joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41648e
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x19c]
sub esp, 0x21c
mov eax, dword [0x4490e8]
xor eax, ebp
mov dword [ebp + 0x198], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0x1a4]
xor esi, esi
push esi
push edi
call dword [sym.imp.USER32.dll_GetSystemMenu]
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.USER32.dll_LoadMenuW]
push esi
push eax
mov dword [ebp - 0x78], eax
call dword [sym.imp.USER32.dll_GetSubMenu]
mov ebx, eax
cmp ebx, esi
je 0x416626
push 1
push esi
push ebx
call dword [sym.imp.USER32.dll_SetMenuDefaultItem]
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push esi
push edi
push dword [ebp - 0x7c]
push dword [ebp - 0x80]
push 0x1a0
push ebx
call dword [sym.imp.USER32.dll_TrackPopupMenuEx]
push dword [ebp - 0x78]
mov ebx, eax
call dword [sym.imp.USER32.dll_DestroyMenu]
cmp ebx, 0x69
jne 0x41652d
push str._sstartfrom_Startup_xmp
jmp 0x416613
cmp ebx, 0x8003
jne 0x416576
call fcn.00424cc9
mov ecx, eax
call fcn.0041ffb6
test eax, eax
je 0x41661f
push 0x44
push 0x436abc
push 0x436a84
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 7
je 0x416626
call fcn.00424cc9
mov ecx, eax
call fcn.0041ff94
jmp 0x41661f
cmp ebx, 0x8006
jne 0x416588
push 1
push esi
push str.http:__www.kankan.com__id141
jmp 0x416598
cmp ebx, 0x8007
jne 0x41659f
push 1
push esi
push str.http:__tantan.kankan.com_feedback.html_fromxmp
push str.iexplore
jmp 0x4165f8
cmp ebx, 0x8008
jne 0x416606
xor eax, eax
push 0x208
mov word [ebp - 0x74], ax
lea eax, [ebp - 0x72]
push esi
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0x104
lea eax, [ebp - 0x74]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str...XmpDoctor.exe
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x416626
push 1
push esi
push str._launchupdate_XMPWinMain_D5F0F030_E8E0_4F8D_98D1_2381E3F773E6
lea eax, [ebp - 0x74]
push eax
push str.open
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x416626
cmp ebx, 0x8005
jne 0x416626
push str._sstartfrom_Startup_xmp__ssysconfig_xmp
call fcn.00424cc9
mov ecx, eax
call fcn.0041fd46
push edi
call dword [sym.imp.USER32.dll_DestroyWindow]
mov ecx, dword [ebp + 0x198]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.00425cba
add ebp, 0x19c
leave
ret
Function at 0x416997
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0x10]
mov eax, dword [esi]
and dword [esi], 0
push edi
mov edi, dword [ebp + 0xc]
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x416a00
cmp dword [ebp + 0x10], 1
je 0x4169d8
cmp dword [ebp + 0x10], 2
je 0x4169d8
push 0xd
pop eax
jmp 0x416a00
mov eax, dword [ebp - 4]
test edi, edi
je 0x4169fa
test eax, eax
je 0x4169f5
test al, 1
jne 0x4169d3
mov ecx, eax
shr ecx, 1
cmp word [edi + ecx*2 - 2], 0
je 0x4169fa
jmp 0x4169d3
xor ecx, ecx
mov word [edi], cx
shr eax, 1
mov dword [esi], eax
xor eax, eax
pop edi
pop esi
leave
ret 0xc
Function at 0x419575
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push 2
push dword [ebp + 8]
call fcn.00416395
pop ecx
pop ecx
call fcn.00424cc9
mov ecx, eax
call fcn.00423e86
mov ecx, dword [0x44a218]
xor esi, esi
cmp ecx, esi
je 0x4195b6
push edi
mov edi, ecx
call fcn.00415b04
push edi
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
pop ecx
mov dword [0x44a218], esi
pop edi
push 0x20006
push str.SoftwareThunder_NetworkXmp
push closesocket
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
call fcn.0040bcbf
test eax, eax
jne 0x4195ff
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.MSVCR90.dll__time64]
mov eax, dword [ebp - 0x14]
pop ecx
push 4
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 4
push esi
push str.LastExitTime
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push esi
call dword [sym.imp.USER32.dll_PostQuitMessage]
lea ecx, [ebp - 0xc]
call fcn.0040bca4
xor eax, eax
pop esi
leave
ret
Function at 0x41c5ff
Capabilities:
Read .ini file

Disassembly:
push 0x58
mov eax, 0x4313e7
call fcn.00425d32
mov ebx, dword [ebp + 8]
mov edi, edx
mov dword [ebp - 0x60], ecx
call fcn.0041b76b
xor esi, esi
mov dword [ebp - 0x50], esi
add esi, 0x800
cmp dword [ebp - 0x50], 0
je 0x41c632
push dword [ebp - 0x50]
call sub.MSVCR90.dll_void___cdecl_operator_delete___void__
pop ecx
push esi
call fcn.00425ad2
pop ecx
mov ecx, ebx
mov dword [ebp - 0x50], eax
call dword [sym.imp.MSVCP90.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
push eax
push esi
push dword [ebp - 0x50]
mov ecx, edi
call dword [sym.imp.MSVCP90.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionA]
lea ecx, [esi - 2]
cmp eax, ecx
je 0x41c61d
mov eax, dword [ebp - 0x50]
test eax, eax
je 0x41c760
mov esi, 0x104
push esi
mov dword [ebp - 0x4c], eax
call fcn.00425ad2
push esi
mov dword [ebp - 0x54], eax
call fcn.00425ad2
mov ebx, dword [sym.imp.MSVCR90.dll_strncpy]
pop ecx
pop ecx
mov dword [ebp - 0x58], eax
mov esi, dword [sym.imp.MSVCR90.dll_strchr]
push 0
push dword [ebp - 0x4c]
call esi
mov edi, eax
sub edi, dword [ebp - 0x4c]
pop ecx
pop ecx
mov dword [ebp - 0x5c], eax
test edi, edi
jle 0x41c745
push 0x3d
push dword [ebp - 0x4c]
call esi
mov esi, eax
sub esi, dword [ebp - 0x4c]
mov dword [ebp - 0x64], eax
lea eax, [esi - 1]
pop ecx
pop ecx
cmp eax, 0x102
ja 0x41c745
sub edi, esi
lea eax, [edi - 1]
cmp eax, 0x104
jge 0x41c745
push esi
push dword [ebp - 0x4c]
push dword [ebp - 0x54]
call ebx
mov eax, dword [ebp - 0x54]
mov byte [esi + eax], 0
mov esi, dword [ebp - 0x58]
lea eax, [edi - 1]
push eax
mov eax, dword [ebp - 0x64]
inc eax
push eax
push esi
call ebx
add esp, 0x18
lea ecx, [ebp - 0x48]
mov byte [edi + esi - 1], 0
call fcn.00415f11
push dword [ebp - 0x54]
and dword [ebp - 4], 0
lea ecx, [ebp - 0x48]
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_char_const__]
push esi
lea ecx, [ebp - 0x2c]
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_char_const__]
mov ecx, dword [ebp - 0x60]
lea eax, [ebp - 0x48]
push eax
call fcn.0041c237
mov esi, dword [ebp - 0x5c]
or dword [ebp - 4], 0xffffffff
lea eax, [esi + 1]
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x4c], eax
call fcn.00415f3d
cmp dword [ebp - 0x4c], esi
jne 0x41c68c
push dword [ebp - 0x54]
call sub.MSVCR90.dll_void___cdecl_operator_delete___void__
push dword [ebp - 0x58]
call sub.MSVCR90.dll_void___cdecl_operator_delete___void__
push dword [ebp - 0x50]
call sub.MSVCR90.dll_void___cdecl_operator_delete___void__
add esp, 0xc
call fcn.00425db5
ret
Function at 0x41d2d7
Capabilities:
Check if file exists
Delete file
Get common file path
Read .ini file
Set registry value

Disassembly:
push ebp
sub esp, 0x410
lea ebp, [esp - 4]
mov eax, dword [0x4490e8]
xor eax, ebp
mov dword [ebp + 0x410], eax
push 0x14
mov eax, 0x431524
call fcn.00425cc9
mov esi, dword [ebp + 0x41c]
push str.TaskbarCreated
mov dword [ebp - 0x10], esi
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
push 0x24
mov dword [0x44a214], eax
call fcn.00425dd4
pop ecx
mov dword [ebp - 0x18], eax
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp eax, ebx
je 0x41d331
mov ecx, eax
call fcn.00415b3a
jmp 0x41d333
xor eax, eax
or dword [ebp - 4], 0xffffffff
push ebx
push esi
mov dword [0x44a218], eax
call fcn.00416395
pop ecx
pop ecx
call fcn.00424cc9
mov ecx, eax
call fcn.0041ff01
push ebx
mov edi, 0x1770
push edi
push 0x3ea
push esi
mov esi, dword [sym.imp.USER32.dll_SetTimer]
call esi
push ebx
push edi
push 0x3e8
push dword [ebp - 0x10]
call esi
xor eax, eax
push 0x206
mov word [ebp], ax
lea eax, [ebp + 2]
push ebx
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0x104
lea eax, [ebp]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str...xmp.ini
lea eax, [ebp]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea eax, [ebp]
push eax
push 0x14
push 0x438340
push str.TimerSetting
call edi
cmp eax, 0x14
jae 0x41d3c9
push 0x14
pop eax
imul eax, eax, 0x3e8
push ebx
push eax
push 0x3eb
push dword [ebp - 0x10]
call esi
lea eax, [ebp]
push eax
push 0x14
push str.UpdateCodecs
push str.TimerSetting
call edi
cmp eax, 0x14
jae 0x41d3f5
push 0x14
pop eax
imul eax, eax, 0x3e8
push ebx
push eax
push 0x3ec
push dword [ebp - 0x10]
call esi
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
push 0x20006
push str.SoftwareThunder_NetworkXmp
push closesocket
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 1
call fcn.0040bcbf
test eax, eax
jne 0x41d457
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.MSVCR90.dll__time64]
mov eax, dword [ebp - 0x20]
pop ecx
push 4
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
push 4
push ebx
push str.LastLaunchTime
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push str._src:XMPTray__force
call fcn.0041d1d5
xor eax, eax
mov word [ebp + 0x208], ax
mov dword [esp], 0x206
lea eax, [ebp + 0x20a]
push ebx
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
lea eax, [ebp + 0x208]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp + 0x208]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
push str.lowIVXMPIVTemp.dat
lea eax, [ebp + 0x208]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp + 0x208]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41d4d0
lea eax, [ebp + 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x14]
call fcn.0040bca4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x410]
xor ecx, ebp
call fcn.00425cba
add ebp, 0x414
leave
ret
Function at 0x41d4fd
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
call fcn.0041bd3a
mov edi, dword [esp + 0x10]
mov ebx, dword [sym.imp.KERNEL32.dll_GetCommandLineW]
test edi, edi
jne 0x41d519
call ebx
mov edi, eax
push edi
call dword [sym.imp.MSVCR90.dll_wcslen]
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00425ad2
pop ecx
pop ecx
mov dword [esi + 0x38], eax
test eax, eax
jne 0x41d542
xor eax, eax
jmp 0x41d56f
test edi, edi
je 0x41d54a
push edi
push eax
jmp 0x41d550
call ebx
push eax
push dword [esi + 0x38]
call dword [sym.imp.MSVCR90.dll_wcscpy]
pop ecx
pop ecx
mov ecx, esi
call fcn.0041d002
test eax, eax
jne 0x41d56c
mov ecx, esi
call fcn.0041bd3a
jmp 0x41d53e
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
ret 4
Function at 0x41f242
Capabilities:
Accept command line arguments
Check mutex on windows

Disassembly:
push 0x50
mov eax, 0x43170d
call fcn.00425cc9
push 0x44a080
push str.mutex_s
push 0x104
mov esi, 0x44b6e0
push esi
call dword [sym.imp.MSVCR90.dll__snwprintf]
add esp, 0x10
push esi
push 1
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, 0xb7
je 0x41f28e
call edi
cmp eax, 5
jne 0x41f2cb
mov edi, str.IsRunning
push edi
call fcn.0041240d
pop ecx
test eax, eax
jne 0x41f2c4
push 1
push esi
push str.szMutex_exists.
push ebx
push edi
call fcn.00410c48
pop ecx
pop ecx
mov ecx, eax
call fcn.004138f2
mov ecx, eax
call fcn.00416d4b
mov ecx, eax
call fcn.00413815
mov al, 1
jmp 0x41f385
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push ebx
push str.XMP_CMD_HELPER31317078_984A_425a_A01C_6071F056D50F_5.0
mov esi, eax
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 0x10], eax
push esi
cmp eax, ebx
je 0x41f318
xor eax, eax
lea edi, [ebp - 0x18]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x1c], 0x800
call dword [sym.imp.MSVCR90.dll_wcslen]
lea eax, [eax + eax + 2]
pop ecx
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1c]
push eax
push ebx
push 0x4a
push dword [ebp - 0x10]
mov dword [ebp - 0x14], esi
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x41f2c4
lea ecx, [ebp - 0x5c]
call fcn.0041d575
push str.embedding
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x5c]
mov dword [ebp - 4], ebx
call fcn.0041c21d
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x30]
mov byte [ebp - 4], 1
sar eax, 2
test eax, eax
ja 0x41f34a
cmp dword [ebp - 0x40], ebx
jle 0x41f36e
push dword [ebp - 0x10]
call dword [sym.imp.OLEAUT32.dll_VariantInit]
test eax, eax
ja 0x41f36e
lea ecx, [ebp - 0x5c]
call fcn.00415b73
push eax
call fcn.00424cc9
mov ecx, eax
call fcn.0041fd46
mov bl, 1
push dword [ebp - 0x10]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5c]
call fcn.0041c112
mov al, bl
call fcn.00425da1
ret
Function at 0x41f72d
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push str.mutexXmpSetupProgress_01572D6A_8C9A_484b_8B31_F2890BF1FB21
push 1
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call esi
cmp eax, 0xb7
je 0x41f75e
call esi
cmp eax, 5
jne 0x41f76c
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
jmp 0x41f846
cmp ebx, edi
je 0x41f777
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
push 0x64
push 0x44a148
push 0x80
push dword [ebp + 8]
call esi
push 0x64
push 0x44a080
push 0x67
push dword [ebp + 8]
call esi
call fcn.0041f242
test al, al
je 0x41f7ac
xor eax, eax
jmp 0x41f846
call fcn.00424cc9
mov ecx, eax
call fcn.004250f9
push str.ChangeWindowMessageFilter
push str.USER32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
cmp esi, edi
je 0x41f7f5
xor ebx, ebx
inc ebx
push ebx
push 0x4a
call esi
push ebx
push 0x465
call esi
push ebx
push 0x466
call esi
push ebx
push 0x467
call esi
push dword [ebp + 8]
call fcn.0041f6cc
push dword [ebp + 0x14]
push dword [ebp + 8]
call fcn.00416358
add esp, 0xc
test eax, eax
je 0x41f7a5
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
jmp 0x41f82b
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push edi
push edi
push edi
lea eax, [ebp - 0x1c]
push eax
call esi
test eax, eax
jne 0x41f817
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x41f882
Capabilities:
Get file version info

Disassembly:
push ebp
lea ebp, [esp - 0x198]
sub esp, 0x218
mov eax, dword [0x4490e8]
xor eax, ebp
mov dword [ebp + 0x194], eax
xor eax, eax
cmp ax, word [0x44bd38]
jne 0x41f9b2
push ebx
push esi
push edi
push 0x206
mov word [ebp - 0x74], ax
xor ebx, ebx
lea eax, [ebp - 0x72]
push ebx
push eax
call sub.MSVCR90.dll_memset
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
add esp, 0xc
mov edi, 0x104
push edi
lea eax, [ebp - 0x74]
push eax
push ebx
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x80], ebx
call esi
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.MSVCR90.dll_wcslen]
pop ecx
lea eax, [ebp + eax*2 - 0x74]
dec eax
push 0x5c
dec eax
pop ecx
cmp cx, word [eax]
jne 0x41f8ef
add eax, 2
push str.XmpCoreVersion.dll
push eax
call dword [sym.imp.MSVCR90.dll_wcscpy]
lea eax, [ebp - 0x74]
push ebx
push eax
call dword [sym.imp.MSVCR90.dll__waccess]
add esp, 0x10
test eax, eax
je 0x41f922
push edi
lea eax, [ebp - 0x74]
push eax
push ebx
call esi
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x74]
push eax
mov dword [ebp - 0x7c], ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
cmp edi, ebx
jbe 0x41f9af
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00425ad2
mov esi, eax
pop ecx
cmp esi, ebx
je 0x41f9af
push esi
push edi
push ebx
lea eax, [ebp - 0x74]
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x41f9af
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x78]
push eax
push 0x43ea98
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x41f9af
mov eax, dword [ebp - 0x78]
movzx ecx, word [eax + 0xc]
push ecx
movzx ecx, word [eax + 0xe]
push ecx
movzx ecx, word [eax + 8]
movzx eax, word [eax + 0xa]
push ecx
push eax
push str._d._d._d._d
push 0x168
push 0x44bd38
call dword [sym.imp.MSVCR90.dll__snwprintf]
push esi
call sub.MSVCR90.dll_void___cdecl_operator_delete___void__
add esp, 0x20
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x194]
xor ecx, ebp
mov eax, 0x44bd38
call fcn.00425cba
add ebp, 0x198
leave
ret

Function at 0x41f9cc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
xor eax, eax
push esi
mov esi, 0x44c008
cmp ax, word [0x44c008]
jne 0x41fa2e
and dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push str.SOFTWAREThunder_NetworkXmp
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41fa2e
and dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 0xc]
push eax
push 0
push str.PeerID
push dword [ebp - 4]
mov dword [ebp - 8], 0x40
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
leave
ret
Function at 0x41fa3e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
xor eax, eax
push esi
mov esi, 0x44c088
cmp ax, word [0x44c088]
jne 0x41faa0
and dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push str.SOFTWAREThunder_NetworkXmp
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41faa0
and dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 0xc]
push eax
push 0
push str.InstallSource
push dword [ebp - 4]
mov dword [ebp - 8], 0x40
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
leave
ret

Function at 0x41fad9
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x4490e8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
or dword [esi], 0xffffffff
and dword [esi + 0x1c], 0
push 0xc8
lea eax, [esi + 0x20]
push str.stat.kankanc2c.xunlei.com
push eax
mov dword [esi + 4], 0xbb8
mov dword [esi + 8], 1
call dword [sym.imp.MSVCR90.dll_strncpy]
mov eax, 0x4a34
push 0x18e
mov word [esi + 0xe8], ax
lea eax, [ebp - 0x194]
push 0
push eax
call sub.MSVCR90.dll_memset
add esp, 0x18
lea eax, [ebp - 0x194]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00425cba
leave
ret
Function at 0x41fbab
Capabilities:
Get file version info

Disassembly:
push ebp
lea ebp, [esp - 0x198]
sub esp, 0x218
mov eax, dword [0x4490e8]
xor eax, ebp
mov dword [ebp + 0x194], eax
xor eax, eax
cmp ax, word [0x44c110]
jne 0x41fcec
push ebx
push esi
push edi
push 0x206
mov word [ebp - 0x74], ax
xor ebx, ebx
lea eax, [ebp - 0x72]
push ebx
push eax
call sub.MSVCR90.dll_memset
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
add esp, 0xc
mov edi, 0x104
push edi
lea eax, [ebp - 0x74]
push eax
push ebx
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x80], ebx
call esi
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.MSVCR90.dll_wcslen]
pop ecx
lea eax, [ebp + eax*2 - 0x74]
dec eax
push 0x5c
dec eax
pop ecx
cmp cx, word [eax]
jne 0x41fc18
add eax, 2
push str.XmpCoreVersion.dll
push eax
call dword [sym.imp.MSVCR90.dll_wcscpy]
lea eax, [ebp - 0x74]
push ebx
push eax
call dword [sym.imp.MSVCR90.dll__waccess]
add esp, 0x10
test eax, eax
je 0x41fc4b
push edi
lea eax, [ebp - 0x74]
push eax
push ebx
call esi
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x74]
push eax
mov dword [ebp - 0x7c], ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
cmp edi, ebx
jbe 0x41fce9
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00425ad2
mov esi, eax
pop ecx
cmp esi, ebx
je 0x41fce9
push esi
push edi
push ebx
lea eax, [ebp - 0x74]
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x41fce9
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x78]
push eax
push 0x43ea98
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x41fce9
mov eax, dword [ebp - 0x78]
movzx ecx, word [eax + 0xc]
push ecx
movzx ecx, word [eax + 0xe]
push ecx
movzx ecx, word [eax + 8]
movzx eax, word [eax + 0xa]
push ecx
push eax
push str._d._d._d._d
push 0x168
push 0x44c110
call dword [sym.imp.MSVCR90.dll__snwprintf]
mov eax, dword [ebp - 0x78]
mov ax, word [eax + 0xc]
push esi
mov word [0x44c108], ax
call sub.MSVCR90.dll_void___cdecl_operator_delete___void__
add esp, 0x20
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x194]
mov ax, word [0x44c108]
xor ecx, ebp
call fcn.00425cba
add ebp, 0x198
leave
ret