joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40947d
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
and dword [ebp - 4], 0
xor eax, eax
cmp byte [ebp + 0xc], al
push esi
sete al
lea ecx, [ebp - 8]
dec eax
and eax, 0x100
add eax, 0x20006
push eax
push str.softwareclassesCLSIDD5E8041D_920F_45e9_B8FB_B1DEB82C6E5E
push dword [ebp + 8]
call fcn.004060f7
mov esi, eax
test esi, esi
jne 0x4094c6
push str.TreatAs
push dword [ebp - 8]
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov esi, eax
lea ecx, [ebp - 8]
call fcn.00406119
mov eax, esi
pop esi
leave
ret

Function at 0x4095bd
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x10]
push esi
xor esi, esi
mov dword [edi], esi
mov dword [ebx], esi
mov dword [eax], esi
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
mov dword [ebp - 0x14], 1
call sub.VERSION.dll_GetFileVersionInfoSizeW
cmp eax, esi
je 0x40969e
inc eax
inc eax
mov dword [ebp - 8], eax
add eax, eax
cmp eax, esi
je 0x40969e
push eax
call fcn.0052f69b
pop ecx
mov dword [ebp - 4], eax
cmp eax, esi
je 0x40969e
mov eax, dword [ebp - 8]
add eax, eax
push eax
push esi
push dword [ebp - 4]
call fcn.00537010
add esp, 0xc
push dword [ebp - 4]
push dword [ebp - 8]
push esi
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x409695
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x57c664
push dword [ebp - 4]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x409695
mov eax, dword [ebp - 0xc]
cmp eax, esi
je 0x409695
mov ecx, dword [ebp - 8]
cmp dword [ebp - 0x10], ecx
jae 0x409695
mov ecx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov esi, dword [ebp + 0xc]
push dword [ebp - 4]
mov edx, ecx
shr edx, 0x10
mov dword [esi], edx
mov edx, dword [ebp + 0x10]
movzx ecx, cx
mov dword [edx], ecx
mov ecx, eax
movzx eax, ax
shr ecx, 0x10
mov dword [ebx], ecx
mov dword [edi], eax
call fcn.0052f7c5
xor eax, eax
pop ecx
inc eax
jmp 0x4096a0
push dword [ebp - 4]
call fcn.0052f7c5
pop ecx
xor eax, eax
pop esi
leave
ret
Function at 0x4096a3
Capabilities:
Check if file exists
Get common file path
Get program files directory

Disassembly:
push 0x27c
mov eax, 0x55f51d
call fcn.00539a44
xor eax, eax
push 0x206
mov word [ebp - 0x218], ax
xor ebx, ebx
lea eax, [ebp - 0x216]
push ebx
push eax
call fcn.00537010
add esp, 0xc
push ebx
push 0x26
lea eax, [ebp - 0x218]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x409845
lea edi, [ebp - 0x218]
dec edi
dec edi
mov ax, word [edi + 2]
inc edi
inc edi
cmp ax, bx
jne 0x4096f3
push 0x10
pop ecx
lea eax, [ebp - 0x218]
mov esi, str.internet_exploreriexplore.exe
push eax
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x409845
push ebx
lea ecx, [ebp - 0x234]
mov dword [ebp - 0x21c], 7
call fcn.004056b6
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x250]
mov dword [ebp - 4], ebx
call fcn.0040a8b0
lea eax, [ebp - 0x260]
push eax
mov byte [ebp - 4], 1
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x218]
mov dword [ebp - 0x25c], ebx
mov dword [ebp - 0x260], ebx
mov dword [ebp - 0x258], ebx
mov dword [ebp - 0x254], ebx
push eax
lea edi, [ebp - 0x254]
lea ebx, [ebp - 0x258]
call fcn.004095bd
add esp, 0xc
xor esi, esi
test eax, eax
je 0x409829
mov ecx, dword [ebp - 0x25c]
mov dword [ebp - 0x270], ecx
mov ecx, dword [ebp - 0x260]
mov dword [ebp - 0x26c], ecx
mov ecx, dword [ebp - 0x258]
mov dword [ebp - 0x268], ecx
mov ecx, dword [ebp - 0x254]
mov eax, 0x57d3a0
mov dword [ebp - 0x274], eax
mov dword [ebp - 0x264], ecx
mov dword [ebp - 0x288], eax
lea eax, [ebp - 0x274]
lea ecx, [ebp - 0x288]
mov dword [ebp - 0x284], 0xa
mov dword [ebp - 0x280], esi
mov dword [ebp - 0x27c], esi
mov dword [ebp - 0x278], esi
call fcn.0040a860
test al, al
jne 0x409829
push esi
push 1
lea ecx, [ebp - 0x250]
call fcn.004053e5
push esi
push 1
lea ecx, [ebp - 0x234]
call fcn.004053e5
mov al, 1
jmp 0x409847
push esi
push 1
lea ecx, [ebp - 0x250]
call fcn.004053e5
push esi
push 1
lea ecx, [ebp - 0x234]
call fcn.004053e5
xor al, al
call fcn.00539ac7
ret
Function at 0x40984d
Capabilities:
Delete registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x5afee0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
call fcn.00409918
call fcn.004a418b
mov ebx, eax
dec ebx
neg ebx
sbb bl, bl
inc bl
mov byte [ebp - 0xc], bl
call fcn.004096a3
mov byte [ebp - 8], al
push dword [ebp - 8]
push 0
push dword [ebp - 0xc]
call fcn.0040a75b
test bl, bl
je 0x4098a5
call fcn.00407346
cmp eax, 5
jl 0x4098a5
push dword [ebp - 8]
push 1
push dword [ebp - 0xc]
call fcn.0040a75b
mov ecx, str.IEXPLORE.EXE
mov eax, ecx
lea esi, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x4098af
sub eax, esi
sar eax, 1
add eax, eax
push eax
push ecx
push 1
push 0x577458
mov esi, str.SOFTWAREClientsStartMenuInternet
push esi
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push esi
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
call fcn.00409b7f
call fcn.004a4132
test eax, eax
je 0x40990a
call fcn.00407346
push edi
cmp eax, 7
jne 0x409905
call fcn.0040a1da
jmp 0x40990a
call fcn.00409dfa
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0052f7d0
leave
ret
Function at 0x409918
Capabilities:
Delete registry value
Persist via default file association registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x638
mov eax, dword [0x5afee0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor eax, eax
push esi
push edi
cmp ax, word [0x5d94d0]
jne 0x409942
call fcn.0040a542
mov edi, eax
jmp 0x409947
mov edi, 0x5d94d0
xor eax, eax
mov esi, 0x206
push esi
push eax
mov word [ebp - 0x628], ax
lea eax, [ebp - 0x626]
push eax
call fcn.00537010
xor eax, eax
push esi
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call fcn.00537010
push edi
push str.__s_____1_
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.00532a01
push str.IEXPLORE.EXE
push str.SOFTWAREClientsStartMenuInternet
push 0x57c6a4
lea eax, [ebp - 0x628]
push 0x103
push eax
call fcn.00532a01
add esp, 0x3c
push str.LocalizedString
lea eax, [ebp - 0x628]
push eax
mov ebx, 0x80000002
push ebx
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
lea eax, [ebp - 0x218]
push eax
mov ecx, str.htmlfile_shell
call fcn.0040a41c
lea eax, [ebp - 0x218]
push eax
mov ecx, str.InternetShortcut_shell
call fcn.0040a41c
lea eax, [ebp - 0x218]
push eax
mov ecx, str.mhtmlfile_shell
call fcn.0040a41c
lea eax, [ebp - 0x218]
push eax
mov ecx, str.IE.AssocFile.HTM_shell
call fcn.0040a41c
lea eax, [ebp - 0x218]
push eax
mov ecx, str.IE.AssocFile.XHT_shell
call fcn.0040a41c
lea eax, [ebp - 0x218]
push eax
mov ecx, str.IE.AssocFile.MHT_shell
call fcn.0040a41c
lea eax, [ebp - 0x218]
push eax
mov ecx, str.IE.AssocFile.HTML_shell
call fcn.0040a41c
call fcn.00406d95
cmp dword [eax], 3
jl 0x409b70
and dword [ebp - 0x62c], 0
mov esi, str.open
lea edi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov dword [ebp - fcn.00450049], str.IE.FTP
mov dword [ebp - fcn.00450049], str.IE.HTTP
mov dword [ebp - fcn.00450049], str.IE.HTTPS
mov edi, 0x577458
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x420], ax
lea eax, [ebp - 0x41e]
push eax
call fcn.00537010
mov eax, dword [ebp - 0x62c]
push dword [ebp + eax*4 - 0x638]
lea eax, [ebp - 0x420]
push str.SoftwareClasses_s_shell
push 0x104
push eax
call fcn.00407467
lea eax, [ebp - 0x10]
add esp, 0x1c
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x409ad4
sub eax, ecx
sar eax, 1
add eax, eax
push eax
lea eax, [ebp - 0x10]
push eax
push 1
push edi
lea eax, [ebp - 0x420]
push eax
push ebx
call esi
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.00537010
mov eax, dword [ebp - 0x62c]
push dword [ebp + eax*4 - 0x638]
lea eax, [ebp - 0x420]
push str.SoftwareClasses_s_shellopencommand
push 0x104
push eax
call fcn.00407467
lea eax, [ebp - 0x218]
add esp, 0x1c
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x409b38
sub eax, ecx
sar eax, 1
add eax, eax
push eax
lea eax, [ebp - 0x218]
push eax
push 1
push edi
lea eax, [ebp - 0x420]
push eax
push ebx
call esi
inc dword [ebp - 0x62c]
cmp dword [ebp - 0x62c], 3
jb 0x409a8d
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0052f7d0
leave
ret
Function at 0x40a41c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x5afee0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
mov ecx, str.open
mov dword [ebp - 0x210], eax
mov eax, ecx
push edi
mov dword [ebp - 0x214], esi
lea edx, [eax + 2]
mov di, word [eax]
inc eax
inc eax
test di, di
jne 0x40a44d
mov ebx, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
sub eax, edx
sar eax, 1
add eax, eax
push eax
push ecx
push 1
push 0x577458
push esi
push 0x80000000
call ebx
lea eax, [ebp - 0x20c]
mov ecx, esi
sub eax, esi
movzx edx, word [ecx]
mov word [eax + ecx], dx
inc ecx
inc ecx
test dx, dx
jne 0x40a47e
lea edi, [ebp - 0x20c]
dec edi
dec edi
mov ax, word [edi + 2]
inc edi
inc edi
test ax, ax
jne 0x40a494
mov eax, dword [ebp - 0x210]
push 7
pop ecx
mov esi, str.opencommand
rep movsd dword es:[edi], dword [esi]
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x40a4b2
sub eax, ecx
sar eax, 1
add eax, eax
push eax
push dword [ebp - 0x210]
mov edi, 0x577458
push 1
push edi
lea eax, [ebp - 0x20c]
push eax
mov esi, 0x80000000
push esi
call ebx
push str.open
push dword [ebp - 0x214]
lea eax, [ebp - 0x20c]
push str._s_scommand
push 0x104
push eax
call fcn.00532a01
mov eax, dword [ebp - 0x210]
add esp, 0x14
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x40a50d
sub eax, ecx
sar eax, 1
add eax, eax
push eax
push dword [ebp - 0x210]
lea eax, [ebp - 0x20c]
push 1
push edi
push eax
push esi
call ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0052f7d0
leave
ret 4

Function at 0x40a542
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebx
push esi
push edi
push 0
push 0x26
mov ebx, 0x5d94d0
push ebx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov edi, ebx
dec edi
dec edi
mov ax, word [edi + 2]
inc edi
inc edi
test ax, ax
jne 0x40a55b
push 0x10
pop ecx
mov esi, str.internet_exploreriexplore.exe
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, ebx
pop ebx
ret
Function at 0x40ac9b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x32c
mov eax, dword [0x5afee0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x320], eax
mov eax, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x31c], eax
xor eax, eax
push 0x7e
mov word [ebp - 0x108], ax
xor edi, edi
lea eax, [ebp - 0x106]
push edi
push eax
call fcn.00537010
add esp, 0xc
push edi
lea eax, [ebp - 0x108]
push 0x40
push eax
call fcn.0049a6b7
add esp, 0xc
xor eax, eax
push 0x7e
mov word [ebp - 0x88], ax
lea eax, [ebp - 0x86]
push edi
push eax
call fcn.00537010
add esp, 0xc
lea eax, [ebp - 0x328]
push eax
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x324]
push eax
push 0x57d2d0
push str.Software_shouxin
push 0x80000001
mov dword [ebp - 0x324], 1
mov dword [ebp - 0x328], 0x7e
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x40ad56
cmp word [ebp - 0x88], di
jne 0x40ad71
push 0x57d2fc
push 0x57cb68
lea eax, [ebp - 0x88]
push 0x3c
push eax
call fcn.00532a01
add esp, 0x10
xor eax, eax
push 0x208
mov word [ebp - 0x318], ax
lea eax, [ebp - 0x316]
push edi
push eax
call fcn.00537010
add esp, 0xc
call fcn.0040ae0a
push eax
push str.0__d
push 0x105
lea edi, [ebp - 0x318]
call fcn.00403d4f
xor eax, eax
add esp, 0xc
cmp ax, word [0x5db980]
jne 0x40adbf
call fcn.00412ed1
jmp 0x40adc4
mov eax, 0x5db980
lea ecx, [ebp - 0x318]
push ecx
push dword [ebp - 0x320]
push eax
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x108]
push eax
push str.http:__ie.xinshuru.com_inst.htm_mid_spid_sver_stype_sto_s
push 0x823
push dword [ebp - 0x31c]
call fcn.00532a01
mov ecx, dword [ebp - 4]
add esp, 0x20
xor eax, eax
xor ecx, ebp
inc eax
pop edi
call fcn.0052f7d0
leave
ret 8

Function at 0x40ae0a
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x5afee0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x110
lea eax, [ebp - 0x114]
push 0
push eax
mov dword [ebp - 0x118], 0x114
call fcn.00537010
add esp, 0xc
push 5
pop esi
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x40aeeb
cmp dword [ebp - 0x108], 2
jne 0x40aeeb
cmp dword [ebp - 0x114], esi
jne 0x40ae8c
cmp dword [ebp - 0x110], 0
je 0x40aeeb
xor eax, eax
inc eax
cmp dword [ebp - 0x110], eax
je 0x40ae88
cmp dword [ebp - 0x110], 2
jne 0x40aeeb
mov esi, eax
jmp 0x40aeeb
cmp dword [ebp - 0x114], 6
jne 0x40aee6
xor eax, eax
inc eax
mov dword [0x5d7890], eax
mov dword [0x5d7878], eax
mov dword [0x5d787c], eax
cmp dword [ebp - 0x110], eax
jne 0x40aeb2
push 2
pop esi
jbe 0x40aeeb
push 3
pop esi
push str.RtlGetVersion
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40aeeb
lea ecx, [ebp - 0x22c]
push ecx
call eax
cmp dword [ebp - 0x228], 0xa
jne 0x40aeeb
jmp 0x40aee8
jbe 0x40aeeb
push 4
pop esi
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0052f7d0
leave
ret
Function at 0x410627
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
xor edi, edi
push edi
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
push 0x58
push esi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push esi
push edi
call dword [sym.imp.USER32.dll_ReleaseDC]
call fcn.0042f966
push fcn.004313f7
call dword [0x5d8f4c]
lea eax, [ebp - 4]
push eax
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
cmp esi, edi
je 0x4106d8
cmp dword [ebp - 4], 4
jne 0x4106d8
push str.ExcptionHandler
push dword [esi + 4]
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x4106d8
push ebx
push 0x10
push edi
push dword [esi + 0xc]
call fcn.00533495
push 0x10
push edi
push dword [esi + 8]
mov ebx, eax
call fcn.00533495
add esp, 0x18
push str.578C05B0_1349_4845_A564_1719E315304D
push edi
push edi
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
push ebx
push dword [ebp - 8]
mov edi, eax
call fcn.0043151a
pop ecx
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
pop ebx
jmp 0x4106ea
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
call fcn.00410fb7
neg eax
sbb eax, eax
neg eax
pop edi
pop esi
leave
ret

Function at 0x410754
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2094
call fcn.005482e0
mov eax, dword [0x5afee0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x5d98e4], 0
je 0x41077e
mov eax, 0x5d98e8
jmp 0x410880
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push 0x5c
push 0x5d8044
mov esi, eax
call fcn.00532331
push esi
push 0x57cb68
mov ebx, eax
lea eax, [ebp - 0x2094]
push 0x1047
push eax
call fcn.00532a01
mov edi, dword [sym.imp.SHLWAPI.dll_StrStrIW]
add esp, 0x18
push ebx
lea eax, [ebp - 0x2094]
push eax
call edi
test eax, eax
je 0x4107df
mov ecx, ebx
lea esi, [ecx + 2]
mov dx, word [ecx]
inc ecx
inc ecx
test dx, dx
jne 0x4107ca
sub ecx, esi
sar ecx, 1
lea esi, [eax + ecx*2]
test esi, esi
jne 0x41080a
add ebx, 2
push ebx
lea eax, [ebp - 0x2094]
push eax
call edi
test eax, eax
je 0x41086c
mov ecx, ebx
lea esi, [ecx + 2]
mov dx, word [ecx]
inc ecx
inc ecx
test dx, dx
jne 0x4107f5
sub ecx, esi
sar ecx, 1
lea esi, [eax + ecx*2]
test esi, esi
je 0x41086c
push 0x57da30
push esi
call edi
test eax, eax
je 0x41081b
lea esi, [eax + 4]
jmp 0x410832
push 2
push 0x57da38
push esi
call fcn.005334c1
add esp, 0xc
test eax, eax
jne 0x410832
add esi, 4
cmp word [esi], 0
je 0x41086c
push esi
push 0x57cb68
push 0x1047
mov ebx, 0x5d98e8
push ebx
call fcn.00532a01
xor eax, eax
add esp, 0x10
mov word [0x5db976], ax
call fcn.004a3522
mov eax, ebx
call fcn.004a3974
call fcn.004a3522
jmp 0x410871
mov ebx, 0x5d98e8
pop edi
pop esi
mov eax, ebx
mov dword [0x5d98e4], 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052f7d0
leave
ret
Function at 0x410dc2
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x5afee0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x5d8044
push str._s.klautoupdate
lea eax, [ebp - 0x20c]
push 0x103
push eax
call fcn.00532a01
lea eax, [ebp - 0x20c]
push eax
call fcn.00496736
add esp, 0x14
lea eax, [ebp - 0x20c]
call fcn.004a35de
lea eax, [ebp - 0x20c]
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
test eax, eax
je 0x410e31
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x410e31
xor eax, eax
inc eax
jmp 0x410e33
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052f7d0
leave
ret

Function at 0x410e3f
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x5afee0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x5d8044
push str._s.klutil
lea eax, [ebp - 0x20c]
push 0x103
push eax
call fcn.00532a01
lea eax, [ebp - 0x20c]
push eax
call fcn.00496736
add esp, 0x14
lea eax, [ebp - 0x20c]
call fcn.004a35de
lea eax, [ebp - 0x20c]
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
test eax, eax
je 0x410eae
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x410eae
xor eax, eax
inc eax
jmp 0x410eb0
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052f7d0
leave
ret

Function at 0x410ebc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x5afee0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
cmp edi, esi
je 0x410f41
cmp word [edi], si
je 0x410f41
cmp dword [0x5d787c], esi
jne 0x410f41
xor eax, eax
push 0x206
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push esi
push eax
call fcn.00537010
add esp, 0xc
push esi
push 0x28
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x410f1b
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.005330a4
add esp, 0xc
neg eax
sbb eax, eax
inc eax
jmp 0x410f44
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0052f7d0
leave
ret

Function at 0x410f51
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x5afee0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x57d2fc
push str._s.uninstall
lea eax, [ebp - 0x20c]
push 0x103
push eax
call fcn.00532a01
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
test eax, eax
je 0x410fa9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x410fa9
xor eax, eax
inc eax
jmp 0x410fab
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052f7d0
leave
ret
Function at 0x411ca0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
mov eax, dword [0x5afee0]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.00537010
push edi
push 0x57dcd8
lea eax, [ebp - 0x20c]
push 0x103
push eax
call fcn.00532a01
push 0x38
lea eax, [ebp - 0x244]
push 0
push eax
mov dword [ebp - 0x248], 0x3c
call fcn.00537010
and dword [ebp - 0x240], 0
or dword [ebp - 0x244], 0x40
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x234], eax
add esp, 0x28
lea eax, [ebp - 0x248]
push eax
mov dword [ebp - 0x23c], str.runas
mov dword [ebp - 0x238], 0x5d8044
mov dword [ebp - 0x22c], 5
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x411d55
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
jmp 0x411d6d
cmp dword [ebp - 0x210], 0
je 0x411d6a
push dword [ebp - 0x210]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052f7d0
leave
ret
Function at 0x4124c1
Capabilities:
Create thread
Delete registry value
Resume thread
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
call fcn.00412442
xor edi, edi
push edi
call dword [sym.imp.ole32.dll_OleInitialize]
call fcn.004422df
mov esi, eax
cmp dword [esi + 0x14], edi
jne 0x412531
mov ebx, dword [sym.imp.KERNEL32.dll_CreateEventW]
push edi
push edi
push 1
push edi
call ebx
push edi
push edi
push 1
push edi
mov dword [esi], eax
call ebx
mov dword [esi + 8], eax
lea eax, [esi + 0x10]
push eax
push 4
push esi
push 0x442423
push edi
push edi
call fcn.0053364a
add esp, 0x18
mov dword [esi + 0xc], eax
cmp eax, edi
je 0x41252a
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [esi + 0x14], 1
call fcn.00412e3d
push eax
push 0x5d824c
push dword [ebp + 8]
call fcn.00442b81
mov esi, eax
call fcn.00442bbc
call fcn.0047c0e1
call fcn.0047c4f6
call fcn.00413ac4
call fcn.00434521
mov ebx, eax
cmp ebx, edi
je 0x412581
push 1
call fcn.004aad5d
mov esi, eax
call fcn.004aad98
push dword [ebp + 8]
call fcn.0041271b
push ebx
call fcn.00434a3d
push 4
lea eax, [ebp - 4]
push eax
push 4
push str.firstrun
mov ebx, str.Software_shouxin
push ebx
mov esi, 0x80000001
push esi
mov dword [ebp - 4], edi
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push str.firstsetdef
push ebx
push esi
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
call fcn.0041088c
mov ebx, dword [sym.imp.USER32.dll_IsWindow]
mov esi, eax
push esi
call ebx
test eax, eax
je 0x4125e9
lea eax, [ebp + 8]
push eax
push esi
mov dword [ebp + 8], edi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_AllowSetForegroundWindow]
push edi
push edi
push 0x502
push esi
call dword [sym.imp.USER32.dll_PostMessageW]
call fcn.00442b81
mov esi, eax
push dword [esi + 4]
call ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x41261f
push edi
push edi
push 0x10
push dword [esi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
push 0x7d0
push dword [esi + 0x24]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esi + 0x24]
call ebx
push 1
call fcn.00443521
mov eax, dword [0x5d7ff4]
pop ecx
cmp eax, edi
je 0x412639
push eax
call ebx
mov dword [0x5d7ff4], edi
mov eax, dword [0x5d8000]
cmp eax, edi
je 0x412657
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push dword [0x5d8000]
call ebx
mov dword [0x5d8000], edi
call dword [sym.imp.ole32.dll_OleUninitialize]
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
leave
ret 4