joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49659f
Capabilities:
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2ac
mov eax, dword [0x4c6644]
xor eax, ebp
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x23c]
call fcn.00412fee
mov byte [ebp - 0x220], 0
push 0x103
push 0
lea eax, [ebp - 0x21f]
push eax
call fcn.00467660
add esp, 0xc
push 0
push 0x28
lea eax, [ebp - 0x220]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
push 0x4b8134
lea ecx, [ebp - 0x258]
call fcn.004052fa
push eax
push 0x4b8144
lea ecx, [ebp - 0x274]
call fcn.004052fa
push eax
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x290]
push eax
call fcn.00415d4e
add esp, 0xc
push eax
lea eax, [ebp - 0x2ac]
push eax
call fcn.00415d7f
add esp, 0xc
push eax
lea ecx, [ebp - 0x23c]
call fcn.0040c158
lea ecx, [ebp - 0x2ac]
call fcn.004052e5
lea ecx, [ebp - 0x290]
call fcn.004052e5
lea ecx, [ebp - 0x274]
call fcn.004052e5
lea ecx, [ebp - 0x258]
call fcn.004052e5
lea ecx, [ebp - 0x23c]
call fcn.00404b9e
push eax
push 0
push str.FUNPALYERCHANNELID
push 0x4b815c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [ebp - 0x114], eax
mov byte [ebp - 0x110], 0
push 0x103
push 0
lea eax, [ebp - 0x10f]
push eax
call fcn.00467660
add esp, 0xc
push 0xa
lea eax, [ebp - 0x110]
push eax
push dword [ebp - 0x114]
call fcn.00415db0
add esp, 0xc
lea eax, [ebp - 0x110]
push eax
mov ecx, dword [ebp + 8]
call fcn.004052fa
lea ecx, [ebp - 0x23c]
call fcn.004052e5
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00467392
leave
ret

Function at 0x4966ee
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x4c6644]
xor eax, ebp
mov dword [ebp - 0xc], eax
push str.SOFTWAREFunshionFunshion
lea ecx, [ebp - 0x28]
call fcn.004052fa
and dword [ebp - 8], 0
and dword [ebp - 0x70], 0
mov dword [ebp - 4], 1
mov dword [ebp - 0x6c], 0x40
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
lea ecx, [ebp - 0x28]
call fcn.00404b9e
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0
je 0x496763
push 0x4b7de2
mov ecx, dword [ebp + 8]
call fcn.004052fa
lea ecx, [ebp - 0x28]
call fcn.004052e5
mov eax, dword [ebp + 8]
jmp 0x4967b3
mov byte [ebp - 0x68], 0
push 0x3f
push 0
lea eax, [ebp - 0x67]
push eax
call fcn.00467660
add esp, 0xc
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 4]
push eax
push 0
push str.Version
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x68]
push eax
mov ecx, dword [ebp + 8]
call fcn.004052fa
lea ecx, [ebp - 0x28]
call fcn.004052e5
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00467392
leave
ret
Function at 0x49686d
Capabilities:
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
mov eax, dword [0x4c6644]
xor eax, ebp
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x41c]
call fcn.00405558
push 0
push 0x28
lea eax, [ebp - 0x418]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x4b8170
push 0x4b818c
lea ecx, [ebp - 0x420]
call fcn.00414bad
push eax
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x424]
push eax
call fcn.00414be6
add esp, 0xc
push eax
lea eax, [ebp - 0x428]
push eax
call fcn.0041421d
add esp, 0xc
push eax
lea ecx, [ebp - 0x41c]
call fcn.00407557
lea ecx, [ebp - 0x428]
call fcn.0040558b
lea ecx, [ebp - 0x424]
call fcn.0040558b
lea ecx, [ebp - 0x420]
call fcn.0040558b
and word [ebp - 0x210], 0
push 0x206
push 0
lea eax, [ebp - 0x20e]
push eax
call fcn.00467660
add esp, 0xc
lea ecx, [ebp - 0x41c]
call fcn.00405490
push eax
push 0x104
lea eax, [ebp - 0x210]
push eax
push 0x4b8190
push str.UpdateUrl
push 0x4b8204
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
mov ecx, dword [ebp + 8]
call fcn.00401092
lea ecx, [ebp - 0x41c]
call fcn.0040558b
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00467392
leave
ret

Function at 0x496997
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x4c6644]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x124], ecx
mov eax, dword [ebp - 0x124]
cmp dword [eax + 4], 0
je 0x496ac1
mov byte [ebp - 0x118], 0
push 0x103
push 0
lea eax, [ebp - 0x117]
push eax
call fcn.00467660
add esp, 0xc
push 0x104
lea eax, [ebp - 0x118]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
lea ecx, [ebp - 0x120]
call fcn.004156a6
lea eax, [ebp - 0x118]
push eax
push str._supdater.txt
lea eax, [ebp - 0x120]
push eax
call fcn.0041438c
add esp, 0xc
lea ecx, [ebp - 4]
call fcn.004156a6
push dword [ebp + 8]
push str._s_r_n
lea eax, [ebp - 4]
push eax
call fcn.0041438c
add esp, 0xc
and dword [ebp - 8], 0
and dword [ebp - 0x11c], 0
push 0
push 0x80
push 4
push 0
push 1
push 0x40000000
lea ecx, [ebp - 0x120]
call fcn.0040105b
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 8], eax
push 2
push 0
push 0
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 4]
call fcn.0040e94e
push eax
lea ecx, [ebp - 4]
call fcn.0040105b
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 4]
call fcn.0040104a
lea ecx, [ebp - 0x120]
call fcn.0040104a
lea ecx, [ebp + 8]
call fcn.0040104a
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00467392
leave
ret 4
Function at 0x496ad7
Capabilities:
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
mov eax, dword [0x4c6644]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x42c], ecx
lea ecx, [ebp - 0x41c]
call fcn.00405558
push 0
push 0x28
lea eax, [ebp - 0x418]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x4b8220
push 0x4b823c
lea ecx, [ebp - 0x420]
call fcn.00414bad
push eax
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x424]
push eax
call fcn.00414be6
add esp, 0xc
push eax
lea eax, [ebp - 0x428]
push eax
call fcn.0041421d
add esp, 0xc
push eax
lea ecx, [ebp - 0x41c]
call fcn.00407557
lea ecx, [ebp - 0x428]
call fcn.0040558b
lea ecx, [ebp - 0x424]
call fcn.0040558b
lea ecx, [ebp - 0x420]
call fcn.0040558b
and word [ebp - 0x210], 0
push 0x206
push 0
lea eax, [ebp - 0x20e]
push eax
call fcn.00467660
add esp, 0xc
lea ecx, [ebp - 0x41c]
call fcn.00405490
push eax
push 0
push 0x4b8240
push 0x4b8258
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [ebp - 0x42c]
mov dword [ecx + 4], eax
lea ecx, [ebp - 0x41c]
call fcn.0040558b
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00467392
leave
ret

Function at 0x498337
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4c6644]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
push dword [eax + 0x6e4]
mov ecx, dword [ebp - 0x28]
add ecx, 0x584
call fcn.00414cfe
push 1
mov ecx, dword [ebp - 0x28]
add ecx, 0x584
call fcn.00409f03
mov eax, dword [ebp - 0x28]
cmp dword [eax + 0x6e4], 0xa
jl 0x49839a
cmp dword [0x4ca280], 0
je 0x49839a
push 0
push 0
push 0x10
push dword [0x4ca264]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x498412
mov eax, dword [ebp - 0x28]
cmp dword [eax + 0x6e4], 0xa
jl 0x498412
cmp dword [0x4ca284], 0
je 0x498412
lea eax, [ebp - 0x20]
push eax
call fcn.004964d8
pop ecx
push 0x4b8698
lea ecx, [ebp - 0x20]
call fcn.0040df40
push 1
push 0
push 0
lea ecx, [ebp - 0x20]
call fcn.004010f3
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push ecx
mov ecx, esp
push 0x4b86b4
call fcn.0040de14
call fcn.0049697b
mov ecx, eax
call fcn.00496997
push 0
push 0
push 0x10
push dword [0x4ca264]
call dword [sym.imp.USER32.dll_PostMessageW]
lea ecx, [ebp - 0x20]
call fcn.004010c8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00467392
leave
ret
Function at 0x49841e
Capabilities:
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x4c6644]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x224], ecx
lea ecx, [ebp - 0x214]
call fcn.00405558
push 0
push 0x28
lea eax, [ebp - 0x210]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x4b85d4
push 0x4b85f0
lea ecx, [ebp - 0x218]
call fcn.00414bad
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.00414be6
add esp, 0xc
push eax
lea eax, [ebp - 0x220]
push eax
call fcn.0041421d
add esp, 0xc
push eax
lea ecx, [ebp - 0x214]
call fcn.00407557
lea ecx, [ebp - 0x220]
call fcn.0040558b
lea ecx, [ebp - 0x21c]
call fcn.0040558b
lea ecx, [ebp - 0x218]
call fcn.0040558b
lea ecx, [ebp - 0x214]
call fcn.00405490
push eax
push 0
push 0x4b85f4
push str.FunShion_Player
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 0
je 0x4984f6
cmp dword [ebp - 0x228], 1
je 0x498503
jmp 0x49850e
push 0x804
call dword [sym.imp.KERNEL32.dll_SetThreadLocale]
jmp 0x49850e
push 0x409
call dword [sym.imp.KERNEL32.dll_SetThreadLocale]
lea ecx, [ebp - 0x214]
call fcn.0040558b
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00467392
leave
ret
Function at 0x4998d6
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b0
mov eax, dword [0x4c6644]
xor eax, ebp
mov dword [ebp - 8], eax
push edi
mov dword [ebp - 0x2b0], ecx
mov ecx, dword [ebp - 0x2b0]
call fcn.00497908
push 0
push 1
push 0x113
mov ecx, dword [ebp - 0x2b0]
add ecx, 4
call fcn.0040ef88
mov ecx, dword [ebp - 0x2b0]
call fcn.004978b1
cmp dword [0x4ca278], 0
je 0x499935
mov dword [0x4ca27c], 1
jmp 0x499ac2
cmp dword [0x4ca25c], 0
jne 0x499982
call fcn.0049d313
mov eax, dword [ebp - 0x2b0]
mov ecx, dword [eax + 0x6bc]
call fcn.0049a41d
mov ecx, dword [ebp - 0x2b0]
add ecx, 0x38
call fcn.0049ba07
mov ecx, dword [ebp - 0x2b0]
call fcn.0049770b
push 1
mov ecx, dword [ebp - 0x2b0]
add ecx, 4
call fcn.00409f03
jmp 0x499ac2
mov ecx, dword [ebp - 0x2b0]
call fcn.0049773f
and dword [ebp - 0x29c], 0
xor eax, eax
lea edi, [ebp - 0x298]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x29c], 5
and dword [ebp - 0x298], 0
and dword [ebp - 0x294], 0
push str.update_msg_wnd
push 0
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x29c]
push eax
push 0
push 0x4a
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [ebp - 0x2a0]
call fcn.00405558
push 0
push 0x28
lea eax, [ebp - 0x290]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.FunShion.ini
push 0x4b8710
lea ecx, [ebp - 0x2a4]
call fcn.00414bad
push eax
lea eax, [ebp - 0x290]
push eax
lea eax, [ebp - 0x2a8]
push eax
call fcn.00414be6
add esp, 0xc
push eax
lea eax, [ebp - 0x2ac]
push eax
call fcn.0041421d
add esp, 0xc
push eax
lea ecx, [ebp - 0x2a0]
call fcn.00407557
lea ecx, [ebp - 0x2ac]
call fcn.0040558b
lea ecx, [ebp - 0x2a8]
call fcn.0040558b
lea ecx, [ebp - 0x2a4]
call fcn.0040558b
and word [ebp - 0x88], 0
push 0x7e
push 0
lea eax, [ebp - 0x86]
push eax
call fcn.00467660
add esp, 0xc
push 1
push 0x4b8714
push 0x40
lea eax, [ebp - 0x88]
push eax
call fcn.00467fc6
add esp, 0x10
lea ecx, [ebp - 0x2a0]
call fcn.00405490
push eax
lea eax, [ebp - 0x88]
push eax
push str.DownloadFileComplete
push str.UPDATE_SETING
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea ecx, [ebp - 0x2a0]
call fcn.0040558b
pop edi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00467392
leave
ret

Function at 0x49a603
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x4c6644]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x214], ecx
and word [ebp - 0x210], 0
push 0x206
push 0
lea eax, [ebp - 0x20e]
push eax
call fcn.00467660
add esp, 0xc
push 0
push 0x28
lea eax, [ebp - 0x210]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x210]
push eax
mov ecx, dword [ebp - 0x214]
add ecx, 0x34
call fcn.00407c54
push str._funshion
mov ecx, dword [ebp - 0x214]
add ecx, 0x34
call fcn.00414204
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00467392
leave
ret
Function at 0x49ab8d
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x15c
mov eax, dword [0x4c6644]
xor eax, ebp
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea ecx, [ebp - 0x28]
call fcn.00405558
mov dword [ebp - 0x150], 0x11c
lea eax, [ebp - 0x150]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 5
je 0x49abec
cmp dword [ebp - 0x154], 6
je 0x49ac4b
jmp 0x49acb9
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 1
je 0x49ac0c
cmp dword [ebp - 0x158], 2
je 0x49ac1b
jmp 0x49ac49
push str.11424344
lea ecx, [ebp - 0x28]
call fcn.00407c54
jmp 0x49ac49
movzx eax, byte [ebp - 0x36]
cmp eax, 1
jne 0x49ac3c
movzx eax, word [ebp - 0x24]
cmp eax, 9
jne 0x49ac3c
push 0x4b8864
lea ecx, [ebp - 0x28]
call fcn.00407c54
jmp 0x49ac49
push 0x4b8868
lea ecx, [ebp - 0x28]
call fcn.00407c54
jmp 0x49acc6
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 0
je 0x49ac6b
cmp dword [ebp - 0x15c], 1
je 0x49ac92
jmp 0x49acb7
movzx eax, byte [ebp - 0x36]
cmp eax, 1
jne 0x49ac83
push 0x4b886c
lea ecx, [ebp - 0x28]
call fcn.00407c54
jmp 0x49ac90
push 0x4b8870
lea ecx, [ebp - 0x28]
call fcn.00407c54
jmp 0x49acb7
movzx eax, byte [ebp - 0x36]
cmp eax, 1
jne 0x49acaa
push 0x4b8874
lea ecx, [ebp - 0x28]
call fcn.00407c54
jmp 0x49acb7
push 0x4b8878
lea ecx, [ebp - 0x28]
call fcn.00407c54
jmp 0x49acc6
push 0x4b887c
lea ecx, [ebp - 0x28]
call fcn.00407c54
push 0
lea ecx, [ebp - 0x28]
call fcn.00405968
push eax
mov ecx, dword [ebp + 8]
call fcn.00401092
lea ecx, [ebp - 0x28]
call fcn.0040558b
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x2c]
xor ecx, ebp
call fcn.00467392
leave
ret

Function at 0x49c423
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4c6644]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x28], ecx
lea eax, [ebp - 0x20]
push eax
call fcn.004964d8
pop ecx
push 0x4b8ce8
lea ecx, [ebp - 0x20]
call fcn.0040df40
push 1
push 0
push 0
lea ecx, [ebp - 0x20]
call fcn.004010f3
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push ecx
mov ecx, esp
push str.CFpMainBtmWnd::onStartFunBtn
call fcn.0040de14
call fcn.0049697b
mov ecx, eax
call fcn.00496997
push 0
push 0
push 0x10
push dword [0x4ca264]
call dword [sym.imp.USER32.dll_PostMessageW]
lea ecx, [ebp - 0x20]
call fcn.004010c8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00467392
leave
ret
Function at 0x49cf8f
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x4c6644]
xor eax, ebp
mov dword [ebp - 4], eax
push dword [ebp + 8]
lea ecx, [ebp - 0x20]
call fcn.00401092
push dword [0x4b903c]
push 0x4b8ee0
lea ecx, [ebp - 0x20]
call fcn.0040c223
mov dword [ebp - 0x2c], eax
push 0x4b8ee4
lea ecx, [ebp - 0x24]
call fcn.00401011
or dword [ebp - 0x28], 0xffffffff
mov eax, dword [ebp - 0x2c]
cmp eax, dword [0x4b903c]
je 0x49d042
push dword [ebp - 0x2c]
push 0
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x20]
call fcn.00407a55
mov ecx, eax
call fcn.004010f3
push eax
lea ecx, [ebp - 0x24]
call fcn.00401ac7
lea ecx, [ebp - 0x48]
call fcn.004010c8
lea ecx, [ebp - 0x24]
call fcn.0040105b
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x49d027
lea ecx, [ebp - 0x24]
call fcn.0040105b
push eax
call dword [sym.imp.dbghelp.dll_MakeSureDirectoryPathExists]
push 0
push 0x80
push 2
push 0
push 5
push 2
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x4c], eax
lea ecx, [ebp - 0x24]
call fcn.0040104a
lea ecx, [ebp - 0x20]
call fcn.004010c8
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00467392
leave
ret

Function at 0x49d2da
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push dword [ebp + 8]
mov ecx, 0x4ca2b8
call fcn.00407c54
push 0
push 0
push 0x4ca2b8
push 0x49d26f
push 0
push 0
call fcn.0046b15b
add esp, 0x18
mov dword [ebp - 4], eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
leave
ret
Function at 0x49d313
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
mov eax, dword [0x4c6644]
xor eax, ebp
mov dword [ebp - 0x18], eax
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0xc], eax
and dword [ebp - 0x248], 0
push 0x228
push 0
lea eax, [ebp - 0x244]
push eax
call fcn.00467660
add esp, 0xc
mov dword [ebp - 0x248], 0x22c
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 0xc]
call sub.KERNEL32.dll_Process32FirstW
mov dword [ebp - 8], eax
and dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00405558
lea ecx, [ebp - 0x10]
call fcn.00405558
cmp dword [ebp - 8], 0
je 0x49d440
push str.funshion_ui3_vc80_mtd.exe
lea ecx, [ebp - 0x14]
call fcn.00407c54
push str.FspServer_vc80_mtd.exe
lea ecx, [ebp - 0x10]
call fcn.00407c54
push 0x4b8e7c
lea ecx, [ebp - 0x14]
call fcn.00407c54
push str.FunshionService.exe
lea ecx, [ebp - 0x10]
call fcn.00407c54
lea ecx, [ebp - 0x14]
call fcn.00405490
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.0046b02f
pop ecx
pop ecx
test eax, eax
je 0x49d3f3
lea ecx, [ebp - 0x10]
call fcn.00405490
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.0046b02f
pop ecx
pop ecx
test eax, eax
jne 0x49d429
mov eax, dword [ebp - 0x240]
mov dword [ebp - 4], eax
push dword [ebp - 4]
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 0
je 0x49d429
push 0
push dword [ebp - 0x24c]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 0xc]
call sub.KERNEL32.dll_Process32NextW
mov dword [ebp - 8], eax
jmp 0x49d37f
lea ecx, [ebp - 0x10]
call fcn.0040558b
lea ecx, [ebp - 0x14]
call fcn.0040558b
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.00467392
leave
ret

Function at 0x4a18b4
Capabilities:
Connect to http server

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x24], ecx
push 1
push 0
push 3
push 0
push 0
push 0x50
mov ecx, dword [ebp - 0x24]
call fcn.004010f3
push eax
lea ecx, [ebp - 4]
call fcn.00401011
mov ecx, eax
call fcn.0040105b
push eax
mov eax, dword [ebp - 0x24]
push dword [eax + 0x54]
call dword [sym.imp.WININET.dll_InternetConnectA]
mov ecx, dword [ebp - 0x24]
mov dword [ecx + 0x58], eax
lea ecx, [ebp - 4]
call fcn.0040104a
mov eax, dword [ebp - 0x24]
cmp dword [eax + 0x58], 0
jne 0x4a1928
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x4a1916
xor eax, eax
jmp 0x4a1975
push 0xffffffffffffffff
mov eax, dword [ebp - 0x24]
push dword [eax + 0x68]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor eax, eax
jmp 0x4a1975
push 0x4ca224
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp - 0x24]
add eax, 0x68
push eax
mov eax, dword [ebp - 0x24]
push dword [eax + 0x58]
lea eax, [ebp - 0x14]
push eax
call fcn.004038eb
add esp, 0xc
push eax
lea ecx, [ebp - 0xc]
call fcn.00403903
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x20]
push eax
mov ecx, 0x4ca2a0
call fcn.00401156
push 0x4ca224
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
inc eax
leave
ret
Function at 0x4a1977
Capabilities:
Check internet connectivity via wininet
Create http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp + 0xc]
mov dword [eax + 0x60], ecx
push dword [ebp + 8]
lea ecx, [ebp - 0x28]
call fcn.00401092
mov eax, dword [ebp - 0x2c]
add eax, 0x1c
push eax
push dword [ebp - 0x2c]
lea eax, [ebp - 0x28]
push eax
call fcn.0049d162
add esp, 0xc
neg eax
sbb eax, eax
inc eax
mov byte [ebp - 9], al
lea ecx, [ebp - 0x28]
call fcn.004010c8
movzx eax, byte [ebp - 9]
test eax, eax
je 0x4a19c6
xor eax, eax
jmp 0x4a1a40
and dword [ebp - 8], 0
push 0
lea eax, [ebp - 8]
push eax
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
mov eax, dword [ebp - 8]
and eax, 4
sub eax, 4
neg eax
sbb eax, eax
and eax, 4
mov dword [ebp - 4], eax
push 0x10000000
push 0
push 0
push dword [ebp - 4]
push str.Mozilla_4.0__compatible__MSIE_7.0__Windows_NT_5.2__.NET_CLR_1.1.4322__.NET_CLR_2.0.50727_
call dword [sym.imp.WININET.dll_InternetOpenA]
mov ecx, dword [ebp - 0x2c]
mov dword [ecx + 0x54], eax
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x54], 0
jne 0x4a1a13
xor eax, eax
jmp 0x4a1a40
mov ecx, dword [ebp - 0x2c]
call fcn.004a1757
mov ecx, dword [ebp - 0x2c]
call fcn.004a1416
push 0x4a160f
mov eax, dword [ebp - 0x2c]
push dword [eax + 0x54]
call dword [sym.imp.WININET.dll_InternetSetStatusCallbackW]
cmp eax, 0xffffffff
jne 0x4a1a3d
xor eax, eax
jmp 0x4a1a40
xor eax, eax
inc eax
leave
ret 8
Function at 0x4a1a44
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x168
mov eax, dword [0x4c6644]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x168], ecx
mov byte [ebp - 0x108], 0
push 0xff
push 0
lea eax, [ebp - 0x107]
push eax
call fcn.00467660
add esp, 0xc
mov dword [ebp - 0x11c], 1
lea ecx, [ebp - 0x118]
call fcn.00401a51
push 0x28
push 0
lea eax, [ebp - 0x144]
push eax
call fcn.00467660
add esp, 0xc
mov dword [ebp - 0x144], 0x28
lea eax, [ebp - 0x108]
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x12c], 0xff
push 2
push 0
lea eax, [ebp - 0x144]
push eax
mov eax, dword [ebp - 0x168]
push dword [eax + 0x5c]
call dword [sym.imp.WININET.dll_InternetReadFileExA]
test eax, eax
jne 0x4a1b09
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x4a1b00
push 0xffffffffffffffff
mov eax, dword [ebp - 0x168]
push dword [eax + 0x70]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x4a1b09
and dword [ebp - 0x11c], 0
jmp 0x4a1b76
mov eax, dword [ebp - 0x12c]
mov byte [ebp + eax - 0x108], 0
cmp dword [ebp - 0x12c], 0
jne 0x4a1b2f
mov eax, dword [ebp - 0x168]
mov dword [eax + 0x74], 1
jmp 0x4a1b66
mov eax, dword [ebp - 0x12c]
lea eax, [ebp + eax - 0x108]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x14c]
push eax
lea ecx, [ebp - 0x118]
call fcn.00401aa8
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x118]
call fcn.00403887
mov eax, dword [ebp - 0x168]
cmp dword [eax + 0x74], 0
je 0x4a1a8f
cmp dword [ebp - 0x11c], 0
je 0x4a1bea
mov ecx, dword [ebp - 0x168]
call fcn.004a14f0
cmp eax, 0xc8
jne 0x4a1bea
lea eax, [ebp - 0x154]
push eax
lea ecx, [ebp - 0x118]
call fcn.00401aa8
push dword [eax + 4]
push dword [eax]
lea eax, [ebp - 0x15c]
push eax
lea ecx, [ebp - 0x118]
call fcn.00401a89
push dword [eax + 4]
push dword [eax]
mov eax, dword [ebp - 0x168]
mov ecx, dword [eax + 0x64]
call fcn.004038b9
mov dword [ebp - 0x160], 1
lea ecx, [ebp - 0x118]
call fcn.00401a78
mov eax, dword [ebp - 0x160]
jmp 0x4a1c02
and dword [ebp - 0x164], 0
lea ecx, [ebp - 0x118]
call fcn.00401a78
mov eax, dword [ebp - 0x164]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00467392
leave
ret