joyce8/EMBER2024-capa huggingface dataset:
Function at 0x453c60
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5020eb
mov eax, dword fs:[0]
push eax
sub esp, 0x78
push ebx
push esi
push edi
mov eax, dword [0x5364d0]
xor eax, esp
push eax
lea eax, [esp + 0x88]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [0x563288]
mov edx, dword [eax + 0xc]
mov ecx, 0x563288
call edx
add eax, 0x10
mov dword [esp + 0x10], eax
lea eax, [edi + 0x20c]
push eax
lea esi, [esp + 0x14]
mov dword [esp + 0x94], 0
call fcn.0041c140
mov ecx, esi
push ecx
mov eax, str.MD5:
call fcn.00472800
mov ebx, dword [esp + 0x10]
mov eax, dword [ebx - 0xc]
cmp eax, 0x20
jne 0x453d50
mov edi, dword [edi + 4]
push edi
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x453dd7
call dword [sym.imp.USER32.dll_EmptyClipboard]
push 0x42
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push ebx
mov esi, eax
push 0x21
push esi
call fcn.004e65c8
add esp, 0xc
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
jne 0x453d45
call dword [sym.imp.USER32.dll_CloseClipboard]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea eax, [ebx - 0x10]
mov dword [esp + 0x90], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x453df2
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x453dd7
lea ecx, [esp + 0x18]
push 0x15e
push ecx
call fcn.00433510
mov ebx, dword [eax]
mov edi, dword [edi + 4]
add esp, 8
lea esi, [esp + 0x14]
call fcn.00401140
mov edx, dword [esp + 0x14]
push 0x40
push edx
push ebx
lea eax, [esp + 0x28]
push eax
call fcn.004bb6a0
push edi
lea edi, [esp + 0x20]
call fcn.0048b3b0
mov ecx, edi
call fcn.004bb800
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x453db3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x453dd3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ebx, dword [esp + 0x10]
lea eax, [ebx - 0x10]
mov dword [esp + 0x90], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x453dfe
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x88]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4548c5
Capabilities:
Create process on windows

Disassembly:
cmp dword [esp + 0x18], 0
push esi
mov esi, ecx
jne 0x454ac3
mov eax, dword [esp + 0xc]
cmp eax, 0x110
jne 0x4548ef
mov eax, esi
call fcn.00454ad0
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov eax, 1
pop esi
ret 0x18
cmp eax, 0x111
jne 0x454ac3
mov eax, dword [esp + 0x10]
mov edx, 0x48c
cmp dx, ax
jne 0x45491d
push edx
call fcn.00455e20
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov eax, 1
pop esi
ret 0x18
mov edx, 0x48f
cmp dx, ax
jne 0x45493c
push edx
call fcn.00455e20
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov eax, 1
pop esi
ret 0x18
mov edx, 0x4af
cmp dx, ax
jne 0x45495b
push edx
call fcn.00455e20
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov eax, 1
pop esi
ret 0x18
mov edx, 0x498
cmp dx, ax
jne 0x45497a
push edx
call fcn.00455e20
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov eax, 1
pop esi
ret 0x18
mov edx, 0x46b
cmp dx, ax
jne 0x454999
push edx
call fcn.00455e20
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov eax, 1
pop esi
ret 0x18
mov edx, 0x5f0
cmp dx, ax
jne 0x4549b8
push edx
call fcn.00455e20
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov eax, 1
pop esi
ret 0x18
mov edx, 0x493
cmp dx, ax
jne 0x4549d7
push edx
call fcn.00455e20
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov eax, 1
pop esi
ret 0x18
mov edx, 0x48d
cmp dx, ax
jne 0x454a13
mov eax, esi
call fcn.00455f60
test eax, eax
je 0x454a02
mov eax, esi
call fcn.00455fd0
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov eax, 1
pop esi
ret 0x18
mov ecx, dword [esp + 0x18]
xor eax, eax
mov dword [ecx], eax
mov eax, 1
pop esi
ret 0x18
mov edx, 0x4a7
cmp dx, ax
jne 0x454a48
push 5
push 0
push 0
push str.https:__www.360totalsecurity.com
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [esp + 0x18]
mov dword [eax], 0
mov eax, 1
pop esi
ret 0x18
mov ecx, 0x8a0
cmp cx, ax
jne 0x454a67
push ecx
call fcn.00455e20
mov edx, dword [esp + 0x18]
mov dword [edx], eax
mov eax, 1
pop esi
ret 0x18
mov ecx, 0x46c
cmp cx, ax
jne 0x454a86
push ecx
call fcn.00455e20
mov edx, dword [esp + 0x18]
mov dword [edx], eax
mov eax, 1
pop esi
ret 0x18
mov ecx, 0x46d
cmp cx, ax
jne 0x454aa5
push ecx
call fcn.00455e20
mov edx, dword [esp + 0x18]
mov dword [edx], eax
mov eax, 1
pop esi
ret 0x18
mov ecx, 0x8a4
cmp cx, ax
jne 0x454ac3
call fcn.00455f10
mov edx, dword [esp + 0x18]
mov dword [edx], eax
mov eax, 1
pop esi
ret 0x18
xor eax, eax
pop esi
ret 0x18
Function at 0x455f10
Capabilities:
Create process on windows

Disassembly:
push ecx
lea eax, [esp]
push 0x2b7
push eax
call fcn.00433510
mov ecx, dword [eax]
add esp, 8
push 5
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [esp]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x455f57
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
pop ecx
ret

Function at 0x458580
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4ff5a9
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5364d0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
mov dword [esp + 0x14], 0
mov dword [esp + 8], 0
mov eax, dword [0x563288]
mov edx, dword [eax + 0xc]
mov ecx, 0x563288
call edx
add eax, 0x10
mov dword [esi], eax
mov dword [esp + 0x14], 0
mov ecx, 1
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, 0x104
or eax, ecx
mov dword [esp + 8], 1
jge 0x4585fa
mov ecx, 0x104
mov eax, esi
call fcn.004014d0
mov eax, dword [esi]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov eax, dword [esi]
mov ecx, dword [eax - 8]
test eax, eax
je 0x45861f
push ecx
push eax
call fcn.004e4d4d
add esp, 8
test eax, eax
jl 0x45865c
mov ecx, dword [esi]
cmp eax, dword [ecx - 8]
jg 0x45865c
mov dword [ecx - 0xc], eax
mov ecx, dword [esi]
xor edx, edx
mov word [ecx + eax*2], dx
push esi
lea eax, [edx + 0x5c]
call fcn.004178f0
push 1
push 0x511ddc
push esi
call fcn.0041e520
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4
push 0x80070057
call fcn.00401540
int3
Function at 0x45a210
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x4fd84b
mov eax, dword fs:[0]
push eax
mov eax, 0x1018
call fcn.004f3c00
mov eax, dword [0x5364d0]
xor eax, esp
mov dword [esp + 0x1014], eax
push esi
mov eax, dword [0x5364d0]
xor eax, esp
push eax
lea eax, [esp + 0x1020]
mov dword fs:[0], eax
test edi, edi
je 0x45a371
lea esi, [esp + 0x14]
mov dword [esp + 0x14], 0
call fcn.0047fb20
xor eax, eax
push 0x7fe
push eax
lea ecx, [esp + 0x26]
push ecx
mov word [esp + 0x28], ax
call fcn.004e8fe0
mov esi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
add esp, 0xc
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x14]
push ecx
push 0
push edi
push SHChangeNotifyDeregister
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0x800
call esi
test eax, eax
jne 0x45a35d
cmp dword [esp + 0xc], 1
jne 0x45a35d
xor edx, edx
push 0x7fe
push edx
lea eax, [esp + 0x826]
push eax
mov word [esp + 0x828], dx
call fcn.004e8fe0
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x82c]
push str._s_shellexDropHandler
push edx
mov ecx, 0x400
call fcn.00428d30
push 0x800
lea eax, [esp + 0x38]
push 0
push eax
call fcn.004e8fe0
add esp, 0x24
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x14]
push eax
push 0
lea ecx, [esp + 0x82c]
push ecx
push SHChangeNotifyDeregister
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0x800
call esi
test eax, eax
jne 0x45a35d
lea esi, [esp + 0x14]
mov dword [esp + 0x1028], 0xffffffff
call fcn.0047fad0
mov eax, 1
jmp 0x45a373
lea esi, [esp + 0x14]
mov dword [esp + 0x1028], 0xffffffff
call fcn.0047fad0
xor eax, eax
mov ecx, dword [esp + 0x1020]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x1014]
xor ecx, esp
call fcn.004e3edb
add esp, 0x1024
ret
Function at 0x45a640
Capabilities:
Check if file exists

Disassembly:
push edi
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsUNCW]
test eax, eax
je 0x45a650
xor eax, eax
pop edi
ret
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x45a64c
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x45a678
push 0
push esi
call fcn.0045a3a0
add esp, 8
neg eax
sbb eax, eax
inc eax
pop edi
ret
push esi
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
test eax, eax
je 0x45a68e
mov edi, eax
call fcn.0045a210
test eax, eax
jne 0x45a64c
push esi
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov eax, 1
pop edi
ret

Function at 0x45a6a0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x418
mov eax, dword [0x5364d0]
xor eax, esp
mov dword [esp + 0x414], eax
push esi
mov esi, ecx
push edi
test esi, esi
je 0x45a7ef
cmp dword [esp + 0x424], 0
je 0x45a7ef
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x12]
push ecx
mov word [esp + 0x14], ax
call fcn.004e8fe0
add esp, 0xc
push 0
push 0x10
lea edx, [esp + 0x10]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x45a7ef
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x21a]
push ecx
mov word [esp + 0x21c], ax
call fcn.004e8fe0
mov edx, dword [esp + 0x438]
mov eax, dword [esp + 0x434]
add esp, 0xc
push edx
push eax
push 1
lea eax, [esp + 0x21c]
call fcn.00459dc0
add esp, 0xc
test eax, eax
jne 0x45a7ba
lea edi, [esp + 8]
mov edx, 0x104
mov eax, esi
sub edi, esi
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x45a773
movzx ecx, word [edi + eax]
test cx, cx
je 0x45a773
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x45a753
jmp 0x45a777
test edx, edx
jne 0x45a77a
sub eax, 2
xor edx, edx
mov word [eax], dx
push 0x515d08
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [esp + 8]
push 1
push ecx
call fcn.0045a3a0
add esp, 8
neg eax
sbb eax, eax
inc eax
pop edi
pop esi
mov ecx, dword [esp + 0x414]
xor ecx, esp
call fcn.004e3edb
add esp, 0x418
ret
cmp eax, 1
jne 0x45a7ef
lea edx, [esp + 0x210]
push edx
lea eax, [esp + 0xc]
push eax
push esi
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
call fcn.0045a640
pop edi
pop esi
mov ecx, dword [esp + 0x414]
xor ecx, esp
call fcn.004e3edb
add esp, 0x418
ret
mov ecx, dword [esp + 0x41c]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.004e3edb
add esp, 0x418
ret
Function at 0x460cc0
Capabilities:
Hide graphical window

Disassembly:
mov ecx, dword [edi + 4]
sub esp, 0x14
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
push esi
lea eax, [esp + 0x10]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
xor ebp, ebp
test byte [0x5667e8], 1
jne 0x460cfe
or dword [0x5667e8], 1
push 0x50c340
mov dword [0x5667e4], ebp
call fcn.004e413c
add esp, 4
lea esi, [edi + 0x4480]
call fcn.004bed90
cmp ebx, ebp
je 0x460dfc
cmp word [ebx], bp
je 0x460dfc
mov edx, dword [edi + 4]
mov ebx, dword [sym.imp.USER32.dll_LockWindowUpdate]
push edx
call ebx
mov eax, dword [edi + 0x441c]
mov ecx, dword [edi + 0xdc]
mov esi, dword [sym.imp.USER32.dll_SetParent]
push eax
push ecx
call esi
mov edx, dword [edi + 0x441c]
mov eax, dword [edi + 0x4614]
push edx
push eax
call esi
mov ecx, dword [edi + 4]
mov eax, dword [edi + 0x441c]
push 6
push ebp
push 0x5667e0
call fcn.004b5930
mov eax, dword [edi + 0x4614]
mov ecx, dword [edi + 0xdc]
lea esi, [edi + 0x443c]
mov dword [esi + 4], eax
mov eax, esi
mov dword [esi], ecx
call fcn.00476e30
push 1
mov eax, 0x11
call fcn.0041cd00
mov ecx, dword [esp + 0x1c]
sub ecx, eax
add ecx, ecx
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebp, eax
mov eax, 0x2d
call fcn.0041cd00
sub ebp, eax
mov eax, ebp
call fcn.00473e10
mov ecx, dword [esp + 0x24]
mov edx, dword [edi + 0x4614]
push ecx
push edx
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov eax, dword [edi + 0x4614]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 5
push eax
mov dword [edi + 0x4a70], 0
call esi
mov ecx, dword [edi + 0x441c]
push 5
push ecx
call esi
push 0
call ebx
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 4
mov edx, dword [edi + 4]
mov esi, dword [sym.imp.USER32.dll_LockWindowUpdate]
push edx
call esi
mov eax, dword [edi + 0x441c]
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push ebp
push eax
call ebx
mov ecx, dword [edi + 0x4614]
push ebp
push ecx
call ebx
mov edx, dword [edi + 4]
mov eax, dword [edi + 0xdc]
mov ebx, dword [sym.imp.USER32.dll_SetParent]
push edx
push eax
call ebx
mov ecx, dword [edi + 4]
mov edx, dword [edi + 0x4614]
push ecx
push edx
call ebx
mov ecx, dword [edi + 4]
mov eax, dword [edi + 0xdc]
push 6
push ebp
push 0x5667e0
call fcn.004b5930
push ebp
call esi
cmp dword [edi + 0x53b0], ebp
je 0x460e71
push ebp
mov eax, edi
mov dword [edi + 0x53b0], ebp
call fcn.00470f70
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 4

Function at 0x460ff0
Capabilities:
Hide graphical window

Disassembly:
push edi
mov edi, eax
mov eax, dword [edi + 4]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.0046f270
test eax, eax
jne 0x46101a
mov ecx, dword [edi + 4]
push ecx
call dword [sym.imp.USER32.dll_DestroyWindow]
push 2
call dword [sym.imp.USER32.dll_PostQuitMessage]
xor eax, eax
pop edi
ret
Function at 0x461020
Capabilities:
Hide graphical window

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
xor eax, eax
cmp dword [ebx + 0x11c], 2
push esi
setne al
push edi
lea ecx, [ebx + 0xd8]
inc eax
mov edi, eax
push edi
call fcn.004c43b0
call fcn.00492130
mov esi, eax
call fcn.00494010
mov edi, ebx
call fcn.00472140
mov ecx, dword [ebx + 0x5370]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x461076
mov edx, dword [ebx + 0x5370]
push 0
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret 4
Function at 0x466080
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x501fe0
mov eax, dword fs:[0]
push eax
sub esp, 0x84
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5364d0]
xor eax, esp
push eax
lea eax, [esp + 0x98]
mov dword fs:[0], eax
mov edi, ecx
xor ebx, ebx
xor ebp, ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ebx
lea eax, [esp + 0x18]
push eax
push 0x2001f
push ebx
push 0x510bac
mov dword [esp + 0xb0], ebx
push SHChangeNotifyDeregister
mov dword [esp + 0x2c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x4660f1
mov ebp, dword [esp + 0x18]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], ebp
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x28]
push eax
push ebx
push str.PWarn
push ebp
mov dword [esp + 0x34], ebx
mov dword [esp + 0x30], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [esp + 0x1c], ebx
jne 0x46617f
lea ecx, [esp + 0x18]
push 0x141
push ecx
call fcn.00433510
mov eax, dword [eax]
mov edx, dword [edi + 4]
push 0x30
push eax
push edx
xor eax, eax
call fcn.00488c60
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
add esp, 0x14
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x466161
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 4
lea ecx, [esp + 0x1c]
push ecx
push 4
push ebx
push str.PWarn
push ebp
mov dword [esp + 0x30], 1
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea esi, [esp + 0x2c]
call fcn.00408400
mov dword [esp + 0x8c], ebx
mov dword [esp + 0x90], ebx
mov dword [esp + 0x2c], vtable.C360zipDialogT_class_CPasswordManageDlgImpl__0__1__0_.0
mov byte [esp + 0xa0], 1
mov eax, dword [edi + 4]
push eax
mov edi, esi
call fcn.00410ad0
mov edx, esi
push edx
mov byte [esp + 0xa4], bl
call fcn.00466490
cmp ebp, ebx
je 0x4661cb
push ebp
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [esp + 0x98]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x90
ret
Function at 0x4661f0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x4fee2b
mov eax, dword fs:[0]
push eax
sub esp, 0xa0
push esi
push edi
mov eax, dword [0x5364d0]
xor eax, esp
push eax
lea eax, [esp + 0xac]
mov dword fs:[0], eax
movzx eax, word [esp + 0xbc]
add eax, 0xfffffb7e
cmp eax, 5
ja case.0x46622d.1155
jmp dword [eax*4 + 0x46630c]
lea eax, [esp + 0x10]
push 0x2b9
push eax
call fcn.00433510
mov esi, dword [eax]
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
add esp, 8
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x466268
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test esi, esi
je case.0x46622d.1155
push 5
push 0
push 0
push esi
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
mov ecx, dword [esp + 0xac]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xac
ret 4
lea ecx, [esp + 0xc]
push 0x2b8
push ecx
call fcn.00433510
mov esi, dword [eax]
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
add esp, 8
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x46625c
mov esi, str.http:__yasuo.360.cn_help.html
jmp 0x46626c
lea eax, [esp + 0x14]
call fcn.00466330
mov dword [esp + 0xb4], 0
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea edi, [esp + 0x18]
call fcn.00474660
mov ecx, edi
push ecx
mov dword [esp + 0xb8], 0xffffffff
call fcn.004663a0
jmp case.0x46622d.1155
Function at 0x46f270
Capabilities:
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x501e88
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
mov eax, dword [0x5364d0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov eax, dword [edi + 0x51e4]
test eax, eax
je 0x46f38e
mov ecx, dword [eax]
mov edx, dword [ecx + 0x64]
push eax
call edx
test eax, eax
je 0x46f38e
lea esi, [esp + 0x14]
call fcn.00401140
mov esi, eax
lea eax, [esp + 0x10]
push 0x1c0
push eax
mov dword [esp + 0x28], 0
call fcn.00433510
mov eax, dword [eax]
mov esi, dword [esi]
mov ecx, dword [edi + 4]
push 0x21
push eax
push ecx
mov eax, esi
call fcn.00488c60
add esp, 0x14
cmp eax, 2
mov eax, dword [esp + 0x10]
sete bl
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x46f310
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x20], 0xffffffff
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x46f338
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
je 0x46f353
mov eax, 1
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x18
ret
mov eax, dword [edi + 0x51e4]
test eax, eax
je 0x46f33c
mov ecx, dword [eax]
mov edx, dword [ecx + 0x64]
push eax
call edx
test eax, eax
je 0x46f33c
mov eax, dword [edi + 0x98]
mov edx, dword [eax + 0x14]
lea ecx, [edi + 0x98]
call edx
mov eax, dword [edi + 0x4c94]
cmp dword [eax - 0xc], 0
je 0x46f33c
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
xor eax, eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x18
ret
Function at 0x472330
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [esi + 0x78]
call fcn.00492130
xor ecx, ecx
cmp dword [eax + 0x120], 2
sete cl
inc ecx
mov eax, ecx
cmp edi, eax
je 0x472377
call fcn.00492130
xor edx, edx
cmp dword [eax + 0x120], 2
lea ecx, [esi + 0x34]
sete dl
inc edx
mov eax, edx
push eax
call fcn.004c43b0
lea edi, [esi - 0xa4]
call fcn.00472140
mov eax, dword [esi + 0x52cc]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4723a8
mov ecx, dword [esi + 0x52cc]
push ecx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x4723a8
mov edx, dword [esi + 0x52cc]
push 0
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
xor eax, eax
pop esi
ret

Function at 0x4723b0
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x52cc]
push edi
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4723e5
mov ecx, dword [esi + 0x52cc]
push ecx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x4723e5
mov edx, dword [esi + 0x52cc]
push 0
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.00492130
mov edi, dword [esi + 0x78]
call fcn.00492130
xor ecx, ecx
cmp dword [eax + 0x120], 2
sete cl
inc ecx
mov eax, ecx
cmp edi, eax
je 0x47242d
call fcn.00492130
xor edx, edx
cmp dword [eax + 0x120], 2
lea ecx, [esi + 0x34]
sete dl
inc edx
mov eax, edx
push eax
call fcn.004c43b0
lea edi, [esi - 0xa4]
call fcn.00472140
pop edi
xor eax, eax
pop esi
ret
Function at 0x472f50
Capabilities:
Delete registry value
Set registry value

Disassembly:
sub esp, 0x248
mov eax, dword [0x5364d0]
xor eax, esp
mov dword [esp + 0x244], eax
push ebx
push ebp
mov ebx, dword [esp + 0x254]
push esi
push edi
xor ebp, ebp
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x18]
push ecx
push ebp
push 0x2001f
push ebp
push ebp
push ebp
push 0x510bac
push SHChangeNotifyDeregister
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x40], ebp
mov dword [esp + 0x38], ebp
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebp
jne 0x472fd7
mov edi, dword [esp + 0x14]
push edi
mov edx, str.Recent_Document_List
lea esi, [esp + 0x1c]
mov dword [esp + 0x24], edi
call fcn.0041a230
test eax, eax
je 0x472fde
mov eax, dword [esp + 0x18]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, ebp
je 0x472fd0
push eax
call esi
cmp edi, ebp
je 0x472fd7
push edi
call esi
xor eax, eax
jmp 0x47310b
mov edx, dword [ebx + 0xc]
mov edi, dword [esp + 0x18]
push 4
lea eax, [esp + 0x2c]
push eax
push 4
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push str.DocumentCount
push edi
mov dword [esp + 0x40], edx
call ebp
mov esi, dword [ebx + 4]
test esi, esi
jle 0x473086
xor eax, eax
xor ecx, ecx
push esi
push str.Document_i
lea edx, [esp + 0x38]
mov word [esp + 0x38], cx
mov dword [esp + 0x3a], eax
mov dword [esp + 0x3e], eax
mov dword [esp + 0x42], eax
mov dword [esp + 0x46], eax
mov dword [esp + 0x4a], eax
call fcn.0047eb50
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x5a]
push eax
mov word [esp + 0x5c], dx
call fcn.004e8fe0
add esp, 0x14
lea ecx, [esp + 0x48]
push ecx
lea edx, [esi + 0xe10f]
push edx
push ebx
call fcn.004763c0
lea eax, [esp + 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [eax + eax + 2]
push ecx
lea edx, [esp + 0x4c]
push edx
push 1
push 0
lea eax, [esp + 0x40]
push eax
push edi
call ebp
dec esi
test esi, esi
jg 0x473008
mov esi, dword [ebx + 4]
inc esi
cmp esi, 0x10
jge 0x4730d2
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
xor eax, eax
xor ecx, ecx
push esi
push str.Document_i
lea edx, [esp + 0x38]
mov word [esp + 0x38], cx
mov dword [esp + 0x3a], eax
mov dword [esp + 0x3e], eax
mov dword [esp + 0x42], eax
mov dword [esp + 0x46], eax
mov dword [esp + 0x4a], eax
call fcn.0047eb50
add esp, 8
lea edx, [esp + 0x30]
push edx
push edi
call ebx
inc esi
cmp esi, 0x10
jl 0x473095
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x4730e1
push edi
call esi
xor edi, edi
mov ebx, dword [esp + 0x20]
test ebx, ebx
je 0x4730f8
push ebx
call esi
mov dword [esp + 0x20], 0
mov ebx, dword [esp + 0x20]
test edi, edi
je 0x4730ff
push edi
call esi
test ebx, ebx
je 0x473106
push ebx
call esi
mov eax, 1
mov ecx, dword [esp + 0x254]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004e3edb
add esp, 0x248
ret 4