joyce8/EMBER2024-capa huggingface dataset:
Function at 0x424df7
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
and word [ebp - 0x208], 0
push esi
push 0x206
mov esi, eax
lea eax, [ebp - 0x206]
push 0
push eax
call fcn.004883c0
add esp, 0xc
mov ecx, 0x4db494
call fcn.004016a0
lea eax, [ebp - 0x208]
push eax
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
test eax, eax
je 0x424e70
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea eax, [ebp - 0x208]
push eax
push esi
call fcn.00401aed
push str.kantivirusTemp_
push esi
call fcn.00405235
push dword [esi]
call fcn.0042291d
pop ecx
jmp 0x424e75
call fcn.004015cc
mov eax, esi
pop esi
leave
ret

Function at 0x425007
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push esi
push edi
push str.2012.sp3.0
mov eax, ebx
call fcn.00401989
and word [ebp - 0x210], 0
push 0x206
lea eax, [ebp - 0x20e]
push 0
push eax
call fcn.004883c0
mov eax, dword [0x4dc6ec]
add eax, 0xfffffff0
call fcn.00401648
lea esi, [eax + 0x10]
push str.ressrcchsuplive.svr
lea eax, [ebp - 8]
lea ecx, [ebp - 4]
mov dword [ebp - 8], esi
call fcn.0041dccb
add esp, 0x10
push dword [eax]
lea eax, [ebp - 0x210]
push 0x208
push eax
push str.2012.3.0
push str.Version
push str.common
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringW]
mov edi, eax
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.0040151c
lea eax, [esi - 0x10]
call fcn.0040151c
test edi, edi
pop edi
pop esi
jle 0x4250aa
lea eax, [ebp - 0x210]
push eax
push ebx
call fcn.00401aed
mov eax, ebx
call fcn.00405111
push 0x4b67bc
push 0x4b69f4
push ebx
call fcn.00404f9c
mov eax, ebx
leave
ret
Function at 0x4250c5
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x284
push ebx
push esi
push edi
xor edi, edi
push 0x228
lea eax, [ebp - 0x27c]
push edi
push eax
mov dword [ebp - 4], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x280], edi
call fcn.004883c0
mov eax, dword [0x4db494]
add esp, 0xc
mov ecx, 0x4db494
call dword [eax + 0xc]
mov ebx, eax
add ebx, 0x10
lea esi, [ebp - 0x4c]
mov dword [ebp - 8], ebx
call fcn.00447f94
push edi
push 2
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x425266
lea eax, [ebp - 0x280]
push eax
push esi
mov dword [ebp - 0x280], 0x22c
call sub.KERNEL32.DLL_Process32FirstW
test eax, eax
je 0x42525f
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x278]
cmp eax, dword [ebp - 0x18]
je 0x425244
cmp eax, edi
je 0x425244
cmp eax, 4
je 0x425244
lea eax, [ebp - 0x25c]
push str.LdTermDaemon.exe
push eax
call fcn.004892cf
test eax, eax
pop ecx
pop ecx
jne 0x425244
push dword [ebp - 0x278]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x4c]
push eax
call fcn.00447fdb
lea edi, [ebp - 8]
call fcn.0040206d
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.0040151c
mov ebx, dword [ebp - 8]
cmp dword [ebx - 0xc], 0
je 0x425244
mov eax, edi
call fcn.00422761
xor edi, edi
inc edi
or dword [ebp - 4], edi
push str.LdTerm.exe
lea eax, [ebp - 8]
lea ecx, [ebp - 0x14]
call fcn.0041dccb
mov eax, dword [eax]
pop ecx
push 0
push eax
call fcn.0048a568
test eax, eax
pop ecx
pop ecx
jne 0x425211
or dword [ebp - 4], 2
push str.LdxManager.exe
lea eax, [ebp - 8]
lea ecx, [ebp - 0x1c]
call fcn.0041dccb
mov eax, dword [eax]
pop ecx
push 0
push eax
call fcn.0048a568
test eax, eax
pop ecx
pop ecx
jne 0x425211
mov bl, 1
jmp 0x425213
xor bl, bl
test byte [ebp - 4], 2
je 0x425228
mov eax, dword [ebp - 0x1c]
and dword [ebp - 4], 0xfffffffd
add eax, 0xfffffff0
call fcn.0040151c
test byte [ebp - 4], 1
je 0x42523d
mov eax, dword [ebp - 0x14]
and dword [ebp - 4], 0xfffffffe
add eax, 0xfffffff0
call fcn.0040151c
test bl, bl
mov ebx, dword [ebp - 8]
jne 0x42525c
lea eax, [ebp - 0x280]
push eax
push esi
call sub.KERNEL32.DLL_Process32NextW
test eax, eax
je 0x42525f
xor edi, edi
jmp 0x42514c
mov dword [ebp - 0xc], edi
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
lea edi, [ebp - 0x4c]
call fcn.00447fc9
lea eax, [ebx - 0x10]
call fcn.0040151c
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4254a5
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push esi
push edi
xor edi, edi
push edi
xor esi, esi
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
mov dword [ebp - 4], edi
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
push 0x206
lea eax, [ebp - 0x216]
push edi
push eax
mov word [ebp - 0x218], di
call fcn.004883c0
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 4]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
lea eax, [ebp - 0x218]
push eax
call fcn.004886c1
test eax, eax
pop ecx
je 0x42559e
mov eax, dword [0x4db494]
mov edi, 0x4db494
push ebx
mov ecx, edi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0xc], eax
push 0x4bb954
lea eax, [ebp - 0x218]
push eax
mov esi, str._s_s.lnk
lea eax, [ebp - 0xc]
push esi
push eax
call fcn.0041dcb8
mov eax, dword [0x4db494]
add esp, 0x10
mov ecx, edi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
push 0x4bb978
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x10]
push esi
push eax
call fcn.0041dcb8
mov edi, dword [ebp - 0xc]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0x10
push edi
call esi
test eax, eax
mov ebx, dword [ebp - 0x10]
jne 0x425588
push ebx
call esi
test eax, eax
jne 0x425588
xor esi, esi
jmp 0x42558b
xor esi, esi
inc esi
lea eax, [ebx - 0x10]
call fcn.0040151c
lea eax, [edi - 0x10]
call fcn.0040151c
xor edi, edi
pop ebx
lea eax, [ebp - 8]
push eax
mov dword [ebp - 8], edi
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jl 0x4255bb
mov eax, dword [ebp - 8]
push dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [ebp - 8]
cmp eax, edi
je 0x4255ce
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
pop edi
mov eax, esi
pop esi
leave
ret
Function at 0x42ab52
Capabilities:
Initialize winsock library

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, eax
lea ebp, [edi + 4]
lea esi, [ebp + 0x10]
call fcn.00437fda
lea esi, [ebp + 0x28]
call fcn.00437fda
or dword [ebp + 0x40], 0xffffffff
xor ebx, ebx
mov dword [ebp], 1
mov dword [ebp + 0xc], ebx
mov dword [ebp + 8], ebx
mov dword [ebp + 4], ebx
mov byte [ebp + 0x44], bl
mov dword [ebp + 0x48], ebx
mov dword [ebp + 0x4c], 0x2710
cmp dword [0x4db218], ebx
je 0x42aba8
push 0x4db088
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [0x4db218], eax
fld dword [0x4c6320]
lea esi, [edi + 0x54]
mov dword [edi], vtable.ATL::CAtlHttpClientT_class_ATL::ZEvtSyncSocket_.0
fstp dword [esi + 0xc]
fld dword [0x4c6324]
or dword [esi + 0x18], 0xffffffff
fstp dword [esi + 0x10]
mov dword [esi], ebx
fld dword [0x4c6328]
mov dword [esi + 4], ebx
fstp dword [esi + 0x14]
mov dword [esi + 8], 0x11
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], 0xa
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
call fcn.00408064
fld dword [0x4c6320]
lea esi, [edi + 0x84]
or dword [esi + 0x18], 0xffffffff
fstp dword [esi + 0xc]
fld dword [0x4c6324]
mov dword [esi], ebx
fstp dword [esi + 0x10]
mov dword [esi + 4], ebx
fld dword [0x4c6328]
mov dword [esi + 8], 0x11
fstp dword [esi + 0x14]
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], 0xa
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
call fcn.00408064
lea eax, [edi + 0xb4]
lea esi, [edi + 0xc8]
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
call fcn.004303fd
lea esi, [edi + 0x10d8]
call fcn.004216bc
lea esi, [edi + 0x3544]
mov ecx, 0x4db494
call fcn.004016a0
lea esi, [edi + 0x3548]
mov ecx, 0x4db494
call fcn.004016a0
mov esi, ebp
call fcn.0042220f
call fcn.00431ed2
mov dword [edi + 0xc4], ebx
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x437ef1
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [ecx]
push ebx
push esi
push edi
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0xc]
push ecx
push 0x2001f
xor esi, esi
push esi
push dword [ebp + 8]
mov dword [ebp - 8], esi
push eax
mov dword [ebp - 0xc], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, eax
cmp edi, esi
jne 0x437fb8
xor eax, eax
cmp dword [ebp - 8], esi
je 0x437f3a
push dword [ebp - 8]
call ebx
cmp eax, esi
mov ecx, dword [ebp - 0xc]
mov edi, eax
mov dword [ebp - 8], ecx
jne 0x437fb8
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea eax, [ebp - 0x1c]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x21c]
push eax
push esi
push ecx
jmp 0x437f8e
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 8]
call fcn.00437ef1
cmp eax, esi
mov dword [ebp - 0xc], eax
jne 0x437fcb
lea eax, [ebp - 0x1c]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x21c]
push eax
push esi
push dword [ebp - 8]
mov dword [ebp - 0x10], 0x100
call edi
test eax, eax
je 0x437f62
cmp dword [ebp - 8], esi
je 0x437fa8
push dword [ebp - 8]
call ebx
mov dword [ebp - 8], esi
push dword [ebp + 8]
mov eax, dword [ebp - 0x14]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov edi, eax
cmp dword [ebp - 8], esi
je 0x437fc2
push dword [ebp - 8]
call ebx
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 4
cmp dword [ebp - 8], esi
je 0x437fd5
push dword [ebp - 8]
call ebx
mov eax, dword [ebp - 0xc]
jmp 0x437fc4

Function at 0x438388
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
push ebx
push ebx
push 3
push ebx
push 1
push SysReAllocString
push dword [ebp + 8]
mov dword [ebp - 0xc], ebx
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
je 0x438420
push edi
lea ecx, [ebp - 4]
push ecx
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
cmp dword [ebp - 4], ebx
mov edi, eax
jne 0x438416
cmp edi, 0x200000
ja 0x438416
lea eax, [edi + 2]
push esi
push eax
call fcn.0048732f
pop ecx
push ebx
mov esi, eax
lea eax, [ebp + 8]
push eax
push edi
push esi
push dword [ebp - 8]
mov dword [ebp + 8], ebx
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x438415
mov eax, dword [ebp + 8]
cmp eax, edi
jne 0x438415
mov byte [eax + esi], bl
mov eax, dword [ebp + 8]
mov byte [eax + esi + 1], bl
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, dword [ebp + 0x10]
mov dword [eax], edi
mov dword [ebp - 0xc], 1
pop esi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
mov eax, dword [ebp - 0xc]
pop ebx
leave
ret 0xc
Function at 0x438c21
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4db494]
push ebx
push esi
push edi
xor ebx, ebx
mov edi, 0x4db494
mov ecx, edi
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ebx
call dword [eax + 0xc]
mov esi, eax
mov eax, dword [0x4db494]
add esi, 0x10
mov ecx, edi
mov dword [ebp - 0xc], esi
call dword [eax + 0xc]
push ebx
push ebx
push 2
push ebx
push 1
push 0x40000000
push dword [ebp + 0xc]
mov edi, eax
add edi, 0x10
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
je 0x438cde
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
call fcn.00438cfb
push ebx
lea eax, [ebp - 4]
push eax
push 2
lea eax, [ebp + 0xc]
push eax
push dword [ebp - 8]
mov byte [ebp + 0xc], 0xff
mov byte [ebp + 0xd], 0xfe
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
mov esi, dword [ebp - 0xc]
je 0x438cd5
cmp dword [ebp - 4], 2
jne 0x438cd5
mov eax, dword [esi - 0xc]
push ebx
lea ecx, [ebp - 4]
push ecx
add eax, eax
push eax
push esi
push dword [ebp - 8]
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
je 0x438cd5
mov eax, dword [ebp + 8]
cmp dword [ebp - 4], eax
jne 0x438cd5
mov dword [ebp - 0x10], 1
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
lea eax, [edi - 0x10]
call fcn.0040151c
lea eax, [esi - 0x10]
call fcn.0040151c
mov eax, dword [ebp - 0x10]
lea esp, [ebp - 0x20]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x4398b7
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
push esi
push edi
mov esi, 0x208
xor edi, edi
push esi
lea eax, [ebp - 0x422]
push edi
push eax
mov word [ebp - 0x424], di
call fcn.004883c0
push esi
lea eax, [ebp - 0x216]
push edi
push eax
mov word [ebp - 0x218], di
call fcn.004883c0
add esp, 0x18
mov eax, 0x104
push eax
lea ecx, [ebp - 0x218]
push ecx
lea ecx, [ebp - 0xc]
push ecx
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 4]
push ecx
push eax
lea eax, [ebp - 0x424]
push eax
push dword [ebp + 8]
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], edi
call dword [sym.imp.KERNEL32.DLL_GetVolumeInformationW]
test eax, eax
jne 0x439930
mov dword [ebp - 4], edi
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret 4

Function at 0x439985
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4db494]
push esi
push edi
mov ecx, 0x4db494
call dword [eax + 0xc]
xor edi, edi
push edi
mov esi, eax
push 0x17
lea eax, [ebp - 0x20c]
push eax
add esi, 0x10
push edi
mov dword [ebp - 4], esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x4399fd
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 4]
push eax
call fcn.00401aed
lea esi, [ebp - 4]
call fcn.0042271d
push 0x4bd9a4
mov eax, esi
push eax
call fcn.00405235
mov esi, dword [ebp - 4]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4399fd
lea eax, [esi - 0x10]
call fcn.0040151c
mov eax, edi
pop edi
pop esi
leave
ret
xor edi, edi
inc edi
jmp 0x4399ef
Function at 0x439a02
Capabilities:
Check if file exists
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4db494]
push esi
push edi
mov ecx, 0x4db494
call dword [eax + 0xc]
xor edi, edi
push edi
mov esi, eax
push 0x19
lea eax, [ebp - 0x20c]
push eax
add esi, 0x10
push edi
mov dword [ebp - 4], esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x439a81
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 4]
push eax
call fcn.00401aed
lea esi, [ebp - 4]
call fcn.0042271d
push str.qQ
mov eax, esi
push eax
call fcn.00405235
mov esi, dword [ebp - 4]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x439a81
push esi
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
lea eax, [esi - 0x10]
call fcn.0040151c
mov eax, edi
pop edi
pop esi
leave
ret
xor edi, edi
inc edi
jmp 0x439a73

Function at 0x439ae1
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x4db494]
and dword [ebp - 0x10], 0
push ebx
push esi
mov esi, 0x4db494
push edi
mov ecx, esi
call dword [eax + 0xc]
mov ebx, eax
mov eax, dword [0x4db494]
add ebx, 0x10
mov ecx, esi
mov dword [ebp - 4], ebx
call dword [eax + 0xc]
and dword [ebp - 8], 0
push 1
mov edi, eax
push str.SYSTEMCurrentControlSet_servicesKingsoft_Antivirus_WebShield_Service
add edi, 0x10
push reloc.OLEAUT32.dll_SysReAllocString
lea esi, [ebp - 8]
mov dword [ebp - 0xc], edi
call fcn.00402204
test eax, eax
je 0x439b5a
lea eax, [ebp - 4]
push eax
push str.ImagePath
mov ebx, esi
call fcn.00402252
test eax, eax
je 0x439b57
lea eax, [ebp - 4]
call fcn.00422761
lea esi, [ebp - 4]
call fcn.0042271d
mov ebx, dword [ebp - 4]
xor esi, esi
cmp dword [ebp - 8], esi
je 0x439b6a
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebx - 0xc], esi
je 0x439bda
push dword [esi + 0x4d7c44]
lea eax, [ebp - 4]
lea ecx, [ebp - 0x10]
call fcn.0041dccb
pop ecx
lea edi, [ebp - 0xc]
call fcn.0040206d
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.0040151c
mov edi, dword [ebp - 0xc]
push 0
push edi
call fcn.0048a568
test eax, eax
pop ecx
pop ecx
jne 0x439bba
push edi
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
test eax, eax
jne 0x439bba
push 4
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_MoveFileExW]
add esi, 4
cmp esi, 0x1c
jb 0x439b6f
push str.SYSTEMCurrentControlSet_servicesKingsoft_Antivirus_WebShield_Service
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0042410f
pop ecx
pop ecx
mov dword [ebp - 0x10], 1
lea eax, [edi - 0x10]
call fcn.0040151c
lea eax, [ebx - 0x10]
call fcn.0040151c
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x439cd5
Capabilities:
Delete file
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x258
push ebx
push edi
xor ebx, ebx
push esi
inc ebx
call fcn.00439dd4
test eax, eax
pop ecx
je 0x439d6b
push ebx
push esi
call fcn.00484f33
push esi
call fcn.00439dd4
add esp, 0xc
test eax, eax
je 0x439dcc
mov eax, dword [0x4db494]
mov ecx, 0x4db494
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
push eax
push esi
lea eax, [esp + 0x14]
push str._s__d
push eax
call fcn.0041dcb8
mov edi, dword [esp + 0x1c]
add esp, 0x10
push edi
push esi
call dword [sym.imp.KERNEL32.DLL_MoveFileW]
mov ebx, eax
lea eax, [edi - 0x10]
call fcn.0040151c
test ebx, ebx
jne 0x439dcc
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov ecx, dword [ebp + 8]
push eax
push esi
push str.KFixManifest::Delete_Folder__s_Error__d__
call fcn.00401e04
add esp, 0xc
jmp 0x439dcc
lea eax, [esp + 0x10]
push eax
push esi
xor edi, edi
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
cmp eax, 0xffffffff
je 0x439dcc
test byte [esp + 0x10], 0x10
jne 0x439d86
inc edi
push eax
call dword [sym.imp.KERNEL32.DLL_FindClose]
test edi, edi
je 0x439dcc
push 0x80
push esi
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
push esi
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
mov ebx, eax
test ebx, ebx
jne 0x439dcc
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov ecx, dword [ebp + 8]
push eax
push esi
push str.KFixManifest::Delete_File__s_Error__d__
call fcn.00401e04
add esp, 0xc
push 4
push ebx
push esi
call dword [sym.imp.KERNEL32.DLL_MoveFileExW]
pop edi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43a1c4
Capabilities:
Create thread

Disassembly:
mov edx, dword [0x4dc6ec]
push esi
xor esi, esi
mov dword [0x4dc6dc], ecx
mov dword [0x4dc6d4], eax
cmp dword [edx - 0xc], esi
jne 0x43a1e4
mov eax, 0xe000001f
jmp 0x43a246
cmp eax, esi
push edi
mov dword [0x4dc6e0], esi
mov edi, 0x4dc6d0
jne 0x43a227
cmp ecx, esi
jne 0x43a227
mov eax, edi
call fcn.0043be86
test eax, eax
jne 0x43a227
cmp dword [0x4dc7e4], esi
je 0x43a227
cmp dword [0x4dc7e8], esi
je 0x43a227
push str.34115DF9_B9DE_49d2_A0B0_AF60FE6EF9D2
push esi
push 1
push esi
call dword [sym.imp.KERNEL32.DLL_CreateEventW]
mov dword [0x4dc750], eax
push esi
push esi
push edi
push 0x43abcf
push esi
push esi
call dword [sym.imp.KERNEL32.DLL_CreateThread]
cmp eax, esi
mov dword [0x4dc6e8], eax
pop edi
jne 0x43a24d
mov eax, 0xe0000020
call fcn.004245b3
jmp 0x43a250
xor esi, esi
inc esi
mov eax, esi
pop esi
ret
Function at 0x43a64b
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov esi, eax
lea eax, [esi + 0x1c]
mov edi, str.ressrcchsextendimg
push edi
lea ecx, [ebp - 4]
mov dword [ebp - 8], eax
call fcn.0041dccb
push dword [eax]
call fcn.0042291d
mov eax, dword [ebp - 4]
pop ecx
pop ecx
add eax, 0xfffffff0
call fcn.0040151c
add esi, 0x20
mov dword [ebp - 4], esi
xor esi, esi
push dword [esi + 0x4d7c60]
mov eax, dword [ebp - 8]
push edi
lea ecx, [ebp - 0x18]
call fcn.0041dccb
pop ecx
lea ecx, [ebp - 0x14]
call fcn.0041dccb
mov ebx, dword [eax]
mov eax, dword [ebp - 4]
pop ecx
push dword [esi + 0x4d7c60]
lea ecx, [ebp - 0x10]
push str.install_res
call fcn.0041dccb
pop ecx
lea ecx, [ebp - 0xc]
call fcn.0041dccb
pop ecx
push 0
push ebx
push dword [eax]
call dword [sym.imp.KERNEL32.DLL_CopyFileW]
mov eax, dword [ebp - 0xc]
add eax, 0xfffffff0
call fcn.0040151c
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.0040151c
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.0040151c
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.0040151c
add esi, 4
cmp esi, 0x14
jb 0x43a686
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
leave
ret

Function at 0x43a884
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push ebx
push esi
push edi
xor ebx, ebx
push 0x206
lea eax, [ebp - 0x20a]
push ebx
push eax
mov word [ebp - 0x20c], bx
call fcn.004883c0
mov eax, dword [0x4db494]
add esp, 0xc
mov ecx, 0x4db494
call dword [eax + 0xc]
mov edi, eax
lea eax, [ebp - 0x20c]
push eax
add edi, 0x10
push 0x104
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
test eax, eax
mov esi, 0x4dc6f0
je 0x43a93c
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea eax, [ebp - 0x20c]
push eax
push esi
call fcn.00401aed
push str.kantivirus_
push esi
call fcn.00405235
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
push eax
lea eax, [ebp - 4]
push str._x_
push eax
call fcn.0041dcb8
mov edi, dword [ebp - 4]
add esp, 0xc
push dword [edi - 0xc]
mov eax, esi
push edi
call fcn.0040c926
push dword [0x4dc6f0]
call fcn.0042291d
test eax, eax
pop ecx
je 0x43a93c
inc ebx
jmp 0x43a941
call fcn.004015cc
lea eax, [edi - 0x10]
call fcn.0040151c
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x43becf
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push esi
push edi
mov esi, eax
mov ecx, 0x4db494
call fcn.004016a0
xor edi, edi
push 0x206
lea eax, [ebp - 0x206]
push edi
push eax
mov word [ebp - 0x208], di
call fcn.004883c0
push str.programfiles
call fcn.0048b0b2
add esp, 0x10
push eax
push esi
call fcn.00401aed
mov eax, dword [esi]
cmp dword [eax - 0xc], edi
jne 0x43bf3e
push edi
push 0x26
lea eax, [ebp - 0x208]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp eax, edi
je 0x43bf55
lea eax, [ebp - 0x208]
push eax
push esi
call fcn.00401aed
mov eax, esi
call fcn.00405111
call fcn.0042271d
push str.kingsoftkingsoft_antivirus_
push esi
call fcn.00405235
pop edi
mov eax, esi
pop esi
leave
ret

Function at 0x43c00d
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x4db494]
push ebx
push esi
mov esi, 0x4db494
push edi
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 8], eax
mov eax, dword [0x4db494]
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
lea edi, [ebp - 0xc]
mov dword [ebp - 4], eax
call fcn.00423b5e
lea edi, [ebp - 8]
call fcn.0040206d
mov eax, dword [ebp - 0xc]
add eax, 0xfffffff0
call fcn.0040151c
mov eax, dword [ebp + 8]
add eax, 0x1c
mov dword [ebp + 8], eax
xor ebx, ebx
mov esi, 0x4dc90c
push dword [ebx + 0x4d7c7c]
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0xc]
call fcn.0041dccb
pop ecx
lea edi, [ebp - 4]
call fcn.0040206d
mov eax, dword [ebp - 0xc]
add eax, 0xfffffff0
call fcn.0040151c
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
push dword [ebp - 4]
mov edi, eax
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push edi
push str.ClearInvalidDrivers_return:_d__error:_d__path:_ws
call fcn.0044866c
push dword [ebx + 0x4d7c7c]
lea edi, [ebp - 0x14]
call fcn.004227a3
push eax
lea eax, [ebp - 8]
lea ecx, [ebp - 0x10]
call fcn.0041dbf6
add esp, 0x18
lea edi, [ebp - 4]
call fcn.0040206d
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.0040151c
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.0040151c
mov edi, dword [ebp - 4]
push edi
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
push edi
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push dword [ebp - 0x18]
push str.ClearInvalidDrivers_return:_d__error:_d__path:_ws
call fcn.0044866c
add ebx, 4
add esp, 0x10
cmp ebx, 0x20
jb 0x43c066
lea eax, [edi - 0x10]
call fcn.0040151c
mov eax, dword [ebp - 8]
add eax, 0xfffffff0
call fcn.0040151c
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
leave
ret 4