joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c8be4
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x5438cc]
push ebx
push esi
mov esi, 0x5438cc
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [0x5438cc]
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 8], eax
mov eax, dword [0x5438cc]
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
lea ebx, [ebp - 0xc]
call fcn.0049e41d
lea eax, [ebp - 4]
push eax
xor esi, esi
push esi
lea eax, [ebp - 0x14]
call fcn.00496e16
pop ecx
lea ecx, [ebp - 0x10]
call fcn.004297a0
pop ecx
push dword [eax]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ebx, eax
mov eax, dword [ebp - 0x10]
neg ebx
sbb bl, bl
add eax, 0xfffffff0
inc bl
call fcn.00401239
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.00401239
test bl, bl
je 0x4c8cbf
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x10]
call fcn.00496e16
pop ecx
lea ecx, [ebp - 0x14]
call fcn.004297a0
mov eax, dword [eax]
pop ecx
push esi
push esi
push 4
push esi
push 3
push SysReAllocStringLen
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.00401239
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00401239
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.00401239
mov eax, dword [ebp - 8]
add eax, 0xfffffff0
call fcn.00401239
mov eax, dword [ebp - 0xc]
add eax, 0xfffffff0
call fcn.00401239
pop esi
pop ebx
leave
ret
Function at 0x4c8d79
Capabilities:
Check for time delay via gettickcount
Modify service
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push edi
push 6
pop ecx
xor ebx, ebx
push 0x40000000
push ebx
xor eax, eax
mov dword [ebp - 0x2c], ebx
lea edi, [ebp - 0x28]
push ebx
mov dword [ebp - 4], ebx
rep stosd dword es:[edi], eax
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
cmp eax, ebx
mov dword [ebp - 0x10], eax
je 0x4c8eb3
push 0xf003f
push str.WZCSVC
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
cmp edi, ebx
je 0x4c8e9c
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push edi
call esi
push dword [ebp - 8]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
lea ecx, [ebp - 8]
push ecx
push dword [ebp - 8]
mov dword [ebp - 0xc], eax
push eax
push edi
call esi
test eax, eax
je 0x4c8e16
mov eax, dword [ebp - 0xc]
cmp dword [eax + 4], 4
jne 0x4c8e16
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 1
push 2
push 0xffffffffffffffff
push edi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov esi, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
lea eax, [ebp - 0x2c]
push eax
push edi
call esi
test eax, eax
je 0x4c8e2d
cmp dword [ebp - 0x28], 4
je 0x4c8e4a
push ebx
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
cmp eax, ebx
mov dword [ebp - 4], eax
jne 0x4c8e53
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x420
jne 0x4c8e94
mov dword [ebp - 4], 1
jmp 0x4c8e94
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
push edi
mov dword [ebp - 0x28], 1
call esi
cmp dword [ebp - 0x28], 2
jne 0x4c8e88
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 4]
cmp eax, 0x1388
jb 0x4c8e5c
xor eax, eax
cmp dword [ebp - 0x28], 4
sete al
mov dword [ebp - 4], eax
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [ebp - 0xc], ebx
je 0x4c8eb3
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 4]
pop edi
pop ebx
leave
ret
Function at 0x4c8f33
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x5438cc]
push ebx
push esi
push edi
mov esi, 0x5438cc
xor edi, edi
mov ecx, esi
inc edi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 4], eax
mov eax, dword [0x5438cc]
mov ecx, esi
call dword [eax + 0xc]
and dword [ebp - 8], 0
push edi
mov ebx, eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
add ebx, 0x10
push reloc.OLEAUT32.dll_SysReAllocString
lea esi, [ebp - 8]
mov dword [ebp - 0xc], ebx
call fcn.00403a08
test eax, eax
je 0x4c9019
lea eax, [ebp - 0xc]
push eax
push str.kwifi
mov ebx, esi
call fcn.00403a8b
test eax, eax
je 0x4c9016
mov esi, 0x510ad8
push esi
lea eax, [ebp - 4]
push eax
call fcn.0040127c
lea eax, [ebp - 0x14]
push str.kwifi.exe
push eax
call fcn.004c8eba
pop ecx
lea ecx, [ebp - 0x10]
call fcn.0042a029
mov eax, dword [eax]
pop ecx
push dword [eax - 0xc]
push eax
lea eax, [ebp - 4]
call fcn.004246f5
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00401239
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.00401239
push esi
lea eax, [ebp - 4]
push eax
call fcn.00407371
push 0x510adc
lea eax, [ebp - 4]
push eax
call fcn.00407371
mov ebx, dword [ebp - 0xc]
push ebx
push dword [ebp - 4]
call dword [sym.imp.MSVCR80.dll__wcsicmp]
mov edi, eax
neg edi
pop ecx
sbb edi, edi
pop ecx
and edi, 2
jmp 0x4c9019
mov ebx, dword [ebp - 0xc]
cmp dword [ebp - 8], 0
je 0x4c9028
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 8], 0
lea eax, [ebx - 0x10]
call fcn.00401239
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.00401239
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4c91e4
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x5438cc]
push ebx
push esi
push edi
xor edi, edi
mov ecx, 0x5438cc
mov dword [ebp - 0xc], edi
call dword [eax + 0xc]
push 1
mov ebx, eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallkwifi
add ebx, 0x10
push reloc.OLEAUT32.dll_SysReAllocString
lea esi, [ebp - 4]
mov dword [ebp - 8], ebx
mov dword [ebp - 4], edi
call fcn.00403a08
test eax, eax
je 0x4c9250
lea eax, [ebp - 8]
push eax
push str.DisplayIcon
mov ebx, esi
call fcn.00403a8b
test eax, eax
mov ebx, dword [ebp - 8]
je 0x4c9250
cmp dword [ebx - 0xc], edi
je 0x4c9250
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4c9250
mov dword [ebp - 0xc], 1
cmp dword [ebp - 4], edi
je 0x4c925e
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebx - 0x10]
mov dword [ebp - 4], edi
call fcn.00401239
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4c92d1
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x5438cc]
push ebx
push esi
mov ecx, 0x5438cc
call dword [eax + 0xc]
and dword [ebp - 8], 0
add eax, 0x10
mov dword [ebp - 4], eax
mov esi, 0x510ad8
push esi
lea eax, [ebp - 4]
push eax
call fcn.00407371
lea eax, [ebp - 0x10]
push str.kwifi.exe
push eax
call fcn.004c8eba
pop ecx
lea ecx, [ebp - 0xc]
call fcn.0042a029
mov eax, dword [eax]
pop ecx
push dword [eax - 0xc]
push eax
lea eax, [ebp - 4]
call fcn.004246f5
mov eax, dword [ebp - 0xc]
add eax, 0xfffffff0
call fcn.00401239
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00401239
push esi
lea eax, [ebp - 4]
push eax
call fcn.00407371
push 0x510adc
lea eax, [ebp - 4]
push eax
call fcn.00407371
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
lea esi, [ebp - 8]
call fcn.00403a08
mov ebx, dword [ebp - 4]
mov esi, eax
test esi, esi
je 0x4c9380
push ebx
push str.kwifi
lea esi, [ebp - 8]
call fcn.00403a56
mov esi, eax
cmp dword [ebp - 8], 0
je 0x4c938f
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 8], 0
lea eax, [ebx - 0x10]
call fcn.00401239
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x4c93a1
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x5438cc]
push ebx
push esi
mov esi, 0x5438cc
push edi
mov ecx, esi
call dword [eax + 0xc]
mov edi, eax
mov eax, dword [0x5438cc]
add edi, 0x10
mov ecx, esi
mov dword [ebp - 4], edi
call dword [eax + 0xc]
and dword [ebp - 8], 0
push 1
mov ebx, eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
add ebx, 0x10
push reloc.OLEAUT32.dll_SysReAllocString
lea esi, [ebp - 8]
mov dword [ebp - 0xc], ebx
call fcn.00403a08
mov esi, eax
test esi, esi
je 0x4c948c
lea eax, [ebp - 0xc]
push eax
push str.kwifi
lea ebx, [ebp - 8]
call fcn.00403a8b
mov ebx, dword [ebp - 0xc]
mov esi, eax
test esi, esi
je 0x4c948c
cmp dword [ebx - 0xc], 0
je 0x4c948c
mov esi, 0x510ad8
push esi
lea eax, [ebp - 4]
push eax
call fcn.0040127c
lea eax, [ebp - 0x10]
push str.kwifi.exe
push eax
call fcn.004c8eba
pop ecx
lea ecx, [ebp - 0xc]
call fcn.0042a029
mov eax, dword [eax]
pop ecx
push dword [eax - 0xc]
push eax
lea eax, [ebp - 4]
call fcn.004246f5
mov eax, dword [ebp - 0xc]
add eax, 0xfffffff0
call fcn.00401239
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00401239
push esi
lea eax, [ebp - 4]
push eax
call fcn.00407371
push 0x510adc
lea eax, [ebp - 4]
push eax
call fcn.00407371
mov edi, dword [ebp - 4]
push ebx
push edi
call dword [sym.imp.MSVCR80.dll__wcsicmp]
mov esi, eax
neg esi
pop ecx
sbb esi, esi
pop ecx
inc esi
cmp dword [ebp - 8], 0
je 0x4c949b
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 8], 0
lea eax, [ebx - 0x10]
call fcn.00401239
lea eax, [edi - 0x10]
call fcn.00401239
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x4c9504
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x5438cc]
push ebx
push esi
push edi
mov ecx, 0x5438cc
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
xor ebx, ebx
call fcn.004c8eba
pop ecx
lea edi, [ebp - 4]
call fcn.0042a0a0
mov eax, dword [ebp - 8]
add eax, 0xfffffff0
call fcn.00401239
push str.knatsvc.exe
mov eax, edi
push eax
call fcn.00407371
mov esi, dword [ebp - 4]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4c956c
push ebx
push str._install__name_knatsvc__description
push esi
xor eax, eax
call fcn.004787e0
add esp, 0xc
mov ebx, eax
lea eax, [esi - 0x10]
call fcn.00401239
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret

Function at 0x4c957b
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x5438cc]
push ebx
push esi
push edi
mov ecx, 0x5438cc
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
xor ebx, ebx
call fcn.004c8eba
pop ecx
lea edi, [ebp - 4]
call fcn.0042a0a0
mov eax, dword [ebp - 8]
add eax, 0xfffffff0
call fcn.00401239
push str.knatsvc.exe
mov eax, edi
push eax
call fcn.00407371
mov esi, dword [ebp - 4]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4c95e3
push ebx
push str._start_knatsvc
push esi
xor eax, eax
call fcn.004787e0
add esp, 0xc
mov ebx, eax
lea eax, [esi - 0x10]
call fcn.00401239
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x4c9fd6
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x5438cc]
and dword [ebp - 0x10], 0
push ebx
push esi
push edi
mov edi, 0x5438cc
mov ecx, edi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [0x5438cc]
mov ecx, edi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 4], eax
mov eax, dword [0x5438cc]
mov ecx, edi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 8], eax
lea eax, [ebp - 0x14]
call fcn.0049ce25
lea edi, [ebp - 4]
call fcn.0042a0a0
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.00401239
push str.kenablehostnet.dat
lea eax, [ebp - 0x18]
call fcn.0049cdcd
lea ecx, [ebp - 0x14]
call fcn.0042a029
pop ecx
lea edi, [ebp - 8]
call fcn.0042a0a0
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.00401239
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.00401239
mov edi, dword [ebp - 8]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
lea eax, [ebp - 0xc]
push str._c__netsh_wlan_start_hostednetwork___s_
push eax
call fcn.0042a016
push str.cmd.exe
lea eax, [ebp - 4]
lea ecx, [ebp - 0x18]
call fcn.0042a029
mov eax, dword [eax]
mov esi, dword [ebp - 0xc]
push 0xffffffffffffffff
push esi
push eax
xor eax, eax
call fcn.004787e0
mov ebx, eax
mov eax, dword [ebp - 0x18]
add esp, 0x1c
neg ebx
sbb bl, bl
add eax, 0xfffffff0
inc bl
call fcn.00401239
test bl, bl
je 0x4ca0d9
push 0
push edi
call dword [sym.imp.MSVCR80.dll__waccess]
test eax, eax
pop ecx
pop ecx
jne 0x4ca0d9
push 0x527088
push edi
call fcn.004c9f28
pop ecx
pop ecx
mov dword [ebp - 0x10], eax
lea eax, [edi - 0x10]
call fcn.00401239
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.00401239
lea eax, [esi - 0x10]
call fcn.00401239
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4ca0fc
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x5438cc]
and dword [ebp - 0x10], 0
push ebx
push esi
push edi
mov edi, 0x5438cc
mov ecx, edi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [0x5438cc]
mov ecx, edi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 4], eax
mov eax, dword [0x5438cc]
mov ecx, edi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 8], eax
lea eax, [ebp - 0x14]
call fcn.0049ce25
lea edi, [ebp - 4]
call fcn.0042a0a0
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.00401239
push str.kenablehostnet.dat
lea eax, [ebp - 0x18]
call fcn.0049cdcd
lea ecx, [ebp - 0x14]
call fcn.0042a029
pop ecx
lea edi, [ebp - 8]
call fcn.0042a0a0
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.00401239
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.00401239
mov edi, dword [ebp - 8]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
push str.1234567890
push str.freewifi123
lea eax, [ebp - 0xc]
push str._c__netsh_wlan_set_hostednetwork_modeallow_ssid_s_key_s___s_
push eax
call fcn.0042a016
push str.cmd.exe
lea eax, [ebp - 4]
lea ecx, [ebp - 0x18]
call fcn.0042a029
mov eax, dword [eax]
mov esi, dword [ebp - 0xc]
push 0xffffffffffffffff
push esi
push eax
xor eax, eax
call fcn.004787e0
mov ebx, eax
mov eax, dword [ebp - 0x18]
add esp, 0x24
neg ebx
sbb bl, bl
add eax, 0xfffffff0
inc bl
call fcn.00401239
test bl, bl
je 0x4ca209
push 0
push edi
call dword [sym.imp.MSVCR80.dll__waccess]
test eax, eax
pop ecx
pop ecx
jne 0x4ca209
push 0x527118
push edi
call fcn.004c9f28
pop ecx
pop ecx
mov dword [ebp - 0x10], eax
lea eax, [edi - 0x10]
call fcn.00401239
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.00401239
lea eax, [esi - 0x10]
call fcn.00401239
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4ca56a
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
or dword [esp], 0xffffffff
push ebx
push esi
push edi
push dword [ebp + 8]
mov ebx, ecx
push 0x400
call fcn.00499623
mov edi, eax
xor esi, esi
cmp edi, esi
pop ecx
pop ecx
jne 0x4ca598
or eax, 0xffffffff
jmp 0x4ca5d2
push str.NtQueryInformationProcess
push str.ntdll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push esi
push 0x18
lea ecx, [esp + 0x28]
push ecx
push esi
push edi
call eax
test eax, eax
jne 0x4ca5c7
mov eax, dword [esp + 0x34]
mov dword [esp + 0xc], eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0xc]
push eax
lea eax, [esp + 0x18]
push eax
lea eax, [ebx + 8]
push eax
call fcn.0049a9f5
push dword [esp + 0x14]
lea edi, [esp + 0x10]
call fcn.00496d4f
pop ecx
mov eax, edi
call fcn.00407211
push str.explorer.exe
mov eax, edi
push eax
call fcn.004249a1
test eax, eax
jne 0x4ca677
cmp dword [ebx + 0x38], 0x5e5
jne 0x4ca677
lea esi, [esp + 0x18]
call fcn.004038c8
push dword [ebp + 0xc]
lea edi, [esp + 0x14]
call fcn.00496d4f
mov esi, dword [esp + 0x20]
test esi, esi
mov edi, dword [esp + 0x14]
pop ecx
je 0x4ca662
mov eax, dword [esi]
push str.duba_processname_launch
mov ecx, esi
call dword [eax + 0xc]
mov eax, dword [esi]
push edi
push str.processname
mov ecx, esi
call dword [eax + 0x18]
mov eax, dword [esi]
push 2
push 0x513abc
mov ecx, esi
call dword [eax + 0x14]
mov eax, dword [esi]
push 0
mov ecx, esi
call dword [eax + 0x20]
lea eax, [edi - 0x10]
call fcn.00401239
test esi, esi
je 0x4ca675
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
xor esi, esi
push str.explorer.exe
lea eax, [esp + 0x10]
push eax
call fcn.004249a1
test eax, eax
jne 0x4ca6f9
push dword [ebp + 0xc]
lea eax, [esp + 0x14]
call fcn.004014ce
lea eax, [esp + 0x10]
mov ecx, ebx
call fcn.004ca915
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
call fcn.00401239
lea edi, [ebx + 0x3c]
mov eax, edi
mov dword [ebx + 0x70], 1
call fcn.00444abf
test eax, eax
jne 0x4ca6f9
push 0xc
call sub.MSVCR80.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, esi
pop ecx
jne 0x4ca6d2
xor eax, eax
jmp 0x4ca6f1
push esi
push esi
push eax
push 0x45681e
push esi
push esi
mov dword [eax], ebx
mov dword [eax + 8], esi
mov dword [eax + 4], 0x4ca891
call dword [sym.imp.MSVCR80.dll__beginthreadex]
add esp, 0x18
push eax
mov esi, edi
call fcn.00444aa9
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
call fcn.00401239
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
call fcn.00401239
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4cb7b0
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov esi, 0x50edd8
push esi
lea eax, [ebp - 4]
call fcn.004014ce
push esi
lea eax, [ebp - 8]
call fcn.004014ce
push str.uninstall
lea eax, [ebp - 4]
push eax
call fcn.0040127c
mov ebx, dword [ebp - 4]
push ebx
lea eax, [ebp - 8]
push str._weatherpanel:_s
push eax
call fcn.0042a016
push 0
lea eax, [ebp - 4]
call fcn.00496e16
push str.kwtpanel.exe
lea eax, [ebp - 4]
lea ecx, [ebp - 0x10]
call fcn.0042a029
mov esi, dword [ebp - 0x10]
and dword [ebp - 0xc], 0
add esp, 0x14
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
mov edi, dword [ebp - 8]
je 0x4cb838
push 1
push 0
push edi
push esi
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 0xc], eax
lea eax, [esi - 0x10]
call fcn.00401239
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.00401239
lea eax, [edi - 0x10]
call fcn.00401239
lea eax, [ebx - 0x10]
call fcn.00401239
xor eax, eax
cmp dword [ebp - 0xc], 0x20
pop edi
pop esi
setg al
pop ebx
leave
ret

Function at 0x4cb869
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov esi, 0x50edd8
push esi
lea eax, [ebp - 4]
call fcn.004014ce
push esi
lea eax, [ebp - 8]
call fcn.004014ce
push str.install
lea eax, [ebp - 4]
push eax
call fcn.0040127c
push dword [ebp + 8]
mov ebx, dword [ebp - 4]
push ebx
lea eax, [ebp - 8]
push str._weatherpanel:_s__src:_d
push eax
call fcn.0042a016
push 0
lea eax, [ebp - 4]
call fcn.00496e16
push str.kwtpanel.exe
lea eax, [ebp - 4]
lea ecx, [ebp - 0x10]
call fcn.0042a029
mov esi, dword [ebp - 0x10]
and dword [ebp - 0xc], 0
add esp, 0x18
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
mov edi, dword [ebp - 8]
je 0x4cb8f4
push 1
push 0
push edi
push esi
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 0xc], eax
lea eax, [esi - 0x10]
call fcn.00401239
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.00401239
lea eax, [edi - 0x10]
call fcn.00401239
lea eax, [ebx - 0x10]
call fcn.00401239
xor eax, eax
cmp dword [ebp - 0xc], 0x20
pop edi
pop esi
setg al
pop ebx
leave
ret

Function at 0x4cb974
Capabilities:
Terminate thread

Disassembly:
mov eax, esi
call fcn.00444abf
test eax, eax
je 0x4cb98b
push 0x2710
mov eax, esi
call fcn.00444ae6
mov eax, esi
call fcn.00444abf
test eax, eax
je 0x4cb9a5
mov eax, dword [esi]
test eax, eax
je 0x4cb9a5
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
call fcn.004cb782
test eax, eax
je 0x4cb9b3
call fcn.004cb7b0
xor eax, eax
inc eax
ret

Function at 0x4cb9df
Capabilities:
Create thread

Disassembly:
push 0xc
call sub.MSVCR80.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
xor ecx, ecx
cmp eax, ecx
jne 0x4cb9f0
xor eax, eax
ret
mov edx, dword [esp + 4]
push ecx
push ecx
push eax
push 0x45681e
push ecx
push ecx
mov dword [eax], edx
mov dword [eax + 8], ecx
mov dword [eax + 4], 0x4cb9b7
call dword [sym.imp.MSVCR80.dll__beginthreadex]
add esp, 0x18
ret
Function at 0x4cbabd
Capabilities:
Read .ini file

Disassembly:
xor eax, eax
cmp dword [esp + 4], eax
je 0x4cbad7
push dword [ecx]
push eax
push dword [esp + 0xc]
push str.nosw
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
ret 4

Function at 0x4cbb58
Capabilities:
Read .ini file

Disassembly:
xor eax, eax
cmp dword [esp + 4], eax
je 0x4cbb72
push dword [ecx]
push eax
push dword [esp + 0xc]
push str.lastst
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
ret 4
Function at 0x4cd780
Capabilities:
Compute adler32 checksum

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, ecx
movzx ecx, di
shr edi, 0x10
test esi, esi
mov ebx, eax
jne 0x4cd79a
pop edi
lea eax, [esi + 1]
pop esi
pop ebx
ret
test ebx, ebx
jbe 0x4cd89c
push ebp
cmp ebx, 0x15b0
mov eax, ebx
jb 0x4cd7b2
mov eax, 0x15b0
sub ebx, eax
cmp eax, 0x10
jl 0x4cd85b
mov edx, eax
shr edx, 4
mov ebp, edx
neg ebp
shl ebp, 4
add eax, ebp
jmp 0x4cd7d0
movzx ebp, byte [esi]
add ecx, ebp
movzx ebp, byte [esi + 1]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 2]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 3]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 4]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 5]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 6]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 7]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 8]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 9]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xa]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xb]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xc]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xd]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xe]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xf]
add edi, ecx
add ecx, ebp
add edi, ecx
add esi, 0x10
sub edx, 1
jne 0x4cd7d0
test eax, eax
je 0x4cd86f
nop
movzx edx, byte [esi]
add ecx, edx
add esi, 1
add edi, ecx
sub eax, 1
jne 0x4cd860
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul edx, edx, 0xffff000f
add ecx, edx
mov eax, 0x80078071
mul edi
shr edx, 0xf
imul edx, edx, 0xffff000f
add edi, edx
test ebx, ebx
ja 0x4cd7a3
pop ebp
mov eax, edi
pop edi
shl eax, 0x10
pop esi
or eax, ecx
pop ebx
ret

Function at 0x4cdd70
Capabilities:
Hash data with crc32

Disassembly:
test ecx, ecx
jne 0x4cdd77
xor eax, eax
ret
mov eax, dword [esp + 4]
jmp fcn.004cdd80