joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a94e0
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
cmp byte [ebx + 0x98], 0
je 0x4a9506
push 0
mov eax, dword [ebx + 0x94]
call fcn.0044c524
push eax
call sub.user32.dll_ShowWindow
mov byte [ebx + 0x98], 0
pop ebx
ret

Function at 0x4a95c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4a9731
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0xa4], 1
mov eax, dword [ebp - 4]
test byte [eax + 0x1c], 0x10
jne 0x4a9716
lea eax, [ebp - 0x10d]
push eax
push pe_nt_image_headers32
call sub.kernel32.dll_GetTempPathA
lea edx, [ebp - 8]
lea eax, [ebp - 0x10d]
call fcn.0040a01c
mov dl, 1
mov eax, dword [0x47eb0c]
call fcn.0047eb64
mov edx, dword [ebp - 4]
mov dword [edx + 0x9c], eax
mov dl, 1
mov eax, dword [0x41cddc]
call fcn.00403780
mov edx, dword [ebp - 4]
mov dword [edx + 0x3c], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xa0]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x9c]
call fcn.0047ebe0
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x4a9713
mov dl, 1
mov eax, dword [0x480104]
call fcn.0048016c
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x3c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x9c]
mov edx, 0x4a9748
call fcn.0047f348
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.00404958
xor eax, eax
push ebp
push 0x4a970c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
xor ecx, ecx
xor edx, edx
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x3c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
call fcn.0048046c
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.004a9750
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a9713
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x9c]
call fcn.004037b0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.004037b0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
call fcn.004037b0
ret
mov bl, byte [ebp - 0xd]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a9738
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404670
ret

Function at 0x4dc1f8
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
cmp dword [esp + 0x10], 2
jne 0x4dc21d
cmp dword [esp + 4], 5
jb 0x4dc21d
mov al, 1
jmp 0x4dc21f
xor eax, eax
add esp, 0x94
ret
Function at 0x4f017f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ebx, ebx
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x512126
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4f01d7
movzx edx, word [ebp + 8]
mov dword [ebp - 8], edx
lea ecx, [ebp - 8]
push ecx
push dword [ebp + 0xc]
push 0
push 0
push 0x512147
push dword [ebp - 4]
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x4f01cd
mov bx, 0x2a04
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey_1
jmp 0x4f01db
mov bx, 0x2a04
mov eax, ebx
pop ebx
pop ecx
pop ecx
pop ebp
ret 8

Function at 0x50d3a8
Capabilities:
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404afc
xor eax, eax
push ebp
push 0x50d49d
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x50d487
xor eax, eax
push ebp
push 0x50d480
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf01ff
mov eax, dword [ebp - 4]
call fcn.00404b0c
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x50d41b
call fcn.004040d0
jmp 0x50d487
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_QueryServiceStatus
cmp dword [ebp - 0x2c], 1
jne 0x50d460
mov eax, dword [0x51299c]
mov edx, 0x50d4b4
call fcn.004046a0
mov byte [ebp - 5], 1
lea eax, [ebp - 0x14]
push eax
push 0
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_StartServiceA
test eax, eax
jne 0x50d460
call fcn.004040d0
jmp 0x50d487
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50d487
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50d4a4
lea eax, [ebp - 4]
call fcn.0040464c
ret
Function at 0x50d4c4
Capabilities:
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404afc
xor eax, eax
push ebp
push 0x50d59c
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x50d586
xor eax, eax
push ebp
push 0x50d57f
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf01ff
mov eax, dword [ebp - 4]
call fcn.00404b0c
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_QueryServiceStatus
cmp dword [ebp - 0x28], 1
je 0x50d54c
lea eax, [ebp - 0x2c]
push eax
push 1
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_ControlService
mov byte [ebp - 5], 1
mov eax, dword [0x51299c]
mov edx, 0x50d5b4
call fcn.004046a0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50d586
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50d5a3
lea eax, [ebp - 4]
call fcn.0040464c
ret

Function at 0x49f260
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.0049f2df
jae 0x49f26c
xor ecx, ecx
call fcn.0049f2df
jae 0x49f296
xor eax, eax
call fcn.0049f2df
jae 0x49f2a7
mov al, 0x10
call fcn.0049f2df
adc al, al
jae 0x49f288
jne 0x49f2d4
stosb byte es:[edi], al
jmp 0x49f26d
call fcn.0049f2eb
dec ecx
loop 0x49f2b3
mov eax, ebp
call fcn.0049f2e9
jmp 0x49f2d5
lodsb al, byte [esi]
shr eax, 1
je 0x49f2fb
adc ecx, 2
mov ebp, eax
jmp 0x49f2d5
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.0049f2e9
cmp eax, 0x7d00
jae 0x49f2d3
cmp eax, 0x500
jae 0x49f2d4
cmp eax, 0x7f
ja 0x49f2d5
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x49f26d
pop ebp
ret 8
Function at 0x44b9b4
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x5ea200]
jne 0x44b9be
repz ret
jmp fcn.0044dfe8

Function at 0x455678
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5ea200]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00450ef2
and dword [ebp - 0x14], 0
cmp dword [0x5ebf74], 0
mov dword [ebp - 0x18], eax
jne 0x45572b
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4557d3
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4557d3
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x5ebf74], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x5ebf78], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x5ebf7c], eax
call edi
push eax
call esi
mov dword [0x5ebf84], eax
test eax, eax
je 0x45572b
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x5ebf80], eax
mov eax, dword [0x5ebf80]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x455784
cmp dword [0x5ebf84], ecx
je 0x455784
push eax
call esi
push dword [0x5ebf84]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x455784
test ebx, ebx
je 0x455784
call edi
test eax, eax
je 0x45577b
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x45577b
test byte [ebp - 8], 1
jne 0x455784
or dword [ebp + 0x10], 0x200000
jmp 0x4557b7
mov eax, dword [0x5ebf78]
cmp eax, dword [ebp - 0x18]
je 0x4557b7
push eax
call esi
test eax, eax
je 0x4557b7
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4557b7
mov eax, dword [0x5ebf7c]
cmp eax, dword [ebp - 0x18]
je 0x4557b7
push eax
call esi
test eax, eax
je 0x4557b7
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x5ebf74]
call esi
test eax, eax
je 0x4557d3
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4557d5
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044b9b4
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x46eb50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp + 8], eax
mov eax, dword [0x46e0ac]
push esi
push edi
test eax, eax
jne 0x46ebcd
mov esi, 0x46e284
mov edx, dword [esi]
lea eax, [ebp - 0x24]
mov cl, byte [edx]
test cl, cl
je 0x46eb8b
lea edi, [ebp - 0x24]
sub edx, edi
xor cl, 0x55
mov byte [eax], cl
mov cl, byte [edx + eax + 1]
inc eax
test cl, cl
jne 0x46eb7d
lea ecx, [ebp - 0x24]
mov byte [eax], 0
push ecx
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov edx, dword [esi - 4]
add esi, 8
cmp esi, 0x46e29c
mov dword [edx], eax
jl 0x46eb6d
mov ecx, dword [0x46e0ac]
mov eax, dword [sym.imp.kernel32.dll_GetModuleHandleA]
push 0
push 0x46e2ac
push ecx
mov dword [0x46e0a4], eax
call fcn.0046ed80
add esp, 0xc
mov dword [0x46e0a8], eax
mov dword [ebp - 4], 0
mov esi, 0x46e284
mov edx, dword [esi]
mov cl, byte [edx]
test cl, cl
je 0x46ec16
mov eax, dword [ebp + 8]
mov al, byte [eax]
test al, al
je 0x46ec16
cmp al, 0x5a
jg 0x46ec02
cmp al, 0x41
jl 0x46ec02
movsx edi, al
add edi, 0x20
movsx ebx, cl
xor edi, 0x55
cmp ebx, edi
je 0x46ec08
xor al, 0x55
cmp cl, al
jne 0x46ec16
mov ecx, dword [ebp + 8]
inc edx
inc ecx
mov dword [ebp + 8], ecx
mov cl, byte [edx]
test cl, cl
jne 0x46ebe1
cmp byte [edx], 0
je 0x46ec36
mov edx, dword [ebp - 4]
add esi, 8
inc edx
cmp esi, 0x46e29c
mov dword [ebp - 4], edx
jl 0x46ebd9
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov edx, dword [ecx*8 + 0x46e280]
mov eax, dword [edx]
mov esp, ebp
pop ebp
ret
Function at 0x4012c0
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x45166c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x103
lea eax, [ebp - 0x107]
push 0
push eax
mov esi, ecx
mov byte [ebp - 0x108], 0
call fcn.0042cb30
add esp, 0xc
lea ecx, [ebp - 0x10c]
push ecx
push 0x26
push 0
mov dword [ebp - 0x10c], 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x401333
mov eax, dword [ebp - 0x10c]
lea edx, [ebp - 0x108]
push edx
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
mov ecx, dword [ebp - 0x10c]
push ecx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
lea eax, [esi + 4]
lea edx, [ebp - 0x108]
mov dword [esi], eax
mov byte [eax], 0
push edx
or eax, 0xffffffff
call int.00413ec0
push 0x4468f4
mov eax, esi
call fcn.00413dc0
push str.bianya2
mov eax, esi
call fcn.00413dc0
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0042397b
mov esp, ebp
pop ebp
ret
Function at 0x402c40
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2114
call fcn.00439110
mov eax, dword [0x45166c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x110c]
push ecx
push 0x1000
lea edx, [ebp - 0x1108]
push edx
mov dword [ebp - 0x1110], eax
call dword [sym.imp.PSAPI.DLL_EnumProcesses]
test eax, eax
jne 0x402c8d
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042397b
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 0x110c]
push ebx
push esi
push edi
shr eax, 2
xor edi, edi
test eax, eax
jle 0x402d14
mov ebx, dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ecx, dword [ebp + edi*4 - 0x1108]
push ecx
push 0
push 0x410
call ebx
lea edx, [ebp - 0x1114]
push edx
mov esi, eax
push 0x1000
lea eax, [ebp - 0x2114]
push eax
push esi
call dword [sym.imp.PSAPI.DLL_EnumProcessModules]
mov edx, dword [ebp - 0x2114]
push 0x104
lea ecx, [ebp - 0x108]
push ecx
push edx
push esi
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExA]
mov eax, dword [ebp - 0x1110]
push eax
lea ecx, [ebp - 0x108]
push ecx
call fcn.00423b80
add esp, 8
test eax, eax
jne 0x402d29
mov edx, dword [ebp - 0x110c]
inc edi
shr edx, 2
cmp edi, edx
jl 0x402ca5
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042397b
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp + edi*4 - 0x1108]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042397b
mov esp, ebp
pop ebp
ret 4

Function at 0x402d50
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x45166c]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x18]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x402d96
lea ecx, [ebp - 0x20]
push ecx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
jne 0x402da6
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042397b
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
push 0
push 0
push 0x10
lea edx, [ebp - 0x14]
push edx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x18]
push 0
push eax
mov dword [ebp - 0x14], 1
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x402df4
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042397b
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 1
call fcn.0042397b
mov esp, ebp
pop ebp
ret
Function at 0x4035c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x45166c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x454434]
cmp byte [eax], 0
push esi
push edi
je 0x403644
sub esp, 0x44
mov esi, esp
lea eax, [esi + 4]
mov dword [ebp - 0x4c], esp
mov dword [esi], eax
mov byte [eax], 0
push str.http:__tongji.bianya.cc_popup.ashx_type0
or eax, 0xffffffff
call int.00413ec0
lea edi, [ebp - 0x48]
call fcn.00403660
mov esi, dword [ebp - 0x48]
mov eax, esi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403610
sub eax, edx
test eax, eax
jle 0x403634
push 3
push 0
push 0
push esi
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, dword [ebp - 0x48]
lea ecx, [ebp - 0x44]
cmp esi, ecx
je 0x403644
push esi
call fcn.004244c1
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0042397b
mov esp, ebp
pop ebp
ret
Function at 0x403660
Capabilities:
Check http status code
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x19054
call fcn.00439110
mov eax, dword [0x45166c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0
push 0
push 0
push 1
push 0
call dword [sym.imp.WININET.dll_InternetOpenA]
mov esi, eax
test esi, esi
jne 0x4036cf
lea eax, [edi + 4]
mov dword [edi], eax
mov byte [eax], 0
push 0x4468c1
or eax, 0xffffffff
mov esi, edi
call int.00413ec0
mov eax, dword [ebp + 8]
lea ecx, [ebp + 0xc]
cmp eax, ecx
je 0x403836
push eax
call fcn.004244c1
add esp, 4
mov eax, edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042397b
mov esp, ebp
pop ebp
ret 0x44
mov edx, dword [ebp + 8]
push ebx
push 0
push 0x102
push 0
push 0
push edx
push esi
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov ebx, eax
test ebx, ebx
jne 0x4036f8
push esi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x40380b
push 0
lea edx, [ebp - 0x19054]
push edx
lea eax, [ebp - 0x19050]
push eax
push 0x20000013
push ebx
mov dword [ebp - 0x19054], 4
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
cmp dword [ebp - 0x19050], 0x190
jae 0x40380b
push 0x19000
lea edx, [ebp - 0x19004]
push 0
push edx
mov dword [ebp - 0x1904c], 0
call fcn.0042cb30
add esp, 0xc
lea eax, [ebp - 0x1904c]
push eax
push 0x19000
lea ecx, [ebp - 0x19004]
push ecx
push ebx
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x4037f9
mov eax, dword [ebp - 0x1904c]
test eax, eax
je 0x4037f9
push ebx
mov ebx, dword [sym.imp.WININET.dll_InternetCloseHandle]
mov byte [ebp + eax - 0x19004], 0
call ebx
push esi
call ebx
lea eax, [ebp - 0x19004]
lea edx, [ebp - 0x19044]
push eax
or eax, 0xffffffff
lea esi, [ebp - 0x19048]
mov dword [ebp - 0x19048], edx
mov byte [ebp - 0x19044], 0
call int.00413ec0
push 0x19000
lea ecx, [ebp - 0x19004]
push 0
push ecx
call fcn.0042cb30
add esp, 0xc
mov edx, esi
push edx
mov eax, edi
call fcn.00413d70
mov eax, dword [ebp - 0x19048]
lea ecx, [ebp - 0x19044]
cmp eax, ecx
je 0x4037ef
push eax
call fcn.004244c1
add esp, 4
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
cmp eax, edx
jmp 0x40382a
push str.zengjiedeweizhi
push 0x446f84
call fcn.00423cff
add esp, 8
lea eax, [edi + 4]
mov dword [edi], eax
mov byte [eax], 0
push 0x4468c1
or eax, 0xffffffff
mov esi, edi
call int.00413ec0
mov eax, dword [ebp + 8]
lea ecx, [ebp + 0xc]
cmp eax, ecx
je 0x403835
push eax
call fcn.004244c1
add esp, 4
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, edi
pop esi
call fcn.0042397b
mov esp, ebp
pop ebp
ret 0x44
Function at 0x403850
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44054b
mov eax, dword fs:[0]
push eax
sub esp, 0x158
mov eax, dword [0x45166c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edi, edi
mov dword [ebp - 0x15c], edi
lea eax, [ebp - 0x154]
mov esi, ecx
mov dword [ebp - 0x158], eax
mov byte [ebp - 0x154], 0
push 0x104
lea ecx, [ebp - 0x114]
push ecx
push edi
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x403971
lea edx, [ebp - 0x164]
push edx
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeA]
mov dword [ebp - 0x160], eax
cmp eax, edi
jle 0x403971
push eax
call fcn.00422f3f
mov ecx, dword [ebp - 0x160]
mov edx, dword [ebp - 0x164]
add esp, 4
mov ebx, eax
push ebx
push ecx
push edx
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoA]
test eax, eax
je 0x403968
lea ecx, [ebp - 0x160]
push ecx
lea edx, [ebp - 0x15c]
push edx
push 0x4468f4
push ebx
call dword [sym.imp.VERSION.dll_VerQueryValueA]
test eax, eax
je 0x403968
mov eax, dword [ebp - 0x15c]
movzx ecx, word [eax + 0xc]
movzx edx, word [eax + 0xe]
push ecx
movzx ecx, word [eax + 8]
push edx
movzx edx, word [eax + 0xa]
push ecx
push edx
push str._d._d._d._d
lea edi, [ebp - 0x158]
call fcn.004143b0
push ebx
call fcn.00423ddd
lea eax, [esi + 4]
mov dword [esi], eax
mov byte [eax], 0
mov eax, dword [ebp - 0x158]
add esp, 0x18
push eax
jmp 0x403980
push ebx
call fcn.00423ddd
add esp, 4
mov edx, dword [ebp - 0x158]
lea eax, [esi + 4]
mov dword [esi], eax
mov byte [eax], 0
push edx
or eax, 0xffffffff
call int.00413ec0
mov eax, dword [ebp - 0x158]
lea ecx, [ebp - 0x154]
cmp eax, ecx
je 0x4039a1
push eax
call fcn.004244c1
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042397b
mov esp, ebp
pop ebp
ret

Function at 0x404820
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp byte [esi + 8], 0
mov dword [esi], method._6qf9e3a_NAr___q_.virtual_0
je 0x404852
cmp byte [esi + 9], 0
jne 0x404852
mov eax, dword [esi + 4]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [esi + 9], 1
test byte [ebp + 8], 1
je 0x404861
push esi
call fcn.00423ddd
add esp, 4
mov eax, esi
pop esi
pop ebp
ret 4
Function at 0x406810
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x447098
mov esi, eax
push 0x6e
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
push edi
push esi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
push eax
call fcn.00422f3f
mov edi, eax
lea eax, [esi + 1]
push eax
push 0
push edi
call fcn.0042cb30
mov eax, dword [ebp - 4]
push esi
push eax
push edi
call fcn.00426a50
mov esi, dword [ebp + 8]
add esp, 0x1c
push edi
or eax, 0xffffffff
call int.00413ec0
push edi
call fcn.004245d3
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4069b0
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x440c56
mov eax, dword fs:[0]
push eax
sub esp, 0x1a0
mov eax, dword [0x45166c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x104
lea eax, [ebp - 0x118]
push 0
push eax
mov edi, ecx
call fcn.0042cb30
add esp, 0xc
lea ecx, [ebp - 0x118]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov eax, dword [edi + 0x110]
lea edx, [ebp - 0x1a4]
push eax
or eax, 0xffffffff
lea esi, [ebp - 0x1a8]
mov dword [ebp - 0x1a8], edx
mov byte [ebp - 0x1a4], 0
call int.00413ec0
lea edx, [ebp - 0x118]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x15c]
push edx
or eax, 0xffffffff
lea esi, [ebp - 0x160]
mov dword [ebp - 0x160], ecx
mov byte [ebp - 0x15c], 0
call int.00413ec0
mov eax, esi
push eax
lea ecx, [ebp - 0x1a8]
mov byte [ebp - 4], 1
call int.00414460
test al, al
je 0x406aa6
mov ecx, dword [edi + 0x154]
mov edx, dword [ebp - 0x160]
push 5
push 0x4468c1
push ecx
push edx
push str.OPEN
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov eax, dword [0x454434]
mov ecx, dword [eax + 0x38]
add edi, 0x44
call int.0041d710
mov eax, dword [ebp - 0x160]
lea ecx, [ebp - 0x15c]
cmp eax, ecx
je 0x406abf
push eax
call fcn.004244c1
add esp, 4
mov eax, dword [ebp - 0x1a8]
lea edx, [ebp - 0x1a4]
cmp eax, edx
je 0x406ad8
push eax
call fcn.004244c1
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042397b
mov esp, ebp
pop ebp
ret