joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4042f0
Capabilities:
Create tcp socket
Create udp socket
Initialize winsock library

Disassembly:
push esi
mov esi, ecx
lea eax, [esi + 8]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
cmp eax, 0xffffffff
jne 0x404312
mov ecx, esi
call fcn.00404340
xor al, al
pop esi
ret
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
mov dword [esi + 4], eax
jne 0x404331
mov ecx, esi
call fcn.00404340
xor al, al
pop esi
ret
mov al, 1
pop esi
ret

Function at 0x404370
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x400
mov edx, ecx
push edi
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 5]
mov byte [esp + 4], 0
rep stosd dword es:[edi], eax
mov ecx, dword [edx + 4]
push 0
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 8]
push 0x400
push eax
push ecx
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
pop edi
je 0x4043dc
mov eax, dword [esp + 0x404]
mov cl, byte [esp]
mov dl, byte [eax]
cmp dl, cl
jne 0x4043dc
mov cl, byte [eax + 1]
mov dl, byte [esp + 1]
cmp cl, dl
jne 0x4043dc
mov dl, byte [eax + 2]
mov al, byte [esp + 2]
cmp dl, al
jne 0x4043dc
mov al, 1
add esp, 0x400
ret 4
xor al, al
add esp, 0x400
ret 4
Function at 0xa68058
Capabilities:
Decompress data using aplib

Disassembly:
call 0xa681a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xa6807e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa6806a
add dl, dl
jne 0xa68089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa680dc
xor eax, eax
add dl, dl
jne 0xa68096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa6817d
add dl, dl
jne 0xa680a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa680b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa680bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa680c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xa680d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xa68075
mov eax, 1
add dl, dl
jne 0xa680ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa680f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa680e1
sub eax, ebx
mov ebx, 1
jne 0xa68128
mov ecx, 1
add dl, dl
jne 0xa6810e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa68119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa68105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa68075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xa6813f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa6814a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa68136
cmp eax, 0x7d00
jae 0xa6816d
cmp eax, 0x500
jb 0xa68168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa68075
cmp eax, 0x7f
ja 0xa68170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa68075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xa6819e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xa68075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x401ab0
Capabilities:
Check os version

Disassembly:
sub esp, 0x1a4
push ebx
push esi
mov esi, dword [esp + 0x1b0]
push edi
test esi, esi
je 0x401cb4
mov ebx, dword [esp + 0x1b8]
test ebx, ebx
jle 0x401cb4
mov ecx, 0x27
xor eax, eax
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0x10], 0x9c
call edi
test eax, eax
jne 0x401b14
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x94
push ecx
call edi
test eax, eax
je 0x401cb4
mov eax, dword [esp + 0x1c]
push ebp
mov ebp, dword [sym.imp.MSVCRT.dll__mbsnbcat]
sub eax, 0
mov byte [esi], 0
je 0x401bdb
dec eax
je 0x401b76
dec eax
jne 0x401be7
mov eax, dword [esp + 0x14]
cmp eax, 4
ja 0x401b49
push ebx
push str.Microsoft_Windows_NT
jmp 0x401be1
cmp eax, 5
jne 0x401b6e
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x401b61
push ebx
push str.Microsoft_Windows_2000
jmp 0x401be1
cmp eax, 1
jne 0x401b6e
push ebx
push str.Microsoft_Windows_XP
jmp 0x401be1
push ebx
push str.Microsoft_Windows_XP_later
jmp 0x401be1
cmp dword [esp + 0x14], 4
jne 0x401bd3
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x401ba5
push ebx
push str.Microsoft_Windows_95
push esi
call ebp
mov al, byte [esp + 0x31]
add esp, 0xc
cmp al, 0x43
je 0x401b9d
cmp al, 0x42
jne 0x401be7
push ebx
push str.OSR2
jmp 0x401be1
cmp eax, 0xa
jne 0x401bc6
push ebx
push str.Microsoft_Windows_98
push esi
call ebp
mov al, byte [esp + 0x31]
add esp, 0xc
cmp al, 0x41
jne 0x401be7
push ebx
push 0x43e298
jmp 0x401be1
cmp eax, 0x5a
jne 0x401bd3
push ebx
push str.Microsoft_Windows_Me
jmp 0x401be1
push ebx
push str.Microsoft_Windows_Me_later
jmp 0x401be1
push ebx
push str.Microsoft_Win32s
push esi
call ebp
add esp, 0xc
mov edx, dword [esp + 0x14]
cmp edx, 4
ja 0x401c4f
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0xad]
mov byte [esp + 0xac], 0
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
and eax, 0xffff
push eax
push ecx
push edx
push str._Build__d._d._d__n
lea edx, [esp + 0xbc]
push 0x104
push edx
call dword [sym.imp.MSVCRT.dll__snprintf]
lea eax, [esp + 0xc4]
push ebx
push eax
push esi
call ebp
add esp, 0x24
mov eax, 1
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1a4
ret
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0xad]
mov byte [esp + 0xac], 0
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
and ecx, 0xffff
push ecx
push eax
lea ecx, [esp + 0x2c]
push edx
push ecx
push str._s__Build__d._d._d__n
lea edx, [esp + 0xc0]
push 0x104
push edx
call dword [sym.imp.MSVCRT.dll__snprintf]
lea eax, [esp + 0xc8]
push ebx
push eax
push esi
call ebp
add esp, 0x28
mov eax, 1
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1a4
ret
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x1a4
ret
Function at 0x401d60
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42afe8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x1188
call fcn.0041e3d0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
xor ebx, ebx
cmp dword [ebp + 8], ebx
je 0x401ef2
cmp dword [ebp + 0xc], ebx
jle 0x401ef2
push 0x104
lea eax, [ebp - 0x118]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [ebp - 0x14]
call sub.MFC42.DLL_CString::CString_2
mov dword [ebp - 4], ebx
mov byte [ebp - 4], 1
xor ecx, ecx
mov dword [ebp - 0x12c], ecx
mov dword [ebp - 0x128], ecx
mov dword [ebp - 0x124], ecx
mov dword [ebp - 0x120], ecx
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
lea edx, [ebp - 0x118]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
mov dword [ebp - 0x11c], esi
cmp esi, 0xffffffff
je 0x401e7f
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 0x130], ebx
lea eax, [ebp - 0x118c]
push eax
call fcn.0040b900
add esp, 4
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
lea ecx, [ebp - 0x130]
push ecx
push 0x1000
lea edx, [ebp - 0x1130]
push edx
push esi
call edi
mov eax, dword [ebp - 0x130]
cmp eax, ebx
je 0x401e62
push eax
lea eax, [ebp - 0x1130]
push eax
lea ecx, [ebp - 0x118c]
push ecx
call fcn.0040b93b
add esp, 0xc
jmp 0x401e28
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [ebp - 0x118c]
push edx
lea eax, [ebp - 0x12c]
push eax
call fcn.0040c48f
add esp, 8
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0x10
lea eax, [ebp - 0x12c]
push eax
call fcn.00401cc0
add esp, 0x10
mov dword [ebp - 0x1190], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call sub.MFC42.DLL_CString::CString
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4024f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42b000
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x220
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x220], 0
mov ecx, 0x41
xor eax, eax
lea edi, [ebp - 0x21f]
rep stosd dword es:[edi], eax
push 0x104
lea eax, [ebp - 0x220]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x5c
lea ecx, [ebp - 0x220]
push ecx
call dword [sym.imp.MSVCRT.dll__mbsrchr]
add esp, 8
test eax, eax
je 0x402557
mov byte [eax], 0
mov byte [ebp - 0x118], 0
mov ecx, 0x41
xor eax, eax
lea edi, [ebp - 0x117]
rep stosd dword es:[edi], eax
push str.BugReport.log
lea edx, [ebp - 0x220]
push edx
push 0x43e194
push 0x104
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x14
mov ebx, dword [ebp + 8]
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [ebp - 0x228], ecx
mov dword [ebp - 4], eax
push eax
push 0x80
push 4
push eax
push 1
push 0x40000000
lea ecx, [ebp - 0x118]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
mov dword [ebp - 0x22c], esi
cmp esi, 0xffffffff
je 0x402601
push 2
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea edx, [ebp - 0x228]
push edx
mov eax, dword [ebp - 0x228]
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4028e0
Capabilities:
Get file version info

Disassembly:
sub esp, 0x34
push ebx
push ebp
push esi
mov esi, ecx
push 0
lea ebp, [esi + 0x30]
push ebp
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
jne 0x402900
pop esi
pop ebp
pop ebx
add esp, 0x34
ret
push edi
push ebx
call sub.MFC42.DLL_operatornew
mov ecx, ebx
mov edi, eax
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [esi + 8], edi
add esp, 4
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esi + 8]
push eax
push ebx
push 0
push ebp
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
pop edi
jne 0x40293a
pop esi
pop ebp
pop ebx
add esp, 0x34
ret
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
call fcn.004026e0
test eax, eax
jne 0x402951
pop esi
pop ebp
pop ebx
add esp, 0x34
ret
mov eax, dword [esp + 0x14]
push 0x104
mov edx, eax
mov word [esi + 0xe], ax
mov eax, dword [esp + 0x1c]
shr edx, 0x10
mov ecx, eax
mov word [esi + 0x12], ax
mov eax, dword [esp + 0x20]
mov word [esi + 0xc], dx
shr ecx, 0x10
mov edx, eax
mov word [esi + 0x16], ax
mov eax, dword [esp + 0x24]
mov word [esi + 0x10], cx
mov ecx, eax
mov word [esi + 0x1a], ax
mov eax, dword [esp + 0x2c]
shr ecx, 0x10
shr edx, 0x10
mov word [esi + 0x18], cx
mov ecx, dword [esp + 0x30]
mov word [esi + 0x14], dx
mov edx, dword [esp + 0x28]
mov dword [esi + 0x24], ecx
lea ecx, [esi + 0x134]
mov dword [esi + 0x1c], edx
mov edx, dword [esp + 0x34]
mov dword [esi + 0x20], eax
mov eax, dword [esp + 0x38]
push ecx
push 0x43e760
mov ecx, esi
mov dword [esi + 0x28], edx
mov dword [esi + 0x2c], eax
call fcn.00402780
test eax, eax
jne 0x4029db
pop esi
pop ebp
pop ebx
add esp, 0x34
ret
lea edx, [esi + 0x33c]
push 0x104
push edx
push 0x43e750
mov ecx, esi
call fcn.00402780
test eax, eax
jne 0x4029fe
pop esi
pop ebp
pop ebx
add esp, 0x34
ret
lea eax, [esi + 0x238]
push 0x104
push eax
push 0x43e744
mov ecx, esi
call fcn.00402780
neg eax
sbb eax, eax
pop esi
pop ebp
pop ebx
neg eax
add esp, 0x34
ret
Function at 0x402b80
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x14
push esi
push edi
push 0x43e808
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov edi, eax
add esp, 8
test edi, edi
jne 0x402bc8
mov esi, dword [esp + 0x28]
test esi, esi
je 0x402bc0
call dword [sym.imp.MSVCRT.dll__errno]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.MSVCRT.dll_strerror]
add esp, 4
mov ecx, esi
push eax
call sub.MFC42.DLL_CString::operator
pop edi
xor al, al
pop esi
add esp, 0x14
ret
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x402bd8
mov edx, dword [eax]
mov dword [esp + 0x20], edx
jmp 0x402be0
mov dword [esp + 0x20], 0
xor eax, eax
push ebx
mov ebx, dword [esp + 0x28]
mov dword [esp + 0xd], eax
mov dword [esp + 0x11], eax
push ebp
mov dword [esp + 0x19], eax
mov ecx, ebx
mov dword [esp + 0x1d], eax
mov byte [esp + 0x10], 0
mov word [esp + 0x21], ax
mov byte [esp + 0x23], al
call sub.MFC42.DLL_CString::Empty
mov ebp, dword [sym.imp.MSVCRT.dll_fseek]
push 2
push 0
push edi
call ebp
push edi
call dword [sym.imp.MSVCRT.dll_ftell]
push 0
push 0
push edi
mov esi, eax
call ebp
add esp, 0x1c
test esi, esi
je 0x402c4f
push edi
push 1
push esi
push esi
mov ecx, ebx
call sub.MFC42.DLL_CString::GetBuffer
push eax
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
mov ecx, ebx
push esi
call sub.MFC42.DLL_CString::ReleaseBuffer
mov eax, dword [esp + 0x30]
pop ebp
test eax, eax
pop ebx
je 0x402c6d
lea ecx, [esp + 8]
push esi
push ecx
push str._s_d_bytes
push eax
call sub.MFC42.DLL_CString::Format
add esp, 0x10
push edi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x30]
add esp, 4
test eax, eax
je 0x402c85
mov edx, dword [esp + 0x20]
mov dword [eax], edx
pop edi
mov al, 1
pop esi
add esp, 0x14
ret
Function at 0x406610
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x42b4f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString_2
mov eax, dword [esi + 0x2a8]
lea ecx, [esp + 0xc]
push eax
push 0x43e108
push ecx
mov dword [esp + 0x28], 0
call sub.MFC42.DLL_CString::Format
mov edx, dword [esp + 0x18]
mov edi, dword [esp + 0x30]
add esp, 0xc
mov ecx, edi
push edx
push str._UIN_
call sub.MFC42.DLL_CString::Replace
lea eax, [esp + 0x10]
mov ecx, esi
push eax
call fcn.00406980
mov ecx, dword [esp + 0x10]
mov byte [esp + 0x1c], 1
push ecx
push str._ADDEDSIGN_
mov ecx, edi
call sub.MFC42.DLL_CString::Replace
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::CString_2
mov edx, dword [esi + 0x2ac]
lea eax, [esp + 8]
push edx
push 0x43e0f8
push eax
mov byte [esp + 0x28], 2
call sub.MFC42.DLL_CString::Format
mov ecx, dword [esp + 0x14]
add esp, 0xc
push ecx
push str._VERSION_
mov ecx, edi
call sub.MFC42.DLL_CString::Replace
push str.__domainqq.com__path__
mov ecx, edi
call sub.MFC42.DLL_CString::operator_2
lea ecx, [esp + 8]
mov byte [esp + 0x1c], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x1c], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x14]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret 4
Function at 0x408910
Capabilities:
Get common file path

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x42bb8b
push eax
mov dword fs:[0], esp
sub esp, 0x108
push ebp
push esi
mov esi, ecx
call fcn.00408ac0
test eax, eax
jne 0x408954
pop esi
mov eax, 1
pop ebp
mov ecx, dword [esp + 0x108]
mov dword fs:[0], ecx
add esp, 0x114
ret
lea ebp, [esi + 0x34]
push edi
mov ecx, ebp
call fcn.0041ed20
push esi
mov ecx, ebp
call fcn.00421150
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x11]
mov byte [esp + 0x10], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x10]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov esi, eax
pop edi
test esi, esi
jle 0x408a1e
cmp esi, 0x104
jge 0x408a1e
push str.qzuif.tmp
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString_3
mov edx, dword [esp + 8]
mov eax, 0x103
sub eax, esi
mov dword [esp + 0x118], 0
mov ecx, dword [edx - 8]
cmp eax, ecx
jl 0x4089cc
mov eax, ecx
push eax
lea ecx, [esp + 0x10]
push edx
push ecx
call dword [sym.imp.MSVCRT.dll_strncat]
add esp, 0xc
lea edx, [esp + 0xc]
mov ecx, ebp
push 0
push edx
push str.http:__imgcache.qq.com_qzone_qzupdate.xml
call fcn.0041ed40
lea ecx, [esp + 8]
mov esi, eax
mov dword [esp + 0x118], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov eax, esi
pop esi
pop ebp
mov ecx, dword [esp + 0x108]
mov dword fs:[0], ecx
add esp, 0x114
ret
mov ecx, dword [esp + 0x110]
pop esi
xor eax, eax
pop ebp
mov dword fs:[0], ecx
add esp, 0x114
ret

Function at 0x408a50
Capabilities:
Set registry value

Disassembly:
sub esp, 0xc
lea eax, [esp]
push esi
push eax
xor esi, esi
push str.SOFTWARETencentQzone
push 0x80000001
mov dword [esp + 0x10], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x408ab1
lea ecx, [esp + 0xc]
push ecx
call sub.MFC42.DLL_CTime::GetTickCount
mov edx, dword [eax]
mov ecx, dword [esp + 4]
lea eax, [esp + 8]
push 4
push eax
push 4
push esi
push str.LastUpdate
push ecx
mov dword [esp + 0x20], edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x408aa6
mov esi, 1
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0xc
ret
Function at 0x408ac0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x1c
lea eax, [esp]
push esi
push eax
push str.SOFTWARETencentQzone
push 0x80000001
mov dword [esp + 0x28], 0
or esi, 0xffffffff
mov dword [esp + 0x10], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x408b6b
lea ecx, [esp + 8]
lea edx, [esp + 0xc]
push ecx
push edx
push eax
push eax
mov eax, dword [esp + 0x14]
push str.LastUpdate
push eax
mov dword [esp + 0x20], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x408b60
mov eax, dword [esp + 0xc]
push ecx
mov ecx, esp
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], esp
lea edx, [esp + 0x1c]
mov dword [ecx], eax
lea ecx, [esp + 0x14]
push ecx
push edx
call sub.MFC42.DLL_CTime::GetTickCount
mov ecx, eax
call fcn.00409470
mov ecx, dword [esp + 0x10]
mov eax, 0xc22e4507
imul ecx
add edx, ecx
xor ecx, ecx
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp edx, 5
setge cl
mov esi, ecx
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x1c
ret

Function at 0x409800
Capabilities:
Delete file

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esi + 0x40]
call fcn.0041ed20
mov eax, dword [esi + 0x3c]
lea edi, [esi + 0x3c]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x409828
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, edi
call sub.MFC42.DLL_CString::Empty
mov ecx, esi
call fcn.00409da0
mov ebx, dword [esi + 0x2c]
xor edi, edi
test ebx, ebx
jle 0x40984c
mov eax, dword [esi + 0x28]
mov ecx, dword [eax + edi*4]
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
inc edi
cmp edi, ebx
jl 0x409838
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x24]
call sub.MFC42.DLL_CPtrArray::SetSize
pop edi
pop esi
pop ebx
ret
Function at 0x409e60
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x42bf46
push eax
mov eax, dword [esp + 0x10]
mov dword fs:[0], esp
sub esp, 0x114
push ebx
xor ebx, ebx
cmp eax, ebx
je 0x409fb9
lea ecx, [esp + 8]
mov dword [esp + 8], ebx
push ecx
push 1
push ebx
push str.command
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x409fb9
push edi
mov ecx, 0x40
lea edi, [esp + 0x19]
mov byte [esp + 0x18], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x10]
stosb byte es:[edi], al
lea eax, [esp + 0x18]
push edx
push eax
push ebx
push ebx
push ebx
push ecx
mov dword [esp + 0x28], 0x103
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x18]
lea ecx, [esp + 8]
push eax
mov dword [esp + 0x10], ebx
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esp + 8]
mov dword [esp + 0x124], ebx
call sub.MFC42.DLL_CString::TrimLeft
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::TrimRight_1
mov eax, dword [esp + 8]
pop edi
cmp dword [eax - 8], ebx
jle 0x409fa5
mov al, byte [eax]
cmp al, 0x22
jne 0x409fa5
push 1
push 0x22
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::Find
cmp eax, 1
jl 0x409fa5
mov ecx, dword [esp + 4]
cmp eax, dword [ecx - 8]
jge 0x409fa5
dec eax
lea edx, [esp + 0x10]
push eax
push 1
push edx
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::Mid_1
mov ecx, dword [esp + 0x12c]
push eax
mov byte [esp + 0x124], 1
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0x10]
mov byte [esp + 0x120], bl
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 4]
mov dword [esp + 0x120], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov al, 1
pop ebx
mov ecx, dword [esp + 0x114]
mov dword fs:[0], ecx
add esp, 0x120
ret
lea ecx, [esp + 4]
mov dword [esp + 0x120], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x118]
xor al, al
pop ebx
mov dword fs:[0], ecx
add esp, 0x120
ret
Function at 0x40a2e0
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [0x440690]
sub esp, 0x5c
test eax, eax
push esi
push edi
jne 0x40a3a8
mov ecx, 0xd
mov esi, str.SOFTWAREMicrosoftInternet_ExplorerVersion_Vector
lea edi, [esp + 0x30]
lea eax, [esp + 8]
rep movsd dword es:[edi], dword [esi]
push eax
push 1
lea ecx, [esp + 0x38]
push 0
push ecx
push 0x80000002
mov dword [esp + 0x1c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40a32f
pop edi
xor al, al
pop esi
add esp, 0x5c
ret
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x11]
mov byte [esp + 0x10], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, dword [esp + 8]
lea edx, [esp + 0xc]
stosb byte es:[edi], al
lea eax, [esp + 0x10]
push edx
push eax
push 0
push 0
push 0x43ee00
push ecx
mov dword [esp + 0x24], 0x1f
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40a39d
mov esi, dword [esp + 0xc]
xor ecx, ecx
test esi, esi
jle 0x40a39d
mov edx, dword [0x440690]
mov al, byte [esp + ecx + 0x10]
cmp al, 0x2e
je 0x40a397
and eax, 0xff
lea edx, [edx + edx*4]
inc ecx
cmp ecx, esi
lea edx, [eax + edx*2 - 0x30]
jl 0x40a37e
mov dword [0x440690], edx
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [0x440690]
xor eax, eax
cmp ecx, 7
pop edi
setge al
pop esi
add esp, 0x5c
ret