joyce8/EMBER2024-capa huggingface dataset:
Function at 0x466e7e
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, ecx
mov ecx, dword [eax + 8]
cmp ecx, 1
jne 0x466ed2
mov eax, dword [eax + 0xc]
cmp eax, 0x64
jne 0x466eb6
push 0
push dword [ebx + 4]
call dword [0x496870]
push 0
push 0
push 0x414
push dword [ebx + 0x36c]
call dword [0x496864]
xor eax, eax
inc eax
pop ebx
ret
cmp eax, 0x66
jne 0x466ec2
call fcn.00466e23
jmp 0x466eb1
cmp eax, 0x65
jne 0x466ed2
push 0
push 0
push 0x411
jmp 0x466ea5
and dword [ebx + 0x368], 0
xor eax, eax
pop ebx
ret

Function at 0x466f1b
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push esi
push edi
xor edi, edi
inc edi
cmp dword [ebp + 0xc], 0x86
mov esi, eax
jne 0x466f5a
cmp dword [ebp + 0x10], 0
mov dword [esi + 0x368], edi
jne 0x466f48
push 0
push dword [esi + 4]
call dword [0x496870]
mov dword [ebx], edi
cmp dword [esi + 0x368], 0
je 0x466f7a
mov eax, edi
jmp 0x466fe7
cmp dword [ebp + 0xc], 0x4e
jne 0x466f7a
mov eax, dword [ebp + 0x14]
cmp dword [eax + 4], 0xffffffff
jne 0x466f7a
mov ecx, esi
mov dword [esi + 0x368], edi
call fcn.00466e7e
mov dword [ebx], eax
jmp 0x466f4a
push 0
push ebx
push dword [ebp + 0x14]
mov ecx, esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004459ad
test eax, eax
jne 0x466f53
cmp dword [ebp + 0xc], 5
lea edx, [esi + 0x360]
jne 0x466fbc
mov eax, dword [ebp + 0x14]
movsx ecx, ax
shr eax, 0x10
movsx eax, ax
push eax
push ecx
push dword [ebp + 0x10]
push edx
call fcn.00446a30
and dword [ebx], 0
jmp 0x466fe5
cmp dword [ebp + 0xc], 2
jne 0x466fc9
and dword [edx], 0
and dword [edx + 4], 0
cmp dword [ebp + 0xc], 0x110
jne 0x466fe5
add esi, 0x368
mov dword [esi], edi
mov dword [ebx], edi
cmp dword [esi], 0
jne 0x466f53
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x46703b
Capabilities:
Create process on windows

Disassembly:
call fcn.00412ffe
cmp eax, 1
jne 0x46706a
push edi
call fcn.004671e8
test eax, eax
je 0x467067
push esi
lea esi, [edi + 8]
call fcn.0047c0f8
push 0
push 1
call dword [edi]
test eax, eax
pop esi
jl 0x467067
xor eax, eax
inc eax
ret
xor eax, eax
ret
mov ecx, edi
jmp 0x46725c
push 8
mov eax, 0x49358c
call fcn.004869c2
mov esi, ecx
add esi, 8
call fcn.0047c0f8
xor ebx, ebx
lea ecx, [ebp - 0x14]
call fcn.00411286
lea ecx, [ebp - 0x10]
push str.kwifibandlaunch.exe
push ecx
xor esi, esi
mov ecx, eax
mov dword [ebp - 4], esi
call fcn.00411d12
mov eax, dword [ebp - 0x14]
pop ecx
pop ecx
add eax, 0xfffffff0
call fcn.00401a1d
push esi
push esi
push str._oper:show
push dword [ebp - 0x10]
push 0x49d1a4
push esi
call dword [0x496728]
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00401a1d
xor eax, eax
inc eax
call fcn.00486a9a
ret
Function at 0x467092
Capabilities:
Check if file exists

Disassembly:
push 0x14
mov eax, 0x4935c7
call fcn.004869c2
call fcn.00412ffe
mov esi, dword [0x49674c]
xor edi, edi
inc edi
cmp eax, edi
jne 0x467122
xor ebx, ebx
lea ecx, [ebp - 0x1c]
call fcn.00411286
and dword [ebp - 4], ebx
lea ecx, [ebp - 0x10]
push str.kwifiband.dll
push ecx
mov ecx, eax
call fcn.00411d12
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
pop ecx
pop ecx
add eax, 0xfffffff0
call fcn.00401a1d
push dword [ebp - 0x10]
call esi
test eax, eax
je 0x467117
call fcn.00412fea
cmp eax, 8
je 0x467105
call fcn.00412fea
cmp eax, 6
je 0x467105
call fcn.00412fea
cmp eax, 0xa
jne 0x467117
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00401a1d
mov eax, edi
jmp 0x4671e2
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00401a1d
call fcn.00412ffe
cmp eax, 2
jne 0x4671e0
xor ebx, ebx
lea ecx, [ebp - 0x1c]
call fcn.00411286
lea ecx, [ebp - 0x18]
push str.kwifiband64.dll
push ecx
mov ecx, eax
mov dword [ebp - 4], edi
call fcn.00411d12
pop ecx
pop ecx
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
call fcn.00401a1d
lea ecx, [ebp - 0x20]
call fcn.00411286
lea ecx, [ebp - 0x14]
push str.kwifibandlaunch.exe
push ecx
mov ecx, eax
mov byte [ebp - 4], 4
call fcn.00411d12
mov eax, dword [ebp - 0x20]
pop ecx
pop ecx
add eax, 0xfffffff0
call fcn.00401a1d
push dword [ebp - 0x18]
call esi
test eax, eax
je 0x4671ca
push dword [ebp - 0x14]
call esi
test eax, eax
je 0x4671ca
call fcn.00412fea
cmp eax, 8
je 0x4671b7
call fcn.00412fea
cmp eax, 6
je 0x4671b7
call fcn.00412fea
cmp eax, 0xa
jne 0x4671ca
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.00401a1d
mov eax, dword [ebp - 0x18]
jmp 0x467108
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.00401a1d
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.00401a1d
xor eax, eax
call fcn.00486a9a
ret

Function at 0x4672c8
Capabilities:
Find taskbar

Disassembly:
push esi
push edi
mov edi, eax
lea esi, [edi + 8]
call fcn.0047c1b8
mov eax, dword [edi]
xor esi, esi
cmp eax, esi
je 0x4672fd
push esi
push esi
call eax
push esi
push str.Shell_TrayWnd
mov dword [edi], esi
call dword [0x496788]
push esi
push 0x18
push 0x113
push eax
call dword [0x496864]
mov edi, dword [edi + 4]
cmp edi, esi
je 0x46730b
push edi
call dword [0x4962d4]
pop edi
pop esi
ret

Function at 0x46730e
Capabilities:
Create process on windows
Find taskbar

Disassembly:
push 8
mov eax, 0x49358c
call fcn.004869c2
mov esi, ecx
add esi, 8
call fcn.0047c1b8
xor ebx, ebx
lea ecx, [ebp - 0x14]
call fcn.00411286
lea ecx, [ebp - 0x10]
push str.kwifibandlaunch.exe
push ecx
xor esi, esi
mov ecx, eax
mov dword [ebp - 4], esi
call fcn.00411d12
mov eax, dword [ebp - 0x14]
pop ecx
pop ecx
add eax, 0xfffffff0
call fcn.00401a1d
push esi
push esi
push str._oper:hide
push dword [ebp - 0x10]
push 0x49d1a4
push esi
call dword [0x496728]
push esi
push str.Shell_TrayWnd
call dword [0x496788]
push esi
push 0x18
push 0x113
push eax
call dword [0x496864]
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00401a1d
call fcn.00486a9a
ret
Function at 0x467bcd
Capabilities:
Create process on windows
Shutdown system

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x49419e
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push edi
mov eax, dword [0x4c002c]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
xor ebx, ebx
inc ebx
mov ecx, esi
mov dword [esi + 0x374], ebx
call fcn.00467fa5
mov eax, dword [esi + 0x36c]
xor edi, edi
sub eax, edi
je 0x467ceb
dec eax
je 0x467cdc
dec eax
je 0x467c7e
dec eax
je 0x467c65
dec eax
je 0x467c3b
dec eax
jne 0x467de1
mov edi, esi
call fcn.0046844a
jmp 0x467de1
mov eax, 0x467e96
push edi
push eax
push esi
call fcn.00479137
mov ecx, dword [esi + 0x530]
add esp, 0xc
mov dword [esi + 0x538], eax
push 2
mov eax, esi
call fcn.00467e63
jmp 0x467dea
push 0x4a6db8
call fcn.00411c64
pop ecx
push edi
push 6
call dword [0x4968e8]
jmp 0x467de1
mov dword [esi + 0x570], ebx
xor ebx, ebx
lea ecx, [esp + 0x18]
call fcn.00411286
lea ecx, [esp + 0x14]
push str.kislive.exe
push ecx
mov ecx, eax
mov dword [esp + 0x30], 2
call fcn.00411d12
mov eax, dword [esp + 0x20]
pop ecx
pop ecx
add eax, 0xfffffff0
call fcn.00401a1d
push 1
push edi
push edi
push dword [esp + 0x20]
push 0x49d1a4
push edi
call dword [0x496728]
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
call fcn.00401a1d
inc ebx
jmp 0x467de1
mov edi, str.http:__bbs.duba.net_forum.php_modviewthreadtid22945143page1extrapid10008229
call fcn.0041191a
jmp 0x467de1
lea eax, [esp + 0x10]
mov ecx, esi
call fcn.004746f2
push 0x4a478c
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x30], edi
call fcn.00402d50
test eax, eax
jne 0x467d8a
mov eax, dword [0x4c4f6c]
mov ecx, 0x4c4f6c
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
mov byte [esp + 0x2c], bl
call fcn.00467dfc
test eax, eax
je 0x467d48
push ebx
push edi
push edi
push dword [esp + 0x20]
push 0x49d1a4
push edi
call dword [0x496728]
jmp 0x467d52
mov edi, str.http:__www.drivergenius.com
call fcn.0041191a
push 0x4a47d8
push 0x65
lea eax, [esi + 0x50]
call fcn.0046254c
mov ecx, dword [esi + 0x530]
push 2
mov eax, esi
call fcn.00467e63
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
call fcn.00401a1d
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
call fcn.00401a1d
jmp 0x467dea
push 0x4a47d8
lea eax, [esp + 0x14]
push eax
call fcn.00402d50
test eax, eax
jne 0x467db8
push edi
push edi
push 0x464
push dword [esi + 0x370]
call dword [0x496864]
mov dword [esi + 0x56c], ebx
jmp 0x467dd5
push 0x4a4718
lea eax, [esp + 0x14]
push eax
call fcn.00402d50
test eax, eax
jne 0x467dd5
mov edi, str.http:__www.amazon.cn_gp_search_ieUTF8camp536creative3200indexcomputerskeywordsUSB_E6_97_A0_E7_BA_BF_E7_BD_91_E5_8D_A1linkCodeur2tagkhdhd2_23
call fcn.0041191a
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
call fcn.00401a1d
mov ecx, ebx
mov eax, esi
call fcn.0045b453
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46801e
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push esi
call fcn.00468076
test eax, eax
je 0x468039
lea eax, [esi + 0x378]
jmp 0x46804e
push str.http:__www.drivergenius.com
lea eax, [ebp - 8]
push eax
call fcn.0040f0b9
mov dword [ebp - 4], 1
push 1
push 0
push 0
push dword [eax]
push 0x49d1a4
push 0
call dword [0x496728]
test byte [ebp - 4], 1
je 0x468074
mov eax, dword [ebp - 8]
add eax, 0xfffffff0
call fcn.00401a1d
leave
ret

Function at 0x4681ac
Capabilities:
Create process on windows

Disassembly:
push 4
mov eax, 0x49057d
call fcn.004869c2
mov eax, dword [0x4c4f6c]
mov ecx, 0x4c4f6c
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
call fcn.00467dfc
test eax, eax
mov ebx, dword [ebp - 0x10]
je 0x4681f5
push 1
push 0
push 0
push ebx
push 0x49d1a4
push 0
call dword [0x496728]
jmp 0x4681ff
mov edi, str.http:__www.drivergenius.com
call fcn.0041191a
lea eax, [ebx - 0x10]
call fcn.00401a1d
call fcn.00486a9a
ret

Function at 0x4683a0
Capabilities:
Create process on windows

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x4c002c]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 4
mov eax, 0x491543
call fcn.004869c2
xor esi, esi
push 0x206
lea eax, [ebp + 2]
push esi
push eax
mov word [ebp], si
call fcn.0048635c
add esp, 0xc
lea eax, [ebp]
push eax
push 0x104
call dword [0x496330]
lea eax, [ebp]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.0040f0b9
push str.xp_sp2_patch
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 4], esi
call fcn.00411618
push 1
push esi
push esi
push dword [ebp - 0x10]
push 0x49d1a4
push esi
call dword [0x496728]
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00401a1d
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.004862e5
add ebp, 0x20c
leave
ret

Function at 0x46857c
Capabilities:
Create process on windows

Disassembly:
push esi
push edi
xor edi, edi
mov esi, ecx
mov ecx, dword [eax + 8]
inc edi
cmp ecx, edi
jne 0x468637
mov eax, dword [eax + 0xc]
cmp eax, 0x64
jne 0x4685a2
call fcn.00467b89
mov eax, edi
jmp 0x468640
cmp eax, 0x65
jne 0x4685ae
call fcn.00467bcd
jmp 0x46859b
cmp eax, 0x12d
jne 0x4685bc
call fcn.0046801e
jmp 0x46859b
cmp eax, 0x1f5
jne 0x4685db
push edi
xor eax, eax
push eax
push eax
push str.http:__bbs.duba.net_forum.php_modredirectgotofindpostptid22928934pid9825363
push 0x49d1a4
push eax
call dword [0x496728]
jmp 0x46859b
cmp eax, 0x259
jne 0x4685fe
mov dword [esi + 0x374], 3
mov ecx, esi
call fcn.00467fa5
mov ecx, edi
mov eax, esi
call fcn.0045b453
jmp 0x46859b
cmp eax, 0x2db
jne 0x46860c
call fcn.004683a0
jmp 0x46859b
cmp eax, 0x2dc
je 0x4685f3
cmp eax, 0x141
jne 0x468624
call fcn.004681ac
jmp 0x46859b
cmp eax, 0x396
jne 0x468637
mov dword [esi + 0x374], 5
jmp 0x4685ec
and dword [esi + 0x368], 0
xor eax, eax
pop edi
pop esi
ret
Function at 0x468b6d
Capabilities:
Hide graphical window

Disassembly:
push edi
mov edi, ecx
mov ecx, dword [eax + 8]
cmp ecx, 1
jne 0x468bbe
mov eax, dword [eax + 0xc]
cmp eax, 0x64
jne 0x468b95
push 0
push dword [edi + 4]
call dword [0x496870]
call fcn.00468b24
xor eax, eax
inc eax
pop edi
ret
cmp eax, 0x65
jne 0x468ba3
mov ecx, edi
call fcn.004689a0
jmp 0x468b80
cmp eax, 0x321
jb 0x468bbe
cmp eax, 0x325
ja 0x468bbe
add eax, 0xfffffce0
mov dword [edi + 0x4f0], eax
jmp 0x468b90
and dword [edi + 0x364], 0
xor eax, eax
pop edi
ret

Function at 0x4695cf
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
xor esi, esi
mov ebx, ecx
mov ecx, dword [eax + 8]
inc esi
cmp ecx, esi
push edi
jne 0x4697a6
mov eax, dword [eax + 0xc]
cmp eax, 0x64
jne 0x4695f8
mov edi, ebx
call fcn.0046d87a
mov eax, esi
jmp 0x4697af
cmp eax, 0x63
jne 0x46962e
mov eax, dword [ebx + 0x378]
test eax, eax
mov edi, dword [0x496870]
je 0x469614
push 0
push dword [eax + 4]
call edi
mov eax, dword [ebx + 0x37c]
test eax, eax
je 0x469625
push 0
push dword [eax + 4]
call edi
push 6
push dword [ebx + 4]
call edi
jmp 0x4695f1
cmp eax, 0x69
jne 0x469641
push esi
call fcn.00480b1e
push esi
call fcn.00472fa8
jmp 0x4695f1
cmp eax, 0x6d
jne 0x46964f
mov eax, ebx
call fcn.0046f146
jmp 0x4695f1
cmp eax, 0x8e
jne 0x46965f
mov eax, ebx
call fcn.00471310
jmp 0x4695f1
cmp eax, 0x80
jne 0x46966f
mov eax, ebx
call fcn.00471379
jmp 0x4695f1
cmp eax, 0x60
jne 0x469683
mov esi, ebx
call fcn.00472244
xor eax, eax
inc eax
jmp 0x4697af
cmp eax, 0x61
jne 0x469694
mov edi, ebx
call fcn.00470637
jmp 0x4695f1
cmp eax, 0x25e
jne 0x4696cb
mov eax, ebx
call fcn.00474f04
test eax, eax
je 0x4696ad
mov ecx, ebx
call fcn.0047081b
mov dword [ebx + 0x3edc], esi
mov esi, ebx
call fcn.004713c4
push 0
push 0x64
push 8
push dword [ebx + 4]
call dword [0x496828]
jmp 0x46967b
cmp eax, 0x25d
jne 0x4696f9
mov eax, ebx
call fcn.00474f04
test eax, eax
je 0x4696e4
mov ecx, ebx
call fcn.0047081b
mov dword [ebx + 0x3edc], esi
mov esi, ebx
call fcn.004713c4
push 0
push 0x64
push 7
jmp 0x4696c0
cmp eax, 0x1f5
je 0x469666
cmp eax, 0x8b
jne 0x46971b
push esi
push 0x6e
lea eax, [ebx + 0x50]
call fcn.00445d8a
jmp 0x4695f1
cmp eax, 0xcc
jne 0x469730
mov eax, esi
mov edi, ebx
call fcn.0047079d
jmp 0x4695f1
cmp eax, 0xcd
jne 0x469743
mov ecx, ebx
call fcn.0047081b
jmp 0x4695f1
cmp eax, 0xce
jne 0x469756
mov esi, ebx
call fcn.004713c4
jmp 0x46967b
cmp eax, 0x66
jne 0x469767
mov esi, ebx
call fcn.004715b8
jmp 0x46967b
cmp eax, 0x209
jne 0x469777
push 0
push 0x208
jmp 0x46970e
cmp eax, 0x20a
jne 0x46978a
mov esi, ebx
call fcn.0046f267
jmp 0x46967b
cmp eax, 0x28b
jne 0x4697a6
mov edi, str.http:__www.amazon.cn_gp_search_ieUTF8camp536creative3200indexcomputerskeywordsUSB_E6_97_A0_E7_BA_BF_E7_BD_91_E5_8D_A1linkCodeur2tagkhdhd2_23
call fcn.0041191a
mov dword [ebx + 0x3f78], esi
jmp 0x4695f1
and dword [ebx + 0x370], 0
xor eax, eax
pop edi
pop esi
pop ebx
ret
Function at 0x46ac2e
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push ebx
push edi
call fcn.0046abc1
xor ebx, ebx
inc ebx
test eax, eax
je 0x46ac4d
lea eax, [edi + 0x36c]
jmp 0x46ac5e
push str.http:__www.drivergenius.com
lea eax, [ebp - 8]
push eax
call fcn.0040f0b9
mov dword [ebp - 4], ebx
push ebx
push 0
push 0
push dword [eax]
push 0x49d1a4
push 0
call dword [0x496728]
test byte [ebp - 4], bl
je 0x46ac82
mov eax, dword [ebp - 8]
add eax, 0xfffffff0
call fcn.00401a1d
mov ecx, ebx
mov eax, edi
call fcn.0045b453
pop ebx
leave
ret

Function at 0x46afa4
Capabilities:
Create thread

Disassembly:
push esi
xor esi, esi
cmp dword [0x4f5fc8], esi
je 0x46afb4
xor eax, eax
inc eax
pop esi
ret
call fcn.0046b087
push esi
push esi
push 1
push esi
call dword [0x496204]
cmp eax, esi
mov dword [0x4f5fcc], eax
jne 0x46afd1
xor eax, eax
pop esi
ret
push esi
push esi
push esi
push 0x46b045
push esi
push esi
call dword [0x4964e8]
xor ecx, ecx
add esp, 0x18
cmp eax, esi
setne cl
mov dword [0x4f5fc8], eax
pop esi
mov eax, ecx
ret

Function at 0x46b563
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x2001f
xor esi, esi
and dword [ebp - 4], esi
push esi
push str.SOFTWAREKingsoftAntiVirusKFlag
push 0x80000002
call dword [0x49603c]
test eax, eax
jne 0x46b58e
mov esi, dword [ebp - 4]
mov eax, dword [ebp + 8]
push 4
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
push 4
push 0
push 0x4a53ac
push esi
call dword [0x49601c]
test esi, esi
je 0x46b5b5
push esi
call dword [0x496034]
pop esi
leave
ret
Function at 0x46c047
Capabilities:
Get graphical window text

Disassembly:
push 0x40
mov eax, 0x48e0d3
call fcn.00486a2b
mov eax, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x38], edi
lea ecx, [ebp - 0x44]
push ecx
push 0x46c1c4
push eax
mov dword [ebp - 4], edi
call dword [0x4968f8]
test eax, eax
jne 0x46c08d
cmp dword [ebp - 0x40], edi
je 0x46c086
push dword [ebp - 0x40]
call fcn.00486228
pop ecx
xor eax, eax
jmp 0x46c1bc
mov dword [ebp - 0x34], edi
mov ecx, dword [ebp - 0x40]
cmp ecx, edi
je 0x46c1b9
mov eax, dword [ebp - 0x3c]
mov esi, dword [ebp - 0x34]
sub eax, ecx
sar eax, 2
cmp esi, eax
jae 0x46c1ae
lea ecx, [ebp - 0x2c]
call dword [0x496390]
mov byte [ebp - 4], 1
cmp dword [ebp - 0x40], edi
je 0x46c0cd
mov eax, dword [ebp - 0x3c]
sub eax, dword [ebp - 0x40]
sar eax, 2
cmp esi, eax
jb 0x46c0d3
call dword [0x49652c]
mov eax, dword [ebp - 0x40]
mov esi, dword [eax + esi*4]
push esi
call dword [0x4968a0]
mov edi, eax
test edi, edi
lea ecx, [ebp - 0x2c]
jne 0x46c0f6
push 0x497364
call dword [0x4963a0]
jmp 0x46c120
lea eax, [edi + 2]
push eax
call dword [0x496450]
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x46c10c
lea eax, [ebp - 0x28]
inc edi
push edi
push eax
push esi
call dword [0x4968d0]
push eax
lea ecx, [ebp - 0x2c]
call dword [0x496450]
xor esi, esi
cmp dword [ebp - 0x18], esi
jbe 0x46c197
cmp dword [ebp - 0x40], esi
je 0x46c13a
mov eax, dword [ebp - 0x3c]
sub eax, dword [ebp - 0x40]
sar eax, 2
cmp dword [ebp - 0x34], eax
jb 0x46c140
call dword [0x49652c]
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x34]
mov edi, dword [ebx + 4]
cmp edi, esi
mov eax, dword [eax + ecx*4]
mov dword [ebp - 0x30], eax
je 0x46c15b
mov esi, dword [ebx + 0xc]
sub esi, edi
sar esi, 5
mov eax, ebx
call fcn.0047577f
cmp eax, esi
jae 0x46c179
lea eax, [ebp - 0x30]
push eax
push 1
push dword [ebx + 8]
call fcn.00476eeb
mov dword [ebx + 8], eax
jmp 0x46c197
mov esi, dword [ebx + 8]
cmp edi, esi
jbe 0x46c186
call dword [0x49652c]
push esi
push ebx
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.00476e68
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0
call dword [0x496378]
inc dword [ebp - 0x34]
xor edi, edi
jmp 0x46c090
cmp ecx, edi
je 0x46c1b9
push ecx
call fcn.00486228
pop ecx
xor eax, eax
inc eax
call fcn.00486aae
ret 4

Function at 0x46d748
Capabilities:
Hide graphical window

Disassembly:
push ecx
push esi
mov esi, eax
mov eax, dword [esi + 0x378]
test eax, eax
push edi
mov edi, dword [0x496870]
je 0x46d764
push 0
push dword [eax + 4]
call edi
mov eax, dword [esi + 0x37c]
test eax, eax
je 0x46d775
push 0
push dword [eax + 4]
call edi
push 0
push dword [esi + 4]
call edi
call fcn.004733cd
pop edi
pop esi
pop ecx
ret
Function at 0x46df3c
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
push esi
push edi
push str.SeDebugPrivilege
mov edi, eax
call fcn.00411c64
pop ecx
xor esi, esi
push 0x1388
push dword [esi + 0x4c0140]
call fcn.0047f452
add esi, 4
cmp esi, 0x28
pop ecx
pop ecx
jb 0x46df4e
push 0xc8
call dword [0x4961f0]
call fcn.0046f5dd
test eax, eax
jl 0x46dfa7
lea eax, [edi + 0x544]
push 0x496d9c
push eax
call fcn.0043b191
test eax, eax
pop ecx
pop ecx
je 0x46dfa5
push 0
push 0
push 0x429
push dword [edi + 4]
call dword [0x496818]
xor eax, eax
pop edi
pop esi
pop ecx
ret
Function at 0x4725db
Capabilities:
Hide graphical window
Log keystrokes

Disassembly:
push ebx
push ebp
push edi
call dword [0x4968c4]
mov edi, eax
call dword [0x496278]
push 0
push edi
mov ebx, eax
call dword [0x4968c0]
mov edi, dword [0x4968bc]
push 1
mov ebp, eax
push ebp
push ebx
call edi
push 9
push dword [esi + 4]
call dword [0x496870]
push dword [esi + 4]
call dword [0x49686c]
push dword [esi + 4]
call dword [0x496868]
push 0
push ebp
push ebx
call edi
push 0
push 1
push 0x41e
push dword [esi + 4]
call dword [0x496864]
pop edi
pop ebp
pop ebx
ret

Function at 0x472b94
Capabilities:
Hide graphical window

Disassembly:
push ecx
push edi
mov edi, eax
mov eax, dword [edi + 0x3b34]
push 0
push dword [eax + 4]
call dword [0x496870]
mov eax, dword [esp + 0xc]
sub eax, 0
je 0x472be0
dec eax
je 0x472bbc
dec eax
jne 0x472be7
push 0xd
jmp 0x472be2
push 0xc
call fcn.0047263e
push 2
mov ecx, edi
call fcn.00471716
push str.wifiautorun
call fcn.0047bc2d
pop ecx
mov eax, edi
call fcn.0046d785
jmp 0x472be7
push 0xe
call fcn.0047263e
xor eax, eax
pop edi
pop ecx
ret 4

Function at 0x472eba
Capabilities:
Hide graphical window

Disassembly:
push esi
push edi
mov edi, eax
call fcn.00472b3b
mov eax, dword [edi + 0x3b34]
test eax, eax
je 0x472ed8
push 0
push dword [eax + 4]
call dword [0x496870]
mov esi, dword [edi + 0x3b2c]
test esi, esi
je 0x472ee7
call fcn.0046225a
mov esi, dword [edi + 0x3b28]
test esi, esi
je 0x472ef6
call fcn.0046225a
pop edi
pop esi
ret

Function at 0x47373f
Capabilities:
Hide graphical window

Disassembly:
push ebx
push ebp
push edi
mov eax, esi
call fcn.00473852
call fcn.0046aff4
mov eax, esi
call fcn.00472eba
mov eax, dword [esi + 0x380]
test eax, eax
mov ebp, dword [0x4968d4]
mov edi, dword [0x496838]
je 0x473792
push dword [eax + 4]
call ebp
test eax, eax
je 0x473792
mov eax, dword [esi + 0x380]
add eax, 4
push dword [eax]
call edi
test eax, eax
je 0x473792
mov eax, dword [esi + 0x380]
xor ecx, ecx
call fcn.0045b453
mov eax, dword [esi + 0x3ec8]
test eax, eax
je 0x4737c3
push dword [eax + 4]
call ebp
test eax, eax
je 0x4737c3
mov eax, dword [esi + 0x3ec8]
add eax, 4
push dword [eax]
call edi
test eax, eax
je 0x4737c3
mov eax, dword [esi + 0x3ec8]
xor ecx, ecx
call fcn.0045b453
push dword [esi + 0x3b60]
call edi
test eax, eax
je 0x4737dd
push 2
lea eax, [esi + 0x3b5c]
pop ecx
call fcn.0045b453
mov ebx, dword [0x496870]
lea edi, [esi + 0x378]
mov eax, dword [edi]
test eax, eax
je 0x473801
push dword [eax + 4]
call ebp
test eax, eax
je 0x473801
mov eax, dword [edi]
push 0
push dword [eax + 4]
call ebx
lea edi, [esi + 0x37c]
mov eax, dword [edi]
test eax, eax
je 0x47381f
push dword [eax + 4]
call ebp
test eax, eax
je 0x47381f
mov eax, dword [edi]
push 0
push dword [eax + 4]
call ebx
call fcn.0046aff4
push 0
push dword [esi + 4]
call ebx
mov edi, dword [0x49683c]
push 0x1a
push dword [esi + 4]
call edi
push 0x1e
push dword [esi + 4]
call edi
push 0
call dword [0x4962c0]
push eax
call dword [0x496310]
pop edi
pop ebp
pop ebx
ret