joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44ad82
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
lea esi, [ebp - 0x14]
call fcn.004038c8
mov esi, dword [ebp - 0x10]
xor edi, edi
cmp esi, edi
je 0x44ada7
mov eax, dword [esi]
push str.duba_mobile_state
mov ecx, esi
call dword [eax + 0xc]
xor eax, eax
push str.dubaenable
inc eax
mov dword [ebp - 4], edi
call fcn.00404a54
test eax, eax
pop ecx
jne 0x44ade8
cmp esi, edi
je 0x44aef4
push 1
mov eax, dword [esi]
push str.reason
mov ecx, esi
call dword [eax + 0x14]
mov eax, dword [esi]
push 0x50edd8
push str.product
mov ecx, esi
call dword [eax + 0x18]
jmp 0x44aef4
mov eax, dword [ebp + 8]
cmp dword [eax + 0x28], edi
je 0x44adfb
cmp esi, edi
je 0x44aef4
push edi
jmp 0x44adc6
push ebx
call fcn.004a87fa
test eax, eax
push str.SOFTWAREKingsoft_shoujizhushou
je 0x44aea7
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], edi
lea edi, [ebp + 8]
call fcn.004a88a0
mov eax, edi
mov dword [esp], 0x515b9c
push eax
call fcn.00407371
push str.error
lea eax, [ebp - 8]
call fcn.004014ce
mov ebx, dword [ebp + 8]
push ebx
lea eax, [ebp - 0x14]
call fcn.004977f9
test eax, eax
je 0x44ae6a
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x14]
call fcn.00497879
lea eax, [ebp + 8]
lea edi, [ebp - 8]
call fcn.0042a0a0
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.00401239
test esi, esi
mov edi, dword [ebp - 8]
je 0x44ae8c
mov eax, dword [esi]
push 2
push str.reason
mov ecx, esi
call dword [eax + 0x14]
mov eax, dword [esi]
push edi
push str.product
mov ecx, esi
call dword [eax + 0x18]
lea eax, [edi - 0x10]
call fcn.00401239
lea eax, [ebx - 0x10]
call fcn.00401239
push dword [ebp - 0x14]
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
pop ecx
jmp 0x44aef3
lea edi, [ebp + 8]
call fcn.004a88a0
mov edi, dword [ebp + 8]
pop ecx
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ebx, eax
lea eax, [edi - 0x10]
call fcn.00401239
test ebx, ebx
je 0x44aed0
test esi, esi
je 0x44aef3
push 3
jmp 0x44aed6
test esi, esi
je 0x44aef3
push 4
mov eax, dword [esi]
push str.reason
mov ecx, esi
call dword [eax + 0x14]
mov eax, dword [esi]
push 0x50edd8
push str.product
mov ecx, esi
call dword [eax + 0x18]
pop ebx
push 0x20019
push str.SoftwareKingsoftKISCommonUpdatehotfix
xor edi, edi
push reloc.OLEAUT32.dll_SysReAllocString
lea eax, [ebp - 4]
mov dword [ebp - 0xc], edi
call fcn.004017a0
test eax, eax
jne 0x44af2c
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
mov dword [ebp + 8], 4
call fcn.00456a3e
cmp esi, edi
je 0x44af55
push dword [ebp - 0xc]
mov eax, dword [esi]
push str.hotfix
mov ecx, esi
call dword [eax + 0x14]
mov eax, dword [esi]
push 1
push 0x50d398
mov ecx, esi
call dword [eax + 0x14]
mov eax, dword [esi]
push edi
mov ecx, esi
call dword [eax + 0x20]
cmp dword [ebp - 4], edi
je 0x44af63
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, edi
je 0x44af6e
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
pop edi
pop esi
leave
ret 4
Function at 0x44b16e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
cmp dword [eax + 0x34], esi
jne 0x44b183
mov eax, 0x8200000b
jmp 0x44b1f4
cmp dword [eax + 0x38], 8
mov dword [ebp - 0xc], 1
mov dword [ebp - 8], 0x208
mov dword [ebp - 4], esi
jb 0x44b19f
mov eax, dword [eax + 0x24]
jmp 0x44b1a2
add eax, 0x24
lea ecx, [ebp - 4]
push ecx
push 0x20019
push esi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x44b1f4
push edi
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
push esi
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
je 0x44b1e6
mov eax, edi
jmp 0x44b1f3
push 4
push dword [ebp + 8]
call dword [sym.imp.MSVCR80.dll__waccess]
pop ecx
pop ecx
pop edi
pop esi
leave
ret 4

Function at 0x44b1f9
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push esi
push edi
mov edi, eax
xor esi, esi
cmp dword [edi + 0x34], esi
jne 0x44b217
mov eax, 0x8200000b
jmp 0x44b2f1
push ebx
push 0x206
lea eax, [ebp - 0x216]
push esi
push eax
mov dword [ebp - 4], esi
or ebx, 0xffffffff
mov word [ebp - 0x218], si
call sub.MSVCR80.dll_memset
add esp, 0xc
cmp dword [ebp + 8], esi
mov dword [ebp - 0x10], 1
mov dword [ebp - 0xc], 0x208
mov dword [ebp - 8], esi
je 0x44b2ee
cmp dword [edi + 0x38], 8
jb 0x44b25f
mov edi, dword [edi + 0x24]
jmp 0x44b262
add edi, 0x24
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push esi
push 0xf003f
push esi
push esi
push esi
push edi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, esi
jne 0x44b2f0
cmp dword [ebp - 8], 2
jne 0x44b2c1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x44b2c1
lea eax, [ebp - 0x218]
push eax
push dword [ebp + 8]
call dword [sym.imp.MSVCR80.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x44b2c1
xor ebx, ebx
jmp 0x44b2e0
push dword [ebp + 8]
call dword [sym.imp.MSVCR80.dll_wcslen]
pop ecx
add eax, eax
push eax
push dword [ebp + 8]
push 1
push esi
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
cmp dword [ebp - 4], esi
je 0x44b2ee
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
pop ebx
pop edi
pop esi
leave
ret 4
Function at 0x44b80f
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push esi
push edi
call fcn.0045644b
push dword [ebp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_TlsSetValue]
push dword [eax + 0xc]
call esi
push 0xfde9
push dword [ebp + 0xc]
lea eax, [ebp - 0x100]
mov dword [ebp - 0x104], eax
lea eax, [ebp - 0x104]
push eax
call fcn.00429683
push dword [ebp - 0x104]
call fcn.0045644b
push eax
call fcn.0044b757
mov edi, eax
lea eax, [ebp - 0x100]
cmp dword [ebp - 0x104], eax
je 0x44b87b
push dword [ebp - 0x104]
call dword [sym.imp.MSVCR80.dll_free]
pop ecx
test edi, edi
je 0x44b89f
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 8]
call edi
add esp, 0xc
mov edi, eax
call fcn.0045644b
push 0
push dword [eax + 0xc]
call esi
mov eax, edi
jmp 0x44b8b0
call fcn.0045644b
push 0
push dword [eax + 0xc]
call esi
mov eax, 0xe0050008
pop edi
pop esi
leave
ret 0x14
Function at 0x44cb32
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18
push esi
push edi
mov edi, ecx
call fcn.0043609c
test eax, eax
jne 0x44cc0b
call fcn.00435bda
mov esi, eax
cmp esi, 2
jne 0x44cb5f
call fcn.00435b93
xor esi, esi
test esi, esi
je 0x44cb68
cmp esi, 3
jne 0x44cbe5
call fcn.00435c67
test eax, eax
jne 0x44cbe5
call fcn.00435cc4
test eax, eax
jne 0x44cbe5
call fcn.004360ca
test eax, eax
je 0x44cbe5
push 7
pop esi
mov dword [esp + 0xc], esi
call fcn.0047867e
cmp eax, esi
je 0x44cb98
cmp eax, 8
jne 0x44cc0b
lea esi, [esp + 0xc]
call fcn.00478692
test eax, eax
je 0x44cc0b
cmp dword [esp + 0xc], 8
jge 0x44cc0b
lea esi, [esp + 0x10]
call fcn.0042a427
mov eax, dword [esp + 0x18]
test eax, eax
je 0x44cbca
mov ecx, dword [eax]
push str.IERecommendPop
push eax
call dword [ecx + 0x28]
jmp 0x44cbcc
xor eax, eax
test eax, eax
je 0x44cbda
call fcn.00435f9e
call fcn.00435ef9
lea esi, [esp + 0x10]
call fcn.0042a513
jmp 0x44cc0b
cmp esi, 1
jne 0x44cc0b
call fcn.00435c67
test eax, eax
jne 0x44cc0b
push 5
push eax
push eax
push dword [edi + 8]
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
call fcn.00435f9e
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x44dc90
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
push dword [ebp + 0xc]
lea eax, [ebp - 4]
push dword [ebp + 8]
xor edi, edi
push eax
mov dword [ebp - 8], edi
call fcn.0044dd04
add esp, 0xc
cmp dword [esi], edi
je 0x44dceb
mov eax, esi
push dword [eax]
lea eax, [ebp - 4]
lea ecx, [ebp - 0xc]
call fcn.0042a029
pop ecx
push dword [eax]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ebx, eax
mov eax, dword [ebp - 0xc]
neg ebx
sbb bl, bl
add eax, 0xfffffff0
inc bl
call fcn.00401239
test bl, bl
jne 0x44dcf2
inc edi
lea eax, [esi + edi*4]
cmp dword [eax], 0
jne 0x44dcb5
mov dword [ebp - 8], 1
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.00401239
mov eax, dword [ebp - 8]
pop edi
pop ebx
leave
ret

Function at 0x44e2e2
Capabilities:
Get disk information
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
push dword [ebp + 8]
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x44e365
xor eax, eax
mov dword [ebp - 0xc], esi
lea edi, [ebp - 8]
stosd dword es:[edi], eax
lea eax, [ebp - 0xc]
push eax
push esi
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x44e365
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
shrd ecx, eax, 0x14
shr eax, 0x14
mov dword [ebp - 8], eax
and dword [ebp - 8], 0x80000000
and eax, 0x7fffffff
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0xc], esi
fild qword [ebp - 0x14]
fild qword [ebp - 0xc]
fchs
faddp st(1)
fld qword [0x5275b0]
fmul st(1)
fcomp qword [0x5275a8]
fnstsw ax
test ah, 0x41
jp 0x44e363
call fcn.004d5cb0
mov esi, eax
jmp 0x44e365
fstp st(0)
pop edi
mov eax, esi
pop esi
leave
ret
Function at 0x44e36b
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x5438cc]
push esi
push edi
mov ecx, 0x5438cc
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 4], eax
push str.netmon360netmon.ini
lea eax, [ebp - 0xc]
call fcn.004a8714
lea ecx, [ebp - 8]
call fcn.0042a029
pop ecx
lea edi, [ebp - 4]
call fcn.0042a0a0
mov eax, dword [ebp - 8]
add eax, 0xfffffff0
call fcn.00401239
mov eax, dword [ebp - 0xc]
add eax, 0xfffffff0
call fcn.00401239
mov esi, dword [ebp - 4]
xor edi, edi
push edi
push esi
call dword [sym.imp.MSVCR80.dll__waccess]
test eax, eax
pop ecx
pop ecx
jne 0x44e3e2
push esi
push 1
push str.ShowFloatBar
push str.setting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edi, eax
lea eax, [esi - 0x10]
call fcn.00401239
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x44e3f0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x5438cc]
push ebx
push edi
mov ecx, 0x5438cc
mov byte [ebp - 1], 0
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 8], eax
push str.netmon360netmon.ini
lea eax, [ebp - 0x10]
call fcn.004a8714
lea ecx, [ebp - 0xc]
call fcn.0042a029
pop ecx
lea edi, [ebp - 8]
call fcn.0042a0a0
mov eax, dword [ebp - 0xc]
add eax, 0xfffffff0
call fcn.00401239
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00401239
mov ebx, dword [ebp - 8]
push 0
push ebx
call dword [sym.imp.MSVCR80.dll__waccess]
test eax, eax
pop ecx
pop ecx
jne 0x44e49d
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push ebx
push 1
push str.ShowFloatBar
mov edi, str.setting
push edi
call esi
push ebx
push 0
push str.AlignMode
test eax, eax
push edi
setne byte [ebp - 1]
call esi
cmp byte [ebp - 1], 0
pop esi
je 0x44e499
cmp eax, 1
je 0x44e493
cmp eax, 3
je 0x44e493
cmp eax, 4
jne 0x44e499
mov byte [ebp - 1], 1
jmp 0x44e49d
mov byte [ebp - 1], 0
lea eax, [ebx - 0x10]
call fcn.00401239
movzx eax, byte [ebp - 1]
pop edi
pop ebx
leave
ret

Function at 0x44e4ad
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x5438cc]
push esi
push edi
mov ecx, 0x5438cc
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 4], eax
lea eax, [ebp - 0xc]
push str.cfg_floatwnd.ini
push eax
call fcn.004a8902
pop ecx
lea ecx, [ebp - 8]
call fcn.0042a029
pop ecx
lea edi, [ebp - 4]
call fcn.0042a0a0
mov eax, dword [ebp - 8]
add eax, 0xfffffff0
call fcn.00401239
mov eax, dword [ebp - 0xc]
add eax, 0xfffffff0
call fcn.00401239
mov esi, dword [ebp - 4]
xor edi, edi
push edi
push esi
call dword [sym.imp.MSVCR80.dll__waccess]
test eax, eax
pop ecx
pop ecx
jne 0x44e526
push esi
push 1
push str.isdisplaywithtray
push str.floatwnd
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edi, eax
lea eax, [esi - 0x10]
call fcn.00401239
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x44e534
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x5438cc]
push ebx
push edi
mov ecx, 0x5438cc
mov byte [ebp - 1], 0
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push str.cfg_floatwnd.ini
push eax
call fcn.004a8902
pop ecx
lea ecx, [ebp - 0xc]
call fcn.0042a029
pop ecx
lea edi, [ebp - 8]
call fcn.0042a0a0
mov eax, dword [ebp - 0xc]
add eax, 0xfffffff0
call fcn.00401239
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00401239
mov ebx, dword [ebp - 8]
push 0
push ebx
call dword [sym.imp.MSVCR80.dll__waccess]
test eax, eax
pop ecx
pop ecx
jne 0x44e5cd
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push ebx
push eax
push str.isdisplaywithtray
mov edi, str.floatwnd
push edi
call esi
test eax, eax
je 0x44e5c8
push ebx
push 0
push str.BorderlineAutoHide
push edi
call esi
test eax, eax
mov byte [ebp - 1], 1
jne 0x44e5cc
mov byte [ebp - 1], 0
pop esi
lea eax, [ebx - 0x10]
call fcn.00401239
mov al, byte [ebp - 1]
pop edi
pop ebx
leave
ret
Function at 0x4511ce
Capabilities:
Create tcp socket
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x190
and word [ebp - 0x190], 0
push 0x18e
lea eax, [ebp - 0x18e]
push 0
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
lea eax, [ebp - 0x190]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x451229
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
push str.localhost
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov eax, 0x545984
leave
ret

Function at 0x45151e
Capabilities:
Create process on windows
Delete registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x357c
call fcn.004d6030
push ebx
push esi
push edi
push 0x2001f
push str.SOFTWAREkingsoftAntivirus
xor ebx, ebx
push reloc.OLEAUT32.dll_SysReAllocString
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
call fcn.004017a0
lea eax, [ebp - 8]
push eax
mov esi, str.coverinstall11
push esi
lea eax, [ebp - 4]
push eax
call fcn.004016fe
test eax, eax
jne 0x4515c6
lea eax, [ebp - 0x3578]
call fcn.0042c16d
push ebx
lea eax, [ebp - 0x3578]
push eax
mov edi, str.http:__www.baidu.com
call fcn.0042c2b8
test al, al
je 0x45159e
push 5
push ebx
push str._minisite
push 0x50d548
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push ebx
push ebx
push dword [0x5453e4]
push 0xffff
call dword [sym.imp.USER32.dll_PostMessageW]
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea ecx, [ebp - 0x3578]
call fcn.0042c02f
cmp dword [ebp - 4], ebx
je 0x4515d4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x452e78
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
push str.kxecom.kid
xor edi, edi
push edi
lea eax, [ebp - 8]
call fcn.00496e16
pop ecx
lea ecx, [ebp - 4]
call fcn.0042a029
mov eax, dword [eax]
push edi
push eax
call dword [sym.imp.MSVCR80.dll__waccess]
mov ebx, eax
mov eax, dword [ebp - 4]
add esp, 0xc
neg ebx
sbb bl, bl
add eax, 0xfffffff0
inc bl
call fcn.00401239
mov eax, dword [ebp - 8]
add eax, 0xfffffff0
call fcn.00401239
test bl, bl
jne 0x452f81
mov ebx, dword [ebp + 8]
push esi
mov esi, ebx
call fcn.004530ae
test eax, eax
jne 0x452f80
push edi
push 1
push edi
lea esi, [ebx + 0x10]
call fcn.00403b70
push edi
push edi
push str.GlobalDownloadKcom90FAD4BB_2248_4231_8864_64023478241D
lea esi, [ebx + 0x18]
call fcn.00403b70
cmp dword [0x5455d0], edi
jne 0x452f34
push 1
mov esi, 0x5455d4
push esi
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push edi
push edi
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
mov dword [0x5455e8], 0xc
mov dword [0x5455ec], esi
mov dword [0x5455d0], 1
push edi
push edi
push str.GlobalD8E32168_81B0_431f_9DC9_0F177EC05DA0
push 0x5455e8
lea esi, [ebx + 0x20]
call fcn.00444aff
push 0xc
call sub.MSVCR80.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, edi
pop ecx
jne 0x452f58
xor eax, eax
jmp 0x452f77
push edi
push edi
push eax
push 0x45681e
push edi
push edi
mov dword [eax], ebx
mov dword [eax + 8], edi
mov dword [eax + 4], 0x452ffa
call dword [sym.imp.MSVCR80.dll__beginthreadex]
add esp, 0x18
push eax
lea esi, [ebx + 0x28]
call fcn.00444aa9
pop esi
pop edi
xor eax, eax
pop ebx
leave
ret 8
Function at 0x453783
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
test esi, esi
je 0x4537d1
push esi
call dword [sym.imp.MSVCR80.dll_wcslen]
test eax, eax
pop ecx
jbe 0x4537d1
push esi
lea eax, [ebp - 4]
call fcn.004014ce
push str._silentinstrcmd
xor ecx, ecx
lea esi, [ebp - 4]
call fcn.00429fa6
xor ecx, ecx
cmp eax, 0xffffffff
mov eax, dword [ebp - 4]
setne cl
add eax, 0xfffffff0
mov esi, ecx
call fcn.00401239
mov eax, esi
jmp 0x4537d3
xor eax, eax
pop esi
leave
ret

Function at 0x4537d6
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
push str.krcmddown.dll
push 0
lea eax, [ebp - 4]
call fcn.00496e16
pop ecx
lea ecx, [ebp - 8]
call fcn.0042a029
mov eax, dword [ebp - 4]
pop ecx
add eax, 0xfffffff0
call fcn.00401239
mov esi, dword [ebp - 8]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edi, eax
lea eax, [esi - 0x10]
call fcn.00401239
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x45381b
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
push str.kdownloader.exe
push 0
lea eax, [ebp - 4]
call fcn.00496e16
pop ecx
lea ecx, [ebp - 8]
call fcn.0042a029
mov eax, dword [ebp - 4]
pop ecx
add eax, 0xfffffff0
call fcn.00401239
mov esi, dword [ebp - 8]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edi, eax
lea eax, [esi - 0x10]
call fcn.00401239
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x453860
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
push str.krcmdtool.dll
push 0
lea eax, [ebp - 4]
call fcn.00496e16
pop ecx
lea ecx, [ebp - 8]
call fcn.0042a029
mov eax, dword [ebp - 4]
pop ecx
add eax, 0xfffffff0
call fcn.00401239
mov esi, dword [ebp - 8]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edi, eax
lea eax, [esi - 0x10]
call fcn.00401239
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x4538a5
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
xor ebx, ebx
push str.cloudctrl.config
push ebx
lea eax, [ebp - 4]
call fcn.00496e16
pop ecx
lea ecx, [ebp - 8]
call fcn.0042a029
mov eax, dword [ebp - 4]
pop ecx
add eax, 0xfffffff0
call fcn.00401239
mov esi, dword [ebp - 8]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x45390e
lea edi, [ebp - 0x18]
call fcn.00490b69
push 2
push esi
mov ebx, edi
call fcn.00490c36
push str.Enable
push str.InstallRcmdBin
mov eax, edi
push eax
xor eax, eax
call fcn.0049111f
mov ebx, eax
call fcn.00490b82
lea eax, [esi - 0x10]
call fcn.00401239
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x453ad1
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
lea esi, [ebp - 0x10]
call fcn.004038c8
mov eax, dword [0x5438cc]
mov ecx, 0x5438cc
call dword [eax + 0xc]
push 1
mov ebx, eax
push str.SOFTWAREkingsoftAntiVirus
add ebx, 0x10
xor edi, edi
push reloc.OLEAUT32.dll_SysReAllocString
lea esi, [ebp - 4]
mov dword [ebp - 8], ebx
mov dword [ebp - 4], edi
call fcn.00403a08
test eax, eax
je 0x453b2c
lea eax, [ebp - 8]
push eax
push str.tproname
mov ebx, esi
call fcn.00403a8b
test eax, eax
mov ebx, dword [ebp - 8]
je 0x453b2c
inc edi
push str.tflag
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp dword [ebp - 4], 0
je 0x453b49
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x453bd1
push str.csrss.exe
push ebx
call dword [sym.imp.MSVCR80.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x453bd1
mov edi, dword [ebp - 0xc]
test edi, edi
je 0x453b84
mov eax, dword [edi]
push str.duba_antikill
mov ecx, edi
call dword [eax + 0xc]
mov eax, dword [edi]
push 1
push str.numver
mov ecx, edi
call dword [eax + 0x14]
call fcn.00453bea
test edi, edi
je 0x453b9a
mov edx, dword [edi]
push eax
push 0x51909c
mov ecx, edi
call dword [edx + 0x14]
lea esi, [ebp - 8]
call fcn.00407395
test edi, edi
je 0x453bbc
mov edx, dword [edi]
push eax
push 0x5190a4
mov ecx, edi
call dword [edx + 0x18]
mov eax, dword [edi]
push 0
mov ecx, edi
call dword [eax + 0x20]
mov eax, dword [ebp - 8]
add eax, 0xfffffff0
call fcn.00401239
test edi, edi
je 0x453be5
mov eax, dword [edi]
mov ecx, edi
jmp 0x453be2
lea eax, [ebx - 0x10]
call fcn.00401239
mov ecx, dword [ebp - 0xc]
test ecx, ecx
je 0x453be5
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x453d8f
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
push 0
lea eax, [ebp - 4]
call fcn.00496e16
lea eax, [ebp - 4]
mov dword [esp], str.kpopmgr.dll
push eax
call fcn.00407371
mov edi, dword [ebp - 4]
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x453dfb
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
mov esi, dword [ebp + 8]
mov dword [esi + 8], eax
je 0x453dfa
push str.DllGetClassObject
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x453dfa
add esi, 0xc
push esi
mov ecx, 0x5198d0
push ecx
push ecx
call eax
test eax, eax
jne 0x453dfa
mov esi, dword [esi]
test esi, esi
je 0x453dfa
mov eax, dword [esi]
push esi
call dword [eax]
pop esi
lea eax, [edi - 0x10]
call fcn.00401239
xor eax, eax
pop edi
leave
ret 8