joyce8/EMBER2024-capa huggingface dataset:
Function at 0x427710
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
sub esp, 0x19c
mov eax, dword [0x4e44b4]
xor eax, esp
mov dword [esp + 0x194], eax
cmp dword [0x54e934], 0
jne 0x427781
lea eax, [esp]
push eax
push 0x202
call sub.WS2_32.dll_WSAStartup
test eax, eax
je 0x427756
xor eax, eax
mov ecx, dword [esp + 0x194]
xor ecx, esp
call fcn.00495cb8
add esp, 0x19c
ret
push str.upload_data.qq.com
call sub.WS2_32.dll_gethostbyname
test eax, eax
je 0x42777c
movsx ecx, word [eax + 0xa]
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
push ecx
push eax
push 0x54e934
call fcn.0049c020
add esp, 0xc
call sub.WS2_32.dll_WSACleanup
mov ecx, dword [esp + 0x194]
mov eax, dword [0x54e934]
xor ecx, esp
call fcn.00495cb8
add esp, 0x19c
ret

Function at 0x4277a0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Initialize winsock library
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
sub esp, 0x2b8
mov eax, dword [0x4e44b4]
xor eax, esp
mov dword [esp + 0x2b0], eax
push ebx
push esi
push edi
lea eax, [esp + 0x20]
push eax
push 0x202
mov esi, ecx
mov ebx, edx
call sub.WS2_32.dll_WSAStartup
test eax, eax
jne 0x4277e5
push 6
push 1
push 2
call sub.WS2_32.dll_socket
mov edi, eax
cmp edi, 0xffffffff
jne 0x4277ff
call sub.WS2_32.dll_WSACleanup
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x2b0]
xor ecx, esp
call fcn.00495cb8
add esp, 0x2b8
ret
mov word [esp + 0x10], 2
call fcn.00427710
test eax, eax
je 0x427818
push eax
call sub.WS2_32.dll_inet_ntoa
push eax
jmp 0x42781d
push str.121.14.102.16
push 0x4d0338
push 0x40
push 0x54e938
call fcn.0049761d
add esp, 0x10
push 0x54e938
call sub.WS2_32.dll_inet_addr
push 0x1bb
mov dword [esp + 0x18], eax
call sub.WS2_32.dll_htons
push 0x10
lea ecx, [esp + 0x14]
push ecx
push edi
mov word [esp + 0x1e], ax
call sub.WS2_32.dll_connect
cmp eax, 0xffffffff
je 0x4277e0
test esi, esi
jle 0x427876
push 0
push esi
push ebx
push edi
call sub.WS2_32.dll_send
sub esi, eax
add ebx, eax
test esi, esi
jg 0x427864
push 0x103
lea edx, [esp + 0x1b5]
push 0
push edx
mov byte [esp + 0x1bc], 0
call fcn.00499a30
add esp, 0xc
push 0
push 0x104
lea eax, [esp + 0x1b8]
push eax
push edi
call sub.WS2_32.dll_recv
lea ecx, [esp + 0x1b0]
push str.RESULT:
push ecx
call fcn.004976d0
add esp, 8
test eax, eax
je 0x4278e4
add eax, 7
cmp byte [eax], 0x20
jne 0x4278d8
jmp 0x4278d0
add eax, 1
cmp byte [eax], 0x20
je 0x4278d0
xor edx, edx
cmp byte [eax], 0x31
sete dl
mov esi, edx
jmp 0x4278e6
xor esi, esi
push edi
call sub.WS2_32.dll_closesocket
call sub.WS2_32.dll_WSACleanup
mov ecx, dword [esp + 0x2bc]
pop edi
mov eax, esi
pop esi
pop ebx
xor ecx, esp
call fcn.00495cb8
add esp, 0x2b8
ret
Function at 0x42afc0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4bd2ca
mov eax, dword fs:[0]
push eax
sub esp, 0xe4
mov eax, dword [0x4e44b4]
xor eax, esp
mov dword [esp + 0xdc], eax
push ebx
push esi
mov eax, dword [0x4e44b4]
xor eax, esp
push eax
lea eax, [esp + 0xf0]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0xc8], 7
mov dword [esp + 0xc4], ebx
mov word [esp + 0xb4], bx
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
mov dword [esp + 0x114], ebx
push 0xb
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push 0x4c9d10
lea esi, [esp + 0xd4]
mov byte [ecx + 4], bl
call fcn.00402d90
call fcn.00401be0
mov esi, 1
add esp, 0x1c
cmp dword [0x4e8f68], esi
mov byte [esp + 0x13], al
jne 0x42b0a7
call fcn.004722e0
cmp eax, 3
jg 0x42b0a7
cmp byte [esp + 0x13], bl
jne 0x42b0a7
push 3
push 0x12
push str.R:BuildWorkTempQQ1.87HummerPack4921AutoProject_setup3HummerSetup_after_install_show_new_feature.cpp
lea ecx, [esp + 0x28]
call fcn.00473160
add eax, 4
push str.Check_failed:_result.
mov byte [esp + 0xfc], 1
push eax
mov dword [esp + 0x1c], esi
call fcn.004041d0
add esp, 8
mov dword [esp + 0xf8], ebx
test byte [esp + 0x14], 1
je 0x42b0be
lea ecx, [esp + 0x1c]
call fcn.00472c30
lea eax, [esp + 0xb0]
push eax
lea ecx, [esp + 0xd0]
call fcn.00475a60
mov eax, dword [esp + 0xd0]
mov esi, 8
cmp dword [esp + 0xe4], esi
jae 0x42b0ee
lea eax, [esp + 0xd0]
push 5
push eax
push ebx
push str.QQWhatsnew.txt
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [esp + 0xcc]
call fcn.00475620
cmp dword [esp + 0xc8], esi
jb 0x42b128
mov ecx, dword [esp + 0xb4]
push ecx
call fcn.00495fd1
add esp, 4
mov ecx, dword [esp + 0xf0]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0xdc]
xor ecx, esp
call fcn.00495cb8
mov esp, ebp
pop ebp
ret 4
Function at 0x4350a0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x4b749b
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4e44b4]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00494e06
push 4
mov dword [esp + 0x24], 0
call fcn.00495ce0
mov edi, eax
add esp, 4
test edi, edi
je 0x435124
call fcn.004950f4
mov dword [edi], eax
call fcn.00494f28
push 0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.00495230
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x435119
add eax, 1
mov dword [ebx + 4], eax
lea ecx, [esp + 0x10]
call fcn.00495251
jmp 0x435126
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret

Function at 0x43ae60
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4b7388
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x4e44b4]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov eax, dword [esp + 0x30]
mov word [esp + 0xc], 0
mov word [esp + 0xe], 0
lea edx, [esp + 0xc]
push edx
mov edx, dword [esp + 0x38]
push 6
mov dword [esp + 0x30], 0
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x18]
call eax
mov esi, eax
test esi, esi
je 0x43aed4
lea eax, [esp + 0xc]
call fcn.0045c810
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x24
ret
mov ax, word [esp + 0xc]
cmp ax, 0xb
jne 0x43af06
cmp word [esp + 0x14], 0
lea eax, [esp + 0xc]
setne cl
mov byte [edi], cl
call fcn.0045c810
xor eax, eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x24
ret
test ax, ax
jne 0x43af29
mov byte [edi], al
lea eax, [esp + 0xc]
call fcn.0045c810
xor eax, eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x24
ret
lea eax, [esp + 0xc]
call fcn.0045c810
mov eax, 0x80004005
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x24
ret
Function at 0x43f050
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0xffffffffffffffff
push 0x4b8080
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4e44b4]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x2c]
xor ebx, ebx
mov dword [esp + 0x2c], ebx
push 0x14
mov dword [esp + 0x20], ebx
call fcn.00495ce0
add esp, 4
cmp eax, ebx
je 0x43f115
mov dword [eax + 4], ebx
mov dword [eax], vtable.ResFileStream.0
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
mov esi, eax
call edx
mov eax, dword [esp + 0x28]
push ebp
push eax
mov dword [esp + 0x34], esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x28]
push ebp
push ecx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [esi + 8], edi
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], eax
mov dword [esp + 0x28], ebx
lea ecx, [esp + 0x28]
mov byte [esp + 0x1c], 1
call fcn.0045ad80
mov edi, eax
cmp edi, ebx
je 0x43f119
mov byte [esp + 0x1c], bl
mov eax, dword [esp + 0x28]
cmp eax, ebx
je 0x43f101
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
mov dword [esp + 0x1c], 0xffffffff
mov ecx, dword [esi]
mov edx, dword [ecx + 8]
push esi
call edx
mov eax, edi
jmp 0x43f184
xor esi, esi
jmp 0x43f0a7
mov ebp, dword [esp + 0x28]
cmp ebp, ebx
jne 0x43f138
mov dword [esp + 0x1c], 0xffffffff
mov eax, dword [esi]
mov ecx, dword [eax + 8]
push esi
call ecx
mov eax, 0x80004005
jmp 0x43f184
mov eax, dword [esp + 0x30]
mov edx, dword [ebp]
mov ecx, dword [edx + 0xc]
push eax
push ebx
push esi
push ebp
call ecx
mov edi, eax
cmp edi, ebx
je 0x43f158
mov byte [esp + 0x1c], bl
mov edx, dword [ebp]
push ebp
jmp 0x43f0fc
mov edi, dword [esp + 0x24]
lea eax, [esp + 0x28]
call fcn.00439c60
mov byte [esp + 0x1c], bl
mov eax, dword [ebp]
mov ecx, dword [eax + 8]
push ebp
call ecx
mov dword [esp + 0x1c], 0xffffffff
mov edx, dword [esi]
mov eax, dword [edx + 8]
push esi
call eax
xor eax, eax
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x10

Function at 0x440950
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
push 4
push 0x16
push 0x45
push eax
push ecx
push 0
push esi
push edi
call ebx
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
push 5
push esi
push edi
call ebx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebx
ret

Function at 0x440980
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x4ee018]
push edi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 1
push eax
push 0x30
push 0x7f1
push esi
call edi
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x4ebf78
push 0x7f1
push esi
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
cmp dword [0x4eb11c], 0
je 0x4409cd
push 5
push 0x7f1
push esi
call edi
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
ret
push 0
push 0x7f1
push esi
call edi
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
ret
Function at 0x4412a0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x2c
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_SetDlgItemTextW]
push 0x4d21b8
mov esi, eax
push 0x418
push esi
call edi
push 0x4d2130
push 2
push esi
call edi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x418
push esi
call edi
mov ebp, dword [sym.imp.USER32.dll_GetWindowLongW]
mov ebx, eax
push 0xfffffffffffffff0
push ebx
call ebp
mov ecx, eax
and ecx, 0xf
sub eax, ecx
add eax, 0xb
push eax
push 0xfffffffffffffff0
push ebx
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 2
push esi
call edi
mov ebx, eax
push 0xfffffffffffffff0
push ebx
call ebp
mov edx, eax
and edx, 0xf
sub eax, edx
add eax, 0xb
push eax
push 0xfffffffffffffff0
push ebx
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 0x418
push esi
call edi
test eax, eax
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
je 0x44133c
mov eax, dword [0x4ee01c]
push 1
push eax
push 0x30
push 0x418
push esi
call edi
push eax
call ebx
push 2
push esi
call edi
test eax, eax
je 0x441358
mov ecx, dword [0x4ee01c]
push 1
push ecx
push 0x30
push 2
push esi
call edi
push eax
call ebx
lea edx, [esp + 0x28]
push edx
push 0x418
push esi
call edi
mov ebx, dword [sym.imp.USER32.dll_GetWindowRect]
push eax
call ebx
lea eax, [esp + 0x18]
push eax
push esi
call ebx
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
mov ebx, dword [sym.imp.USER32.dll_OffsetRect]
neg ecx
push ecx
neg edx
push edx
lea eax, [esp + 0x30]
push eax
call ebx
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
neg ecx
push ecx
neg edx
push edx
lea eax, [esp + 0x20]
push eax
call ebx
mov eax, dword [esp + 0x30]
mov ebp, dword [esp + 0x24]
mov ebx, dword [esp + 0x20]
sub ebp, dword [esp + 0x34]
push 0
push 0x418
sub ebx, eax
push esi
mov dword [esp + 0x20], eax
sub ebx, 8
sub ebp, 6
call edi
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 2
push esi
call edi
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 4
push 0x16
push 0x45
push ebp
push ebx
push 0
push 2
push esi
call edi
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
push 5
push 2
push esi
call edi
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
sub ebx, dword [esp + 0x14]
push 4
push 0x16
push 0x45
push ebp
sub ebx, 8
push ebx
push 0
push 0x418
push esi
call edi
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
push 5
push 0x418
push esi
call edi
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x418
push esi
call edi
mov esi, eax
push 0xfffffffffffffff0
push esi
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov ecx, eax
and ecx, 0xf
sub eax, ecx
add eax, 1
push eax
push 0xfffffffffffffff0
push esi
call dword [sym.imp.USER32.dll_SetWindowLongW]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
Function at 0x44a120
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x21c
mov eax, dword [0x4e44b4]
xor eax, esp
mov dword [esp + 0x218], eax
push ebx
push esi
push edi
push 0x104
lea eax, [esp + 0x1c]
mov esi, ecx
push eax
push esi
mov dword [esp + 0x20], esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
xor ebx, ebx
push esi
lea esi, [esp + 0x10]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
call fcn.00448980
add esp, 4
test eax, eax
je 0x44a218
mov edi, dword [esp + 0xc]
cmp edi, ebx
jne 0x44a17a
call fcn.00496100
mov esi, dword [esp + 0x10]
cmp esi, dword [edi + 8]
jb 0x44a188
call fcn.00496100
mov ebx, dword [esi]
mov edi, dword [ebx + 0x10]
add ebx, 0xc
cmp edi, dword [ebx + 8]
jbe 0x44a1a0
call fcn.00496100
lea ebx, [ebx]
mov esi, dword [ebx + 8]
cmp dword [ebx + 4], esi
jbe 0x44a1ad
call fcn.00496100
test ebx, ebx
je 0x44a1b5
cmp ebx, ebx
je 0x44a1ba
call fcn.00496100
cmp edi, esi
je 0x44a218
test ebx, ebx
jne 0x44a1c7
call fcn.00496100
cmp edi, dword [ebx + 8]
jb 0x44a1d1
call fcn.00496100
mov esi, dword [edi]
mov ecx, dword [esi]
push ecx
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
cmp eax, dword [esp + 0x22c]
jne 0x44a1eb
cmp dword [esi + 0x10], 0
jne 0x44a1fa
cmp edi, dword [ebx + 8]
jb 0x44a1f5
call fcn.00496100
add edi, 4
jmp 0x44a1a0
mov esi, dword [esi]
push esi
push esi
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
movzx edx, ax
mov eax, dword [esp + 0x18]
push edx
push 0x111
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [esp + 0x224]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00495cb8
add esp, 0x21c
ret
Function at 0x44bbe0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4b8ce8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x4e44b4]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
push 0xd
push 0x4d2918
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 7
mov dword [esp + 0x20], 0
mov word [esp + 0x10], 0
call fcn.00405680
mov eax, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
push eax
lea ecx, [esp + 8]
push ecx
push 0
push edx
mov dword [esp + 0x38], 0
call fcn.0047e8a0
add esp, 0x10
cmp dword [esp + 0x1c], 8
jb 0x44bc5f
mov eax, dword [esp + 8]
push eax
call fcn.00495fd1
add esp, 4
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
add esp, 0x28
ret

Function at 0x44c8f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, eax
mov eax, dword [0x4ece48]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [0x4ece48]
push edi
push ecx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
jne 0x44c91e
pop edi
pop esi
pop ebx
pop ecx
ret
push ebp
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push esi
push ebx
push eax
call fcn.0049c020
add esp, 0xc
lea edx, [esp + 0x10]
push edx
push 0
push edi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov ebp, dword [esp + 0x10]
push 0x10
call sub.gdiplus.dll_GdipAlloc
mov esi, eax
test esi, esi
je 0x44c976
lea eax, [esi + 4]
push eax
push ebp
mov dword [esi], vtable.Gdiplus::Image.0
mov dword [eax], 0
call sub.gdiplus.dll_GdipLoadImageFromStream
mov dword [esi + 8], eax
jmp 0x44c978
xor esi, esi
mov ebp, dword [esp + 0x18]
push edi
mov dword [ebp], esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor eax, eax
cmp dword [ebp], eax
pop ebp
pop edi
pop esi
setne al
pop ebx
pop ecx
ret
Function at 0x44dac0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x214
mov eax, dword [0x4e44b4]
xor eax, esp
mov dword [esp + 0x210], eax
push 0x206
lea eax, [esp + 0xe]
push 0
push eax
mov word [esp + 0x14], 0
call fcn.00499a30
add esp, 0xc
lea ecx, [esp]
push ecx
push 0x20019
push 0
push str.SoftwareMicrosoftInternet_ExplorerMain
push closesocket
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x44db5d
mov ecx, dword [esp]
lea edx, [esp + 4]
push edx
lea eax, [esp + 0xc]
push eax
push 0
push 0
push str.Start_Page
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x44db3d
mov edx, dword [esp]
push edx
jmp 0x44db57
mov edx, str.WWW.QQ.COM
lea ecx, [esp + 8]
call fcn.0044d760
test eax, eax
jl 0x44db53
mov byte [esi + 0x1c], 1
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.00495cb8
add esp, 0x214
ret
Function at 0x44f300
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x4b98db
mov eax, dword fs:[0]
push eax
sub esp, 0x450
mov eax, dword [0x4e44b4]
xor eax, esp
mov dword [esp + 0x44c], eax
push ebx
mov eax, dword [0x4e44b4]
xor eax, esp
push eax
lea eax, [esp + 0x458]
mov dword fs:[0], eax
xor ebx, ebx
push 0x206
lea eax, [esp + 0x4a]
push ebx
push eax
mov word [esp + 0x50], bx
call fcn.00499a30
push 0x206
lea ecx, [esp + 0x25e]
push ebx
push ecx
mov word [esp + 0x264], bx
call fcn.00499a30
add esp, 0x18
cmp dword [esi + 0x14], ebx
jbe 0x44f492
push esi
lea ecx, [esp + 0x2c]
call fcn.00475a60
lea edx, [esp + 0xc]
push edx
lea ecx, [esp + 0x2c]
mov dword [esp + 0x464], ebx
call fcn.00475e20
cmp dword [esp + 0x24], 8
mov eax, dword [esp + 0x10]
jae 0x44f3a4
lea eax, [esp + 0x10]
push eax
push str._sSharedAccountConfigConfig.ini
push 0x208
lea eax, [esp + 0x50]
push 0x104
push eax
call fcn.00496163
add esp, 0x14
lea ecx, [esp + 0xc]
call fcn.00475620
lea ecx, [esp + 0x28]
mov dword [esp + 0x460], 0xffffffff
call fcn.00475620
lea eax, [esp + 0x44]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x44f3e5
sub eax, edx
sar eax, 1
je 0x44f492
lea ecx, [esp + 0x44]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x44f492
lea edx, [esp + 0x44]
push edx
push 0x64
lea eax, [esp + 0x254]
push eax
push 0x4cadec
push str.HomePage
push str.Startup
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [esp + 0x24c]
lea edx, [eax + 2]
jmp 0x44f440
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x44f440
sub eax, edx
sar eax, 1
je 0x44f492
mov edx, str.WWW.QQ.COM
lea ecx, [esp + 0x24c]
call fcn.0044d760
test eax, eax
jl 0x44f46c
mov byte [esi + 0x1c], 1
jmp 0x44f492
cmp byte [esp + 0x468], bl
je 0x44f48f
lea ecx, [esp + 0x44]
push ecx
push str.http:__www.qq.com_
push str.HomePage
push str.Startup
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov byte [esi + 0x1c], bl
mov ecx, dword [esp + 0x458]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [esp + 0x44c]
xor ecx, esp
call fcn.00495cb8
add esp, 0x45c
ret 4
Function at 0x450fb0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x4b72fb
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4e44b4]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.00494e06
push 4
mov dword [esp + 0x20], 0
call fcn.00495ce0
mov edi, eax
add esp, 4
test edi, edi
je 0x451030
call fcn.004950f4
mov dword [edi], eax
call fcn.00494f28
push 0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.00495230
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x451025
add eax, 1
mov dword [ebx + 4], eax
lea ecx, [esp + 0x10]
call fcn.00495251
jmp 0x451032
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4

Function at 0x451af0
Capabilities:
Access firewall settings via inetfwmgr

Disassembly:
sub esp, 8
push esi
lea eax, [esp + 8]
push eax
push 0x4d30d4
push 1
push 0
push 0x4d30c4
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [edi], 0
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
test esi, esi
jl 0x451b4f
mov eax, dword [esp + 8]
mov ecx, dword [eax]
lea edx, [esp + 4]
push edx
push eax
mov eax, dword [ecx + 0x1c]
call eax
mov esi, eax
test esi, esi
jl 0x451b4f
mov eax, dword [esp + 4]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x1c]
push edi
push eax
call edx
mov esi, eax
mov eax, dword [esp + 4]
test eax, eax
je 0x451b5f
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 8]
test eax, eax
je 0x451b6f
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, esi
pop esi
add esp, 8
ret
Function at 0x452a30
Capabilities:
Get file version info

Disassembly:
sub esp, 0x220
mov eax, dword [0x4e44b4]
xor eax, esp
mov dword [esp + 0x21c], eax
mov eax, dword [esp + 0x224]
push ebp
push esi
push edi
xor ebp, ebp
push 0x206
lea edx, [esp + 0x26]
push ebp
push edx
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ecx
mov dword [esp + 0x20], ebp
mov dword [esp + 0x18], ebp
mov word [esp + 0x2c], bp
call fcn.00499a30
add esp, 0xc
push ebp
push ebx
mov dword [esp + 0x18], ebp
xor esi, esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
cmp edi, ebp
je 0x452b68
push edi
call fcn.00494ec8
mov esi, eax
add esp, 4
cmp esi, ebp
je 0x452b68
push edi
push ebp
push esi
call fcn.00499a30
add esp, 0xc
push esi
push edi
push ebp
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x452b71
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x18]
push ecx
push str.VarFileInfoTranslation
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x452b71
mov eax, dword [esp + 0x14]
movzx ecx, byte [eax + 2]
mov edx, dword [esp + 0x18]
push edx
movzx edx, byte [eax + 3]
push ecx
movzx ecx, byte [eax]
push edx
movzx edx, byte [eax + 1]
push ecx
push edx
push str.StringFileInfo_02x_02x_02x_02x_s
push 0x208
lea eax, [esp + 0x3c]
push 0x104
push eax
call fcn.00496163
add esp, 0x24
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x28]
push eax
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x452b71
cmp dword [esp + 0xc], 0x104
ja 0x452b71
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x1c]
push ecx
push 0x104
push edx
call fcn.00496aea
add esp, 0xc
pop edi
pop esi
lea eax, [ebp + 1]
pop ebp
mov ecx, dword [esp + 0x21c]
xor ecx, esp
call fcn.00495cb8
add esp, 0x220
ret
push esi
call fcn.00495fd1
add esp, 4
mov ecx, dword [esp + 0x228]
pop edi
pop esi
pop ebp
xor ecx, esp
xor eax, eax
call fcn.00495cb8
add esp, 0x220
ret