joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43bd55da
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov ecx, dword [ebp + 0x14]
push ebx
push esi
push edi
lea edx, [ecx + 2]
xor ebx, ebx
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x43bd55ea
mov esi, dword [ebp + 0xc]
sub ecx, edx
mov edi, dword [ebp + 8]
sar ecx, 1
lea eax, [ecx*2 + 2]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 0xf003f
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push esi
push edi
call ebx
cmp eax, 5
jne 0x43bd562e
lea eax, [ebp - 4]
push eax
push 2
push 0
push esi
push edi
call ebx
test eax, eax
je 0x43bd5668
cmp eax, 2
jne 0x43bd5699
mov edx, esi
mov ecx, edi
call fcn.43bd557c
test eax, eax
je 0x43bd5699
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push esi
push edi
call ebx
cmp eax, 5
jne 0x43bd5664
lea eax, [ebp - 4]
push eax
push 2
push 0
push esi
push edi
call ebx
test eax, eax
jne 0x43bd5699
push dword [ebp - 8]
push dword [ebp + 0x14]
push 1
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x43bd5694
push dword [ebp - 4]
call esi
test eax, eax
jne 0x43bd5694
inc eax
jmp 0x43bd569b
push dword [ebp - 4]
call esi
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43bd56a2
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x43c3a250]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov dword [ebp - 0x1c], edx
xor esi, esi
lea edx, [ebp - 0x10]
mov dword [ebp - 0x20], ebx
push edx
push 1
push esi
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43bd577e
push edi
mov word [ebp - 0xc], ax
mov edi, esi
lea eax, [ebp - 0x14]
mov dword [ebp - 0xa], esi
push eax
lea eax, [ebp - 0xc]
mov dword [ebp - 0x14], 4
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 1
push eax
push esi
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 0xea
jne 0x43bd5749
mov ebx, dword [ebp - 0x14]
add ebx, 2
push ebx
call fcn.43bf9a94
mov edi, eax
pop ecx
test edi, edi
je 0x43bd5774
push ebx
push esi
push edi
call fcn.43bfa2b0
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
push edi
lea eax, [ebp - 0x18]
push eax
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x43bd5769
test edi, edi
lea esi, [ebp - 0xc]
cmovne esi, edi
push esi
call fcn.43bc209d
pop ecx
mov ecx, dword [ebp - 0x1c]
push eax
push esi
call fcn.43bc2024
xor esi, esi
inc esi
test edi, edi
je 0x43bd5774
push edi
call fcn.43bf9a5c
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.43bfad82
mov esp, ebp
pop ebp
ret
Function at 0x43bd57ab
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
test edx, edx
jne 0x43bd57ba
xor eax, eax
jmp 0x43bd5894
push ebx
push esi
mov esi, dword [ebp + 8]
mov ecx, 0xffe79e6d
mov ebx, 0xff
cmp esi, 8
jb 0x43bd5875
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x43c23d40]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x43c23d40]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x43c23d40]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x43c23d40]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x43c23d40]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x43c23d40]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x43c23d40]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x43c23d40]
dec edi
jne 0x43bd57d8
pop edi
test esi, esi
je 0x43bd588e
movzx eax, byte [edx]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x43c23d40]
inc edx
dec esi
jne 0x43bd5879
not ecx
pop esi
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43bd60a0
Capabilities:
Get session user name
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc18
mov eax, dword [0x43c3a250]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
mov edi, 0x3fe
push edi
push eax
mov word [ebp - 0x404], ax
mov ebx, 0x200
lea eax, [ebp - 0x402]
mov dword [ebp - 0xc10], ebx
push eax
mov esi, ecx
call fcn.43bfa2b0
xor eax, eax
push edi
push eax
mov word [ebp - 0x804], ax
lea eax, [ebp - 0x802]
push eax
call fcn.43bfa2b0
xor eax, eax
push edi
mov word [ebp - 0xc04], ax
xor edi, edi
lea eax, [ebp - 0xc02]
push edi
push eax
call fcn.43bfa2b0
xor eax, eax
mov dword [ebp - 0xc08], ebx
add esp, 0x24
mov word [esi], ax
lea eax, [ebp - 0xc08]
mov dword [ebp - 0xc0c], ebx
mov dword [ebp - 0xc14], ebx
push eax
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x43bd61ca
lea ecx, [ebp - 0x404]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x43bd614e
sub ecx, edx
sar ecx, 1
lea eax, [ecx + 1]
mov dword [ebp - 0xc08], eax
lea eax, [ebp - 0xc18]
push eax
lea eax, [ebp - 0xc14]
push eax
lea eax, [ebp - 0xc04]
push eax
lea eax, [ebp - 0xc0c]
push eax
lea eax, [ebp - 0x804]
push eax
lea eax, [ebp - 0x404]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
je 0x43bd61ca
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x43bd61ca
lea eax, [ebp - 0xc10]
mov edx, esi
push eax
lea ecx, [ebp - 0x804]
call fcn.43bd5f6b
pop ecx
test eax, eax
je 0x43bd61ca
xor eax, eax
inc eax
jmp 0x43bd61cc
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.43bfad82
mov esp, ebp
pop ebp
ret
Function at 0x43bd633b
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x43c18a3d
mov eax, dword fs:[0]
push eax
sub esp, 0x134
mov eax, dword [0x43c3a250]
xor eax, esp
mov dword [esp + 0x12c], eax
push ebx
push esi
mov eax, dword [0x43c3a250]
xor eax, esp
push eax
lea eax, [esp + 0x140]
mov dword fs:[0], eax
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x43bd6498
lea eax, [esp + 0x18]
push eax
call fcn.43bd65be
test al, al
je 0x43bd6498
mov esi, dword [esp + 0x18]
cmp esi, 0x21
ja 0x43bd6498
xor ebx, ebx
lea eax, [esp + 0x35]
push 0xfe
push ebx
push eax
mov byte [esp + 0x40], bl
call fcn.43bfa2b0
add esp, 0xc
lea eax, [esp + 0x34]
push eax
call fcn.43bd64bf
test al, al
je 0x43bd6498
mov byte [esp + esi + 0x34], 1
mov esi, ebx
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x148], ebx
xor eax, eax
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], ebx
mov word [esp + 0x1c], ax
lea eax, [esp + 0x1c]
mov byte [esp + 0x148], 1
push eax
call fcn.43bd65f7
cmp dword [esp + 0x2c], ebx
je 0x43bd647c
cmp dword [esp + 0x30], 8
lea eax, [esp + 0x1c]
push 0x2001f
cmovae eax, dword [esp + 0x20]
push eax
push ecx
lea ecx, [esp + 0x18]
call fcn.43bc410f
cmp eax, 2
jne 0x43bd645d
cmp dword [esp + 0x30], 8
lea eax, [esp + 0x1c]
cmovae eax, dword [esp + 0x1c]
sub esp, 0x14
push eax
push ecx
lea ecx, [esp + 0x28]
call fcn.43bd672d
test eax, eax
jne 0x43bd645d
mov esi, dword [esp + 0xc]
jmp 0x43bd647c
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x34]
push 0xff
push eax
push 3
push ebx
push 0x43c2bd10
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov bl, 1
push 0
push 1
lea ecx, [esp + 0x24]
call fcn.43bc1f54
test esi, esi
je 0x43bd6494
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
jmp 0x43bd649a
xor al, al
mov ecx, dword [esp + 0x140]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x12c]
xor ecx, esp
call fcn.43bfad82
mov esp, ebp
pop ebp
ret 4
Function at 0x43bd64bf
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x43c18a7b
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x43c3a250]
xor eax, esp
mov dword [esp + 0x2c], eax
push ebx
push esi
mov eax, dword [0x43c3a250]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
test esi, esi
jne 0x43bd6503
xor al, al
jmp 0x43bd659f
xor ebx, ebx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x48], ebx
xor eax, eax
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], ebx
mov word [esp + 0x20], ax
lea eax, [esp + 0x20]
mov byte [esp + 0x48], 1
push eax
call fcn.43bd65f7
cmp dword [esp + 0x34], 8
lea eax, [esp + 0x20]
push 0x2001f
cmovae eax, dword [esp + 0x24]
push eax
push ecx
lea ecx, [esp + 0x18]
call fcn.43bc410f
cmp eax, 2
je 0x43bd657f
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0xff
push eax
push esi
lea eax, [esp + 0x24]
push eax
push ebx
push 0x43c2bd10
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov bl, 1
push 0
push 1
lea ecx, [esp + 0x28]
call fcn.43bc1f54
cmp dword [esp + 0xc], 0
je 0x43bd659d
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.43bfad82
mov esp, ebp
pop ebp
ret 4
Function at 0x43bdf265
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x43bdf276
mov eax, dword [eax]
push 0x2001f
push eax
push 0x80000001
lea ecx, [ebp - 0xc]
call fcn.43bc4378
cmp dword [ebp - 8], 0
je 0x43bdf2ab
and dword [ebp + 8], 0
lea eax, [ebp + 8]
push 4
push eax
push 4
push 0
push 0x43c2c2c4
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], vtable.Util::RegKey.0
call fcn.43bc43e0
mov esp, ebp
pop ebp
ret 8

Function at 0x43bdf373
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
and dword [ebp - 4], 0
cmp dword [eax + 0x14], 8
jb 0x43bdf386
mov eax, dword [eax]
lea ecx, [ebp - 4]
push ecx
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x43bdf3a8
push 0x43c2c2cc
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp dword [ebp - 4], 0
je 0x43bdf3b7
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret 4

Function at 0x43be0cd2
Capabilities:
Accept command line arguments

Disassembly:
push 4
mov eax, 0x43c19e67
call fcn.43bfae26
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
test eax, eax
je 0x43be0d43
xor ecx, ecx
cmp cx, word [eax]
je 0x43be0d43
push 0x20
push eax
call fcn.43bfef0e
pop ecx
pop ecx
test eax, eax
je 0x43be0d43
push 2
pop esi
add eax, esi
lea ecx, [ebp - 0x10]
push eax
call fcn.43be0f6f
and dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
push str._private
call fcn.43be0e72
test eax, eax
je 0x43be0d34
push 0x43c23920
lea ecx, [ebp - 0x10]
call fcn.43be0e72
xor esi, esi
test eax, eax
jne 0x43be0d34
inc esi
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.43bc6323
mov eax, esi
jmp 0x43be0d45
xor eax, eax
call fcn.43bfadf4
ret
Function at 0x43be128b
Capabilities:
Copy file
Delete file
Get file size
Read file on windows

Disassembly:
push 0x3c
mov eax, 0x43c19f36
call fcn.43bfae59
mov edi, ecx
xor dl, dl
lea ecx, [ebp - 0x44]
xor bl, bl
call fcn.43be14c9
xor ecx, ecx
lea eax, [ebp - 0x44]
push ecx
push ecx
mov dword [ebp - 4], ecx
cmp dword [ebp - 0x30], 8
push 3
cmovae eax, dword [ebp - 0x44]
push ecx
inc ecx
push ecx
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x43be135e
mov dl, 1
lea ecx, [ebp - 0x2c]
call fcn.43be14c9
lea ecx, [ebp - 0x44]
call fcn.43be1955
test al, al
jne 0x43be132b
lea ecx, [ebp - 0x2c]
call fcn.43be1955
test al, al
je 0x43be132b
cmp dword [ebp - 0x30], 8
lea ecx, [ebp - 0x44]
push 0
cmovae ecx, dword [ebp - 0x44]
lea eax, [ebp - 0x2c]
cmp dword [ebp - 0x18], 8
push ecx
cmovae eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x43be132b
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
xor ecx, ecx
push ecx
push ecx
push 3
push ecx
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
push 1
lea ecx, [ebp - 0x2c]
mov esi, eax
call fcn.43bc1f54
cmp esi, 0xffffffff
je 0x43be1398
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x10
jb 0x43be1391
and dword [ebp - 0x48], 0
lea eax, [ebp - 0x48]
push 0
push eax
push 0x10
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x43be1391
cmp dword [ebp - 0x48], 0x10
push 1
movzx ebx, bl
pop eax
cmove ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
lea ecx, [ebp - 0x44]
push 0
inc eax
push eax
call fcn.43bc1f54
mov al, bl
call fcn.43bfae08
ret

Function at 0x43be13ae
Capabilities:
Write file on windows

Disassembly:
push 0x3c
mov eax, 0x43c19f36
call fcn.43bfae59
mov edi, ecx
xor dl, dl
lea ecx, [ebp - 0x44]
xor bl, bl
call fcn.43be14c9
xor ecx, ecx
lea eax, [ebp - 0x44]
push ecx
push ecx
mov dword [ebp - 4], ecx
cmp dword [ebp - 0x30], 8
push 2
cmovae eax, dword [ebp - 0x44]
push ecx
inc ecx
push ecx
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x43be142f
mov dl, 1
lea ecx, [ebp - 0x2c]
call fcn.43be14c9
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
xor ecx, ecx
push ecx
push ecx
push 2
push ecx
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
push 1
lea ecx, [ebp - 0x2c]
mov esi, eax
call fcn.43bc1f54
cmp esi, 0xffffffff
je 0x43be1457
push 0
lea eax, [ebp - 0x48]
push eax
push 0x10
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x43be1450
cmp dword [ebp - 0x48], 0x10
push 1
movzx ebx, bl
pop eax
cmove ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
lea ecx, [ebp - 0x44]
push 0
inc eax
push eax
call fcn.43bc1f54
mov al, bl
call fcn.43bfae08
ret
Function at 0x43be14c9
Capabilities:
Get common file path
Get startup folder

Disassembly:
push 0x22c
mov eax, 0x43c19f88
call fcn.43bfae59
mov bl, dl
mov esi, ecx
xor ecx, ecx
mov dword [ebp - 0x238], esi
mov dword [ebp - 0x234], ecx
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], ecx
mov word [esi], ax
push 0x208
xor edi, edi
mov dword [ebp - 4], ecx
push ecx
lea eax, [ebp - 0x218]
inc edi
push eax
mov dword [ebp - 0x234], edi
call fcn.43bfa2b0
add esp, 0xc
test bl, bl
push edi
push 0x23
pop eax
push 0x1a
pop ecx
cmovne eax, ecx
push eax
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x43be15b2
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.43bc35c0
push 0xffffffffffffffff
push 0
push eax
mov ecx, esi
mov dword [ebp - 4], edi
call fcn.43bc2e08
push 0
push edi
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 0
call fcn.43bc1f54
mov edi, str.TencentDeskUpdate
test bl, bl
jne 0x43be157b
mov edi, str.TencentDesktop
push edi
call fcn.43bc209d
pop ecx
push eax
push edi
mov ecx, esi
call fcn.43bc2eae
mov ecx, esi
call fcn.43be15ba
test al, al
jne 0x43be159d
mov ecx, esi
call fcn.43be1685
mov edi, str.Global.db
push edi
call fcn.43bc209d
pop ecx
push eax
push edi
mov ecx, esi
call fcn.43bc2eae
mov eax, esi
call fcn.43bfae08
ret
Function at 0x43be33b0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push ebx
lea ecx, [esi + 0x10]
call fcn.43bd4cf5
mov ecx, esi
mov dword [esi + 0xc], ebx
call fcn.43bd4107
mov eax, dword [esi + 0xe8]
mov byte [esi + 0xf0], bl
test eax, eax
je 0x43be33e3
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [esi + 0xe4]
test eax, eax
je 0x43be3409
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x43be3409
push 0xffffffffffffffff
push dword [esi + 0xe4]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [esi + 0xe4]
test eax, eax
je 0x43be341a
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 0xe8]
test eax, eax
je 0x43be342b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0xe4], ebx
mov al, 1
mov dword [esi + 0xe8], ebx
mov dword [esi + 0xe0], ebx
pop esi
pop ebx
pop ebp
ret 4
Function at 0x43be6794
Capabilities:
Query or enumerate registry value

Disassembly:
push 4
mov eax, 0x43c1a5a6
call fcn.43bfae26
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp dword [esi + 0x14], 0x10
mov dword [esi + 0x10], ebx
jb 0x43be67b2
mov eax, dword [esi]
jmp 0x43be67b4
mov eax, esi
mov byte [eax], bl
mov dword [ebp + 8], ebx
lea eax, [ebp + 8]
mov dword [ebp - 4], ebx
push eax
push 0x20019
push ebx
push str.SoftwareTencentQQBrowserPrivateCfg
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43be681e
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
push eax
push ebx
push ebx
push ebx
push 0x43c2c628
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x43be681e
push ebx
push dword [ebp - 0x10]
mov ecx, esi
call fcn.43bc1ac6
cmp dword [esi + 0x14], 0x10
jb 0x43be6809
mov esi, dword [esi]
lea eax, [ebp - 0x10]
push eax
push esi
push ebx
push ebx
push 0x43c2c628
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp + 8], 0
je 0x43be682d
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.43bfadf4
ret 4
Function at 0x43be688e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x43c1a5ec
mov eax, dword fs:[0]
push eax
sub esp, 0x80
mov eax, dword [0x43c3a250]
xor eax, esp
mov dword [esp + 0x78], eax
push ebx
push esi
push edi
mov eax, dword [0x43c3a250]
xor eax, esp
push eax
lea eax, [esp + 0x90]
mov dword fs:[0], eax
mov ebx, ecx
xor eax, eax
mov dword [esp + 0x50], 0xf
mov dword [esp + 0x4c], eax
mov byte [esp + 0x3c], al
mov dword [esp + 0x98], eax
lea eax, [esp + 0x3c]
push eax
call fcn.43be6794
cmp dword [esp + 0x4c], 0
je 0x43be6a6c
and dword [esp + 0x64], 0
xor eax, eax
mov dword [esp + 0x68], 7
mov word [esp + 0x54], ax
lea eax, [esp + 0x54]
mov byte [esp + 0x98], 1
push eax
lea eax, [esp + 0x40]
push eax
call fcn.43be6835
test eax, eax
je 0x43be6a5f
and dword [esp + 0x24], 0
and dword [esp + 0x28], 0
and dword [esp + 0x2c], 0
lea eax, [esp + 0x24]
mov byte [esp + 0x98], 2
push eax
push ecx
push 0x40
pop edx
lea ecx, [esp + 0x5c]
call fcn.43bc65f0
mov esi, dword [esp + 0x2c]
mov edi, dword [esp + 0x30]
pop ecx
pop ecx
cmp esi, edi
je 0x43be6a56
mov eax, dword [ebx]
mov ecx, ebx
push dword [eax + 4]
call fcn.43be6b8b
mov ecx, dword [ebx]
sub edi, esi
mov eax, edi
push 0x18
cdq
mov dword [ecx + 4], ecx
mov ecx, dword [ebx]
mov dword [ecx], ecx
mov ecx, dword [ebx]
mov dword [ecx + 8], ecx
pop ecx
idiv ecx
and dword [ebx + 4], 0
dec eax
mov dword [esp + 0x20], eax
je 0x43be6a56
and dword [esp + 0x14], 0
and dword [esp + 0x18], 0
and dword [esp + 0x1c], 0
lea eax, [esp + 0x14]
mov byte [esp + 0x98], 3
push eax
push ecx
push 0x24
pop edx
mov ecx, esi
call fcn.43bc65f0
mov eax, dword [esp + 0x20]
mov edi, dword [esp + 0x1c]
sub eax, edi
pop ecx
pop ecx
push 0x18
cdq
pop ecx
idiv ecx
cmp eax, 2
jne 0x43be6a36
cmp dword [edi + 0x14], 8
jb 0x43be69e4
mov eax, dword [edi]
jmp 0x43be69e6
mov eax, edi
push eax
call fcn.43bf9b8f
mov dword [esp + 0x34], eax
pop ecx
test eax, eax
je 0x43be6a36
lea eax, [edi + 0x18]
push eax
lea edx, [esp + 0x34]
lea ecx, [esp + 0x70]
call fcn.43be6c43
pop ecx
push eax
mov ecx, ebx
mov byte [esp + 0x9c], 4
call fcn.43be6c64
push eax
add eax, 0x10
push eax
push ecx
lea eax, [esp + 0x40]
mov ecx, ebx
push eax
call fcn.43be6c96
push 0
push 1
lea ecx, [esp + 0x78]
call fcn.43bc1f54
lea ecx, [esp + 0x14]
mov byte [esp + 0x98], 2
call fcn.43bc2c9c
push 0x18
pop eax
add esi, eax
dec dword [esp + 0x20]
jne 0x43be699c
lea ecx, [esp + 0x24]
call fcn.43bc2c9c
push 0
push 1
lea ecx, [esp + 0x5c]
call fcn.43bc1f54
push 0
push 1
lea ecx, [esp + 0x44]
call fcn.43bc2382
mov ecx, dword [esp + 0x90]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x78]
xor ecx, esp
call fcn.43bfad82
mov esp, ebp
pop ebp
ret
Function at 0x43be6f64
Capabilities:
Encode data using xor
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov eax, ecx
mov dword [ebp - 4], edx
mov dword [ebp - 0x10], eax
push esi
push edi
mov edi, dword [eax]
mov esi, dword [eax + 4]
mov eax, edi
shr eax, 4
xor eax, esi
mov dword [ebp - 8], 8
and eax, 0xf0f0f0f
xor esi, eax
shl eax, 4
xor edi, eax
mov eax, edi
shr eax, 0x10
xor eax, esi
and eax, 0xffff
xor esi, eax
shl eax, 0x10
xor edi, eax
mov eax, esi
shr eax, 2
xor eax, edi
and eax, 0x33333333
xor edi, eax
shl eax, 2
xor esi, eax
mov ebx, esi
shr ebx, 8
xor ebx, edi
and ebx, 0xff00ff
xor edi, ebx
shl ebx, 8
xor ebx, esi
rol ebx, 1
mov eax, ebx
xor eax, edi
and eax, 0xaaaaaaaa
xor ebx, eax
xor eax, edi
rol eax, 1
mov edi, eax
mov eax, dword [ebp - 4]
mov edx, ebx
ror edx, 4
xor edx, dword [eax]
add eax, 4
mov dword [ebp - 4], eax
mov ecx, edx
shr ecx, 0x18
mov eax, edx
shr eax, 0x10
and ecx, 0x3f
and eax, 0x3f
mov esi, dword [ecx*4 + 0x43c25c30]
or esi, dword [eax*4 + 0x43c25a30]
mov eax, edx
shr eax, 8
and edx, 0x3f
and eax, 0x3f
or esi, dword [eax*4 + 0x43c25830]
or esi, dword [edx*4 + 0x43c25630]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
add eax, 4
mov dword [ebp - 4], eax
xor edx, ebx
mov ecx, edx
mov eax, edx
shr eax, 0x10
shr ecx, 0x18
and eax, 0x3f
and ecx, 0x3f
mov ecx, dword [ecx*4 + 0x43c25d30]
or ecx, dword [eax*4 + 0x43c25b30]
mov eax, edx
shr eax, 8
and edx, 0x3f
and eax, 0x3f
or ecx, dword [eax*4 + 0x43c25930]
or ecx, dword [edx*4 + 0x43c25730]
mov eax, dword [ebp - 4]
or ecx, esi
xor edi, ecx
mov edx, edi
ror edx, 4
xor edx, dword [eax]
add eax, 4
mov dword [ebp - 4], eax
mov ecx, edx
shr ecx, 0x18
mov eax, edx
shr eax, 0x10
and ecx, 0x3f
and eax, 0x3f
mov esi, dword [ecx*4 + 0x43c25c30]
or esi, dword [eax*4 + 0x43c25a30]
mov eax, edx
shr eax, 8
and edx, 0x3f
and eax, 0x3f
or esi, dword [eax*4 + 0x43c25830]
mov eax, dword [ebp - 4]
or esi, dword [edx*4 + 0x43c25630]
mov edx, dword [eax]
add eax, 4
xor edx, edi
mov dword [ebp - 4], eax
mov ecx, edx
mov eax, edx
shr ecx, 0x18
and ecx, 0x3f
shr eax, 0x10
and eax, 0x3f
mov ecx, dword [ecx*4 + 0x43c25d30]
or ecx, dword [eax*4 + 0x43c25b30]
mov eax, edx
shr eax, 8
and edx, 0x3f
and eax, 0x3f
or ecx, dword [eax*4 + 0x43c25930]
or ecx, dword [edx*4 + 0x43c25730]
or ecx, esi
xor ebx, ecx
dec dword [ebp - 8]
jne 0x43be6fe1
ror ebx, 1
mov edx, ebx
mov esi, dword [ebp - 0x10]
xor edx, edi
and edx, 0xaaaaaaaa
xor ebx, edx
xor edx, edi
ror edx, 1
mov eax, edx
shr eax, 8
xor eax, ebx
and eax, 0xff00ff
xor ebx, eax
shl eax, 8
xor edx, eax
mov eax, edx
shr eax, 2
xor eax, ebx
and eax, 0x33333333
xor ebx, eax
shl eax, 2
xor edx, eax
mov eax, ebx
shr eax, 0x10
xor eax, edx
and eax, 0xffff
xor edx, eax
shl eax, 0x10
xor ebx, eax
mov ecx, ebx
shr ecx, 4
xor ecx, edx
and ecx, 0xf0f0f0f
mov eax, ecx
shl eax, 4
xor eax, ebx
xor ecx, edx
pop edi
mov dword [esi], eax
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret