joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10002030
Capabilities:
Create process on windows
Schedule task via schtasks
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
push ebx
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push str._C_schtasks__F__Create__TN_FFWallpaperEmbCore__SC_minute__MO_6__TR__C:ProgramDataFFWallpaperCoreSFFWallpaperCore.exe_FFWallpaper_
push str.c:windows_system32cmd.exe
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x100020d3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ecx
push str.No:
push 0x1002c868
call fcn.10005bf0
add esp, 0xc
push eax
call fcn.100031b0
mov esi, eax
push 0xa
mov ecx, esi
call fcn.10003390
mov ecx, dword [esi]
mov eax, dword [ecx + 4]
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x100020aa
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x100020aa
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test edi, edi
je 0x100020cb
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], 0
jne 0x100020c3
or eax, 4
push 0
push eax
call fcn.10001350
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebx]
push 0x7d0
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebx]
lea eax, [ebp - 4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov edx, dword [ebp - 4]
push edx
push ecx
push str.T_exit:
push 0x1002c790
call fcn.10005bf0
add esp, 0xc
push eax
call fcn.100031b0
mov esi, eax
push 0xa
mov ecx, esi
call fcn.10003390
mov eax, dword [esi]
mov eax, dword [eax + 4]
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x1000213b
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x1000213b
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test edi, edi
je 0x1000215c
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], 0
jne 0x10002154
or eax, 4
push 0
push eax
call fcn.10001350
mov edx, dword [ebx]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [ebx + 4]
push eax
call esi
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x10002c70
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
dec eax
jne 0x10002caf
push 0x104
push 0x1002d790
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x5c
push 0x1002d790
call fcn.10008b53
add esp, 8
xor ecx, ecx
push 0x1002d790
mov word [eax + 2], cx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
call fcn.10001690
mov eax, 1
pop ebp
ret 0xc

Function at 0x100084e0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100227f4]
jne 0x100084ea
repz ret
jmp fcn.1000ce65

Function at 0x1001635a
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x100227f4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.1000e4a7
and dword [ebp - 0x14], 0
cmp dword [0x1002d774], 0
mov dword [ebp - 0x18], eax
jne 0x1001640d
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x100164b5
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x100164b5
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x1002d774], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x1002d778], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x1002d77c], eax
call edi
push eax
call esi
mov dword [0x1002d784], eax
test eax, eax
je 0x1001640d
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x1002d780], eax
mov eax, dword [0x1002d780]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x10016466
cmp dword [0x1002d784], ecx
je 0x10016466
push eax
call esi
push dword [0x1002d784]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x10016466
test ebx, ebx
je 0x10016466
call edi
test eax, eax
je 0x1001645d
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x1001645d
test byte [ebp - 8], 1
jne 0x10016466
or dword [ebp + 0x10], 0x200000
jmp 0x10016499
mov eax, dword [0x1002d778]
cmp eax, dword [ebp - 0x18]
je 0x10016499
push eax
call esi
test eax, eax
je 0x10016499
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x10016499
mov eax, dword [0x1002d77c]
cmp eax, dword [ebp - 0x18]
je 0x10016499
push eax
call esi
test eax, eax
je 0x10016499
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x1002d774]
call esi
test eax, eax
je 0x100164b5
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x100164b7
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100084e0
leave
ret
Function at 0x401bf0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
xor edx, edx
jmp 0x401c00
mov eax, edx
and eax, 1
dec eax
not eax
and eax, 0xedb88320
mov ecx, edx
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov dword [edx*4 + 0x4af980], ecx
inc edx
cmp edx, 0x100
jb 0x401c00
cmp edx, 0x800
jae 0x401cd9
lea ebx, [ebx]
mov eax, dword [edx*4 + 0x4af580]
mov ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x4af980]
inc edx
mov dword [edx*4 + 0x4af97c], eax
cmp edx, 0x800
jb 0x401cb0
lea esi, [ebp - 0x24]
mov dword [0x49bf98], 0x401da0
call fcn.00405650
test eax, eax
je 0x401d96
mov eax, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x18]
mov esi, eax
shr eax, 4
shr esi, 8
and eax, 0xf00f
and esi, 0xff00f
xor edi, edi
mov dword [ebp - 4], eax
mov ecx, 0x466298
xor edx, edx
mov eax, dword [ecx - 8]
cmp eax, dword [ebp - 0x20]
jne 0x401d2c
mov eax, dword [ebp - 0x1c]
cmp dword [ecx - 4], eax
jne 0x401d2c
cmp dword [ecx], ebx
je 0x401d64
add edx, 0xc
inc edi
add ecx, 0xc
cmp edx, 0x24
jb 0x401d18
or ecx, 0xffffffff
sub ecx, 0
je 0x401d7c
dec ecx
je 0x401d68
dec ecx
jne 0x401d96
cmp esi, 6
jb 0x401d96
jne 0x401d8c
cmp dword [ebp - 4], 0xf
jb 0x401d96
mov dword [0x49bf98], 0x401e50
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, edi
jmp 0x401d3b
cmp esi, 5
jb 0x401d96
jne 0x401d8c
mov eax, dword [ebp - 4]
cmp eax, 6
jb 0x401d96
cmp eax, 0xa
jmp 0x401d8a
cmp esi, 6
jb 0x401d96
jne 0x401d8c
cmp dword [ebp - 4], 0x100c
je 0x401d96
mov dword [0x49bf98], 0x401e50
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4054c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ecx]
and esi, 7
mov dword [ebp - 4], 0
cmp eax, 5
jae 0x4054e2
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 8]
lea edx, [edx + eax - 4]
push ebx
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0xc], edx
push edi
mov edi, dword [ebp - 4]
mov eax, dword [ebp + 8]
add edi, eax
cmp edi, edx
jae 0x405510
mov cl, byte [edi]
and cl, 0xfe
cmp cl, 0xe8
je 0x405510
inc edi
cmp edi, edx
jb 0x405501
mov ebx, edi
sub ebx, eax
mov eax, ebx
sub eax, dword [ebp - 8]
mov dword [ebp - 4], ebx
cmp edi, edx
jae 0x405617
cmp eax, 3
jbe 0x405547
xor esi, esi
mov al, byte [edi + 4]
mov dword [ebp - 8], ebx
test al, al
je 0x405584
cmp al, 0xff
je 0x405584
and esi, 3
add esi, esi
or esi, 1
inc ebx
mov dword [ebp - 4], ebx
jmp 0x4054f5
lea ecx, [eax - 1]
shl esi, cl
and esi, 7
je 0x40552b
movzx eax, byte [esi + 0x457758]
mov ecx, edi
sub ecx, eax
cmp byte [esi + 0x457750], 0
mov al, byte [ecx + 4]
je 0x405570
test al, al
je 0x405570
cmp al, 0xff
jne 0x40552b
and esi, 3
add esi, esi
mov dword [ebp - 8], ebx
or esi, 1
inc ebx
mov dword [ebp - 4], ebx
jmp 0x4054f5
movzx ecx, byte [edi + 2]
movzx edx, al
movzx eax, byte [edi + 3]
shl edx, 8
or edx, eax
movzx eax, byte [edi + 1]
shl edx, 8
or edx, ecx
shl edx, 8
or edx, eax
sub edx, ebx
lea eax, [edx - 5]
test esi, esi
je 0x4055e7
movzx edx, byte [esi + 0x457758]
add edx, edx
add edx, edx
add edx, edx
mov ecx, 0x18
sub ecx, edx
mov ebx, eax
shr ebx, cl
mov cl, bl
test cl, cl
je 0x4055ce
cmp cl, 0xff
jne 0x4055e4
mov ebx, dword [ebp - 4]
mov ecx, 0x20
sub ecx, edx
mov edx, 1
shl edx, cl
dec edx
xor edx, eax
jmp 0x4055a2
mov ebx, dword [ebp - 4]
mov ecx, eax
shr ecx, 0x18
and cl, 1
dec cl
not cl
mov byte [edi + 4], cl
mov edx, eax
shr edx, 0x10
mov ecx, eax
shr ecx, 8
add ebx, 5
mov byte [edi + 3], dl
mov edx, dword [ebp - 0xc]
mov byte [edi + 2], cl
mov byte [edi + 1], al
mov dword [ebp - 4], ebx
jmp 0x4054f5
cmp eax, 3
jbe 0x40562c
mov edx, dword [ebp + 0xc]
pop edi
xor esi, esi
mov eax, ebx
pop ebx
mov dword [edx], esi
pop esi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0xc]
lea ecx, [eax - 1]
shl esi, cl
pop edi
mov eax, ebx
pop ebx
and esi, 7
mov dword [edx], esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4071a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, eax
mov eax, dword [ebp + 8]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4071b8
pop edi
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4071ea
mov ecx, dword [ebp + 8]
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, esi
and edi, 0xf
jbe 0x4071e6
cmp esi, eax
jae 0x4071ea
dec edi
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x4071d8
cmp esi, eax
jb 0x4071f0
pop esi
xor eax, eax
pop edi
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebp
ret
Function at 0x407f00
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov edi, eax
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
test esi, esi
jne 0x407f27
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 4], 1
jne 0x407f3e
mov dword [edi], 3
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi + 4]
push str.simple
push ecx
call fcn.0043c01f
add esp, 8
test eax, eax
jne 0x407f64
mov dword [edi], 4
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
mov edx, dword [esi + 4]
push edx
call fcn.0043c138
add esp, 4
test eax, eax
jne 0x407faf
push ebx
lea eax, [ebp - 8]
push eax
push 0xd5
push str.R:TempViewMiscSetup3BackupDownloaderBackupDownload.cpp
mov edx, 0x457798
mov ebx, 0x457aec
mov edi, 3
mov ecx, str._anonymous_namespace::ParseCmdLine
mov dword [ebp - 8], 0x457ab8
call fcn.00407520
add esp, 0xc
pop ebx
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 4], 2
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
jle 0x407fdf
mov edx, dword [esi + 8]
push str.silent
push edx
call fcn.0043c01f
add esp, 8
neg eax
sbb eax, eax
add eax, 2
mov dword [edi], eax
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
mov dword [edi], 1
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x407ff0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
lea eax, [ebp - 4]
push eax
push 0x2001f
xor esi, esi
push esi
push str.SoftwareTencentTodayDo
push closesocket
mov dword [ebp - 8], 0
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x408046
mov esi, dword [ebp - 4]
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x10]
push eax
push 0
push str.RunTaskQQ
push esi
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, dword [ebp - 8]
test esi, esi
je 0x408054
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x408060
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x465100]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x20]
push eax
mov eax, str.SoftwareTencentTodayDo
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
call fcn.00407350
test eax, eax
jne 0x4080f9
push esi
push edi
lea ecx, [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx edx, word [ebp - 0x14]
movzx eax, word [ebp - 0x12]
imul edx, edx, 0x64
movzx ecx, word [ebp - 0xe]
mov edi, dword [ebp - 0x20]
add edx, eax
imul edx, edx, 0x64
add edx, ecx
push 4
mov dword [ebp - 0x24], edx
lea edx, [ebp - 0x24]
push edx
push 4
push 0
push str.RunTaskQQ
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
neg esi
sbb esi, esi
test edi, edi
je 0x4080e6
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
lea eax, [esi + 1]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043b634
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x408107
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.0043b634
mov esp, ebp
pop ebp
ret
Function at 0x408120
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x450f10
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x465100]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
mov eax, dword [0x4660e4]
mov edx, dword [eax + 0xc]
mov ecx, 0x4660e4
call edx
add eax, 0x10
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
push eax
push 0x457b94
lea edi, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.00408bc0
add esp, 8
lea ecx, [ebp - 0x24]
push ecx
mov eax, str.SoftwareTencentReport
mov dword [ebp - 0x10], ebx
call fcn.00407350
test eax, eax
jne 0x40822d
mov edi, dword [ebp - 0x14]
mov esi, dword [ebp - 0x24]
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x14]
push ecx
push ebx
push edi
push esi
mov dword [ebp - 0x18], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [ebp - 0x10]
push 4
lea edx, [ebp - 0x18]
push edx
push 4
push ebx
inc eax
push edi
push esi
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp esi, ebx
je 0x4081e9
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
mov dword [ebp - 0x24], esi
lea eax, [edi - 0x10]
mov dword [ebp - 0x20], ebx
mov byte [ebp - 4], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40820b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp esi, ebx
je 0x408216
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40824f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x24]
cmp eax, ebx
je 0x40825d
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x408280
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4517fb
mov eax, dword fs:[0]
push eax
sub esp, 0x224
mov eax, dword [0x465100]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx esi, word [ebp - 0x228]
movzx ecx, word [ebp - 0x226]
imul esi, esi, 0x64
movzx edx, word [ebp - 0x222]
add esi, ecx
imul esi, esi, 0x64
add esi, edx
call fcn.00407ff0
xor ecx, ecx
cmp eax, esi
setne cl
xor ebx, ebx
mov eax, ecx
cmp eax, ebx
je 0x408403
call fcn.00408060
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x220], ebx
mov dword [ebp - 0x21c], ebx
lea edx, [ebp - 0x22c]
push edx
push 0x20019
push ebx
push str.SoftwareTencentQQBrowser
mov dword [ebp - 4], ebx
push closesocket
mov dword [ebp - 0x22c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x408403
mov eax, dword [ebp - 0x22c]
push 0x206
lea edx, [ebp - 0x216]
xor ecx, ecx
push ebx
push edx
mov dword [ebp - 0x224], eax
mov dword [ebp - 0x220], ebx
mov word [ebp - 0x218], cx
call fcn.0043f7e0
add esp, 0xc
push 0x457c18
lea eax, [ebp - 0x224]
push eax
lea edi, [ebp - 0x230]
lea esi, [ebp - 0x218]
mov dword [ebp - 0x230], 0x104
call fcn.004073d0
test eax, eax
jne 0x4083f2
cmp word [ebp - 0x218], bx
je 0x4083f2
mov ecx, esi
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4083f2
push ebx
push ebx
push str._host__tasks__fromqq
mov edx, esi
push edx
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jbe 0x4083e5
push 0x80054c6
call fcn.00408120
add esp, 4
lea esi, [ebp - 0x224]
call fcn.00407320
call fcn.00407300
lea eax, [ebx + 1]
jmp 0x408405
push 0x80054c7
call fcn.00408120
add esp, 4
mov eax, dword [ebp - 0x22c]
cmp eax, ebx
je 0x408403
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043b634
mov esp, ebp
pop ebp
ret
Function at 0x4098e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x465100]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [eax]
mov eax, dword [eax + 4]
push edi
lea edi, [ebp - 0x14]
xor edx, edx
bswap ecx
bswap eax
sub esi, edi
jmp 0x409910
lea edi, [esi + edx*4]
mov edi, dword [ebp + edi - 0x14]
bswap edi
mov dword [ebp + edx*4 - 0x14], edi
inc edx
cmp edx, 4
jl 0x409910
mov edx, 0xfd1228e0
mov dword [ebp - 0x18], 0x20
nop
mov esi, ecx
shr esi, 5
add esi, dword [ebp - 8]
mov edi, ecx
shl edi, 4
add edi, dword [ebp - 0xc]
xor esi, edi
lea edi, [edx + ecx]
xor esi, edi
sub eax, esi
mov esi, eax
shr esi, 5
add esi, dword [ebp - 0x10]
mov edi, eax
shl edi, 4
add edi, dword [ebp - 0x14]
xor esi, edi
lea edi, [edx + eax]
xor esi, edi
sub ecx, esi
sub edx, 0x57e89147
dec dword [ebp - 0x18]
jne 0x409930
mov edx, dword [ebp - 0x1c]
bswap ecx
mov dword [edx], ecx
mov ecx, dword [ebp - 4]
bswap eax
pop edi
xor ecx, ebp
mov dword [edx + 4], eax
pop esi
call fcn.0043b634
mov esp, ebp
pop ebp
ret
Function at 0x40a0d0
Capabilities:
Check if file exists
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4517a0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x465100]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi + 0x5c]
mov ecx, dword [eax - 0xc]
test ecx, ecx
je 0x40a1b8
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40a1b8
mov eax, dword [edi + 0x34]
mov ecx, dword [edi + 0x5c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
cmp dword [edi + 0x48], 0
jne 0x40a131
cmp dword [edi + 0x4c], 0
je 0x40a1b0
push ecx
mov eax, esp
mov dword [ebp - 0x10], esp
push eax
mov ecx, str.tencent
call fcn.004086e0
mov dword [ebp - 4], 0
mov eax, dword [edi + 0x34]
push ecx
sub eax, 0x10
mov dword [ebp - 0x14], esp
mov ebx, esp
call fcn.00408990
add eax, 0x10
mov dword [ebx], eax
or esi, 0xffffffff
mov dword [ebp - 4], esi
call fcn.0041cde0
add esp, 8
test eax, eax
je 0x40a1b0
mov eax, dword [edi + 0x54]
push ecx
sub eax, 0x10
mov dword [ebp - 0x14], esp
mov ebx, esp
call fcn.00408990
add eax, 0x10
mov dword [ebx], eax
mov dword [ebp - 4], 1
mov eax, dword [edi + 0x34]
push ecx
sub eax, 0x10
mov dword [ebp - 0x10], esp
mov ebx, esp
call fcn.00408990
add eax, 0x10
mov dword [ebx], eax
mov eax, dword [edi]
mov edx, dword [eax + 0x54]
mov ecx, edi
mov dword [ebp - 4], esi
call edx
lea esi, [edi + 0x5c]
call fcn.00408850
mov eax, dword [edi]
mov edx, dword [eax + 8]
mov ecx, edi
call edx
test eax, eax
je 0x40a218
cmp dword [edi + 0x48], 0
jne 0x40a1d1
cmp dword [edi + 0x4c], 0
je 0x40a1f5
mov eax, dword [edi]
mov edx, dword [eax + 0x5c]
mov ecx, edi
call edx
test eax, eax
je 0x40a1f5
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x3c]
mov ecx, dword [edi + 0x34]
push 0
push eax
push ecx
mov esi, edi
call fcn.0040a390
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40a2b0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4523a8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x465100]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi + 0x34]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40a2fc
xor esi, esi
push esi
mov dword [edi + 4], 2
push str._fT
mov ecx, 0x131
jmp 0x40a34f
push ecx
mov ecx, dword [ebp + 8]
mov eax, esp
mov dword [ebp - 0x10], esp
push eax
call fcn.004086e0
mov dword [ebp - 4], 0
mov eax, dword [edi + 0x34]
push ecx
sub eax, 0x10
mov dword [ebp + 8], esp
mov esi, esp
call fcn.00408990
add eax, 0x10
mov dword [esi], eax
mov dword [ebp - 4], 0xffffffff
call fcn.0041cde0
mov esi, eax
add esp, 8
test esi, esi
jne 0x40a344
mov dword [edi + 4], 3
push esi
push 0x457f30
mov ecx, 0x13b
push str.CInstallObjectAgent::CheckDownloadFile
mov ebx, 0x457e00
mov edi, 3
mov edx, str.r:_tempviewmisc_setup3_backupdownloaderinstallobjectInstallObject.h
call fcn.00408be0
mov eax, esi
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40a390
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push 0x3c
lea eax, [ebp - 0x3c]
push 0
push eax
call fcn.0043f7e0
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], ecx
add esp, 0xc
lea ecx, [ebp - 0x3c]
push ecx
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x38], 0x540
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x40a3e9
mov eax, dword [ebp - 4]
test eax, eax
je 0x40a3de
mov dword [esi + 0x44], eax
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp - 0x1c]
cmp eax, 0x20
ja case.0x40a3f8.1
movzx edx, byte [eax + 0x40a488]
jmp dword [edx*4 + 0x40a468]
mov dword [esi + 4], 1
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
mov dword [esi + 4], 2
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
mov dword [esi + 4], 6
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
mov dword [esi + 4], 4
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
mov dword [esi + 4], 7
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
mov dword [esi + 4], 8
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
mov dword [esi + 4], 5
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc