joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a880
Capabilities:
Acquire debug privileges

Disassembly:
sub esp, 0x18
push ebx
mov ebx, dword [esp + 0x20]
push edi
lea eax, [esp + 0xc]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40a8e6
lea ecx, [esp + 0x14]
push ecx
push str.SeDebugPrivilege
push 0
mov dword [esp + 0x1c], 1
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov eax, dword [esp + 0xc]
push 0
push 0
push 0x10
lea edx, [esp + 0x1c]
push edx
push 0
push eax
mov dword [esp + 0x34], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.0040a930
mov edi, eax
test edi, edi
je 0x40a921
call fcn.0040a9c0
test eax, eax
je 0x40a914
test esi, esi
je 0x40a921
push esi
push edi
mov ecx, ebx
call fcn.0040aae0
mov eax, 1
pop edi
pop ebx
add esp, 0x18
ret 4
test esi, esi
je 0x40a921
push esi
push edi
mov ecx, ebx
call fcn.0040ad20
pop edi
mov eax, 1
pop ebx
add esp, 0x18
ret 4

Function at 0x40a9c0
Capabilities:
Check os version

Disassembly:
sub esp, 0x144
mov eax, dword [0x4451b0]
xor eax, esp
mov dword [esp + 0x140], eax
mov eax, dword [0x4468ac]
test eax, eax
jl 0x40a9fb
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
mov ecx, dword [esp + 0x140]
xor ecx, esp
call fcn.0041a78f
add esp, 0x144
ret
xor eax, eax
push esi
push 0x11c
push eax
lea edx, [esp + 0x30]
push edx
mov dword [0x4468ac], 0
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
call fcn.0041c7f0
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
add esp, 0xc
lea eax, [esp + 0x28]
push eax
mov dword [esp + 0x2c], 0x11c
call esi
test eax, eax
jne 0x40aa6b
lea ecx, [esp + 0x28]
push ecx
mov dword [esp + 0x2c], 0x114
call esi
test eax, eax
je 0x40aabd
push str.GetNativeSystemInfo
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40aabd
lea edx, [esp + 4]
push edx
call eax
mov eax, dword [esp + 4]
cmp ax, 9
je 0x40aa9d
cmp ax, 6
jne 0x40aabd
mov eax, 1
mov dword [0x4468ac], eax
pop esi
mov ecx, dword [esp + 0x140]
xor ecx, esp
call fcn.0041a78f
add esp, 0x144
ret
mov ecx, dword [esp + 0x144]
pop esi
xor ecx, esp
xor eax, eax
call fcn.0041a78f
add esp, 0x144
ret
Function at 0x40c8c0
Capabilities:
Check if file exists
Get file size

Disassembly:
push 0xffffffffffffffff
push 0x434928
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x4451b0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov edi, edx
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40c9e2
xor ebx, ebx
mov dword [esp + 0x10], ebx
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push edi
mov dword [esp + 0x44], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x40c983
call fcn.004089e0
test eax, eax
jl 0x40c9e2
lea eax, [esp + 0x18]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
mov dword [esp + 0x14], edi
cmp edi, 0xffffffff
jne 0x40c954
call fcn.004089e0
test eax, eax
jl 0x40c9d7
mov edi, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
test eax, eax
jb 0x40c9d7
ja 0x40c962
test edi, edi
jbe 0x40c9d7
test eax, eax
ja 0x40c9d7
jb 0x40c970
cmp edi, 0x500000
jae 0x40c9d7
mov eax, dword [esi + 0x14]
cmp edi, eax
ja 0x40c98b
push 0xffffffffffffffff
push edi
mov ecx, esi
call fcn.00401ff0
jmp 0x40c995
mov ebx, eax
mov dword [esp + 0x10], ebx
jmp 0x40c92c
mov ecx, edi
sub ecx, eax
push ecx
call fcn.0040d540
cmp dword [esi + 0x18], 0x10
jb 0x40c9a0
mov ecx, dword [esi + 4]
jmp 0x40c9a3
lea ecx, [esi + 4]
mov esi, edi
lea edx, [esp + 0x10]
call fcn.0040c3c0
xor edx, edx
test eax, eax
setge dl
mov esi, edx
test ebx, ebx
je 0x40c9c2
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret
test ebx, ebx
je 0x40c9e2
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret
Function at 0x40ca00
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x244
mov eax, dword [0x4451b0]
xor eax, esp
mov dword [esp + 0x240], eax
push ebx
push ebp
mov ebp, dword [esp + 0x250]
push esi
push edi
push 0
push 2
mov dword [esp + 0x18], 0
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [esp + 0x14], esi
cmp esi, 0xffffffff
je 0x40ca6d
push 0x228
lea eax, [esp + 0x24]
push 0
push eax
call fcn.0041c7f0
add esp, 0xc
lea ecx, [esp + 0x1c]
push ecx
push esi
mov dword [esp + 0x24], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x40ca74
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x40cb3c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 0x18], eax
mov edi, edi
mov edx, dword [esp + 0x18]
cmp edx, dword [esp + 0x24]
je 0x40cb10
mov edi, dword [ebp + 0xc]
cmp edi, dword [ebp + 0x10]
jbe 0x40ca9b
call fcn.0041af1f
mov esi, dword [ebp]
mov edi, edi
mov ebx, dword [ebp + 0x10]
cmp dword [ebp + 0xc], ebx
jbe 0x40caad
call fcn.0041af1f
mov eax, dword [ebp]
test esi, esi
je 0x40cab8
cmp esi, eax
je 0x40cabd
call fcn.0041af1f
cmp edi, ebx
je 0x40cb0c
test esi, esi
jne 0x40cb04
call fcn.0041af1f
xor eax, eax
cmp edi, dword [eax + 0x10]
jb 0x40cad6
call fcn.0041af1f
mov eax, dword [edi]
lea ecx, [esp + 0x40]
push ecx
push eax
call fcn.0041bab3
add esp, 8
test eax, eax
je 0x40cb25
test esi, esi
jne 0x40cb08
call fcn.0041af1f
xor eax, eax
cmp edi, dword [eax + 0x10]
jb 0x40caff
call fcn.0041af1f
add edi, 4
jmp 0x40caa0
mov eax, dword [esi]
jmp 0x40cacc
mov eax, dword [esi]
jmp 0x40caf5
mov esi, dword [esp + 0x14]
lea edx, [esp + 0x1c]
push edx
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x40ca80
jmp 0x40cb31
mov esi, dword [esp + 0x14]
mov dword [esp + 0x10], 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x250]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0041a78f
add esp, 0x244
ret
Function at 0x40cb60
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x430
mov eax, dword [0x4451b0]
xor eax, esp
mov dword [esp + 0x42c], eax
cmp dword [edi + 0x18], 8
push ebx
mov eax, 4
push esi
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], eax
lea ebx, [edi + 4]
jb 0x40cba0
mov eax, dword [ebx]
jmp 0x40cba2
mov eax, ebx
mov esi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x14]
push ecx
push eax
push str.Softwareldspop
push SysReAllocString
call esi
test eax, eax
jne 0x40cbd0
mov dword [esp + 8], 1
xor edx, edx
push 0x3fe
push edx
lea eax, [esp + 0x3e]
push eax
mov dword [esp + 0x18], 1
mov dword [esp + 0x1c], 0x400
mov word [esp + 0x40], dx
call fcn.0041c7f0
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x38]
push edx
lea eax, [esp + 0x14]
push eax
push str.shown_ids
push str.SOFTWARELudashi
push SysReAllocString
call esi
test eax, eax
jne 0x40ccc5
mov dword [esp + 0x2c], eax
xor ecx, ecx
lea eax, [esp + 0x34]
mov dword [esp + 0x30], 7
mov word [esp + 0x1c], cx
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40cc40
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 0x38]
push edx
lea esi, [esp + 0x20]
call fcn.00405230
cmp dword [edi + 0x18], 8
jb 0x40cc68
mov edx, dword [ebx]
jmp 0x40cc6a
mov edx, ebx
mov eax, edx
lea esi, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40cc70
sub eax, esi
sar eax, 1
push eax
push edx
lea eax, [esp + 0x20]
call fcn.0040d3b0
mov esi, 1
cmp eax, 0xffffffff
jne 0x40cc98
mov esi, dword [esp + 8]
cmp dword [esp + 0x30], 8
jb 0x40ccac
mov eax, dword [esp + 0x1c]
push eax
call fcn.0041a784
add esp, 4
mov eax, esi
pop esi
pop ebx
mov ecx, dword [esp + 0x42c]
xor ecx, esp
call fcn.0041a78f
add esp, 0x430
ret
mov ecx, dword [esp + 0x434]
mov eax, dword [esp + 8]
pop esi
pop ebx
xor ecx, esp
call fcn.0041a78f
add esp, 0x430
ret
Function at 0x40cce0
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x4348eb
mov eax, dword fs:[0]
push eax
sub esp, 0x42c
mov eax, dword [0x4451b0]
xor eax, esp
mov dword [esp + 0x428], eax
push ebx
push esi
push edi
mov eax, dword [0x4451b0]
xor eax, esp
push eax
lea eax, [esp + 0x43c]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x18], 8
mov dword [esp + 0x18], 1
lea edi, [esi + 4]
jb 0x40cd31
mov eax, dword [edi]
jmp 0x40cd33
mov eax, edi
mov ebx, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push 4
lea ecx, [esp + 0x1c]
push ecx
push 4
push eax
push str.Softwareldspop
push SysReAllocString
call ebx
xor edx, edx
push 0x3fe
push edx
lea eax, [esp + 0x42]
push eax
mov dword [esp + 0x20], 1
mov dword [esp + 0x1c], 0x400
mov word [esp + 0x44], dx
call fcn.0041c7f0
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0x1c]
push eax
push str.shown_ids
push str.SOFTWARELudashi
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x40ce7d
xor ecx, ecx
push 0xffffffffffffffff
push ecx
mov dword [esp + 0x38], eax
push esi
lea eax, [esp + 0x28]
mov dword [esp + 0x40], 7
mov word [esp + 0x2c], cx
call fcn.00402080
mov dword [esp + 0x444], 0
cmp dword [esp + 0x10], 0x190
jbe 0x40cdf1
push str.shown_ids
push str.SOFTWARELudashi
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
jmp 0x40ce2e
push 1
push 0x43b728
lea eax, [esp + 0x24]
call fcn.0040d5e0
lea eax, [esp + 0x38]
lea edx, [eax + 2]
jmp 0x40ce10
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40ce10
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0x24]
call fcn.0040d5e0
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x20]
add eax, eax
mov esi, 8
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], eax
cmp dword [esp + 0x34], esi
jae 0x40ce53
lea ecx, [esp + 0x20]
push eax
push ecx
push 1
push str.shown_ids
push str.SOFTWARELudashi
push SysReAllocString
call ebx
cmp dword [esp + 0x34], esi
jb 0x40ceaf
mov eax, dword [esp + 0x20]
push eax
call fcn.0041a784
add esp, 4
jmp 0x40ceaf
mov eax, dword [esi + 0x14]
add eax, eax
cmp dword [esi + 0x18], 8
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], eax
jb 0x40ce98
mov ecx, dword [edi]
jmp 0x40ce9a
mov ecx, edi
push eax
push ecx
push 1
push str.shown_ids
push str.SOFTWARELudashi
push SysReAllocString
call ebx
mov ecx, dword [esp + 0x43c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x428]
xor ecx, esp
call fcn.0041a78f
add esp, 0x438
ret
Function at 0x40cee0
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x804]
sub esp, 0x804
push 0xfffffffffffffffe
push 0x4418d8
push 0x41c8d0
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x4451b0]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0x800], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, ecx
mov edi, edx
mov ebx, dword [ebp + 0x80c]
mov dword [ebp - 4], 0
test esi, esi
je 0x40d018
cmp word [esi], 0
je 0x40d018
mov eax, esi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40cf50
sub eax, edx
sar eax, 1
cmp eax, 0x104
ja 0x40d018
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40d018
xor eax, eax
mov word [ebp], ax
push 0x7fe
push eax
lea ecx, [ebp + 2]
push ecx
call fcn.0041c7f0
push esi
push 0x43b72c
lea edx, [ebp]
push edx
mov ecx, 0x3ff
call fcn.0040bed0
push 0x3c
push 0
lea eax, [ebp - 0x54]
push eax
call fcn.0041c7f0
add esp, 0x24
mov dword [ebp - 0x54], 0x3c
lea ecx, [ebp]
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x48], str.open
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x38], 1
mov dword [ebp - 0x50], 0x440
lea edx, [ebp - 0x54]
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov esi, eax
test ebx, ebx
je 0x40cff6
test esi, esi
je 0x40d004
push ebx
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test esi, esi
je 0x40d004
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x40d021
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x800]
xor ecx, ebp
call fcn.0041a78f
add ebp, 0x804
mov esp, ebp
pop ebp
ret

Function at 0x40d050
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x40c
mov eax, dword [0x4451b0]
xor eax, esp
mov dword [esp + 0x408], eax
push esi
xor eax, eax
push 0x3fe
push eax
lea ecx, [esp + 0x16]
push ecx
xor esi, esi
mov dword [esp + 0x10], 1
mov dword [esp + 0x14], 0x400
mov word [esp + 0x18], ax
call fcn.0041c7f0
add esp, 0xc
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0xc]
push ecx
push str.DisplayName
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
lea eax, [esi + 1]
je 0x40d0be
mov eax, esi
mov ecx, dword [esp + 0x40c]
pop esi
xor ecx, esp
call fcn.0041a78f
add esp, 0x40c
ret

Function at 0x40f080
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov eax, 4
mov dword [esp + 4], eax
mov dword [esp], eax
lea eax, [esp]
push eax
mov eax, dword [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0xc]
push edx
push eax
push ecx
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
neg eax
sbb eax, eax
inc eax
add esp, 8
ret 8
Function at 0x40f130
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
push esi
push edi
mov edi, 1
mov dword [esp + 8], 0
test eax, eax
jne 0x40f18b
push edi
lea esi, [esp + 0x18]
call fcn.0040f0c0
mov eax, dword [eax]
mov ecx, 4
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], ecx
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0xc]
push edx
lea ecx, [esp + 0x18]
push ecx
push str.lds_show
push eax
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov esi, eax
neg esi
sbb esi, esi
inc esi
jmp 0x40f245
cmp eax, 1
jne 0x40f20b
push 0
mov eax, edi
lea esi, [esp + 0x10]
call fcn.0040f0c0
mov eax, dword [eax]
mov ecx, 4
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x18]
push edx
push str.show
push eax
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov esi, eax
mov eax, dword [esp + 0xc]
neg esi
sbb esi, esi
add eax, 0xfffffff0
inc esi
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40f1f3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test esi, esi
jne 0x40f269
push 1
xor eax, eax
lea esi, [esp + 0x18]
call fcn.0040f0c0
push str.show
jmp 0x40f237
cmp eax, 2
jne 0x40f222
push 0
lea esi, [esp + 0x18]
call fcn.0040f0c0
push str.lite_show
jmp 0x40f237
cmp eax, 3
jne 0x40f274
push 0
lea esi, [esp + 0x18]
call fcn.0040f0c0
push str.desktop_show
mov eax, dword [eax]
push eax
lea ecx, [esp + 0x10]
call fcn.0040f080
mov esi, eax
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
or ecx, 0xffffffff
lea edx, [eax + 0xc]
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40f265
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test esi, esi
je 0x40f274
xor ecx, ecx
cmp dword [esp + 8], ecx
setne cl
mov edi, ecx
mov eax, edi
pop edi
pop esi
add esp, 0x10
ret
Function at 0x40fb80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0xffffffffffffffff
push 0x434738
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4451b0]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [esp + 0x34]
movzx ecx, word [esp + 0x38]
push eax
xor ebp, ebp
push ecx
push edi
mov dword [esp + 0x28], ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x2c], ebp
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
cmp esi, ebp
je 0x40fca0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
cmp ebx, ebp
jle 0x40fca0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebp
je 0x40fca0
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
cmp esi, ebp
je 0x40fca0
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push ebx
mov edi, eax
push esi
push edi
mov dword [esp + 0x2c], edi
call fcn.0041d980
add esp, 0xc
lea edx, [esp + 0x18]
push edx
push ebp
push edi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
cmp dword [esp + 0x18], ebp
je 0x40fcb0
push 0x10
call sub.gdiplus.dll_GdipAlloc
mov esi, eax
cmp esi, ebp
je 0x40fc64
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x38]
push ecx
push eax
mov dword [esi], vtable.Gdiplus::Bitmap.0
mov dword [esp + 0x40], ebp
call sub.gdiplus.dll_GdipCreateBitmapFromStream
mov edx, dword [esp + 0x38]
mov dword [esi + 8], eax
mov dword [esi + 4], edx
jmp 0x40fc66
xor esi, esi
cmp esi, ebp
jne 0x40fc74
mov dword [esp + 0x2c], 0xffffffff
jmp 0x40fca0
mov ecx, dword [esi + 4]
push 0xff000000
lea eax, [esp + 0x20]
push eax
push ecx
call sub.gdiplus.dll_GdipCreateHBITMAPFromBitmap
mov dword [esp + 0x2c], 0xffffffff
push 1
mov ecx, esi
cmp eax, ebp
je 0x40fc9a
mov dword [esi + 8], eax
mov edx, dword [esi]
mov eax, dword [edx]
call eax
mov eax, dword [esp + 0x18]
cmp eax, ebp
je 0x40fcb0
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x20]
mov dword [esp + 0x18], ebp
cmp eax, ebp
je 0x40fcc3
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x4101f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x435598
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4451b0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x34]
mov ebx, dword [esp + 0x30]
mov esi, ecx
mov al, byte [esi + 0xc]
mov byte [esp + 0x34], 0
mov byte [esp + 0x35], 0
mov byte [esp + 0x36], al
mov byte [esp + 0x37], 1
mov dword [esp + 0x30], vtable.CTempDC.0
mov eax, esi
mov dword [esp + 0x20], 0
call fcn.00410190
test eax, eax
jne 0x4102fc
mov ecx, dword [esi + 4]
cmp ebp, ecx
jl 0x410264
cmp byte [esi + 0xc], al
je 0x4102fc
mov eax, dword [esi + 0x1c]
cdq
idiv ecx
mov ecx, dword [esi + 0x30]
mov edx, dword [0x44a9f4]
push ecx
push edx
mov edi, eax
call dword [sym.imp.GDI32.dll_SelectObject]
cmp dword [esi + 0x68], 0
mov dword [esp + 0x30], eax
je 0x4102c1
cmp word [esi + 0x2a], 0x20
je 0x410293
mov byte [esp + 0x37], 0
mov eax, dword [esp + 0x34]
mov esi, dword [esi + 0x20]
mov edx, dword [0x44a9f4]
push eax
mov eax, dword [esp + 0x30]
push esi
mov ecx, edi
imul ecx, ebp
push edi
push 0
push ecx
mov ecx, dword [esp + 0x3c]
push edx
push esi
push edi
push ebx
push eax
push ecx
call dword [sym.imp.MSIMG32.dll_AlphaBlend]
jmp 0x4102ea
mov eax, dword [0x44a9f4]
mov ecx, dword [esi + 0x20]
mov edx, edi
imul edx, ebp
push 0xcc0020
push 0
push edx
mov edx, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push ecx
push edi
push ebx
push edx
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
mov ecx, dword [esp + 0x30]
mov edx, dword [0x44a9f4]
push ecx
push edx
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0x10
Function at 0x4111c0
Capabilities:
Check if file exists
Print debug messages

Disassembly:
sub esp, 0x21c
mov eax, dword [0x4451b0]
xor eax, esp
mov dword [esp + 0x214], eax
push ebx
push ebp
push esi
push edi
push 0x208
lea eax, [esp + 0x1c]
push 0
push eax
mov edi, ecx
call fcn.0041c7f0
add esp, 0xc
push 0x104
lea ecx, [esp + 0x1c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea edx, [esp + 0x18]
push edx
call esi
lea eax, [esp + 0x18]
push eax
call esi
mov ebx, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push str.wallpaperhelper360NetUL.dll
lea ecx, [esp + 0x1c]
push ecx
call ebx
mov ebp, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea edx, [esp + 0x18]
push edx
call ebp
test eax, eax
jne 0x41125c
lea eax, [esp + 0x18]
push eax
call esi
lea ecx, [esp + 0x18]
push ecx
call esi
push str.DrvMgr360NetUL.dll
lea edx, [esp + 0x1c]
push edx
call ebx
lea eax, [esp + 0x18]
push eax
call ebp
test eax, eax
je 0x411296
call fcn.0040c310
test eax, eax
je 0x41128b
lea ecx, [esp + 0x18]
push ecx
push 0x44a5b8
lea esi, [esp + 0x1c]
mov dword [esp + 0x1c], 0
call fcn.0040c120
test eax, eax
je 0x41128b
cmp dword [esp + 0x14], 3
jne 0x41129a
push str._pop_check_360NetUL.dll_failed.
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor eax, eax
jmp 0x4112a4
lea edx, [esp + 0x18]
push edx
call fcn.004112c0
mov ecx, dword [esp + 0x224]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0041a78f
add esp, 0x21c
ret

Function at 0x4112c0
Capabilities:
Link many functions at runtime

Disassembly:
cmp dword [edi], 0
push ebx
mov ebx, dword [esp + 8]
push esi
je 0x4112d5
mov eax, 1
pop esi
pop ebx
ret 4
call fcn.0040c310
test eax, eax
je 0x411300
push ebx
push 0x44a5b8
lea esi, [esp + 0x14]
mov dword [esp + 0x14], 0
call fcn.0040c120
test eax, eax
je 0x411300
cmp dword [esp + 0xc], 3
jne 0x411307
xor eax, eax
pop esi
pop ebx
ret 4
cmp dword [edi + 4], 0
jne 0x411396
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [edi + 4], eax
test eax, eax
je 0x411300
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.HttpInit
push eax
call esi
mov dword [edi + 8], eax
mov eax, dword [edi + 4]
push str.HttpUninit
push eax
call esi
mov ecx, dword [edi + 4]
push str.zlib_uncompress
push ecx
mov dword [edi + 0xc], eax
call esi
mov edx, dword [edi + 4]
push str.zlib_compress
push edx
mov dword [edi + 0x14], eax
call esi
mov dword [edi + 0x18], eax
mov eax, dword [edi + 4]
push str.zlib_compressBound
push eax
call esi
mov dword [edi + 0x1c], eax
mov eax, dword [edi + 8]
test eax, eax
je 0x411374
call eax
mov dword [edi + 0x10], eax
cmp dword [edi + 0xc], 0
je 0x411392
cmp dword [edi + 8], 0
je 0x411392
cmp dword [edi + 0x10], 0
je 0x411392
mov eax, 1
mov dword [edi], eax
pop esi
pop ebx
ret 4
xor eax, eax
mov dword [edi], eax
mov eax, dword [edi]
pop esi
pop ebx
ret 4
Function at 0x4136e0
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x68
mov eax, dword [0x4451b0]
xor eax, esp
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x6c]
xor ecx, ecx
push esi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], ecx
push eax
mov eax, dword [esp + 0x78]
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.00417500
add esp, 4
lea esi, [esp + 8]
mov ecx, edi
call fcn.004175a0
mov ecx, dword [esp + 0x64]
pop esi
xor ecx, esp
call fcn.0041a78f
add esp, 0x68
ret