joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100422c0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x10042325
push esi
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov eax, dword [ebp + 0x18]
lea eax, [eax*2 + 2]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x1004231e
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
cmp dword [ebp + 0x1c], 8
lea ecx, [ebp + 8]
push 0x104
cmovae ecx, dword [ebp + 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop esi
mov eax, dword [ebp + 0x1c]
cmp eax, 8
jb 0x10042337
inc eax
push eax
push dword [ebp + 8]
call fcn.10003020
pop ebp
ret
Function at 0x10042340
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005f552
mov eax, dword fs:[0]
push eax
sub esp, 0x42c
mov eax, dword [0x1007b00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x42c], esi
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push 0
push eax
mov dword [ebp - 0x438], esi
mov dword [ebp - 0x430], 0
call sub.VCRUNTIME140.dll_memset
push 0x20a
lea eax, [ebp - 0x424]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
xor edi, edi
mov dword [esi + 0x14], 7
add esp, 0x18
mov dword [ebp - 0x428], edi
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], edi
jb 0x100423d2
mov eax, dword [esi]
jmp 0x100423d4
mov eax, esi
xor ecx, ecx
push ecx
mov word [eax], cx
mov ecx, esi
push 0x10067498
call fcn.10002e00
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push 0
push eax
mov dword [ebp - 0x430], 1
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x10042516
lea eax, [ebp - 0x218]
push 0x5c
push eax
call dword [sym.imp.VCRUNTIME140.dll_wcsrchr]
add esp, 8
test eax, eax
je 0x10042516
xor ecx, ecx
push str.kblist.drt
mov word [eax], cx
lea eax, [ebp - 0x218]
push eax
push str._s_s
push 0xffffffffffffffff
lea eax, [ebp - 0x424]
push 0x104
push eax
call fcn.1000f290
add esp, 0x18
lea eax, [ebp - 0x424]
push 0
push 0x80
push 3
push 0
push 0
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x100424fe
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x42c], eax
test eax, eax
je 0x100424fe
cmp eax, 0xffffffff
je 0x100424fe
add eax, 2
push 0x1007da74
push eax
mov dword [ebp - 0x434], eax
call fcn.1005be25
mov edi, eax
add esp, 8
test edi, edi
je 0x100424fe
push dword [ebp - 0x434]
push 0
push edi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x428]
push 0
push eax
push dword [ebp - 0x42c]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100424fe
push edi
mov ecx, esi
call fcn.1000c1b0
test ebx, ebx
je 0x10042509
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x10042516
push edi
call fcn.1005be17
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1005b6db
mov esp, ebp
pop ebp
ret
Function at 0x10042540
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1007b00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
xor esi, esi
mov dword [ebp - 8], esi
mov ebx, edx
test edi, edi
je 0x1004260b
xor eax, eax
cmp ax, word [edi]
je 0x1004260d
test ebx, ebx
je 0x1004260d
cmp ax, word [ebx]
je 0x1004260d
lea eax, [ebp - 8]
push eax
push 2
push esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallQQ
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100425fd
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100425a0
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 1
push 0
push str.DisplayName
push dword [ebp - 8]
call edi
test eax, eax
jne 0x100425fd
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100425d1
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
push ebx
push 1
push 0
push str.DisplayVersion
push dword [ebp - 8]
call edi
test eax, eax
mov ecx, 1
cmove esi, ecx
mov eax, dword [ebp - 8]
test eax, eax
je 0x1004260b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1005b6db
mov esp, ebp
pop ebp
ret

Function at 0x10042800
Capabilities:
Check if file exists
Create directory
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x1007b00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x20a
lea eax, [ebp - 0x210]
mov ebx, edx
push 0
push eax
mov esi, ecx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor edi, edi
call fcn.1004b770
test eax, eax
lea eax, [ebp - 0x210]
push 0x104
push eax
je 0x1004284e
push str._USERPROFILE_AppDataLocal_
jmp 0x10042853
push str._USERPROFILE_Local_Settings_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x1004286b
mov edx, 0x104
mov ecx, eax
cmp edx, eax
sbb edi, edi
inc edi
jmp 0x10042870
mov ecx, 0x104
cmp ebx, ecx
jb 0x100428c0
push ecx
lea eax, [ebp - 0x210]
push eax
push ebx
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
push 4
push str.Temp
push ebx
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat_s]
add esp, 0x20
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x100428aa
push eax
push esi
push eax
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005b6db
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1005b6db
mov esp, ebp
pop ebp
ret
Function at 0x100428e0
Capabilities:
Check if file exists
Create directory
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x1007b00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x20a
lea eax, [ebp - 0x210]
mov ebx, edx
push 0
push eax
mov esi, ecx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor edi, edi
call fcn.1004b770
test eax, eax
lea eax, [ebp - 0x210]
push 0x104
push eax
je 0x1004292e
push str._USERPROFILE_AppDataLocal_
jmp 0x10042933
push str._USERPROFILE_Local_Settings_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x1004294b
mov edx, 0x104
mov ecx, eax
cmp edx, eax
sbb edi, edi
inc edi
jmp 0x10042950
mov ecx, 0x104
test edi, edi
je 0x100429b4
cmp ebx, ecx
jb 0x100429b4
push ecx
lea eax, [ebp - 0x210]
push eax
push ebx
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
add esp, 0x10
call fcn.1004b770
push 0xffffffffffffffff
test eax, eax
je 0x1004297d
push str.MicrosoftWindowsTemporary_Internet_Files
jmp 0x10042982
push str.Temporary_Internet_Files
push ebx
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat_s]
add esp, 0x10
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x100429a1
push eax
push esi
push eax
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005b6db
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1005b6db
mov esp, ebp
pop ebp
ret

Function at 0x100429d0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x1007b00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x20a
lea eax, [ebp - 0x210]
mov edi, edx
push 0
push eax
mov ebx, ecx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor esi, esi
call fcn.1004b770
test eax, eax
lea eax, [ebp - 0x210]
push 0x104
push eax
je 0x10042a1e
push str._USERPROFILE_AppDataLocal_
jmp 0x10042a23
push str._USERPROFILE_Local_Settings_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x10042a3b
mov edx, 0x104
mov ecx, eax
cmp edx, eax
sbb esi, esi
inc esi
jmp 0x10042a40
mov ecx, 0x104
test esi, esi
je 0x10042aac
cmp edi, ecx
jb 0x10042aac
push ecx
lea eax, [ebp - 0x210]
push eax
push edi
push ebx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
add esp, 0x10
call fcn.1004b770
push 0xffffffffffffffff
test eax, eax
je 0x10042a89
push str.MicrosoftWindowsHistory
push edi
push ebx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat_s]
add esp, 0x10
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005b6db
mov esp, ebp
pop ebp
ret
push str.History
push edi
push ebx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat_s]
add esp, 0x10
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005b6db
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1005b6db
mov esp, ebp
pop ebp
ret
Function at 0x10042ac0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x1007b00c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x20a
lea eax, [ebp - 0x210]
mov dword [ebp - 0x218], 1
push 0
push eax
mov esi, ecx
mov dword [ebp - 0x214], 0x104
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esi + 0x10], 0
cmp dword [esi + 0x14], 8
jb 0x10042b11
mov eax, dword [esi]
jmp 0x10042b13
mov eax, esi
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x218]
push eax
push str.Install
push str.SOFTWARETencentTTraveler
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x10042b64
push 0xffffffffffffffff
push str._binTTraveler.exe
lea eax, [ebp - 0x210]
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat_s]
add esp, 0x10
jmp 0x10042ba6
lea eax, [ebp - 0x214]
mov dword [ebp - 0x218], 1
push eax
lea eax, [ebp - 0x210]
mov dword [ebp - 0x214], 0x104
push eax
lea eax, [ebp - 0x218]
push eax
push 0x1006a72c
push str.SOFTWARETencentTraveler
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x10042bde
cmp word [ebp - 0x210], 0
jne 0x10042bb4
xor ecx, ecx
jmp 0x10042bcf
lea ecx, [ebp - 0x210]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10042bc0
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x210]
mov ecx, esi
push eax
call fcn.10002e00
mov ecx, dword [ebp - 4]
xor eax, eax
cmp dword [esi + 0x10], eax
pop esi
setne al
xor ecx, ebp
call fcn.1005b6db
mov esp, ebp
pop ebp
ret
Function at 0x10042cb0
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x11b8
call fcn.1005cad0
mov eax, dword [0x1007b00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push 0xfa0
lea eax, [ebp - 0x11ac]
mov ebx, ecx
push 0
push eax
mov dword [ebp - 0x11b8], ebx
call sub.VCRUNTIME140.dll_memset
push 0x208
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x11b0], 0
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x18
mov dword [ebp - 0x11b4], 0
test ebx, ebx
je 0x10042e29
xor eax, eax
cmp ax, word [ebx]
je 0x10042e29
lea eax, [ebp - 0x11b0]
push eax
push 0xfa0
lea eax, [ebp - 0x11ac]
push eax
call dword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
je 0x10042e29
mov ebx, dword [ebp - 0x11b0]
test ebx, ebx
je 0x10042e29
push esi
push edi
shr ebx, 2
xor edi, edi
test ebx, ebx
je 0x10042df9
nop
push dword [ebp + edi*4 - 0x11ac]
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x10042df0
push 0x208
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x11b4], 0
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x11b0]
push eax
push 4
lea eax, [ebp - 0x11b4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x10042de9
push 0x104
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x11b4]
push esi
call dword [sym.imp.KERNEL32.dll_K32GetModuleBaseNameW]
test eax, eax
je 0x10042de9
push dword [ebp - 0x11b8]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x10042e0c
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, ebx
jb 0x10042d60
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005b6db
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005b6db
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop ebx
call fcn.1005b6db
mov esp, ebp
pop ebp
ret
Function at 0x10042f10
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x1007b00c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
test esi, esi
jne 0x10042f3b
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005b6db
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10042f65
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x10042f65
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005b6db
mov esp, ebp
pop ebp
ret
push edi
push 0x208
xor edi, edi
lea eax, [ebp - 0x20c]
push edi
push eax
call sub.VCRUNTIME140.dll_memset
push 0x104
push esi
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
add esp, 0x1c
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea esi, [ebp - 0x206]
cmp word [ebp - 0x206], di
je 0x10043009
lea eax, [edi + 0x5c]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
cmp word [esi], di
je 0x10042ffc
cmp word [esi], 0x5c
je 0x10042fcf
add esi, 2
cmp word [esi], 0
jne 0x10042fc0
cmp word [esi], 0
je 0x10042ffc
xor eax, eax
push eax
mov word [esi], ax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov edi, eax
test edi, edi
jne 0x10042ff7
call ebx
cmp eax, 0xb7
jne 0x10043008
mov eax, 0x5c
mov word [esi], ax
add esi, 2
cmp word [esi], 0
jne 0x10042fc0
pop ebx
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.1005b6db
mov esp, ebp
pop ebp
ret

Function at 0x10043020
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x1007b00c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x208
lea eax, [ebp - 0x20c]
mov esi, ecx
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x208
lea eax, [ebp - 0x414]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x18
lea eax, [ebp - 0x20c]
push 0x103
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
pop esi
test eax, eax
je 0x100430af
push 0
lea eax, [ebp - 0x414]
push eax
push 0x103
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
je 0x100430af
lea ecx, [ebp - 0x414]
call fcn.10042f10
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005b6db
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.1005b6db
mov esp, ebp
pop ebp
ret
Function at 0x100430c0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x1007b00c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x1007dfb0], 0
push esi
mov esi, ecx
je 0x10043113
cmp word [0x1007dfb8], 0
je 0x10043113
push 0xffffffffffffffff
push 0x1007dfb8
push 0x104
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
add esp, 0x10
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005b6db
mov esp, ebp
pop ebp
ret
push edi
push 0x208
xor edi, edi
lea eax, [ebp - 0x20c]
push edi
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
test esi, esi
je 0x100431c4
mov word [esi], ax
lea eax, [ebp - 0x20c]
push 0x103
push eax
push str._ALLUSERSPROFILE_Application_DataTencentQQPCMgr_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea ecx, [ebp - 0x20c]
call fcn.10043020
test eax, eax
jne 0x10043184
push 0x103
lea eax, [ebp - 0x20c]
push eax
push str._ALLUSERSPROFILE_TencentQQPCMgr_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea ecx, [ebp - 0x20c]
call fcn.10043020
test eax, eax
je 0x100431c2
push 0xffffffffffffffff
lea eax, [ebp - 0x20c]
push eax
push 0x104
push esi
mov esi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
call esi
push 0xffffffffffffffff
lea eax, [ebp - 0x20c]
push eax
push 0x104
push 0x1007dfb8
call esi
add esp, 0x20
mov dword [0x1007dfb0], 1
mov edi, 1
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1005b6db
mov esp, ebp
pop ebp
ret

Function at 0x100432c0
Capabilities:
Check if file exists
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov eax, dword [0x1007b00c]
xor eax, esp
mov dword [esp + 0x18], eax
mov edx, ecx
lea ecx, [esp]
push esi
call fcn.1003e7c0
cmp dword [esp + 0x18], 8
lea eax, [esp + 4]
cmovae eax, dword [esp + 4]
push eax
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
test eax, eax
jne 0x1004330e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x10043315
xor esi, esi
jmp 0x1004331a
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, 1
mov ecx, dword [esp + 0x18]
cmp ecx, 8
jb 0x1004332e
inc ecx
push ecx
push dword [esp + 8]
call fcn.10003020
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop esi
xor ecx, esp
call fcn.1005b6db
mov esp, ebp
pop ebp
ret
Function at 0x100437e0
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x13c8
call fcn.1005cad0
mov eax, dword [0x1007b00c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0xfa0
lea eax, [ebp - 0x13b8]
mov dword [ebp - 0x13c8], ecx
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x208
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x13bc], 0
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x18
mov dword [ebp - 0x13c0], 0
lea eax, [ebp - 0x13bc]
xor esi, esi
push eax
push 0xfa0
lea eax, [ebp - 0x13b8]
push eax
call dword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
je 0x100439eb
mov eax, dword [ebp - 0x13bc]
test eax, eax
je 0x100439eb
push ebx
shr eax, 2
xor ebx, ebx
mov dword [ebp - 0x13c4], eax
push edi
test eax, eax
je 0x10043961
push dword [ebp + ebx*4 - 0x13b8]
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x10043954
push 0x208
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x13c0], 0
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x13bc]
push eax
push 4
lea eax, [ebp - 0x13c0]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x1004394d
push 0x104
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x13c0]
push edi
call dword [sym.imp.KERNEL32.dll_K32GetModuleBaseNameW]
test eax, eax
je 0x1004394d
push str.QQPCMgr.exe
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x10043912
lea esi, [eax + 1]
jmp 0x10043949
push str.QQPCTray.exe
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1004392d
lea esi, [eax + 1]
jmp 0x10043949
push str.QQPCRTP.exe
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
mov eax, 1
cmove esi, eax
test esi, esi
jne 0x10043974
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
cmp ebx, dword [ebp - 0x13c4]
jb 0x10043881
pop edi
pop ebx
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005b6db
mov esp, ebp
pop ebp
ret
push 0x20a
lea eax, [ebp - 0x418]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x418]
push 0x104
push eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExW]
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x418]
push ecx
mov ecx, dword [ebp - 0x13c8]
call fcn.1000c1b0
mov ecx, dword [ebp - 0x13c8]
push 0x10067494
call fcn.1000c160
pop edi
pop ebx
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005b6db
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.1005b6db
mov esp, ebp
pop ebp
ret
Function at 0x10043fd0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005f696
mov eax, dword fs:[0]
push eax
sub esp, 0x254
mov eax, dword [0x1007b00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov edi, ecx
push 0x20a
xor esi, esi
lea eax, [ebp - 0x220]
push esi
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x228], 0x104
mov dword [ebp - 0x25c], esi
mov dword [ebp - 0x224], 1
test edi, edi
je 0x100441c9
test ebx, ebx
je 0x100441c9
lea eax, [ebp - 0x25c]
push eax
push 1
push esi
push str.SOFTWARETencentQQPCMgr
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100440d1
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x224]
push eax
push esi
push str.Version
push dword [ebp - 0x25c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100440bd
cmp dword [ebp - 0x224], 1
jne 0x100440bd
lea ecx, [ebp - 0x220]
call fcn.10043c70
test eax, eax
je 0x100440bd
push 0xffffffffffffffff
lea eax, [ebp - 0x220]
push eax
push ebx
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
add esp, 0x10
mov esi, 1
push dword [ebp - 0x25c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x100441b5
xor eax, eax
mov dword [ebp - 0x22c], 7
mov dword [ebp - 0x230], 0
mov word [ebp - 0x240], ax
lea ecx, [ebp - 0x240]
mov dword [ebp - 4], eax
call fcn.10043a00
test eax, eax
je 0x1004419f
xor eax, eax
mov dword [ebp - 0x244], 7
mov dword [ebp - 0x248], 0
mov word [ebp - 0x258], ax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x240]
cmp dword [ebp - 0x22c], 8
lea edx, [ebp - 0x258]
cmovae ecx, dword [ebp - 0x240]
call fcn.10043e90
test eax, eax
je 0x1004414f
mov esi, 1
jmp 0x10044174
cmp dword [ebp - 0x22c], 8
lea ecx, [ebp - 0x240]
lea edx, [ebp - 0x258]
cmovae ecx, dword [ebp - 0x240]
call fcn.10043f40
mov esi, eax
test esi, esi
je 0x10044194
cmp dword [ebp - 0x244], 8
lea ecx, [ebp - 0x258]
cmovae ecx, dword [ebp - 0x258]
push ecx
push ebx
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
lea ecx, [ebp - 0x258]
call fcn.10002cc0
lea ecx, [ebp - 0x240]
mov dword [ebp - 4], 0xffffffff
call fcn.10002cc0
test esi, esi
je 0x100441c5
mov ecx, edi
call fcn.10043c70
test eax, eax
jne 0x100441c5
mov word [edi], ax
xor esi, esi
mov eax, esi
jmp 0x100441cb
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1005b6db
mov esp, ebp
pop ebp
ret