joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43413d
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push 0x2a0
mov eax, 0x4f1761
call fcn.004bcfcf
mov dword [ebp - 0x2ac], ecx
mov esi, dword [ebp + 8]
xor eax, eax
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
cmp dword [esi + 0x10], eax
je 0x434288
push 0x24c
push eax
mov dword [ebp - 0x2a8], eax
lea eax, [ebp - 0x2a4]
push eax
call fcn.004bf240
add esp, 0xc
lea eax, [ebp - 0x40]
push 0x512bcc
push esi
push eax
call fcn.00424515
add esp, 0xc
and dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
push esi
call fcn.00406c10
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2a8]
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
push ecx
cmovae eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp word [ebp - 0x27c], 0x2e
je 0x434250
test byte [ebp - 0x2a8], 0x10
je 0x434205
push 0x50f8e4
lea ecx, [ebp - 0x28]
call fcn.00406da0
lea eax, [ebp - 0x27c]
push eax
lea ecx, [ebp - 0x28]
call fcn.00406da0
mov ecx, dword [ebp - 0x2ac]
lea eax, [ebp - 0x28]
push ebx
push edi
push eax
call fcn.0043413d
jmp 0x434250
cmp word [ebp - 0x27c], 0
je 0x434250
test edi, edi
je 0x434250
push 0x50f8e4
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.00424515
add esp, 0xc
lea eax, [ebp - 0x27c]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x58]
call fcn.00406da0
lea eax, [ebp - 0x58]
push ebx
push eax
call edi
pop ecx
pop ecx
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 1
call fcn.00402a40
lea eax, [ebp - 0x2a8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4341bf
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.00402a40
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.00402a40
xor eax, eax
inc eax
call fcn.004bcf7e
ret 0xc
Function at 0x43454e
Capabilities:
Print debug messages

Disassembly:
push 0xe4
mov eax, 0x4f1817
call fcn.004bcfcf
call fcn.00434506
test eax, eax
mov esi, reloc.OLEAUT32.dll_SysReAllocString
mov edx, str.SOFTWAREClassesCLSIDD27CDB6E_AE6D_11cf_96B8_444553540000InprocServer32
setne cl
test cl, cl
lea ecx, [ebp - 0x28]
lea eax, [esi - 2]
cmovne esi, eax
mov eax, str.CLSIDD27CDB6E_AE6D_11cf_96B8_444553540000InprocServer32
cmove eax, edx
push eax
call fcn.00406c40
xor ebx, ebx
lea eax, [ebp - 0x28]
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x41]
cmp dword [ebp - 0x14], 8
mov edi, 0xf003f
push 1
cmovae eax, dword [ebp - 0x28]
push edi
push eax
push esi
call fcn.00433204
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], ebx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
push edi
cmovae ecx, dword [ebp - 0x28]
push ecx
push esi
lea ecx, [ebp - 0x50]
call fcn.00426042
mov ebx, eax
or edi, 0xffffffff
test ebx, ebx
jne 0x4345ee
push 1
mov eax, 0x50f8e0
lea ecx, [ebp - 0x50]
push eax
push eax
call fcn.00432207
mov edi, eax
push ecx
push ecx
lea ecx, [ebp - 0xf0]
call fcn.00434bd2
mov byte [ebp - 4], 2
lea eax, [ebp - 0xf0]
cmp dword [ebp - 0x14], 8
lea esi, [ebp - 0x28]
push eax
cmovae esi, dword [ebp - 0x28]
call fcn.00437912
pop ecx
push edi
push ecx
push dword [ebp - 0x54]
mov edx, str.CrashRepair::BeginRegisterAcessable
push ecx
push ebx
push ecx
mov ecx, eax
call fcn.00437944
mov edx, str.__reg.Open:
mov ecx, eax
call fcn.00437b91
pop ecx
mov ecx, eax
call fcn.00434dfd
mov edx, str.__helper.AddRegAccess:
mov ecx, eax
call fcn.00437b91
pop ecx
mov ecx, eax
call fcn.00434d05
mov edx, str.__reg.SetStringValue
mov ecx, eax
call fcn.00437b91
pop ecx
mov ecx, eax
call fcn.00434dfd
mov edx, str.__location_is:
mov ecx, eax
call fcn.00437b91
mov edx, esi
mov ecx, eax
call fcn.00437b91
push eax
call fcn.00437912
pop ecx
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0xf0]
call fcn.00434ccd
mov byte [ebp - 4], 3
cmp dword [eax + 0x14], 8
jb 0x43469e
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 2
call fcn.00402a40
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], 1
call fcn.00434c8a
lea eax, [ebp - 0xa0]
mov dword [ebp - 0xa0], vtable.std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__.0
push eax
mov dword [ebp - 0xa0], vtable.std::ios_base.0
call fcn.004bb773
pop ecx
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 0
call fcn.00426028
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00402a40
call fcn.004bcf7e
ret
Function at 0x4346ff
Capabilities:
Print debug messages

Disassembly:
push 0xdc
mov eax, 0x4f186a
call fcn.004bcfcf
call fcn.00434506
test eax, eax
mov esi, reloc.OLEAUT32.dll_SysReAllocString
mov edx, str.SOFTWAREClassesCLSIDD27CDB6E_AE6D_11cf_96B8_444553540000InprocServer32
setne cl
test cl, cl
lea ecx, [ebp - 0x28]
lea eax, [esi - 2]
cmovne esi, eax
mov eax, str.CLSIDD27CDB6E_AE6D_11cf_96B8_444553540000InprocServer32
cmove eax, edx
push eax
call fcn.00406c40
xor ebx, ebx
lea eax, [ebp - 0x28]
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x49]
cmp dword [ebp - 0x14], 8
mov edi, ebx
cmovae eax, dword [ebp - 0x28]
push eax
push esi
lea eax, [ebp - 0x50]
push eax
call fcn.00433381
mov byte [ebp - 4], 1
mov esi, dword [ebp - 0x50]
cmp dword [esi - 0xc], ebx
je 0x43479a
lea ecx, [ebp - 0x48]
call fcn.00432610
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 2
call fcn.00432747
push ebx
lea eax, [ebp - 0x48]
push eax
push 4
push esi
call fcn.00432f83
add esp, 0x10
movzx edi, al
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 1
call fcn.00432653
lea ecx, [esi - 0x10]
mov byte [ebp - 4], bl
call fcn.004206ab
push ecx
push ecx
lea ecx, [ebp - 0xe8]
call fcn.00434bd2
mov byte [ebp - 4], 3
lea eax, [ebp - 0xe8]
cmp dword [ebp - 0x14], 8
lea esi, [ebp - 0x28]
push eax
cmovae esi, dword [ebp - 0x28]
call fcn.00437912
pop ecx
push edi
push ecx
mov edx, str.CrashRepair::EndRegisterAcessable
mov ecx, eax
call fcn.00437944
mov edx, str.__RestoreRegAccess:
mov ecx, eax
call fcn.00437b91
pop ecx
mov ecx, eax
call fcn.00434d05
mov edx, str.__location_is:
mov ecx, eax
call fcn.00437b91
mov edx, esi
mov ecx, eax
call fcn.00437b91
push eax
call fcn.00437912
pop ecx
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0xe8]
call fcn.00434ccd
mov byte [ebp - 4], 4
cmp dword [eax + 0x14], 8
jb 0x434827
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 3
call fcn.00402a40
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], bl
call fcn.00434c8a
lea eax, [ebp - 0x98]
mov dword [ebp - 0x98], vtable.std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__.0
push eax
mov dword [ebp - 0x98], vtable.std::ios_base.0
call fcn.004bb773
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x28]
call fcn.00402a40
call fcn.004bcf7e
ret
Function at 0x4409dd
Capabilities:
Create process on windows
Get common file path
Get program files directory
Get startup folder

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4f2c3b
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x52fe80]
xor eax, esp
mov dword [esp + 0x224], eax
push esi
push edi
mov eax, dword [0x52fe80]
xor eax, esp
push eax
lea eax, [esp + 0x238]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 8]
cmp eax, dword [edi + 0x10]
je 0x440b11
cmp eax, dword [edi + 0x14]
je 0x440b11
cmp eax, dword [edi + 0x18]
je 0x440b11
cmp eax, dword [edi + 0x1c]
jne 0x440a7f
lea ecx, [edi - 0x40]
call fcn.00441172
lea eax, [edi + 0xc0]
xor esi, esi
push eax
lea ecx, [edi + 0x40]
mov dword [edi + 0xd8], esi
call fcn.0044329a
lea eax, [edi - 0x40]
test eax, eax
je 0x440a6a
lea esi, [edi + 8]
lea ecx, [edi - 0x38]
mov eax, dword [ecx]
push esi
call dword [eax + 8]
mov ecx, eax
call fcn.0044a351
jmp 0x440b20
cmp eax, dword [edi + 0x38]
jne 0x440b20
xor esi, esi
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], esi
push esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], 7
call fcn.00403c20
lea eax, [esp + 0x24]
mov dword [esp + 0x240], esi
push eax
push esi
push esi
push 0x26
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x440acd
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x10]
call fcn.00406d50
push str.Internet_Exploreriexplore.exe
lea ecx, [esp + 0x10]
call fcn.00407250
cmp dword [esp + 0x20], 8
lea eax, [esp + 0xc]
push 5
cmovae eax, dword [esp + 0x10]
push esi
push str.http:__www.liebao.cn_go_security_doctor_contact.html
push eax
push 0x511078
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
or dword [esp + 0x240], 0xffffffff
lea ecx, [esp + 0xc]
call fcn.00402a40
jmp 0x440b20
lea ecx, [edi - 0x38]
mov eax, dword [ecx]
call dword [eax + 8]
mov ecx, eax
call fcn.0044a0f0
mov ecx, dword [esp + 0x238]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x224]
xor ecx, esp
call fcn.004bc1bd
mov esp, ebp
pop ebp
ret 4
Function at 0x440b48
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4f2c79
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x52fe80]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push esi
push edi
mov eax, dword [0x52fe80]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0xd0]
test eax, eax
jne 0x440c33
push dword [esi + 0x3c]
mov ecx, dword [esi + 0x18]
call fcn.00440693
mov al, byte [esi + 0x42]
test al, al
je 0x440c2d
push 0x51382c
lea ecx, [esp + 0x14]
call fcn.00406c40
xor ebx, ebx
lea edx, [esp + 0x10]
mov dword [esp + 0x38], ebx
mov ecx, dword [esi + 0x1c]
push edx
mov eax, dword [ecx]
call dword [eax + 0x40]
or dword [esp + 0x38], 0xffffffff
lea ecx, [esp + 0x10]
call fcn.00402a40
lea ecx, [esi - 0x40]
call fcn.0044dbb4
xor edi, edi
lea eax, [esp + 0x10]
inc edi
lea ecx, [esi + 0x38]
push eax
mov dword [esi + 0xd0], edi
call fcn.004405b9
mov dword [esp + 0x38], edi
lea edi, [esi + 0x98]
lea ecx, [edi + 4]
cmp ecx, eax
je 0x440c0c
push 0xffffffffffffffff
push ebx
push eax
call fcn.004072a0
push ebx
push ebx
push edi
push 0x44377a
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
or dword [esp + 0x38], 0xffffffff
lea ecx, [esp + 0x10]
mov dword [edi + 0x1c], eax
call fcn.00402a40
cmp byte [esi + 0x41], 0
jmp 0x440c4b
cmp eax, 1
jne 0x440c6e
push 0
push dword [esi + 0xb4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x440c6e
lea ecx, [esi - 0x48]
call fcn.00441235
lea eax, [esi - 0x48]
neg eax
lea ecx, [esi - 0x40]
sbb eax, eax
and eax, esi
push eax
mov eax, dword [ecx]
call dword [eax + 8]
mov ecx, eax
call fcn.0044a3a9
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.004bc1bd
mov esp, ebp
pop ebp
ret 4
Function at 0x441581
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x6c
mov eax, 0x4f2df7
call fcn.004bcfcf
xor ebx, ebx
mov dword [ebp - 0x48], str.chrome.dll
mov dword [ebp - 0x30], ebx
lea ecx, [ebp - 0x44]
push ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], 7
call fcn.00403c20
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], ebx
call fcn.0044399e
mov esi, ebx
mov edi, vtable.WinMod::CWinModule.0
inc ebx
push dword [ebp + esi*4 - 0x48]
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.00424515
add esp, 0xc
mov byte [ebp - 4], bl
lea eax, [ebp - 0x2c]
cmp dword [ebp - 0x18], 8
cmovae eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x44163c
test al, 0x10
jne 0x44163c
lea ecx, [ebp - 0x78]
call fcn.0042ba72
mov byte [ebp - 4], 2
lea eax, [ebp - 0x2c]
cmp dword [ebp - 0x18], 8
push ecx
cmovae eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x78]
push eax
call fcn.0043f114
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x78], edi
test eax, eax
jne 0x441637
call fcn.00424b15
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0
call fcn.00402a40
inc esi
cmp esi, ebx
jb 0x4415bf
jmp 0x44164a
call fcn.00424b15
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0
call fcn.00402a40
xor bl, bl
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x44]
call fcn.00402a40
mov al, bl
call fcn.004bcf7e
ret

Function at 0x44165e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x64
mov eax, 0x4f2e34
call fcn.004bcfcf
xor ebx, ebx
mov dword [ebp - 0x24], str.resources.pak
mov dword [ebp - 0x40], ebx
lea ecx, [ebp - 0x54]
push ebx
mov dword [ebp - 0x20], str.chrome_100_percent.pak
mov dword [ebp - 0x1c], 0x513954
mov dword [ebp - 0x18], str.localeszh_CN.pak
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], 7
call fcn.00403c20
lea ecx, [ebp - 0x54]
mov dword [ebp - 4], ebx
call fcn.0044399e
mov esi, ebx
inc ebx
mov dword [ebp - 0x70], ebx
jmp 0x4416b4
xor ebx, ebx
inc ebx
push dword [ebp + esi*4 - 0x24]
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.00424515
add esp, 0xc
mov byte [ebp - 4], bl
lea eax, [ebp - 0x3c]
cmp dword [ebp - 0x28], 8
cmovae eax, dword [ebp - 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x44172f
test al, 0x10
jne 0x44172f
cmp dword [ebp - 0x28], 8
lea eax, [ebp - 0x3c]
lea ecx, [ebp - 0x6c]
cmovae eax, dword [ebp - 0x3c]
push eax
call fcn.00406c40
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 2
call fcn.0043f67d
mov bl, al
mov byte [ebp - 4], 1
neg bl
lea ecx, [ebp - 0x6c]
sbb bl, bl
call fcn.00402a40
inc bl
jne 0x44172f
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], bl
call fcn.00402a40
inc esi
cmp esi, 4
jb 0x4416b1
jmp 0x44173f
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 0
call fcn.00402a40
mov byte [ebp - 0x70], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x54]
call fcn.00402a40
mov al, byte [ebp - 0x70]
call fcn.004bcf7e
ret
Function at 0x44269a
Capabilities:
Get file size
Read file via mapping

Disassembly:
push 0x30
mov eax, 0x4f302a
call fcn.004bcfcf
mov edi, ecx
mov eax, dword [ebp + 8]
xor ebx, ebx
or dword [edi + 0xc], 0xffffffff
mov dword [ebp - 0x3c], edi
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocStringLen
mov dword [ebp - 4], ebx
push eax
mov dword [edi], vtable.KBufFileSendData.0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [edi + 0x10], eax
cmp eax, 0xffffffff
jne 0x442704
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x513c50
lea ecx, [ebp - 0x38]
call fcn.0042ad56
push 0x52b58c
lea eax, [ebp - 0x38]
push eax
call fcn.004bcf07
push ebx
push ebx
push ebx
push 2
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [edi + 0x14], eax
test eax, eax
jne 0x44272f
push dword [edi + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x513c60
jmp 0x4426ee
push ebx
push ebx
push ebx
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
jne 0x44275f
push dword [edi + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [edi + 0x10]
call esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x513c74
jmp 0x4426ee
push ebx
push dword [edi + 0x10]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [edi + 0xc], eax
mov eax, edi
mov dword [edi + 8], esi
call fcn.004bcf7e
ret 4
Function at 0x44779b
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push edi
push dword [ebp + 8]
mov edi, ecx
xor eax, eax
mov dword [edi], eax
mov dword [edi + 4], eax
mov byte [edi + 0x5c], al
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [edi], eax
test eax, eax
je 0x4478d1
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.XL_Init
push eax
call esi
push str.XL_UnInit
push dword [edi]
mov dword [edi + 4], eax
call esi
push str.XL_CreateTask
push dword [edi]
mov dword [edi + 8], eax
call esi
push str.XL_DeleteTask
push dword [edi]
mov dword [edi + 0xc], eax
call esi
push str.XL_StartTask
push dword [edi]
mov dword [edi + 0x10], eax
call esi
push str.XL_StopTask
push dword [edi]
mov dword [edi + 0x14], eax
call esi
push str.XL_QueryTaskInfoEx
push dword [edi]
mov dword [edi + 0x18], eax
call esi
push str.XL_DelTempFile
push dword [edi]
mov dword [edi + 0x1c], eax
call esi
push str.XL_SetSpeedLimit
push dword [edi]
mov dword [edi + 0x20], eax
call esi
push str.XL_SetUploadSpeedLimit
push dword [edi]
mov dword [edi + 0x24], eax
call esi
push str.XL_SetProxy
push dword [edi]
mov dword [edi + 0x28], eax
call esi
push str.XL_SetUserAgent
push dword [edi]
mov dword [edi + 0x2c], eax
call esi
push str.XL_ParseThunderPrivateUrl
push dword [edi]
mov dword [edi + 0x30], eax
call esi
push str.XL_Determine3GNetType
push dword [edi]
mov dword [edi + 0x34], eax
call esi
push str.XL_GetFileSizeWithUrl
push dword [edi]
mov dword [edi + 0x38], eax
call esi
push str.XL_SetFileIdAndSize
push dword [edi]
mov dword [edi + 0x3c], eax
call esi
push str.XL_SetAdditionInfo
push dword [edi]
mov dword [edi + 0x40], eax
call esi
push str.XL_CreateTaskByURL
push dword [edi]
mov dword [edi + 0x44], eax
call esi
push str.XL_CreateTaskByThunder
push dword [edi]
mov dword [edi + 0x48], eax
call esi
push str.XL_CreateBTTaskByThunder
push dword [edi]
mov dword [edi + 0x4c], eax
call esi
push str.XL_AddServerResourceEx
push dword [edi]
mov dword [edi + 0x50], eax
call esi
push str.XL_SetThreadNum
push dword [edi]
mov dword [edi + 0x54], eax
call esi
mov dword [edi + 0x58], eax
mov byte [edi + 0x5c], 1
pop esi
mov eax, edi
pop edi
pop ebp
ret 4
Function at 0x4484ed
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, ecx
cmp byte [edi + 0x24], 0
je 0x448501
xor eax, eax
jmp 0x44859b
cmp dword [edi + 0x18], 0
je 0x4484fa
push esi
lea esi, [edi + 8]
cmp dword [esi + 0x14], 8
jb 0x448515
mov eax, dword [esi]
jmp 0x448517
mov eax, esi
push ebx
push 0x512c10
push eax
call fcn.004c2c07
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
jne 0x44857a
push 3
pop ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x448571
test ebx, ebx
jle 0x448576
dec ebx
push 0xc8
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [esi + 0x14], 8
jb 0x448553
mov eax, dword [esi]
jmp 0x448555
mov eax, esi
push 0x512c10
push eax
call fcn.004c2c07
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
jne 0x44857a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [ebp - 4]
cmp eax, 0x20
je 0x448536
xor eax, eax
jmp 0x448599
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004c2abe
push ebx
mov esi, eax
call fcn.004c0d4e
add esp, 0x14
mov eax, esi
add dword [edi + 0x28], esi
pop ebx
pop esi
pop edi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x44a0f0
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push 0
mov eax, dword [esi + 4]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 4]
push 0
push 0
push 0x402
push dword [eax + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
pop esi
ret
Function at 0x44cac9
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x52fe80]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
push 0
mov dword [ebp - 0x208], edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edx, dword [0x55d814]
mov esi, eax
test edx, edx
movzx ecx, di
push str.BINDATA
cmovne esi, edx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x44cb7a
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
je 0x44cb74
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x44cb74
push edi
push eax
call dword [sym.imp.SHLWAPI.dll_SHCreateMemStream]
push 0x10
mov edi, eax
call dword [sym.imp.gdiplus.dll_GdipAlloc]
mov esi, eax
test esi, esi
je 0x44cb64
lea ecx, [esi + 4]
mov dword [esi], vtable.Gdiplus::Image.0
and dword [ecx], 0
push ecx
push edi
call dword [sym.imp.gdiplus.dll_GdipLoadImageFromStream]
mov dword [esi + 8], eax
jmp 0x44cb66
xor esi, esi
test edi, edi
je 0x44cb70
mov ecx, dword [edi]
push edi
call dword [ecx + 8]
mov eax, esi
jmp 0x44cbd0
mov edi, dword [ebp - 0x208]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
je 0x44cbce
xor eax, eax
push 0x1fc
push eax
mov word [ebp - 0x204], ax
lea eax, [ebp - 0x202]
push eax
call fcn.004bf240
push esi
push edi
lea eax, [ebp - 0x204]
push str.Function:__s__image_id:_d__Last_error:__d
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x1c
lea eax, [ebp - 0x204]
push 0
push str.Error
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004bc1bd
mov esp, ebp
pop ebp
ret
Function at 0x450035
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x19c
mov eax, dword [0x52fe80]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x55dc5c], 0
push esi
je 0x450059
xor eax, eax
jmp 0x4500e6
mov al, byte [0x55d80d]
xor esi, esi
movzx ecx, al
inc esi
test al, al
mov dword [fcn.004bc2f0], 0x4bc2f0
lea eax, [ebp - 0x198]
mov dword [fcn.004bbc6e], 0x4bbc6e
push eax
cmove ecx, esi
mov dword [fcn.004c048f], 0x4c048f
push 0x101
mov dword [fcn.004c54db], 0x4c54db
mov dword [fcn.004bc2b0], 0x4bc2b0
mov byte [0x55d80d], cl
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x4500e3
mov eax, dword [ebp - 0x198]
cmp al, 1
jne 0x4500dd
shr eax, 8
cmp al, 1
jne 0x4500dd
mov dword [0x55dc5c], esi
mov dword [0x55dc58], 3
jmp 0x450052
call dword [sym.imp.WS2_32.dll_WSACleanup]
push 2
pop eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004bc1bd
mov esp, ebp
pop ebp
ret
Function at 0x46d276
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
push eax
push eax
push eax
push 0x46cf6c
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0x14]
mov dword [eax], 1
xor eax, eax
pop ebp
ret 0x10