joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f4d10
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
lea ecx, [ebp - 4]
call fcn.00402e30
push str.IQiYihelper.dll
mov eax, dword [0x556fe4]
push eax
push 0x520014
lea ecx, [ebp - 4]
push ecx
call fcn.00405f70
add esp, 0x10
lea ecx, [ebp - 4]
call sym.QiyiInstaller.exe_public:_enum_eScriptType___thiscall_CScriptModule::Type_void_
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x927c0
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
lea edx, [ebp - 4]
push edx
call fcn.004020c0
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
lea eax, [ebp + 8]
push eax
call fcn.004020c0
call fcn.004eb610
add esp, 0xc
test eax, eax
jne 0x4f4da5
push ecx
mov ecx, esp
mov dword [ebp - 0x2c], esp
push str.1562
call fcn.004037d0
call sym.QiyiInstaller.exe_SendThirdPartyStatLog
add esp, 4
lea ecx, [ebp - 4]
call fcn.00407160
lea ecx, [ebp + 8]
call fcn.00407160
jmp 0x4f4ee1
lea ecx, [ebp - 4]
call sym.QiyiInstaller.exe_public:_enum_eScriptType___thiscall_CScriptModule::Type_void_
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4f4ed1
mov byte [ebp - 0xd], 0
push str.IQYIsBDAExist
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4f4ec7
call dword [ebp - 0xc]
mov byte [ebp - 0xd], al
movzx edx, byte [ebp - 0xd]
test edx, edx
je 0x4f4e0c
push ecx
mov ecx, esp
mov dword [ebp - 0x30], esp
push str.1561
call fcn.004037d0
call sym.QiyiInstaller.exe_SendThirdPartyStatLog
add esp, 4
jmp 0x4f4ec7
push str.IQYIsCompeteExist
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4f4ec7
call dword [ebp - 0x14]
mov byte [ebp - 0xd], al
movzx ecx, byte [ebp - 0xd]
test ecx, ecx
je 0x4f4e50
push ecx
mov ecx, esp
mov dword [ebp - 0x34], esp
push str.1564
call fcn.004037d0
call sym.QiyiInstaller.exe_SendThirdPartyStatLog
add esp, 4
jmp 0x4f4ec7
push str.IQYHelper
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x4f4e6b
call dword [ebp - 0x1c]
mov byte [ebp - 0x15], 0
push str.IQYIsSuccess
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x4f4ec7
call dword [ebp - 0x20]
mov byte [ebp - 0x15], al
movzx ecx, byte [ebp - 0x15]
test ecx, ecx
je 0x4f4eaf
push ecx
mov ecx, esp
mov dword [ebp - 0x38], esp
push str.1560
call fcn.004037d0
call sym.QiyiInstaller.exe_SendThirdPartyStatLog
add esp, 4
jmp 0x4f4ec7
push ecx
mov ecx, esp
mov dword [ebp - 0x3c], esp
push str.1563
call fcn.004037d0
call sym.QiyiInstaller.exe_SendThirdPartyStatLog
add esp, 4
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [ebp - 4]
call fcn.00407160
lea ecx, [ebp + 8]
call fcn.00407160
mov esp, ebp
pop ebp
ret
Function at 0x4f6250
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], 0
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
push str.GetNativeSystemInfo
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4f62a3
lea ecx, [ebp - 0x28]
push ecx
call dword [ebp - 4]
jmp 0x4f62ad
lea edx, [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, word [ebp - 0x28]
cmp eax, 6
je 0x4f62bf
movzx ecx, word [ebp - 0x28]
cmp ecx, 9
jne 0x4f62c3
mov al, 1
jmp 0x4f62c5
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x4f6390
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x284]
push ecx
call sym.QiyiInstaller.exe_public:_static_class_CUISystem____cdecl_Singleton_class_CUISystem_::GetInstance_void_
mov ecx, eax
call sym.QiyiInstaller.exe_public:_void___thiscall_CUISystem::SetInstance_struct_HINSTANCE____
push str.skin
push 0x2bc
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x284]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4f6437
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x284]
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x284]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4f6437
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4f642d
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0x10]
push eax
call sym.QiyiInstaller.exe_public:_static_class_CUISystem____cdecl_Singleton_class_CUISystem_::GetInstance_void_
mov ecx, eax
call sym.QiyiInstaller.exe_public:_void___thiscall_CUISystem::SetResourceZip_void___unsigned_int_
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov esp, ebp
pop ebp
ret
Function at 0x4f64c0
Capabilities:
Terminate process
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
add eax, 0x298
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 0x274]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0x28c], 0xffffffff
je 0x4f6522
mov ecx, dword [ebp - 0x1c]
add ecx, 0x288
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 0x288]
mov edx, dword [eax + 0x48]
call edx
mov ecx, dword [ebp - 0x1c]
add ecx, 0x288
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax + 0x288]
mov eax, dword [edx + 0x4c]
call eax
lea ecx, [ebp - 8]
push ecx
mov ecx, dword [ebp - 0x1c]
add ecx, 0x124
call fcn.00414e70
jmp 0x4f6544
push 0
lea edx, [ebp - 0x10]
push edx
lea ecx, [ebp - 8]
call fcn.00407120
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x1c]
add ecx, 0x124
call fcn.00408a00
push eax
lea ecx, [ebp - 8]
call fcn.00408b70
movzx ecx, al
test ecx, ecx
je 0x4f6595
push 0x3e8
lea ecx, [ebp - 8]
call fcn.00407100
mov edx, dword [eax]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4f6593
push 0xffffffffffffffff
lea ecx, [ebp - 8]
call fcn.00407100
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
jmp 0x4f6536
mov ecx, dword [ebp - 0x1c]
call fcn.004f62d0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 0x1c]
call fcn.004a20f9
mov esp, ebp
pop ebp
ret

Function at 0x4f65c0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1020
call fcn.004c9070
mov eax, dword [0x551bd0]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x101c], ecx
xor eax, eax
mov word [ebp - 0x1010], ax
push 0xffe
push 0
lea ecx, [ebp - 0x100e]
push ecx
call fcn.004bff70
add esp, 0xc
push 0x521984
mov edx, dword [ebp - 0x101c]
add edx, 0xa8
push edx
lea eax, [ebp - 0x1018]
push eax
call fcn.004041d0
add esp, 0xc
mov dword [ebp - 0x1020], eax
mov ecx, dword [ebp - 0x1020]
call sym.QiyiInstaller.exe_public:_enum_eScriptType___thiscall_CScriptModule::Type_void_
push eax
push 0x800
lea ecx, [ebp - 0x1010]
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesW]
lea ecx, [ebp - 0x1018]
call fcn.00407160
mov dword [ebp - 0x1014], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov edx, dword [ebp - 4]
lea eax, [ebp + edx*2 - 0x1010]
push eax
call fcn.004bfe74
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x4f669e
mov ecx, dword [ebp - 0x1014]
add ecx, 1
mov dword [ebp - 0x1014], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
lea ecx, [eax + edx + 1]
mov dword [ebp - 4], ecx
jmp 0x4f6664
mov eax, dword [ebp - 0x1014]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004bfe65
mov esp, ebp
pop ebp
ret
Function at 0x4f68f0
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5049e6
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x551bd0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x40], 0
lea ecx, [ebp - 0x30]
call fcn.00407a50
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x38], 0
lea eax, [ebp - 0x38]
push eax
push 0
call sub.IPHLPAPI.DLL_GetAdaptersInfo
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
je 0x4f6982
cmp dword [ebp - 0x3c], 0x6f
je 0x4f6982
lea ecx, [ebp - 0x30]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00402940
mov edx, dword [ebp - 0x40]
or edx, 1
mov dword [ebp - 0x40], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00402b90
mov eax, dword [ebp + 8]
jmp 0x4f6ab7
mov eax, dword [ebp - 0x38]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4f69c3
lea ecx, [ebp - 0x30]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00402940
mov edx, dword [ebp - 0x40]
or edx, 1
mov dword [ebp - 0x40], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00402b90
mov eax, dword [ebp + 8]
jmp 0x4f6ab7
lea eax, [ebp - 0x38]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call sub.IPHLPAPI.DLL_GetAdaptersInfo
test eax, eax
je 0x4f6a0a
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea eax, [ebp - 0x30]
push eax
mov ecx, dword [ebp + 8]
call fcn.00402940
mov ecx, dword [ebp - 0x40]
or ecx, 1
mov dword [ebp - 0x40], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00402b90
mov eax, dword [ebp + 8]
jmp 0x4f6ab7
lea ecx, [ebp - 0x34]
call fcn.00402e30
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x10]
movzx eax, byte [edx + 0x199]
push eax
mov ecx, dword [ebp - 0x10]
movzx edx, byte [ecx + 0x198]
push edx
mov eax, dword [ebp - 0x10]
movzx ecx, byte [eax + 0x197]
push ecx
mov edx, dword [ebp - 0x10]
movzx eax, byte [edx + 0x196]
push eax
mov ecx, dword [ebp - 0x10]
movzx edx, byte [ecx + 0x195]
push edx
mov eax, dword [ebp - 0x10]
movzx ecx, byte [eax + 0x194]
push ecx
push str._02X_02X_02X_02X_02X_02X
lea edx, [ebp - 0x34]
push edx
call fcn.004074f0
add esp, 0x20
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea ecx, [ebp - 0x34]
call fcn.00407180
push eax
lea ecx, [ebp - 0x30]
call fcn.00407a30
lea ecx, [ebp - 0x30]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00402940
mov edx, dword [ebp - 0x40]
or edx, 1
mov dword [ebp - 0x40], edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x34]
call fcn.00407160
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00402b90
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004bfe65
mov esp, ebp
pop ebp
ret
Function at 0x4f6bd0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x504b95
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x551bd0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x28], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x28]
add eax, 0x298
push eax
call dword [sym.imp.KERNEL32.dll_TryEnterCriticalSection]
test eax, eax
je 0x4f6ce7
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
lea ecx, [ebp - 0x14]
call fcn.00402e30
mov byte [ebp - 4], 2
mov edx, dword [ebp + 8]
push edx
movzx eax, word [ebp - 0x16]
push eax
movzx ecx, word [ebp - 0x18]
push ecx
movzx edx, word [ebp - 0x1a]
push edx
movzx eax, word [ebp - 0x1c]
push eax
movzx ecx, word [ebp - 0x1e]
push ecx
movzx edx, word [ebp - 0x22]
push edx
movzx eax, word [ebp - 0x24]
push eax
push str._r_n_d__02d__02d__02d:_02d:_02d._03d_:__s
lea ecx, [ebp - 0x14]
push ecx
call fcn.00405f70
add esp, 0x28
lea ecx, [ebp - 0x14]
call sym.QiyiInstaller.exe_public:_enum_eScriptType___thiscall_CScriptModule::Type_void_
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov edx, dword [ebp - 0x28]
cmp dword [edx + 0x28c], 0xffffffff
je 0x4f6cb5
lea ecx, [ebp - 0x14]
call fcn.004032b0
shl eax, 1
push eax
lea ecx, [ebp - 0x14]
call sym.QiyiInstaller.exe_public:_enum_eScriptType___thiscall_CScriptModule::Type_void_
push eax
mov ecx, dword [ebp - 0x28]
add ecx, 0x288
mov eax, dword [ebp - 0x28]
mov edx, dword [eax + 0x288]
mov eax, dword [edx + 0x38]
call eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.00407160
jmp 0x4f6cd0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x28]
add ecx, 0x298
push ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00407160
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4f7000
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5051b0
mov eax, dword fs:[0]
push eax
sub esp, 0x254
mov eax, dword [0x551bd0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x260], ecx
mov dword [ebp - 0x25c], 0
lea ecx, [ebp - 0x24c]
call fcn.00402e30
mov dword [ebp - 4], 0
mov dword [ebp - 0x250], 0
mov dword [ebp - 0x258], 0
mov dword [ebp - 0x248], 0
mov dword [ebp - 0x254], 0
mov dword [ebp - 0x244], 0
push 0x228
push 0
lea eax, [ebp - 0x240]
push eax
call fcn.004bff70
add esp, 0xc
mov dword [ebp - 0x244], 0x22c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x250], eax
push 0
push 0x40000002
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0xffffffff
je 0x4f711d
lea ecx, [ebp - 0x244]
push ecx
mov edx, dword [ebp - 0x254]
push edx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x4f711d
mov eax, dword [ebp - 0x23c]
cmp eax, dword [ebp - 0x250]
jne 0x4f70f9
mov ecx, dword [ebp - 0x22c]
mov dword [ebp - 0x258], ecx
jmp 0x4f7110
lea edx, [ebp - 0x244]
push edx
mov eax, dword [ebp - 0x254]
push eax
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4f70dd
mov ecx, dword [ebp - 0x254]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x258], 0
jbe 0x4f719e
push 0
push 0x40000002
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0xffffffff
je 0x4f719e
lea edx, [ebp - 0x244]
push edx
mov eax, dword [ebp - 0x254]
push eax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x4f719e
mov ecx, dword [ebp - 0x23c]
cmp ecx, dword [ebp - 0x258]
jne 0x4f717a
lea edx, [ebp - 0x220]
push edx
lea ecx, [ebp - 0x24c]
call fcn.004037b0
jmp 0x4f7191
lea eax, [ebp - 0x244]
push eax
mov ecx, dword [ebp - 0x254]
push ecx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4f7158
mov edx, dword [ebp - 0x254]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x24c]
push eax
mov ecx, dword [ebp + 8]
call fcn.004020c0
mov ecx, dword [ebp - 0x25c]
or ecx, 1
mov dword [ebp - 0x25c], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24c]
call fcn.00407160
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004bfe65
mov esp, ebp
pop ebp
ret 4
Function at 0x4f9d70
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax], vtable.CPoster.0
mov ecx, dword [ebp - 4]
mov dword [ecx + method.DuiLib::CContainerUI.virtual_0], vtable.CPoster.1.0
mov edx, dword [ebp - 4]
cmp dword [edx + 0x3fc], 0
je 0x4f9dc1
push 0x64
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x3fc]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4f9dc1
push 0
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x3fc]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [ebp - 4]
add ecx, 0x3f8
call fcn.00407160
mov ecx, dword [ebp - 4]
add ecx, 0x3f4
call fcn.00407160
mov ecx, dword [ebp - 4]
add ecx, 0x3f0
call fcn.00407160
mov ecx, dword [ebp - 4]
call sym.QiyiInstaller.exe_public_virtual:_void___thiscall_DuiLib::CContainerUI::destructor_void_
mov esp, ebp
pop ebp
ret
Function at 0x404548
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
xor edx, edx
call fcn.00406890
test esi, esi
jne 0x404580
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.004069cc
jmp 0x40459e
call sub.kernel32.dll_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.0040448c
mov edi, eax
test esi, esi
je 0x40459e
cmp dword [ebx], 0
je 0x40459e
dec esi
jmp 0x404587
add esp, 0x20c
pop edi
pop esi
pop ebx
ret

Function at 0x4045d0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x4f0008], 0x8088405
inc edx
mov dword [ebx + 0x4f0008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x405ddc
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x4f7050], 0
je 0x405e3d
cmp word [0x4f732c], 0xd7b2
jne 0x405e05
cmp dword [0x4f7334], 0
jbe 0x405e05
mov eax, 0x4f7328
call dword [0x4f7344]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x405e68
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x4f0030], 0
jne 0x405e59
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x405fe8
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 0x10]
cmp dword [0x4f0034], 0
je 0x40600e
mov edx, esi
mov eax, ebx
call dword [0x4f0034]
jmp 0x40601d
mov eax, 8
call fcn.004041d4
mov dword [eax], ebx
mov dword [eax + 4], esi
mov byte [0x4f7051], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x405fb0
push eax
mov eax, dword [ebp - 4]
push eax
push edi
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0xc
Function at 0x408554
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe94
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 0x16c], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4086bb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
xor edx, edx
call fcn.00406890
cmp si, word [0x4f07dc]
jb 0x4085ee
cmp si, word [0x4f09dc]
ja 0x4085ee
mov edi, 0x40
xor eax, eax
mov dword [ebp - 0xc], eax
cmp edi, dword [ebp - 0xc]
jb 0x4085ee
mov ebx, dword [ebp - 0xc]
add ebx, edi
shr ebx, 1
cmp si, word [ebx*8 + 0x4f07dc]
jae 0x4085c8
mov edi, ebx
dec edi
jmp 0x4085e9
cmp si, word [ebx*8 + 0x4f07dc]
jbe 0x4085d8
inc ebx
mov dword [ebp - 0xc], ebx
jmp 0x4085e9
mov edx, dword [ebp - 8]
mov eax, dword [ebx*8 + 0x4f07e0]
call fcn.00408464
jmp 0x4085ee
cmp edi, dword [ebp - 0xc]
jae 0x4085b2
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jne 0x40869d
push 2
movzx eax, si
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x40869d
push 0x55
lea eax, [ebp - 0xb6]
push eax
push 0x59
movzx ebx, si
push ebx
call sub.kernel32.dll_GetLocaleInfoW
push 0x55
lea eax, [ebp - 0x160]
push eax
push 0x5a
push ebx
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x164]
lea edx, [ebp - 0xb6]
mov ecx, 0x55
call fcn.00406a78
push dword [ebp - 0x164]
push 0x4086d8
lea eax, [ebp - 0x168]
lea edx, [ebp - 0x160]
mov ecx, 0x55
call fcn.00406a78
push dword [ebp - 0x168]
push 0x4086e8
lea eax, [ebp - 0x16c]
lea edx, [ebp - 0xb6]
mov ecx, 0x55
call fcn.00406a78
push dword [ebp - 0x16c]
mov eax, dword [ebp - 8]
mov edx, 5
call fcn.00406e30
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4086c2
lea eax, [ebp - 0x16c]
mov edx, 3
call fcn.00406888
ret
Function at 0x408874
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x408979
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4f9b58
call sub.kernel32.dll_EnterCriticalSection
cmp bx, word [0x4f9b70]
jne 0x4088c0
mov eax, esi
mov edx, 0x4f9b74
mov ecx, 0x55
call fcn.00406a78
push 0x4f9b58
call sub.kernel32.dll_LeaveCriticalSection
jmp 0x408963
push 0x4f9b58
call sub.kernel32.dll_LeaveCriticalSection
mov eax, esi
xor edx, edx
call fcn.00406890
push 2
movzx eax, bx
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x408931
cmp byte [0x4f9b54], 0
je 0x4088f6
mov edx, esi
mov eax, ebx
call fcn.00408754
jmp 0x408931
mov edx, esi
mov eax, ebx
call fcn.00408554
call sub.kernel32.dll_GetSystemDefaultUILanguage
cmp bx, ax
je 0x408931
cmp dword [esi], 0
je 0x40891a
mov eax, esi
mov edx, 0x408994
call fcn.00406c8c
call sub.kernel32.dll_GetSystemDefaultUILanguage
lea edx, [ebp - 4]
call fcn.00408554
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.00406c8c
push 0x4f9b58
call sub.kernel32.dll_EnterCriticalSection
mov word [0x4f9b70], bx
push 0xaa
mov eax, dword [esi]
call fcn.0040691c
push eax
push 0x4f9b74
call sub.kernel32.dll_lstrcpynW
push 0x4f9b58
call sub.kernel32.dll_LeaveCriticalSection
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408980
lea eax, [ebp - 4]
call fcn.00406880
ret