joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402170
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x405e8c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebp
push esi
push edi
mov esi, ecx
mov dword [esp + 0x20], 0
xor edi, edi
mov dword [esp + 0xc], edi
lea eax, [esi + 0x7c]
push eax
lea ecx, [esp + 0x18]
push 0x407830
push ecx
mov byte [esp + 0x2c], 3
call fcn.00401cb0
push str.____L_
push eax
lea edx, [esp + 0x24]
push edx
mov byte [esp + 0x38], 4
call fcn.00401c10
add esp, 0x18
lea ecx, [esp + 0x14]
call dword [0x40706c]
lea ecx, [esp + 0x28]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x10]
push edx
push edi
push 0x2001f
push edi
push edi
push edi
push eax
push 0x80000000
mov dword [esp + 0x30], edi
call dword [0x407014]
test eax, eax
mov ebp, dword [0x407018]
jne 0x402276
mov al, byte [esi + 0x80]
test al, al
mov edi, dword [esp + 0xc]
mov dword [esp + 0xc], edi
je 0x402224
lea ecx, [esp + 0x30]
jmp 0x40223b
push 0x407824
lea ecx, [esp + 0x30]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::Compare]
test eax, eax
je 0x402252
lea ecx, [esp + 0x2c]
push 0
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
lea ecx, [esp + 0x14]
push 0x407818
call fcn.00401e10
push 0
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
push str.shellopencommand
lea ecx, [esp + 0x18]
call fcn.00401e10
test edi, edi
je 0x402276
push edi
call ebp
xor edi, edi
lea ecx, [esp + 0x10]
call dword [0x40706c]
test edi, edi
je 0x402287
push edi
call ebp
lea ecx, [esp + 0x28]
call dword [0x40706c]
lea ecx, [esp + 0x2c]
call dword [0x40706c]
lea ecx, [esp + 0x30]
call dword [0x40706c]
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x18
ret 0xc
Function at 0x401f40
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x110], 0
cmp dword [ebp + 8], 0
jne 0x401f6d
mov eax, 8
jmp 0x4020d2
push 0x104
push 0
lea eax, [ebp - 0x104]
push eax
call sub.ntdll.dll_memset
add esp, 0xc
push 0x104
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x104]
push edx
call dword [sym.imp.ntdll.dll_strncpy]
add esp, 0xc
push 0x4c1c80
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 8
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0
jne 0x401fc7
mov eax, 6
jmp 0x4020d2
mov ecx, dword [ebp + 8]
push ecx
call fcn.00401bd0
add esp, 4
mov dword [ebp - 0x108], eax
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x108]
mov dword [edx], eax
mov ecx, dword [ebp - 0x108]
add ecx, 1
push ecx
call fcn.004017e0
add esp, 4
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 0xc]
cmp dword [eax], 0
jne 0x402030
cmp dword [ebp - 0x110], 0
je 0x40201c
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov dword [ebp - 0x110], 0
mov eax, 9
jmp 0x4020d2
mov edx, dword [ebp - 0x110]
push edx
mov eax, dword [ebp - 0x108]
push eax
push 1
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
push edx
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp - 0x10c]
cmp eax, dword [ebp - 0x108]
je 0x4020ad
mov ecx, dword [ebp + 0xc]
cmp dword [ecx], 0
je 0x40207a
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
push eax
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
mov ecx, dword [ebp + 0xc]
mov dword [ecx], 0
cmp dword [ebp - 0x110], 0
je 0x40209c
mov edx, dword [ebp - 0x110]
push edx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov dword [ebp - 0x110], 0
mov eax, 6
jmp 0x4020d2
cmp dword [ebp - 0x110], 0
je 0x4020c6
mov eax, dword [ebp - 0x110]
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov dword [ebp - 0x110], 0
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x402495
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x18]
add ecx, 0x1c
call fcn.00402b80
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
jmp 0x4024c5
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp - 8]
jae 0x4025eb
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp - 0x18]
add ecx, 0x1c
call fcn.00402c90
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x402528
cmp dword [ebp - 0xc], 0
jne 0x402528
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
call fcn.0041fef2
test eax, eax
je 0x40250a
mov dword [ebp - 0x1c], 0x4c1b60
jmp 0x402511
mov dword [ebp - 0x1c], 0x4c1b6c
mov ecx, dword [ebp - 0x1c]
push ecx
push 2
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp - 0x18]
add ecx, 0x1c
call fcn.00402ba0
jmp 0x4024bc
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x18]
add ecx, 0x1c
call fcn.00402bd0
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4025e6
cmp dword [ebp - 0x10], 0
je 0x4025e6
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
push 1
mov edx, dword [ebp - 0x14]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x14]
call dword [eax + 0xc]
test eax, eax
je 0x4025d0
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x14]
call dword [edx + 8]
cmp eax, 1
jne 0x402590
push 0x4c1b78
push 2
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x18]
add ecx, 0x1c
call fcn.00402ba0
jmp 0x4025ce
call fcn.0041fe28
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x4025b8
push 0x4c1b84
push 2
mov ecx, dword [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 0x18]
add ecx, 0x1c
call fcn.00402ba0
jmp 0x4025ce
push 0x4c1ba4
push 2
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp - 0x18]
add ecx, 0x1c
call fcn.00402ba0
jmp 0x4025e6
push 0x4c1bc8
push 2
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x18]
add ecx, 0x1c
call fcn.00402ba0
jmp 0x4024bc
cmp dword [ebp - 4], 0
jne 0x402608
push 0
push 0x54b108
push 0x4c1bd4
mov ecx, dword [ebp - 0x18]
add ecx, 4
call fcn.00402b50
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x402610
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x18], ecx
mov dword [ebp - 8], 0
mov ecx, dword [ebp - 0x18]
add ecx, 0x1c
call fcn.00402b80
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0
jmp 0x402640
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp - 4]
jae 0x402766
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp - 0x18]
add ecx, 0x1c
call fcn.00402c90
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4026a3
cmp dword [ebp - 0xc], 0
jne 0x4026a3
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
call fcn.004202aa
test eax, eax
je 0x402685
mov dword [ebp - 0x1c], 0x4c1be0
jmp 0x40268c
mov dword [ebp - 0x1c], 0x4c1bf0
mov ecx, dword [ebp - 0x1c]
push ecx
push 2
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp - 0x18]
add ecx, 0x1c
call fcn.00402ba0
jmp 0x402637
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x18]
add ecx, 0x1c
call fcn.00402bd0
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x402761
cmp dword [ebp - 0x10], 0
je 0x402761
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
push 0
mov edx, dword [ebp - 0x14]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x14]
call dword [eax + 0xc]
test eax, eax
je 0x40274b
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x14]
call dword [edx + 8]
cmp eax, 2
jne 0x40270b
push 0x4c1c00
push 2
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x18]
add ecx, 0x1c
call fcn.00402ba0
jmp 0x402749
call fcn.0041fe28
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x402733
push 0x4c1c10
push 2
mov ecx, dword [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 0x18]
add ecx, 0x1c
call fcn.00402ba0
jmp 0x402749
push 0x4c1c38
push 2
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp - 0x18]
add ecx, 0x1c
call fcn.00402ba0
jmp 0x402761
push 0x4c1c60
push 2
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x18]
add ecx, 0x1c
call fcn.00402ba0
jmp 0x402637
cmp dword [ebp - 8], 0
jne 0x402783
push 0
push 0x54b10c
push 0x4c1c70
mov ecx, dword [ebp - 0x18]
add ecx, 4
call fcn.00402b50
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4030f3
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov dword [ebp - 0x418], ecx
push 0
mov ecx, dword [ebp - 0x418]
add ecx, 4
call fcn.004014a0
push 0x42d
mov ecx, dword [ebp - 0x418]
add ecx, 4
call fcn.00402b10
push eax
mov ecx, dword [ebp - 0x418]
add ecx, 0x1c
call fcn.004044f0
push 0x42c
mov ecx, dword [ebp - 0x418]
add ecx, 4
call fcn.00402b10
push eax
mov ecx, dword [ebp - 0x418]
add ecx, 0x74
call fcn.004044f0
push 0x433
mov ecx, dword [ebp - 0x418]
add ecx, 4
call fcn.00402b10
push eax
mov ecx, dword [ebp - 0x418]
add ecx, 0xcc
call fcn.004044f0
push 0
push 4
mov ecx, dword [ebp - 0x418]
add ecx, 0x1c
call fcn.00404330
push 0
push 4
mov ecx, dword [ebp - 0x418]
add ecx, 0xcc
call fcn.00404330
push 0x4c2588
push 0x410
lea eax, [ebp - 0x410]
push eax
push 0x4c259c
push str.view_immunity
push 0x4c25e4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jbe 0x4031e3
lea ecx, [ebp - 0x410]
push ecx
mov ecx, dword [ebp - 0x418]
add ecx, 0x74
call fcn.00404380
jmp 0x4031f6
push str.http:__baike.360.cn_3229787_2649304.html_recommend1
mov ecx, dword [ebp - 0x418]
add ecx, 0x74
call fcn.00404380
push 0x42b
mov ecx, dword [ebp - 0x418]
add ecx, 4
call fcn.00402b10
push eax
mov ecx, dword [ebp - 0x418]
add ecx, 0x124
call fcn.0048a600
push 0x429
mov ecx, dword [ebp - 0x418]
add ecx, 4
call fcn.00402b10
push eax
mov ecx, dword [ebp - 0x418]
add ecx, 0x128
call fcn.0048a600
push 0x42a
mov ecx, dword [ebp - 0x418]
add ecx, 4
call fcn.00402b10
push eax
mov ecx, dword [ebp - 0x418]
add ecx, 0x12c
call fcn.0048a600
push 0
push 1
push 0
push 0x4c2628
push 0x64
mov ecx, dword [ebp - 0x418]
add ecx, 0x130
call fcn.00403fa0
push 1
mov ecx, dword [ebp - 0x418]
add ecx, 0x130
call fcn.0047e220
push eax
mov ecx, dword [ebp - 0x418]
add ecx, 0x124
call fcn.00404140
push 1
mov ecx, dword [ebp - 0x418]
add ecx, 0x130
call fcn.0047e220
push eax
mov ecx, dword [ebp - 0x418]
add ecx, 0x128
call fcn.00404140
push 1
mov ecx, dword [ebp - 0x418]
add ecx, 0x130
call fcn.0047e220
push eax
mov ecx, dword [ebp - 0x418]
add ecx, 0x12c
call fcn.00404140
call fcn.0040339b
test eax, eax
je 0x40331a
call fcn.0043b6d0
mov dword [ebp - 0x414], eax
mov ecx, dword [ebp - 0x414]
call fcn.0043bbb6
test eax, eax
jne 0x40331a
call fcn.00403419
mov ecx, dword [ebp - 0x418]
call fcn.00403712
test eax, eax
je 0x403343
push 0
push 1
push 0xf1
mov ecx, dword [ebp - 0x418]
add ecx, 0x12c
call fcn.00404110
call fcn.00420510
test eax, eax
je 0x40336b
call fcn.00420578
push 0
push 1
push 0xf1
mov ecx, dword [ebp - 0x418]
add ecx, 0x124
call fcn.00404110
call fcn.0041fdc0
test eax, eax
je 0x403393
call fcn.004203b1
push 0
push 1
push 0xf1
mov ecx, dword [ebp - 0x418]
add ecx, 0x128
call fcn.00404110
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4034b5
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov dword [ebp - 0x108], ecx
push 0x104
lea eax, [ebp - 0x104]
push eax
call fcn.00436b50
add esp, 8
test eax, eax
je 0x4034f9
push 5
push 0
lea ecx, [ebp - 0x104]
push ecx
push str.notepad.exe
push 0x4c2684
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4035a1
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov dword [ebp - 0x210], ecx
xor eax, eax
mov al, byte [0x54b114]
and eax, 1
test eax, eax
jne 0x4035dd
mov cl, byte [0x54b114]
or cl, 1
mov byte [0x54b114], cl
mov ecx, dword [ebp - 0x210]
call fcn.00403712
mov dword [0x54b110], eax
cmp dword [0x54b110], 0
jne 0x4036c4
push 4
push 0x4c268c
push 0x4c2694
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 6
je 0x403633
push 0
push 0
push 0xf1
mov ecx, dword [ebp - 0x210]
add ecx, 0x12c
call fcn.00404110
xor eax, eax
jmp 0x40370c
push 0x104
lea edx, [ebp - 0x104]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x104]
push eax
push 0x4c2724
push 0x104
lea ecx, [ebp - 0x208]
push ecx
call fcn.00403f10
add esp, 0x10
lea edx, [ebp - 0x208]
push edx
call sub.ntdll.dll_strlen
add esp, 4
push eax
lea eax, [ebp - 0x208]
push eax
push 1
push 0x4c2730
push 0x4c2738
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0043ed70
mov ecx, eax
call fcn.0043f1c2
push 1
call fcn.0043b6d0
mov ecx, eax
call fcn.0043bb20
push 0
push 0x4c2768
push 0x4c2770
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x4036f8
push 0x4c2784
push 0x4c278c
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0043ed70
mov ecx, eax
call fcn.0043f332
push 0
push 0x4c27bc
push 0x4c27c4
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
cmp dword [0x54b110], 0
sete cl
mov dword [0x54b110], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x403712
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x31c
mov dword [ebp - 0x31c], ecx
mov dword [ebp - 0x318], 0x104
push 0x104
lea eax, [ebp - 0x104]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [ebp - 0x104]
push ecx
push str.__s___anti
push 0x104
lea edx, [ebp - 0x314]
push edx
call fcn.00403f10
add esp, 0x10
lea eax, [ebp - 0x318]
push eax
lea ecx, [ebp - 0x208]
push ecx
lea edx, [ebp - 0x210]
push edx
push 0x4c27e4
push 0x4c27ec
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0043ed70
mov ecx, eax
call fcn.0043efbf
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0
je 0x40382b
mov dword [ebp - 0x318], 0x104
lea eax, [ebp - 0x318]
push eax
lea ecx, [ebp - 0x208]
push ecx
lea edx, [ebp - 0x210]
push edx
push 0x4c281c
push 0x4c2828
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0043ed70
mov ecx, eax
call fcn.0043efbf
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0
je 0x40382b
mov dword [ebp - 0x318], 0x104
lea eax, [ebp - 0x318]
push eax
lea ecx, [ebp - 0x208]
push ecx
lea edx, [ebp - 0x210]
push edx
push 0x4c2858
push 0x4c2864
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0043ed70
mov ecx, eax
call fcn.0043efbf
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0
jne 0x4038dd
cmp dword [ebp - 0x210], 1
jne 0x4038dd
cmp dword [ebp - 0x318], 0
jbe 0x4038dd
lea eax, [ebp - 0x314]
push eax
lea ecx, [ebp - 0x208]
push ecx
call fcn.00402af0
add esp, 8
test eax, eax
jne 0x4038dd
push str.killrodog4
push 0x4c28a0
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0043ed70
mov ecx, eax
call fcn.0043f332
push str.killrodog
push 0x4c28dc
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0043ed70
mov ecx, eax
call fcn.0043f332
lea edx, [ebp - 0x314]
push edx
call sub.ntdll.dll_strlen
add esp, 4
push eax
lea eax, [ebp - 0x314]
push eax
push 1
push str.akCheck
push 0x4c2914
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0043ed70
mov ecx, eax
call fcn.0043f1c2
mov eax, 1
jmp 0x4038df
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x406440
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x18]
call fcn.00406f50
and eax, 0xff
test eax, eax
je 0x4064a5
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x18]
add ecx, 4
call fcn.00406550
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0xfffffffe
lea edx, [ebp - 0x10]
push edx
mov ecx, dword [ebp - 0x18]
add ecx, 4
call fcn.00406550
push eax
push 0x4e
mov ecx, dword [ebp - 0x18]
add ecx, 4
call fcn.00405d10
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x406540
mov ecx, dword [ebp - 0x18]
call fcn.00406d90
and eax, 0xff
test eax, eax
je 0x4064ec
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 4]
push ecx
mov ecx, dword [ebp - 0x18]
add ecx, 4
call fcn.00406550
and eax, 0xffff
and eax, 0xffff
push eax
push 0x111
mov ecx, dword [ebp - 0x18]
add ecx, 4
call fcn.00405d10
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x406540
push 1
push 0
push 0
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0x24]
push eax
push 0x4c2b58
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [ebp - 0x14], eax
mov ecx, 0x20
cmp ecx, dword [ebp - 0x14]
sbb edx, edx
neg edx
mov byte [ebp - 4], dl
mov eax, dword [ebp - 4]
and eax, 0xff
test eax, eax
je 0x406540
mov ecx, dword [ebp - 0x18]
mov dl, byte [ecx + 0x54]
or dl, 2
mov eax, dword [ebp - 0x18]
mov byte [eax + 0x54], dl
push 1
mov ecx, dword [ebp - 0x18]
add ecx, 4
call fcn.00405180
mov al, byte [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x408560
Capabilities:
Get common file path
Get graphical window text
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ab9d9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x11c
mov dword [ebp - 0x128], ecx
lea ecx, [ebp - 0x10]
call fcn.00409420
mov dword [ebp - 4], 0
push 0x401
mov eax, dword [ebp - 0x128]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
ja 0x4085dc
mov dword [ebp - 0x120], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004095f0
mov eax, dword [ebp - 0x120]
jmp 0x4086da
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
call fcn.004094a0
push eax
push 0x401
mov ecx, dword [ebp - 0x128]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.004095a0
push 0
push 0x10
lea eax, [ebp - 0x118]
push eax
mov ecx, dword [ebp - 0x128]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x4086bb
push 0x4c301c
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
push 0x4c3030
lea ecx, [ebp - 0x118]
push ecx
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 8
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0
je 0x4086bb
mov edx, dword [ebp - 0x11c]
push edx
push 1
mov eax, dword [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
call fcn.0047e220
push eax
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x10
test eax, eax
jbe 0x4086ab
push 0
push 0x4c3034
push 0x4c303c
mov ecx, dword [ebp - 0x128]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [ebp - 0x11c]
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov dword [ebp - 0x124], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004095f0
mov eax, dword [ebp - 0x124]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x408851
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0x40f
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.00402b10
push eax
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
jne 0x40888d
push 5
push 0
push 0
push str.http:__baike.360.cn_help.html
push 0x4c3118
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x4088a4
mov eax, dword [ebp - 4]
push eax
push 0
push 0x408836
call fcn.00445260
mov ecx, eax
call fcn.004454b5
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x409140
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4abaed
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
call fcn.00409420
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 4
call fcn.00409420
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 8
call fcn.00409420
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.00409420
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x10]
add ecx, 0x10
call fcn.00409420
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x10]
add ecx, 0x14
call fcn.00409420
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call fcn.00409420
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x10]
add ecx, 0x1c
call fcn.00409420
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x10]
add ecx, 0x20
call fcn.00409420
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x10]
add ecx, 0x24
call fcn.00409420
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x10]
add ecx, 0x28
call fcn.00409420
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x10]
add ecx, 0x2c
call fcn.00409420
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.00409420
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x10]
add ecx, 0x34
call fcn.00409420
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0x10]
add ecx, 0x38
call fcn.00409420
mov byte [ebp - 4], 0xe
mov ecx, dword [ebp - 0x10]
add ecx, 0x3c
call fcn.00409420
mov byte [ebp - 4], 0xf
push 0x54b120
mov ecx, dword [ebp - 0x10]
call fcn.00409440
push 0x54b120
mov ecx, dword [ebp - 0x10]
add ecx, 4
call fcn.00409440
push 0x54b120
mov ecx, dword [ebp - 0x10]
add ecx, 8
call fcn.00409440
push 0x54b120
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.00409440
push 0x54b120
mov ecx, dword [ebp - 0x10]
add ecx, 0x10
call fcn.00409440
push 0x54b120
mov ecx, dword [ebp - 0x10]
add ecx, 0x14
call fcn.00409440
push 0x54b120
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call fcn.00409440
push 0x54b120
mov ecx, dword [ebp - 0x10]
add ecx, 0x1c
call fcn.00409440
push 0x54b120
mov ecx, dword [ebp - 0x10]
add ecx, 0x20
call fcn.00409440
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x409300
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4abbb1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0xe
mov ecx, dword [ebp - 0x10]
add ecx, 0x3c
call fcn.004095f0
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0x10]
add ecx, 0x38
call fcn.004095f0
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x10]
add ecx, 0x34
call fcn.004095f0
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.004095f0
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x10]
add ecx, 0x2c
call fcn.004095f0
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x10]
add ecx, 0x28
call fcn.004095f0
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x10]
add ecx, 0x24
call fcn.004095f0
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x10]
add ecx, 0x20
call fcn.004095f0
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x10]
add ecx, 0x1c
call fcn.004095f0
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call fcn.004095f0
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x10]
add ecx, 0x14
call fcn.004095f0
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x10]
add ecx, 0x10
call fcn.004095f0
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.004095f0
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 8
call fcn.004095f0
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 4
call fcn.004095f0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
call fcn.004095f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret