax, eax
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
jne 0x48fbee
push str.SOFTWARETencentQQPCMgrDownloader
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov edi, eax
call fcn.0041bb70
call fcn.0041bb70
xor eax, eax
test edi, edi
sete al
jmp 0x48fbfd
lea esi, [ebp - 0x14]
call fcn.0041bb70
call fcn.0041bb70
xor eax, eax
call fcn.004beb28
ret

Function at 0x48fcec
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x198]
sub esp, 0x218
mov eax, dword [0x50f130]
xor eax, ebp
mov dword [ebp + 0x194], eax
push ebx
push esi
xor ebx, ebx
test byte [0x51617c], 1
mov esi, ecx
push edi
mov dword [ebp - 0x80], esi
mov dword [ebp - 0x7c], ebx
mov edi, 0x516040
jne 0x48fd3e
or dword [0x51617c], 1
mov esi, edi
call fcn.00416d00
push 0x4e6eab
call fcn.004b9683
mov esi, dword [ebp - 0x80]
pop ecx
mov eax, dword [0x516040]
cmp dword [eax - 0xc], ebx
jne 0x48fdd4
push 0x20a
lea eax, [ebp - 0x76]
push ebx
push eax
mov word [ebp - 0x78], bx
call fcn.004be320
add esp, 0xc
push 1
push 0x1a
lea eax, [ebp - 0x78]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea edx, [ebp - 0x78]
call fcn.004049e0
mov edx, dword [0x516040]
mov eax, dword [edx - 0xc]
cmp eax, ebx
jle 0x48fdd4
lea ecx, [eax - 1]
cmp ecx, ebx
jl 0x48fe00
cmp ecx, eax
jg 0x48fe00
cmp word [edx + ecx*2], 0x5c
je 0x48fd9f
push 0x5c
call fcn.0043d650
mov edx, str.TencentQQPCMgr_
call fcn.00413750
push dword [0x516040]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x48fdd4
mov edx, dword [0x516040]
sub esp, 0x1c
mov eax, esp
mov dword [ebp - 0x7c], esp
call fcn.004036c0
call fcn.0048fe0b
add esp, 0x1c
mov eax, dword [0x516040]
add eax, 0xfffffff0
call fcn.004012d0
mov ecx, dword [ebp + 0x194]
add eax, 0x10
mov dword [esi], eax
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b84de
add ebp, 0x198
leave
ret
push 0x80070057
call fcn.00401340
int3
Function at 0x48fe0b
Capabilities:
Create directory

Disassembly:
push 0x40
mov eax, 0x4de93e
call fcn.004beaa5
and dword [ebp - 4], 0
lea eax, [ebp + 8]
push eax
lea esi, [ebp - 0x2c]
call fcn.00416980
mov eax, esi
xor edi, edi
mov byte [ebp - 4], 1
push eax
inc edi
lea ebx, [ebp - 0x30]
mov dword [ebp - 0x30], 0x5c
call fcn.0047c8c0
cmp eax, 0xffffffff
je 0x48fe85
push eax
mov eax, esi
push eax
xor ecx, ecx
lea esi, [ebp - 0x4c]
call fcn.00416b30
push 0xffffffffffffffff
push 0
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 2
call fcn.00402090
mov byte [ebp - 4], 1
call fcn.00416cb0
sub esp, 0x1c
lea eax, [ebp - 0x2c]
mov esi, esp
mov dword [ebp - 0x30], esp
push eax
call fcn.00416980
call fcn.0048fe0b
add esp, 0x1c
cmp dword [ebp + 0x20], 8
mov eax, dword [ebp + 0xc]
jae 0x48fe91
lea eax, [ebp + 0xc]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x48fea4
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [ebp - 0x2c]
call fcn.00416cb0
lea esi, [ebp + 8]
call fcn.00416cb0
call fcn.004beb28
ret
Function at 0x4902d7
Capabilities:
Enumerate processes

Disassembly:
push ebp
sub esp, 0x438
lea ebp, [esp - 4]
mov eax, dword [0x50f130]
xor eax, ebp
mov dword [ebp + 0x438], eax
push 0x18
mov eax, 0x4e1228
call fcn.004bea3c
mov eax, dword [ebp + 0x444]
xor ebx, ebx
xor edi, edi
inc ebx
mov dword [ebp - 0x20], edi
test byte [0x516178], bl
mov dword [ebp - 0x24], eax
mov esi, 0x516174
jne 0x49032f
or dword [0x516178], ebx
call fcn.00416d00
push 0x4e6eb5
call fcn.004b9683
pop ecx
push edi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
push 0x208
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x22e]
push edi
push eax
mov word [ebp + 0x22c], di
call fcn.004be320
push esi
mov ecx, 0x4ef7d8
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x1c], edi
call fcn.004138f0
add esp, 0x10
test al, al
jne 0x4904a3
cmp dword [ebp - 0x14], 0xffffffff
je 0x4904cc
lea eax, [ebp]
push eax
push dword [ebp - 0x14]
mov dword [ebp], 0x22c
call sub.KERNEL32.dll_Process32FirstW
jmp 0x4903a9
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0x448]
je 0x490482
lea eax, [ebp]
push eax
push dword [ebp - 0x14]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x49038e
mov eax, edi
push eax
push edi
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp eax, edi
mov dword [ebp - 0x1c], eax
je 0x4904a3
lea eax, [ebp - 0x18]
push eax
mov ecx, str.Psapi.dll
call fcn.004099e0
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], edi
call fcn.004927aa
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x10], eax
call fcn.00416ce0
cmp dword [ebp - 0x10], edi
je 0x4904a3
push str.GetModuleFileNameExW
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, edi
je 0x4904a3
push 0x104
lea ecx, [ebp + 0x22c]
push ecx
push edi
push dword [ebp - 0x1c]
call eax
lea edx, [ebp + 0x22c]
mov edi, esi
call fcn.004049e0
mov eax, dword [0x516174]
mov edi, dword [eax - 0xc]
call fcn.00413790
mov ecx, eax
inc ecx
push esi
mov eax, edi
lea edx, [ebp - 0x20]
call fcn.00409930
mov dword [ebp - 4], ebx
mov ecx, dword [eax]
mov edi, dword [0x516174]
lea eax, [ecx - 0x10]
add edi, 0xfffffff0
cmp eax, edi
je 0x490495
cmp dword [edi + 0xc], 0
jl 0x49048a
mov edx, dword [eax]
cmp edx, dword [edi]
jne 0x49048a
call fcn.004012d0
mov esi, eax
mov eax, edi
call fcn.004010d0
add esi, 0x10
mov dword [0x516174], esi
jmp 0x490495
mov eax, dword [ebp + 0x18]
jmp 0x4903af
mov ebx, dword [ecx - 0xc]
push ecx
mov eax, esi
call fcn.00401450
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00416ce0
xor edi, edi
cmp dword [ebp - 0x14], 0xffffffff
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x4904b4
push dword [ebp - 0x14]
call esi
cmp dword [ebp - 0x1c], edi
je 0x4904be
push dword [ebp - 0x1c]
call esi
cmp dword [ebp - 0x10], edi
je 0x4904cc
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [0x516174]
add eax, 0xfffffff0
call fcn.004012d0
mov ecx, eax
mov eax, dword [ebp - 0x24]
add ecx, 0x10
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x438]
xor ecx, ebp
call fcn.004b84de
add ebp, 0x43c
leave
ret
Function at 0x49091c
Capabilities:
Check os version
Create process on windows
Create process suspended

Disassembly:
push 0x3a0
mov eax, 0x4e1186
call fcn.004beaa5
mov eax, dword [ebp + 8]
lea ebx, [ebp - 0x350]
mov esi, ecx
mov dword [ebp - 0x34c], eax
call fcn.00492658
xor ebx, ebx
lea eax, [ebp - 0x350]
mov dword [ebp - 4], ebx
call fcn.00492622
mov edx, str.Netsh.exe
lea edi, [ebp - 0x350]
call fcn.00413750
push 0x208
lea eax, [ebp - 0x222]
push ebx
push eax
mov word [ebp - 0x224], bx
call fcn.004be320
add esp, 0xc
cmp esi, ebx
lea eax, [ebp - 0x224]
jne 0x490996
push 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
jmp 0x49099f
push esi
push eax
call fcn.004daba9
pop ecx
pop ecx
cmp dword [ebp - 0x34c], ebx
jne 0x4909b1
mov dword [ebp - 0x34c], str.TencentDownloadProgram
lea esi, [ebp - 0x348]
call fcn.00416d00
mov esi, 0x11c
push esi
lea eax, [ebp - 0x344]
push ebx
push eax
mov byte [ebp - 4], 1
call fcn.004be320
add esp, 0xc
lea eax, [ebp - 0x344]
mov dword [ebp - 0x344], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push eax
call esi
cmp eax, ebx
jne 0x490a0a
lea eax, [ebp - 0x344]
push eax
mov dword [ebp - 0x344], 0x114
call esi
test eax, eax
je 0x490b58
cmp dword [ebp - 0x340], 5
jb 0x490b58
push 5
pop eax
cmp eax, dword [ebp - 0x340]
lea edi, [ebp - 0x348]
sbb eax, eax
inc eax
jne 0x490a5c
mov edx, str.advfirewall_firewall_add_rule_name_
call fcn.004049e0
mov edx, dword [ebp - 0x34c]
call fcn.00413750
mov edx, str.___dirin_program_
call fcn.00413750
lea edx, [ebp - 0x224]
call fcn.00413750
mov edx, str.__actionallow
jmp 0x490a91
mov edx, str.firewall_add_allowedprogram_program_
call fcn.004049e0
lea edx, [ebp - 0x224]
lea edi, [ebp - 0x348]
call fcn.00413750
mov edx, str.__name_
call fcn.00413750
mov edx, dword [ebp - 0x34c]
call fcn.00413750
mov edx, str.__modeENABLE_profileALL
lea edi, [ebp - 0x348]
call fcn.00413750
push 0x40
lea eax, [ebp - 0x3a8]
push ebx
push eax
call fcn.004be320
mov dword [ebp - 0x360], ebx
xor eax, eax
lea edi, [ebp - 0x35c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
lea esi, [ebp - 0x34c]
mov dword [ebp - 0x3ac], 0x44
mov dword [ebp - 0x380], 0x181
mov word [ebp - 0x37c], bx
stosd dword es:[edi], eax
call fcn.00416d00
mov byte [ebp - 4], 2
push dword [ebp - 0x348]
mov edi, esi
push dword [ebp - 0x350]
push str.__s___s
call fcn.00406040
add esp, 0xc
lea eax, [ebp - 0x360]
push eax
lea eax, [ebp - 0x3ac]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 0x34c]
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x490b4d
push 0xffffffffffffffff
push dword [ebp - 0x360]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x360]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x35c]
call esi
lea ecx, [ebp - 0x34c]
call fcn.00416ce0
lea ecx, [ebp - 0x348]
call fcn.00416ce0
lea ecx, [ebp - 0x350]
call fcn.00416ce0
call fcn.004beb28
ret
Function at 0x490b74
Capabilities:
Check os version
Create process on windows
Create process suspended

Disassembly:
push 0x3a0
mov eax, 0x4e1186
call fcn.004beaa5
mov eax, dword [ebp + 8]
lea ebx, [ebp - 0x350]
mov esi, ecx
mov dword [ebp - 0x34c], eax
call fcn.00492658
xor ebx, ebx
lea eax, [ebp - 0x350]
mov dword [ebp - 4], ebx
call fcn.00492622
mov edx, str.Netsh.exe
lea edi, [ebp - 0x350]
call fcn.00413750
push 0x208
lea eax, [ebp - 0x222]
push ebx
push eax
mov word [ebp - 0x224], bx
call fcn.004be320
add esp, 0xc
cmp esi, ebx
lea eax, [ebp - 0x224]
jne 0x490bee
push 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
jmp 0x490bf7
push esi
push eax
call fcn.004daba9
pop ecx
pop ecx
cmp dword [ebp - 0x34c], ebx
jne 0x490c09
mov dword [ebp - 0x34c], str.TencentDownloadProgram
lea esi, [ebp - 0x348]
call fcn.00416d00
mov esi, 0x11c
push esi
lea eax, [ebp - 0x344]
push ebx
push eax
mov byte [ebp - 4], 1
call fcn.004be320
add esp, 0xc
lea eax, [ebp - 0x344]
mov dword [ebp - 0x344], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push eax
call esi
cmp eax, ebx
jne 0x490c62
lea eax, [ebp - 0x344]
push eax
mov dword [ebp - 0x344], 0x114
call esi
test eax, eax
je 0x490d68
cmp dword [ebp - 0x340], 5
jb 0x490d68
push 5
pop eax
cmp eax, dword [ebp - 0x340]
lea edi, [ebp - 0x348]
sbb eax, eax
inc eax
jne 0x490c95
mov edx, str.advfirewall_firewall_delete_rule_name_
call fcn.004049e0
mov edx, dword [ebp - 0x34c]
jmp 0x490ca5
mov edx, str.firewall_delete_allowedprogram_program_
call fcn.004049e0
lea edx, [ebp - 0x224]
lea edi, [ebp - 0x348]
call fcn.00413750
mov edx, 0x4f0b70
call fcn.00413750
push 0x40
lea eax, [ebp - 0x3a8]
push ebx
push eax
call fcn.004be320
mov dword [ebp - 0x360], ebx
xor eax, eax
lea edi, [ebp - 0x35c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
lea esi, [ebp - 0x34c]
mov dword [ebp - 0x3ac], 0x44
mov dword [ebp - 0x380], 0x181
mov word [ebp - 0x37c], bx
stosd dword es:[edi], eax
call fcn.00416d00
mov byte [ebp - 4], 2
push dword [ebp - 0x348]
mov edi, esi
push dword [ebp - 0x350]
push str.__s___s
call fcn.00406040
add esp, 0xc
lea eax, [ebp - 0x360]
push eax
lea eax, [ebp - 0x3ac]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 0x34c]
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x490d5d
push dword [ebp - 0x360]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x35c]
call esi
lea ecx, [ebp - 0x34c]
call fcn.00416ce0
lea ecx, [ebp - 0x348]
call fcn.00416ce0
lea ecx, [ebp - 0x350]
call fcn.00416ce0
call fcn.004beb28
ret
Function at 0x490d84
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
sub esp, 0x20c
lea ebp, [esp - 4]
mov eax, dword [0x50f130]
xor eax, ebp
mov dword [ebp + 0x20c], eax
push 0x24
mov eax, 0x4df0d7
call fcn.004bea3c
xor edi, edi
push 0x208
lea eax, [ebp + 2]
mov dword [ebp - 0x28], edi
push edi
push eax
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], edi
mov word [ebp], di
call fcn.004be320
add esp, 0xc
lea esi, [ebp - 0x14]
call fcn.00416d00
lea eax, [ebp - 0x18]
push eax
push 0x20019
push edi
push str.SoftwareTencentQQPCMgr
mov dword [ebp - 4], edi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x20], 0x20a
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x490eb8
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp]
push eax
lea eax, [ebp - 0x30]
push eax
push edi
push str.InstallDir
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x490eaf
lea eax, [ebp]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea edx, [ebp]
mov edi, esi
call fcn.004049e0
mov eax, esi
push eax
lea eax, [ebp - 0x24]
push eax
mov ebx, str.QQPCtray.exe
call fcn.00413810
pop ecx
pop ecx
mov byte [ebp - 4], 1
push dword [eax]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor ebx, ebx
inc ebx
mov dword [ebp - 0x28], ebx
call esi
test eax, eax
je 0x490e81
mov eax, edi
push eax
lea eax, [ebp - 0x2c]
push eax
mov ebx, str.QQPCMgr.exe
call fcn.00413810
pop ecx
pop ecx
push 3
pop ebx
push dword [eax]
call esi
test eax, eax
mov byte [ebp - 0xd], 1
jne 0x490e85
mov byte [ebp - 0xd], 0
test bl, 2
je 0x490e95
lea ecx, [ebp - 0x2c]
and ebx, 0xfffffffd
call fcn.00416ce0
test bl, 1
je 0x490ea2
lea ecx, [ebp - 0x24]
call fcn.00416ce0
cmp byte [ebp - 0xd], 0
je 0x490eaf
mov dword [ebp - 0x1c], 1
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x14]
call fcn.00416ce0
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x20c]
xor ecx, ebp
call fcn.004b84de
add ebp, 0x210
leave
ret
Function at 0x490ee6
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
sub esp, 0x20c
lea ebp, [esp - 4]
mov eax, dword [0x50f130]
xor eax, ebp
mov dword [ebp + 0x20c], eax
push 0x20
mov eax, 0x4df08e
call fcn.004bea3c
xor edi, edi
push 0x208
lea eax, [ebp + 2]
mov dword [ebp - 0x10], edi
push edi
push eax
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x18], edi
mov word [ebp], di
call fcn.004be320
add esp, 0xc
lea esi, [ebp - 0x14]
call fcn.00416d00
lea eax, [ebp - 0x20]
push eax
push 0x20019
push edi
push str.SOFTWAREkingsoftAntivirus
mov dword [ebp - 4], edi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x28], 0x20a
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x49109b
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp]
push eax
lea eax, [ebp - 0x2c]
push eax
push edi
push str.ProgramPath
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x491092
lea eax, [ebp]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea edx, [ebp]
mov edi, esi
call fcn.004049e0
mov eax, esi
push eax
lea eax, [ebp - 0x24]
push eax
mov ebx, str.kismain.exe
call fcn.00413810
pop ecx
pop ecx
mov byte [ebp - 4], 1
push dword [eax]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov dword [ebp - 0x10], 1
call esi
test eax, eax
je 0x490fe8
mov eax, edi
push eax
lea eax, [ebp - 0x1c]
push eax
mov ebx, str.kisuisp.exe
call fcn.00413810
pop ecx
pop ecx
push dword [eax]
mov dword [ebp - 0x10], 3
call esi
test eax, eax
je 0x490fe8
mov bl, 1
jmp 0x490fea
xor bl, bl
test byte [ebp - 0x10], 2
je 0x490ffc
and dword [ebp - 0x10], 0xfffffffd
lea ecx, [ebp - 0x1c]
call fcn.00416ce0
and dword [ebp - 4], 0
test byte [ebp - 0x10], 1
je 0x491012
and dword [ebp - 0x10], 0xfffffffe
lea ecx, [ebp - 0x24]
call fcn.00416ce0
test bl, bl
je 0x49101d
mov dword [ebp - 0x18], 1
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
mov ebx, str.kxetray.exe
call fcn.00413810
pop ecx
pop ecx
mov byte [ebp - 4], 2
push dword [eax]
or dword [ebp - 0x10], 4
call esi
test eax, eax
je 0x491065
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x24]
push eax
mov ebx, str.kislive.exe
call fcn.00413810
or dword [ebp - 0x10], 8
pop ecx
pop ecx
push dword [eax]
call esi
test eax, eax
je 0x491065
mov bl, 1
jmp 0x491067
xor bl, bl
test byte [ebp - 0x10], 8
je 0x491079
and dword [ebp - 0x10], 0xfffffff7
lea ecx, [ebp - 0x24]
call fcn.00416ce0
test byte [ebp - 0x10], 4
je 0x491087
lea ecx, [ebp - 0x1c]
call fcn.00416ce0
test bl, bl
je 0x491092
mov dword [ebp - 0x18], 1
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x14]
call fcn.00416ce0
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x20c]
xor ecx, ebp
call fcn.004b84de
add ebp, 0x210
leave
ret
Function at 0x4923d2
Capabilities:
Create thread
Resume thread

Disassembly:
push 4
mov eax, 0x4dd3b9
call fcn.004bea3c
xor edi, edi
cmp dword [esi], edi
jne 0x492491
cmp dword [esi + 8], edi
jne 0x492412
push 0x1c
call fcn.004b9230
cmp eax, edi
pop ecx
je 0x49240d
mov dword [eax + 4], edi
mov dword [eax], vtable.QMDDetector::CMainDlg.0
mov dword [eax + 0x14], edi
mov dword [eax + 0x18], edi
mov dword [eax + 8], edi
jmp 0x49240f
xor eax, eax
mov dword [esi + 8], eax
cmp dword [esi + 0xc], edi
jne 0x49243a
push 0x6c
call fcn.004b9230
pop ecx
mov dword [ebp - 0x10], eax
cmp eax, edi
mov dword [ebp - 4], edi
je 0x492431
push eax
call fcn.004925c3
jmp 0x492433
xor eax, eax
or dword [ebp - 4], 0xffffffff
mov dword [esi + 0xc], eax
cmp dword [esi + 0x10], edi
jne 0x492462
push 0x78
call fcn.004b9230
pop ecx
mov dword [ebp - 0x10], eax
cmp eax, edi
mov dword [ebp - 4], 1
je 0x49245d
push eax
call fcn.00494d68
jmp 0x49245f
xor eax, eax
mov dword [esi + 0x10], eax
mov eax, dword [ebp + 8]
mov dword [esi + 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x18], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x1c], eax
lea eax, [esi + 4]
push eax
push 4
push esi
push 0x492499
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
call fcn.004beb14
ret 0xc

Function at 0x492549
Capabilities:
Allocate thread local storage
Get thread local storage value

Disassembly:
push esi
call fcn.0049259b
mov esi, eax
cmp dword [esi], 0xffffffff
jne 0x49255e
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [esi], eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
pop esi
je 0x49256f
mov eax, dword [eax + 0xc]
ret
xor eax, eax
ret

Function at 0x492658
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x50f130]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor edi, edi
test byte [0x516090], 1
mov dword [ebp - 0x214], edi
mov esi, 0x51608c
jne 0x49269a
or dword [0x516090], 1
call fcn.00416d00
push 0x4e6f28
call fcn.004b9683
pop ecx
mov eax, dword [0x51608c]
cmp dword [eax - 0xc], edi
jne 0x4926df
push 0x20a
lea eax, [ebp - 0x20e]
push edi
push eax
mov word [ebp - 0x210], di
call fcn.004be320
add esp, 0xc
push 1
push 0x25
lea eax, [ebp - 0x210]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea edx, [ebp - 0x210]
mov edi, esi
call fcn.004049e0
mov eax, dword [0x51608c]
add eax, 0xfffffff0
call fcn.004012d0
mov ecx, dword [ebp - 4]
add eax, 0x10
pop edi
mov dword [ebx], eax
xor ecx, ebp
mov eax, ebx
pop esi
call fcn.004b84de
leave
ret
Function at 0x492701
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x50f130]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor edi, edi
test byte [0x516088], 1
mov dword [ebp - 0x214], edi
mov esi, 0x516084
jne 0x492743
or dword [0x516088], 1
call fcn.00416d00
push 0x4e6f32
call fcn.004b9683
pop ecx
mov eax, dword [0x516084]
cmp dword [eax - 0xc], edi
jne 0x492788
push 0x20a
lea eax, [ebp - 0x20e]
push edi
push eax
mov word [ebp - 0x210], di
call fcn.004be320
add esp, 0xc
push 1
push 0x24
lea eax, [ebp - 0x210]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea edx, [ebp - 0x210]
mov edi, esi
call fcn.004049e0
mov eax, dword [0x516084]
add eax, 0xfffffff0
call fcn.004012d0
mov ecx, dword [ebp - 4]
add eax, 0x10
pop edi
mov dword [ebx], eax
xor ecx, ebp
mov eax, ebx
pop esi
call fcn.004b84de
leave
ret
Function at 0x492f6e
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
xor edi, edi
cmp dword [esi + 4], edi
jne 0x492f95
lea eax, [ebp - 4]
push eax
push edi
push esi
push 0x492fd1
push edi
push edi
mov dword [ebp - 4], edi
call fcn.004b9394
add esp, 0x18
mov dword [esi + 4], eax
xor eax, eax
cmp dword [esi + 4], edi
pop edi
setne al
leave
ret

Function at 0x493039
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x50f130]
xor eax, ebp
mov dword [ebp - 4], eax
and word [ebp - 0x24], 0
push edi
push 7
pop ecx
push dword [edx]
xor eax, eax
lea edi, [ebp - 0x22]
rep stosd dword es:[edi], eax
push 0xf
stosw word es:[edi], ax
lea eax, [ebp - 0x24]
push eax
push 0
push str.LastFailTime
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
pop edi
je 0x49308b
push 0xa
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.004c1e46
add esp, 0xc
mov dword [ebp + 8], eax
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 8]
xor ecx, ebp
call fcn.004b84de
leave
ret 4