joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47bd80
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax], 0
je 0x47bd9d
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
call fcn.0047bd60
add esp, 4
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
test ecx, ecx
je 0x47bdbd
mov edx, dword [ebp + 8]
movsx eax, byte [edx]
cmp eax, 0x2f
je 0x47bdbd
push str.Comments_must_start_with__
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0xffffffffffffffff
mov ecx, dword [ebp + 8]
push ecx
call fcn.0047bde0
add esp, 8
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov esp, ebp
pop ebp
ret 4

Function at 0x47bde0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0xc], 0xffffffff
jne 0x47bdf9
mov eax, dword [ebp + 8]
push eax
call fcn.004bdee0
add esp, 4
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
push ecx
call fcn.004c00db
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x47be1c
push str.Failed_to_allocate_string_value_buffer
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.004be570
add esp, 0xc
mov edx, dword [ebp - 4]
add edx, dword [ebp + 0xc]
mov byte [edx], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x47ce30
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 8]
shl ecx, 0x18
sar ecx, 0x18
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 7
ja case.default.0x47ce5c
mov edx, dword [ebp - 0xc]
jmp dword [edx*4 + 0x47cf14]
push 0x50ee1f
mov ecx, dword [ebp + 8]
call fcn.004023d0
mov eax, dword [ebp - 4]
or eax, 1
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
jmp 0x47cf0c
mov ecx, dword [ebp - 8]
cmp dword [ecx], 0
je 0x47ce93
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
jmp 0x47ce9a
mov dword [ebp - 0x10], 0x50ee20
mov ecx, dword [ebp - 0x10]
push ecx
mov ecx, dword [ebp + 8]
call fcn.004023d0
mov edx, dword [ebp - 4]
or edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp + 8]
jmp 0x47cf0c
mov eax, dword [ebp - 8]
movzx ecx, byte [eax]
test ecx, ecx
je 0x47cec7
mov dword [ebp - 0x14], 0x50ee24
jmp 0x47cece
mov dword [ebp - 0x14], 0x50ee2c
mov edx, dword [ebp - 0x14]
push edx
mov ecx, dword [ebp + 8]
call fcn.004023d0
mov eax, dword [ebp - 4]
or eax, 1
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
jmp 0x47cf0c
push str.Type_is_not_convertible_to_string
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x50ee21
mov ecx, dword [ebp + 8]
call fcn.004023d0
mov ecx, dword [ebp - 4]
or ecx, 1
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret 4
Function at 0x47cf40
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
shl ecx, 0x18
sar ecx, 0x18
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 7
ja case.default.0x47cf65
mov edx, dword [ebp - 8]
jmp dword [edx*4 + 0x47d048]
xor eax, eax
jmp 0x47d042
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
cmp dword [ecx + 4], 0xffffffff
jl 0x47cfab
jg 0x47cf8f
mov edx, dword [ebp - 0xc]
cmp dword [edx], 0x80000000
jb 0x47cfab
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
cmp dword [ecx + 4], 0
jl 0x47cfb6
jg 0x47cfab
mov edx, dword [ebp - 0x10]
cmp dword [edx], 0x7fffffff
jbe 0x47cfb6
push 0x50ee58
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
jmp 0x47d042
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
cmp dword [edx + 4], 0
ja 0x47cfda
mov eax, dword [ebp - 0x14]
cmp dword [eax], 0x7fffffff
jbe 0x47cfe5
push str.unsigned_integer_out_of_signed_int_range
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
jmp 0x47d042
mov edx, dword [ebp - 4]
fld qword [0x50f108]
fcomp qword [edx]
fnstsw ax
test ah, 0x41
jp 0x47d010
mov eax, dword [ebp - 4]
fld qword [0x50f100]
fcomp qword [eax]
fnstsw ax
test ah, 1
je 0x47d01b
push str.Real_out_of_signed_integer_range
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
fld qword [ecx]
call fcn.004c7480
jmp 0x47d042
mov edx, dword [ebp - 4]
movzx eax, byte [edx]
neg eax
sbb eax, eax
neg eax
jmp 0x47d042
push str.Type_is_not_convertible_to_int
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x47d070
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
shl ecx, 0x18
sar ecx, 0x18
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 7
ja case.default.0x47d095
mov edx, dword [ebp - 8]
jmp dword [edx*4 + 0x47d18c]
xor eax, eax
jmp 0x47d186
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
cmp dword [ecx + 4], 0
jg 0x47d0c7
jl 0x47d0bc
mov edx, dword [ebp - 0xc]
cmp dword [edx], 0
jae 0x47d0c7
push str.Negative_integer_can_not_be_converted_to_unsigned_integer
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
cmp dword [ecx + 4], 0
jl 0x47d0eb
jg 0x47d0e0
mov edx, dword [ebp - 0x10]
cmp dword [edx], 0xffffffff
jbe 0x47d0eb
push str.signed_integer_out_of_UInt_range
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
jmp 0x47d186
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
cmp dword [edx + 4], 0
ja 0x47d10c
mov eax, dword [ebp - 0x14]
cmp dword [eax], 0xffffffff
jbe 0x47d117
push str.unsigned_integer_out_of_UInt_range
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
jmp 0x47d186
mov edx, dword [ebp - 4]
fldz
fcomp qword [edx]
fnstsw ax
test ah, 0x41
jp 0x47d13e
mov eax, dword [ebp - 4]
fld qword [0x50f110]
fcomp qword [eax]
fnstsw ax
test ah, 1
je 0x47d149
push str.Real_out_of_unsigned_integer_range
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
fld qword [ecx]
fnstcw word [ebp - 0x16]
movzx eax, word [ebp - 0x16]
or eax, 0xc00
mov dword [ebp - 0x1c], eax
fldcw word [ebp - 0x1c]
fistp qword [ebp - 0x24]
fldcw word [ebp - 0x16]
mov eax, dword [ebp - 0x24]
jmp 0x47d186
mov edx, dword [ebp - 4]
movzx eax, byte [edx]
neg eax
sbb eax, eax
neg eax
jmp 0x47d186
push str.Type_is_not_convertible_to_uint
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x47d1b0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
shl ecx, 0x18
sar ecx, 0x18
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 7
ja case.default.0x47d1d5
mov edx, dword [ebp - 8]
jmp dword [edx*4 + 0x47d284]
xor eax, eax
xor edx, edx
jmp 0x47d27d
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
mov edx, dword [ecx + 4]
jmp 0x47d27d
mov edx, dword [ebp - 4]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
cmp dword [eax + 4], 0x7fffffff
jb 0x47d219
ja 0x47d20e
mov ecx, dword [ebp - 0xc]
cmp dword [ecx], 0xffffffff
jbe 0x47d219
push str.unsigned_integer_out_of_Int64_range
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov edx, dword [edx + 4]
jmp 0x47d27d
mov eax, dword [ebp - 4]
fld qword [0x50f120]
fcomp qword [eax]
fnstsw ax
test ah, 0x41
jp 0x47d247
mov ecx, dword [ebp - 4]
fld qword [0x50f118]
fcomp qword [ecx]
fnstsw ax
test ah, 1
je 0x47d252
push str.Real_out_of_Int64_range
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 4]
fld qword [edx]
call fcn.004c7480
cdq
jmp 0x47d27d
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
neg eax
sbb eax, eax
neg eax
cdq
jmp 0x47d27d
push str.Type_is_not_convertible_to_Int64
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
xor edx, edx
mov esp, ebp
pop ebp
ret

Function at 0x47d2b0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
shl ecx, 0x18
sar ecx, 0x18
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 7
ja case.default.0x47d2d5
mov edx, dword [ebp - 8]
jmp dword [edx*4 + 0x47d390]
xor eax, eax
xor edx, edx
jmp 0x47d38a
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
cmp dword [ecx + 4], 0
jg 0x47d309
jl 0x47d2fe
mov edx, dword [ebp - 0xc]
cmp dword [edx], 0
jae 0x47d309
push str.Negative_integer_can_not_be_converted_to_UInt64
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
mov edx, dword [ecx + 4]
jmp 0x47d38a
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov edx, dword [edx + 4]
jmp 0x47d38a
mov eax, dword [ebp - 4]
fldz
fcomp qword [eax]
fnstsw ax
test ah, 0x41
jp 0x47d33d
mov ecx, dword [ebp - 4]
fld qword [0x50f128]
fcomp qword [ecx]
fnstsw ax
test ah, 1
je 0x47d348
push str.Real_out_of_UInt64_range
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 4]
fld qword [edx]
fnstcw word [ebp - 0xe]
movzx eax, word [ebp - 0xe]
or eax, 0xc00
mov dword [ebp - 0x14], eax
fldcw word [ebp - 0x14]
fistp qword [ebp - 0x1c]
fldcw word [ebp - 0xe]
mov eax, dword [ebp - 0x1c]
xor edx, edx
jmp 0x47d38a
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
neg eax
sbb eax, eax
neg eax
cdq
jmp 0x47d38a
push str.Type_is_not_convertible_to_UInt64
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
xor edx, edx
mov esp, ebp
pop ebp
ret
Function at 0x49ffb2
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x274
mov eax, dword [0x54eb90]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0x800
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x234], eax
mov esi, ecx
lea eax, [ebp - 0xc]
jne 0x4a004a
push 0x50fe0c
push 4
push eax
call fcn.004c08be
push eax
call fcn.00403010
add esp, 0x10
push ebx
push edi
call fcn.004c3550
mov edi, dword [eax]
call fcn.004c3550
xor ebx, ebx
mov dword [eax], ebx
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x234]
lea eax, [ebp - 0x230]
push esi
push 0x111
mov esi, 0x112
push esi
push eax
call fcn.004c7c6b
add esp, 0x18
mov dword [ebp - 0x234], eax
call fcn.004c3550
cmp dword [eax], ebx
je 0x4a0061
call fcn.004c3550
push dword [eax]
call fcn.0047a220
pop ecx
jmp 0x4a0068
push 4
push eax
push 3
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x49fff5
jmp 0x4a00ef
call fcn.004c3550
mov dword [eax], edi
cmp dword [ebp - 0x234], 0xffffffff
je 0x4a00eb
cmp dword [ebp - 0x234], esi
jae 0x4a00eb
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push 0x3c
mov esi, eax
lea eax, [ebp - 0x270]
push ebx
push eax
mov dword [ebp - 0x274], 0x40
call fcn.004bd840
add esp, 0xc
push 0x50fb6c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp eax, ebx
je 0x4a00da
push str.FindActCtxSectionStringW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x4a00da
lea ecx, [ebp - 0x274]
push ecx
push esi
push 2
push ebx
push ebx
call eax
test eax, eax
je 0x4a00da
push ebx
push ebx
push esi
jmp 0x4a00e3
push ebx
push ebx
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x4a00ed
xor eax, eax
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004bd72f
leave
ret

Function at 0x4a1b2b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x4a1b73
call fcn.004a4c80
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x4a1b73
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x4a1bb6
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
test ebx, ebx
je 0x4a1b9f
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x4a1b9f
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x4a1bb3
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x4a3020
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
test ebx, 0xffff0000
jne 0x4a3044
cmp dword [edi + 0x54], 0
jne 0x4a3044
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.004a4c80
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.004a2fe1
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4a541b
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x4fea27
call fcn.004c7b43
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x4a5440
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x4a5486
lea ecx, [ebp - 0x10]
call fcn.00407130
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0049ef96
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00403320
mov eax, esi
call fcn.004c7c1b
ret 8

Function at 0x4aad9e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x4aade5
call fcn.004a4c80
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x4aade5
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x4aae01
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.004aa916
mov esi, eax
test edi, edi
je 0x4aadff
test ebx, ebx
je 0x4aadff
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x4ab77c
Capabilities:
Create http request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, ecx
and dword [esi + 0x10], 0
and dword [esi + 0xc], 0
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
mov dword [esi], vtable.CInternetSession.0
test eax, eax
jne 0x4ab7a7
call fcn.004a4c80
mov eax, dword [eax + 0x10]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [esi + 8], eax
test eax, eax
jne 0x4ab7ca
push eax
push dword [esi + 4]
call fcn.004ab702
push esi
push eax
mov ecx, 0x552a34
call fcn.004ab3af
mov eax, esi
pop esi
pop ebp
ret 0x18

Function at 0x4bd72f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x54eb90]
jne 0x4bd739
repz ret
jmp fcn.004ca792
Function at 0x4d8945
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004ca1a1
and dword [ebp - 4], 0
cmp dword [0x553af4], 0
mov ebx, eax
jne 0x4d89f6
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4d8aa7
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4d8aa7
push eax
call fcn.004ca12f
mov dword [esp], 0x514f10
push edi
mov dword [0x553af4], eax
call esi
push eax
call fcn.004ca12f
mov dword [esp], 0x514efc
push edi
mov dword [0x553af8], eax
call esi
push eax
call fcn.004ca12f
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x553afc], eax
call esi
push eax
call fcn.004ca12f
pop ecx
mov dword [0x553b04], eax
test eax, eax
je 0x4d89f6
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004ca12f
pop ecx
mov dword [0x553b00], eax
mov eax, dword [0x553b00]
cmp eax, ebx
je 0x4d8a4e
cmp dword [0x553b04], ebx
je 0x4d8a4e
push eax
call fcn.004ca1aa
push dword [0x553b04]
mov esi, eax
call fcn.004ca1aa
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4d8a4e
test edi, edi
je 0x4d8a4e
call esi
test eax, eax
je 0x4d8a45
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4d8a45
test byte [ebp - 0xc], 1
jne 0x4d8a4e
or dword [ebp + 0x10], 0x200000
jmp 0x4d8a87
mov eax, dword [0x553af8]
cmp eax, ebx
je 0x4d8a87
push eax
call fcn.004ca1aa
pop ecx
test eax, eax
je 0x4d8a87
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4d8a87
mov eax, dword [0x553afc]
cmp eax, ebx
je 0x4d8a87
push eax
call fcn.004ca1aa
pop ecx
test eax, eax
je 0x4d8a87
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x553af4]
call fcn.004ca1aa
pop ecx
test eax, eax
je 0x4d8aa7
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4d8aa9
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4de8a0
Capabilities:
Get session information
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 8]
push ecx
push 5
push 0xffffffffffffffff
push 0
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
test eax, eax
je 0x4de8ea
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004c08be
add esp, 0xc
mov edx, dword [ebp - 8]
push edx
call sub.WTSAPI32.dll_WTSFreeMemory
jmp 0x4de8f8
lea eax, [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x4df100
Capabilities:
Check if file exists
Create process on windows
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x500b14
mov eax, dword fs:[0]
push eax
sub esp, 0xcc
mov eax, dword [0x54eb90]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xd0], ecx
mov ecx, 0x553f1c
call sym.QiyiInstaller.exe_public:_char_const____thiscall_Json::StaticString::operator_char_const__void_const
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4df216
push ecx
mov ecx, esp
mov dword [ebp - 0xc8], esp
push str.Run_QiyiInstaller_Repair...
call fcn.00403820
mov dword [ebp - 0xd4], eax
mov ecx, 0x553e48
call fcn.004f2090
push 5
push 0
push str._repair
mov ecx, 0x553f1c
call sym.QiyiInstaller.exe_public:_char_const____thiscall_Json::StaticString::operator_char_const__void_const
push eax
push 0x516bc0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [0x553f58], 1
push 0
mov eax, dword [ebp - 0xd0]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
lea ecx, [ebp - 0xc4]
call fcn.004f9f50
mov dword [ebp - 4], 0
push ecx
mov ecx, esp
mov dword [ebp - 0xcc], esp
push str.SendLog_7cancelsysbtn3
call fcn.00403820
mov dword [ebp - 0xd8], eax
lea ecx, [ebp - 0xc4]
call fcn.004f9e50
push 0
push 0
push 0x464
mov edx, dword [ebp - 0xd0]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc4]
call fcn.004f9e30
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x4df230
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x500b3d
mov eax, dword fs:[0]
push eax
sub esp, 0xd4
mov eax, dword [0x54eb90]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xd4], ecx
cmp dword [0x553f58], 0
jne 0x4df336
push 0
mov eax, dword [ebp - 0xd4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
lea ecx, [ebp - 0xc4]
call fcn.004f9f50
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0xd4]
cmp dword [edx + 0x3bc], 0
je 0x4df2cb
push ecx
mov ecx, esp
mov dword [ebp - 0xc8], esp
push str.OpenUrl_http:__app.iqiyi.com_pc_player_feedback_index.html_entryuninstallversion_realversionie
call fcn.00403820
mov dword [ebp - 0xd8], eax
lea ecx, [ebp - 0xc4]
call fcn.004f9e50
jmp 0x4df324
mov eax, dword [ebp - 0xd4]
cmp dword [eax + 0x3c0], 0
je 0x4df300
push ecx
mov ecx, esp
mov dword [ebp - 0xcc], esp
push str.SendLog_7cancelsysbtn0
call fcn.00403820
mov dword [ebp - 0xdc], eax
lea ecx, [ebp - 0xc4]
call fcn.004f9e50
jmp 0x4df324
push ecx
mov ecx, esp
mov dword [ebp - 0xd0], esp
push str.SendLog_7cancelsysbtn1
call fcn.00403820
mov dword [ebp - 0xe0], eax
lea ecx, [ebp - 0xc4]
call fcn.004f9e50
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc4]
call fcn.004f9e30
push 0
push 0
push 0x464
mov ecx, dword [ebp - 0xd4]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x4e0eb0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x54eb90]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
xor eax, eax
mov word [ebp - 0x218], ax
push 0x206
push 0
lea ecx, [ebp - 0x216]
push ecx
call fcn.004bd840
add esp, 0xc
cmp dword [ebp + 0xc], 0
je 0x4e0fc3
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x4e0fc3
lea eax, [ebp - 4]
push eax
push 0x10008
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0
jne 0x4e0fc1
cmp dword [ebp - 0x21c], 0
jne 0x4e0fb7
mov dword [ebp - 0x220], 0x104
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x218]
push ecx
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0x103
jne 0x4e0f90
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov dword [ebp - 0x21c], eax
jmp 0x4e0fb7
cmp dword [ebp - 0x21c], 0
jne 0x4e0fb2
lea edx, [ebp - 0x218]
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.004e0eb0
add esp, 8
mov dword [ebp - 0x21c], eax
jmp 0x4e0f31
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4e0fcd
mov dword [ebp - 0x21c], 0x3f2
mov eax, dword [ebp - 0x21c]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004bd72f
mov esp, ebp
pop ebp
ret