joyce8/EMBER2024-capa huggingface dataset:
Function at 0x459560
Capabilities:
Enumerate processes

Disassembly:
push 0x29c
mov eax, 0x4b61fa
call fcn.00461a91
mov esi, edx
mov dword [ebp - 0x2a8], esi
mov ebx, ecx
push 0x228
lea eax, [ebp - 0x2a0]
mov dword [ebp - 0x2a4], 0x22c
push 0
push eax
call fcn.00464590
add esp, 0xc
lea eax, [ebp - 0x2a4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
jmp 0x4596d3
push 0xfde9
push 0xffffffffffffffff
lea edx, [ebp - 0x280]
lea ecx, [ebp - 0x60]
call fcn.00418c95
and dword [ebp - 4], 0
mov esi, dword [ebp - 0x29c]
push 0x4d46c8
push ebx
call fcn.00414bb4
push 0xa
mov edi, eax
lea eax, [ebp - 0x30]
push 0x20
push eax
push esi
call fcn.004670dc
lea eax, [ebp - 0x30]
push eax
push edi
call fcn.00414bb4
add esp, 0x28
lea ecx, [ebp - 0x60]
push ecx
push 0x4d46b4
push eax
call fcn.00414bb4
pop ecx
pop ecx
push eax
call fcn.0041374a
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
lea ecx, [ebp - 0x60]
call fcn.00404f45
cmp dword [ebp - 0x29c], 0
je 0x4596b2
push dword [ebp - 0x29c]
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x4596b2
mov edx, esi
lea ecx, [ebp - 0x78]
call fcn.00415663
push 0xfde9
push eax
lea eax, [ebp - 0x48]
mov dword [ebp - 4], 1
push eax
call fcn.0040a860
add esp, 0xc
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 3
call fcn.00405118
lea ecx, [ebp - 0x48]
call fcn.00405bc9
test al, al
jne 0x45969f
push 0x4d46c4
lea eax, [ebp - 0x48]
push eax
push 0x4d4318
push ebx
call fcn.00414bb4
pop ecx
pop ecx
push eax
call fcn.0041374a
pop ecx
pop ecx
push eax
call fcn.00414bb4
pop ecx
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.00404f45
push 0x4d29e0
push ebx
call fcn.00414bb4
mov esi, dword [ebp - 0x2a8]
lea eax, [ebp - 0x2a4]
pop ecx
pop ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x4595ac
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
call fcn.00461a3b
ret
Function at 0x4599f0
Capabilities:
Get graphical window text

Disassembly:
push 0x430
mov eax, 0x4b628d
call fcn.00461a91
mov esi, ecx
mov dword [ebp - 0x434], esi
mov dword [ebp - 0x438], esi
mov eax, dword [ebp + 8]
lea edi, [esi + 4]
mov dword [ebp - 0x43c], esi
mov ecx, edi
mov dword [esi], eax
call fcn.00414daa
and dword [ebp - 4], 0
lea ebx, [esi + 0x1c]
mov ecx, ebx
call fcn.00414daa
lea eax, [esi + 0x34]
mov ecx, eax
mov dword [ebp - 0x438], eax
call fcn.00404dc9
xor eax, eax
mov dword [esi + 0x58], eax
mov dword [esi + 0x5c], eax
mov dword [esi + 0x60], eax
mov byte [ebp - 4], 3
push dword [esi]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
setne al
mov byte [esi + 0x54], al
add esi, 0x4c
mov eax, dword [ebp - 0x434]
push esi
push dword [eax]
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ecx, dword [ebp - 0x434]
push 0x80
mov dword [ecx + 0x50], eax
lea eax, [ebp - 0x110]
push eax
push dword [ecx]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0x80
lea eax, [ebp - 0x210]
push eax
mov eax, dword [ebp - 0x434]
push dword [eax]
call dword [sym.imp.USER32.dll_GetClassNameW]
push 0xfde9
push 0xffffffffffffffff
lea edx, [ebp - 0x110]
lea ecx, [ebp - 0x430]
call fcn.00418c95
pop ecx
pop ecx
lea eax, [ebp - 0x430]
mov ecx, edi
push eax
call fcn.0041dade
lea ecx, [ebp - 0x430]
call fcn.00404f45
push 0xfde9
push 0xffffffffffffffff
lea edx, [ebp - 0x210]
lea ecx, [ebp - 0x430]
call fcn.00418c95
pop ecx
pop ecx
lea eax, [ebp - 0x430]
mov ecx, ebx
push eax
call fcn.0041dade
lea ecx, [ebp - 0x430]
call fcn.00404f45
push dword [esi]
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x459b6d
push 0x104
lea eax, [ebp - 0x418]
push eax
push 0
push edi
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
test eax, eax
je 0x459b66
lea eax, [ebp - 0x418]
push 0x5c
push eax
call fcn.0040dbbf
pop ecx
test eax, eax
lea esi, [ebp - 0x418]
pop ecx
mov ecx, dword [ebp - 0x438]
lea edx, [eax + 2]
cmovne esi, edx
push esi
call fcn.0040f8b1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x434]
call fcn.00461a3b
ret 4
Function at 0x459b7b
Capabilities:
Enumerate gui resources

Disassembly:
push 0x22c
mov eax, 0x4b62d6
call fcn.00461a91
mov esi, edx
mov dword [ebp - 0x22c], ecx
xor ebx, ebx
cmp dword [esi + 0x1c], ebx
je 0x459d05
lea ecx, [ebp - 0x238]
call fcn.00403b7f
push 0x7fffffff
lea eax, [ebp - 0x238]
mov dword [ebp - 4], ebx
mov ecx, dword [esi + 0x1c]
push 0x7c
push eax
call fcn.00417e57
add esp, 0xc
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x220], ebx
lea eax, [ebp - 0x228]
mov byte [ebp - 4], 1
push eax
push 0x459d8c
call dword [sym.imp.USER32.dll_EnumWindows]
test eax, eax
je 0x459cbb
lea ecx, [ebp - 0x21c]
call fcn.0040a6f3
mov byte [ebp - 4], 3
mov edi, ebx
mov eax, dword [ebp - 0x224]
sub eax, dword [ebp - 0x228]
sar eax, 2
test eax, eax
je 0x459c82
lea ecx, [ebp - 0x238]
call fcn.00405868
test eax, eax
je 0x459c6c
mov esi, dword [ebp - 0x228]
lea ecx, [ebp - 0x238]
push ebx
call fcn.0040584d
mov ecx, eax
call fcn.00404e0f
mov ecx, dword [esi + edi*4]
push eax
add ecx, 0x34
call fcn.00404e0f
push eax
call fcn.00467153
pop ecx
pop ecx
test eax, eax
je 0x459d0b
lea ecx, [ebp - 0x238]
inc ebx
call fcn.00405868
cmp ebx, eax
jb 0x459c27
xor ebx, ebx
mov eax, dword [ebp - 0x224]
inc edi
sub eax, dword [ebp - 0x228]
sar eax, 2
cmp edi, eax
jb 0x459c18
lea ecx, [ebp - 0x21c]
call fcn.00405ae7
lea ecx, [ebp - 0x21c]
mov esi, eax
call fcn.00414c36
push ecx
mov ecx, dword [ebp - 0x22c]
mov edx, str.wndinfo.txt
push esi
push eax
call fcn.0045c811
add esp, 0xc
lea ecx, [ebp - 0x21c]
call fcn.0040a6d0
lea ecx, [ebp - 0x228]
mov byte [ebp - 4], 4
call fcn.00404e51
mov ecx, dword [ebp - 0x228]
test ecx, ecx
je 0x459cfa
mov eax, dword [ebp - 0x220]
sub eax, ecx
and eax, 0xfffffffc
push eax
push ecx
call fcn.0040502f
pop ecx
pop ecx
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x220], ebx
lea ecx, [ebp - 0x238]
call fcn.00405a54
call fcn.00461a3b
ret
mov edx, dword [ebp - 0x228]
lea ecx, [ebp - 0x21c]
xor ebx, ebx
push ebx
mov edx, dword [edx + edi*4]
call fcn.00459de0
pop ecx
jmp 0x459c6e
Function at 0x45aeda
Capabilities:
Get common file path

Disassembly:
push 0x35c
mov eax, 0x4b63ef
call fcn.00461a91
mov dword [ebp - 0x358], edx
mov esi, ecx
mov dword [ebp - 0x360], esi
xor eax, eax
lea ebx, [ebp - 0x350]
mov dword [ebp - 4], eax
mov edi, eax
mov dword [ebp - 0x368], esi
mov dword [ebp - 0x364], eax
mov dword [ebp - 0x350], 0x4d4a94
mov dword [ebp - 0x34c], 4
mov byte [ebp - 0x348], al
mov dword [ebp - 0x344], str.Windows_
mov dword [ebp - 0x340], 9
mov byte [ebp - 0x33c], 1
mov dword [ebp - 0x338], str.SystemRoot_
mov dword [ebp - 0x334], 0xc
mov byte [ebp - 0x330], 1
mov dword [ebp - 0x32c], str.System32
mov dword [ebp - 0x328], eax
mov byte [ebp - 0x324], 1
mov dword [ebp - 0x320], str.SysWOW64
mov dword [ebp - 0x31c], eax
mov byte [ebp - 0x318], 1
mov byte [ebp - 0x351], al
mov dword [ebp - 0x35c], eax
mov ecx, dword [ebx]
lea eax, [ecx + 1]
mov dword [ebp - 0x360], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x45afa5
sub ecx, dword [ebp - 0x360]
push ecx
push dword [ebx]
push edx
call fcn.0046a281
add esp, 0xc
test eax, eax
je 0x45afe7
mov eax, dword [ebp - 0x35c]
add ebx, 0xc
mov edx, dword [ebp - 0x358]
inc eax
mov dword [ebp - 0x35c], eax
cmp eax, 5
jne 0x45af9a
mov bl, byte [ebp - 0x351]
mov bh, bl
jmp 0x45aff5
mov edi, dword [ebx + 4]
mov bh, byte [ebx + 8]
mov bl, 1
add edi, dword [ebp - 0x358]
push 0x4cf54a
mov ecx, esi
call fcn.00404885
and dword [ebp - 4], 0
mov dword [ebp - 0x364], 1
test bl, bl
je 0x45b01d
test bh, bh
jne 0x45b01d
push edi
jmp 0x45b0a1
push 0x200
lea eax, [ebp - 0x314]
push 0
push eax
call fcn.00464590
push 0x104
lea eax, [ebp - 0x114]
push 0
push eax
call fcn.00464590
add esp, 0x18
lea eax, [ebp - 0x114]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x114]
test bl, bl
je 0x45b07a
push edi
push eax
lea eax, [ebp - 0x314]
push str._s_s
push eax
call fcn.0045b7a8
add esp, 0x10
jmp 0x45b09a
push dword [ebp - 0x358]
push str.system32drivers
push eax
lea eax, [ebp - 0x314]
push str._s_s_s
push eax
call fcn.0045b7a8
add esp, 0x14
lea eax, [ebp - 0x314]
push eax
mov ecx, esi
call fcn.0040ae37
mov eax, esi
call fcn.00461a3b
ret
Function at 0x45c9f3
Capabilities:
Write file on windows

Disassembly:
push 0x24
mov eax, 0x4b6620
call fcn.00461a91
mov edi, ecx
and dword [ebp - 0x2c], 0
lea esi, [edi + 8]
mov edx, dword [esi + 4]
xor ebx, ebx
mov ecx, dword [esi]
mov eax, edx
sub eax, ecx
sar eax, 3
test eax, eax
je 0x45ca55
push 0
lea eax, [ebp - 0x30]
push eax
push dword [ecx + ebx*8 + 4]
push dword [ecx + ebx*8]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esi]
push dword [eax + ebx*8]
call fcn.00466e1b
mov eax, dword [ebp - 0x2c]
mov edx, dword [edi + 0xc]
pop ecx
mov ecx, dword [esi]
add eax, dword [ecx + ebx*8 + 4]
inc ebx
mov dword [ebp - 0x2c], eax
mov eax, edx
sub eax, ecx
sar eax, 3
cmp ebx, eax
jb 0x45ca1a
xor eax, eax
mov dword [ebp - 0x28], 0x6054b50
sub edx, ecx
mov dword [ebp - 0x24], eax
mov ecx, dword [edi + 4]
xor ebx, ebx
sar edx, 3
movzx eax, dx
mov word [ebp - 0x1e], ax
mov word [ebp - 0x20], ax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebx
mov word [ebp - 0x14], ax
lea eax, [ebp - 0x30]
push eax
push 0x16
lea eax, [ebp - 0x28]
mov dword [ebp - 0x18], ecx
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, esi
mov dword [ebp - 4], ebx
call fcn.00404e51
cmp dword [esi], ebx
je 0x45cac8
mov eax, dword [esi + 8]
sub eax, dword [esi]
and eax, 0xfffffff8
push eax
push dword [esi]
call fcn.0040502f
mov dword [esi], ebx
pop ecx
mov dword [esi + 4], ebx
pop ecx
mov dword [esi + 8], ebx
push 0x14
push edi
call fcn.00461025
pop ecx
pop ecx
call fcn.00461a3b
ret

Function at 0x47a631
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0047a2e2

Function at 0x47a63c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0047a46c

Function at 0x488ec0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x489360
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x489375
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x489387
movzx eax, ax
or eax, 0x80070000
push eax
lea ecx, [ebp - 0x10]
call fcn.0049130e
push 0x4e5b88
lea eax, [ebp - 0x10]
push eax
call fcn.00464ec4
int3
Function at 0x49f8b4
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b7826
mov eax, dword fs:[0]
push eax
sub esp, 0xc4
mov eax, dword [0x4ec06c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xd0], ecx
push str.Webkit_
call fcn.00440b3c
add eax, 0x24
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00403d38
add esp, 0xc
and dword [ebp - 4], 0
push str.DefaultCookies
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.00403d38
add esp, 0xc
mov dword [ebp - 0xac], eax
mov ecx, dword [ebp - 0xac]
call fcn.00404e0f
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x70]
call fcn.00405118
lea ecx, [ebp - 0xcc]
call fcn.004057b5
mov byte [ebp - 4], 1
push str.Profile_
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x88]
push eax
call fcn.00403d38
add esp, 0xc
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0xb4], eax
mov byte [ebp - 4], 2
push 2
lea eax, [ebp - 0xcc]
push eax
mov ecx, dword [ebp - 0xb4]
call fcn.00404e0f
push eax
call fcn.004051e5
add esp, 0xc
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x88]
call fcn.00405118
lea eax, [ebp - 0xcc]
mov dword [ebp - 0xa8], eax
lea eax, [ebp - 0xa4]
push eax
mov ecx, dword [ebp - 0xa8]
call fcn.0040574e
lea eax, [ebp - 0xb8]
push eax
mov ecx, dword [ebp - 0xa8]
call fcn.0040572c
jmp 0x49f9de
lea ecx, [ebp - 0xa4]
call fcn.00405707
lea eax, [ebp - 0xb8]
push eax
lea ecx, [ebp - 0xa4]
call fcn.004056d9
movzx eax, al
test eax, eax
je 0x49fab6
lea ecx, [ebp - 0xa4]
call fcn.0040571b
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp - 0xbc]
add eax, 0x2c
push eax
lea ecx, [ebp - 0x40]
call fcn.00404d2c
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x40]
call fcn.00405bef
mov ax, word [eax]
movzx eax, ax
push eax
call fcn.00469eeb
pop ecx
test eax, eax
je 0x49faa5
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0xa0]
push eax
call fcn.00407416
add esp, 0xc
mov dword [ebp - 0xc0], eax
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0xc4], eax
mov byte [ebp - 4], 4
push str.Cookies
push dword [ebp - 0xc4]
lea eax, [ebp - 0x58]
push eax
call fcn.00403de8
add esp, 0xc
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xa0]
call fcn.00405118
lea ecx, [ebp - 0x58]
call fcn.00404e0f
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x58]
call fcn.00405118
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x40]
call fcn.00405118
jmp 0x49f9d3
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xcc]
call fcn.00405772
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00405118
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00461014
leave
ret
Function at 0x4a3479
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b80d9
mov eax, dword fs:[0]
push eax
sub esp, 0x410
mov eax, dword [0x4ec06c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x41c]
call fcn.0040a6f3
and dword [ebp - 4], 0
push 0x4c7820
call fcn.00440b3c
add eax, 0x24
mov ecx, eax
call fcn.00404e0f
push eax
lea eax, [ebp - 0x41c]
push eax
call fcn.0040a68b
pop ecx
pop ecx
push eax
call fcn.0040a68b
pop ecx
pop ecx
lea ecx, [ebp - 0x41c]
call fcn.0040a840
xor dl, dl
mov ecx, eax
call fcn.00415c2f
movzx eax, al
test eax, eax
je 0x4a350b
lea ecx, [ebp - 0x41c]
call fcn.0040a840
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x41c]
call fcn.0040a6d0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00461014
leave
ret
Function at 0x4a5e6d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x4ec06c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x230], ecx
push 0x20a
push 0
lea eax, [ebp - 0x210]
push eax
call fcn.00464590
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push str.se_inst_tmp_backup
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x228]
push eax
call fcn.0040b2d7
add esp, 0xc
mov dword [ebp - 0x22c], eax
push dword [ebp - 0x22c]
mov ecx, dword [ebp - 0x230]
add ecx, 0x30
call fcn.00405cfe
lea ecx, [ebp - 0x228]
call fcn.00405118
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00461014
leave
ret
Function at 0x4a848d
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b8c68
mov eax, dword fs:[0]
push eax
sub esp, 0x2cc
mov eax, dword [0x4ec06c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2d8], ecx
push 0x250
push 0
lea eax, [ebp - 0x2c0]
push eax
call fcn.00464590
add esp, 0xc
push str.Thumbnails
call fcn.00440b3c
add eax, 0x24
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.00403d38
add esp, 0xc
and dword [ebp - 4], 0
push str..jpg
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.00403d38
add esp, 0xc
mov byte [ebp - 4], 1
lea eax, [ebp - 0x2c0]
push eax
lea ecx, [ebp - 0x58]
call fcn.00404e0f
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x2c4], eax
cmp dword [ebp - 0x2c4], 0xffffffff
je 0x4a8678
mov eax, dword [ebp - 0x2c0]
and eax, 0x10
jne 0x4a859b
push 0x4c95cc
lea eax, [ebp - 0x294]
push eax
call fcn.00467153
pop ecx
pop ecx
test eax, eax
je 0x4a859b
push 0x4c95d0
lea eax, [ebp - 0x294]
push eax
call fcn.00467153
pop ecx
pop ecx
test eax, eax
je 0x4a859b
push str.backgorund.jpg
lea eax, [ebp - 0x294]
push eax
call fcn.00467153
pop ecx
pop ecx
test eax, eax
je 0x4a859b
push str.background.jpg
lea eax, [ebp - 0x294]
push eax
call fcn.00467153
pop ecx
pop ecx
test eax, eax
jne 0x4a85a5
jmp 0x4a865f
push 0x4c9618
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.00403d38
add esp, 0xc
mov dword [ebp - 0x2cc], eax
mov eax, dword [ebp - 0x2cc]
mov dword [ebp - 0x2d0], eax
mov byte [ebp - 4], 2
lea eax, [ebp - 0x294]
push eax
push dword [ebp - 0x2d0]
lea eax, [ebp - 0x28]
push eax
call fcn.00403de8
add esp, 0xc
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x70]
call fcn.00405118
push 0
push 0x80
push 3
push 0
push 0
lea ecx, [ebp - 0x28]
call fcn.00404e0f
mov edx, 0x80000000
mov ecx, eax
call fcn.0044b3e9
mov dword [ebp - 0x2c8], eax
push 0
push dword [ebp - 0x2c8]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x2d4], eax
mov ecx, dword [ebp - 0x2c8]
call fcn.0044b48f
cmp dword [ebp - 0x2d4], 0
jne 0x4a8653
lea ecx, [ebp - 0x28]
call fcn.00404e0f
mov ecx, eax
call fcn.0044b46f
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.00405118
lea edx, [ebp - 0x2c0]
mov ecx, dword [ebp - 0x2c4]
call fcn.0044b4af
test eax, eax
jne 0x4a8534
mov ecx, dword [ebp - 0x2c4]
call fcn.0044b4d4
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x58]
call fcn.00405118
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.00405118
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00461014
leave
ret

Function at 0x4a900f
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push str.Event_UnCompress
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x4f7400], eax
push 0
push 0
push dword [0x4f7400]
push 0x4a8fea
push 0x100000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebp
ret
Function at 0x4aadb7
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
add ecx, 0x368
call fcn.0040e3d2
cmp eax, dword [ebp + 8]
jne 0x4aaddd
push 1
mov ecx, dword [ebp - 4]
call fcn.004aa8f6
jmp 0x4aae35
mov ecx, dword [ebp - 4]
add ecx, 0x374
call fcn.0040e3d2
cmp eax, dword [ebp + 8]
jne 0x4aae0a
push 5
push 0
push 0
push str.https:__go.ie.sogou.com_fwlink_linkid0003
push 0x4cba90
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x4aae35
mov ecx, dword [ebp - 4]
add ecx, 0x378
call fcn.0040e3d2
cmp eax, dword [ebp + 8]
jne 0x4aae35
push 5
push 0
push 0
push str.https:__go.ie.sogou.com_fwlink_linkid0004
push 0x4cba9c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
inc eax
leave
ret 0xc

Function at 0x4acf40
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b9418
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x4ec06c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x38], ecx
and dword [ebp - 0x1c], 0
push 0x4cbb34
movzx eax, word [ebp + 8]
push eax
call fcn.0041208c
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x4acf90
jmp 0x4ad040
push dword [ebp - 0x14]
call fcn.0041208c
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x18], eax
push dword [ebp - 0x14]
call fcn.0041208c
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x4acfbf
jmp 0x4ad040
push dword [ebp - 0x18]
call fcn.0046142c
pop ecx
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x10], eax
push dword [ebp - 0x18]
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
push dword [ebp - 0x10]
call fcn.00462840
add esp, 0xc
push 0x1c
call fcn.0040ebc6
pop ecx
mov dword [ebp - 0x24], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0
je 0x4ad011
push dword [ebp - 0x18]
push dword [ebp - 0x10]
mov ecx, dword [ebp - 0x24]
call fcn.004aa6d5
mov dword [ebp - 0x28], eax
jmp 0x4ad015
and dword [ebp - 0x28], 0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x34], eax
push dword [ebp - 0x34]
call fcn.00461435
pop ecx
and dword [ebp - 0x10], 0
xor eax, eax
jne 0x4acf6c
xor eax, eax
jne 0x4ad040
cmp dword [ebp - 0x1c], 0
je 0x4ad059
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x38]
add ecx, 0x58
call fcn.00410973
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
leave
ret 4
Function at 0x4ad43a
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push dword [ebp + 8]
mov ecx, 0x4f6c94
call fcn.00405ca2
mov byte [0x4f6cac], 0
mov ecx, 0x4f6cb0
call fcn.0041244b
mov byte [ebp - 2], 0
mov byte [ebp - 1], 1
push 0
push 0
push 0
push 0x4ad0cb
push 0x100000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4ad4c0
push 0xbb8
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4ad4b7
mov al, byte [0x4f6cac]
mov byte [ebp - 1], al
push 0x4f6cb0
mov ecx, dword [ebp + 0xc]
call fcn.00405ca2
mov byte [ebp - 2], 1
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, byte [ebp - 2]
test eax, eax
jne 0x4ad4d4
mov byte [ebp - 1], 1
mov ecx, dword [ebp + 0xc]
call fcn.0041244b
mov al, byte [ebp - 1]
leave
ret

Function at 0x4ad5c5
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x4ec06c]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
xor eax, eax
inc eax
imul eax, eax, 0
movsx eax, byte [eax + 0x4f74a8]
test eax, eax
jne 0x4ad6e8
and dword [ebp - 0x54], 0
mov dword [ebp - 0x50], 0x40
push 0xfde9
push 0xffffffffffffffff
mov edx, 0x4cbc18
lea ecx, [ebp - 0x2c]
call fcn.00418b36
pop ecx
pop ecx
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x50]
push eax
push 0x4f74a8
lea eax, [ebp - 0x54]
push eax
push 0x4cbc14
mov ecx, dword [ebp - 0x58]
call fcn.0040a7fe
push eax
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
je 0x4ad642
mov dword [ebp - 0x4c], 1
jmp 0x4ad646
and dword [ebp - 0x4c], 0
mov al, byte [ebp - 0x4c]
mov byte [ebp - 0x45], al
lea ecx, [ebp - 0x2c]
call fcn.00404f45
movzx eax, byte [ebp - 0x45]
test eax, eax
je 0x4ad6e8
xor eax, eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0
xor edx, edx
lea ecx, [ebp - 0x14]
call fcn.00421ac7
pop ecx
movzx eax, al
test eax, eax
je 0x4ad69b
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push 0x4cbc48
push 0x4f74a8
call fcn.00413ba4
add esp, 0x18
push 0xfde9
push 0xffffffffffffffff
mov edx, 0x4cbc60
lea ecx, [ebp - 0x44]
call fcn.00418b36
pop ecx
pop ecx
mov dword [ebp - 0x5c], eax
push 0x4f74a8
call fcn.00466d90
pop ecx
push eax
push 0x4f74a8
push 1
push 0x4cbc5c
mov ecx, dword [ebp - 0x5c]
call fcn.0040a7fe
push eax
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
lea ecx, [ebp - 0x44]
call fcn.00404f45
mov eax, 0x4f74a8
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00461014
leave
ret