joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a140
Capabilities:
Connect to http server

Disassembly:
push 4
mov eax, 0x5622d4
call fcn.0054236c
mov esi, ecx
mov dword [ebp - 0x10], esi
push dword [ebp + 0x1c]
mov edi, dword [ebp + 0xc]
push dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
push edi
push ebx
call fcn.0040a22a
and dword [ebp - 4], 0
lea ecx, [esi + 0x18]
mov dword [esi], vtable.CHttpConnection.0
call fcn.00406df0
mov byte [ebp - 4], 1
test edi, edi
jne 0x40a182
xor eax, eax
jmp 0x40a189
push edi
call fcn.00548174
pop ecx
push eax
push edi
lea ecx, [esi + 0x18]
call fcn.00406c20
push dword [esi + 8]
push 0
push 3
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push edi
push dword [ebx + 8]
call dword [sym.imp.WININET.dll_InternetConnectW]
mov dword [esi + 4], eax
test eax, eax
je 0x40a1cc
push dword [esi + 0xc]
mov ecx, 0x5c6488
push eax
call fcn.0040b16e
mov eax, esi
call fcn.00542335
ret 0x18
push 0
push dword [esi + 8]
call fcn.0040a7f1
int3

Function at 0x40a343
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, ecx
and dword [esi + 0x10], 0
and dword [esi + 0xc], 0
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
mov dword [esi], vtable.CInternetSession.0
test eax, eax
jne 0x40a36c
call fcn.00409d20
mov eax, dword [eax + 0x10]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [esi + 8], eax
test eax, eax
je 0x40a399
push esi
push eax
mov ecx, 0x5c6488
call fcn.0040b16e
mov eax, esi
pop esi
pop ebp
ret 0x18
push 0
push dword [esi + 4]
call fcn.0040a7f1
int3

Function at 0x40e42e
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
push edi
cmp dword [ecx + 0x58], esi
je 0x40e481
push esi
push dword [ebp + 8]
call fcn.0040e617
mov edi, eax
test edi, edi
je 0x40e47c
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x40e47c
mov eax, dword [ebp - 8]
jmp 0x40e493
mov eax, dword [ebp + 0x10]
jmp 0x40e493
push dword [ecx + 0x6c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
pop edi
pop esi
leave
ret 0xc

Function at 0x40f7f3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call fcn.00409d20
push 5
push dword [ebp + 8]
mov edi, dword [eax + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40f826
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
push edi
push dword [ebp + 0xc]
mov ecx, ebx
push esi
call fcn.0040f839
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x414b0a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor esi, esi
mov ebx, ecx
push edi
cmp dword [ebp + 8], esi
je 0x414b49
call fcn.00409d20
push 0xf0
push dword [ebp + 8]
mov edi, dword [eax + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x414b49
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x414b51
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
push esi
mov ecx, ebx
call fcn.004238ec
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x415568
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x4155f4
cmp dword [esi + 0x20], 0
je 0x4155f4
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4155f4
cmp dword [ebp + 8], 0
je 0x4155f4
xor edi, edi
mov ebx, edi
call fcn.00409d20
push 0x5743e0
push dword [ebp + 8]
mov eax, dword [eax + 0xc]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 8], eax
test eax, eax
je 0x4155d8
mov ebx, dword [ebp - 4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 8]
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4155f4
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push edi
push ebx
push esi
call fcn.0043b9df
mov edi, eax
add esp, 0xc
test edi, edi
je 0x4155f0
mov ecx, esi
call fcn.00415306
mov eax, edi
jmp 0x4155f6
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x419b10
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x5620d1
call fcn.0054236c
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x74], ebx
jne 0x419b36
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x419b90
lea ecx, [ebp - 0x10]
call fcn.00406df0
mov edi, dword [edi + 0x74]
lea ecx, [ebp - 0x10]
push ecx
mov dword [ebp - 4], ebx
mov eax, dword [edi]
mov esi, dword [eax + 0x8c]
mov ecx, esi
call dword [0x571990]
mov ecx, edi
call esi
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push esi
call fcn.00549bb5
push eax
call fcn.004061d0
add esp, 0x14
test esi, esi
je 0x419b83
push esi
call fcn.00548174
pop ecx
mov ebx, eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00406dd0
mov eax, ebx
call fcn.00542335
ret 8
Function at 0x43d454
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov dword [ebp - 4], ebx
test byte [esi + 4], 1
mov edi, dword [esi + 0xc]
jne 0x43d4aa
push 5
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x43d483
call fcn.00410d07
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x43d498
call fcn.00410d07
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x43d4aa
call fcn.00410d07
call fcn.00409d20
cmp dword [eax + 0x3c], 0
je 0x43d4bf
push edi
mov ecx, ebx
call fcn.0043cb77
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.0043d6a5
mov ebx, eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x88]
test ecx, ecx
je 0x43d4e8
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 4]
and dword [eax + 0x88], 0
test ebx, ebx
je 0x43d4f4
mov edi, ebx
mov dword [eax + 0x88], ebx
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x442f6c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
mov ecx, dword [esi + 4]
call fcn.00419a56
push 0xfffffffffffffff0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
push dword [ebp + 0xc]
and eax, 3
mov ecx, esi
cmp al, 3
je 0x442fa8
call fcn.00443189
mov dword [esi + 0xc], 1
jmp 0x442fad
call fcn.00443189
cmp dword [esi], 0
je 0x442ff8
push edi
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, dword [ebp + 0x10]
mov edi, eax
mov ecx, esi
test edi, edi
jle 0x442fd3
push edi
call fcn.00409f08
lea ecx, [edi + 1]
push ecx
jmp 0x442fe2
push 0xff
call fcn.00406aa0
push 0x100
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xffffffffffffffff
mov ecx, esi
call fcn.00406600
pop edi
jmp 0x44301c
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
jne 0x44301c
push dword [esi]
push dword [ebp - 4]
call fcn.0041c1b7
pop esi
leave
ret 0xc

Function at 0x4430e0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push edi
push dword [ebp + 0xc]
call fcn.00443189
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x443128
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.00409f08
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.00406600
jmp 0x443133
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.0041c1b7
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x4774cc
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, ecx
call fcn.005180b7
call fcn.00409d74
cmp dword [eax + 0x14], 0
jne 0x4774e7
mov ecx, esi
pop esi
jmp fcn.004767f0
pop esi
ret

Function at 0x47f065
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
push edi
test esi, esi
jne 0x47f07e
call fcn.00409d20
mov esi, dword [eax + 0xc]
push 0x581258
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x47f0c0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x47f0c0
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x47f0c0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 4]
push eax
push ebx
call fcn.0047f0c9
jmp 0x47f0c2
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x4ccb27
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
call fcn.00552e5e
pop ecx
test eax, eax
jne 0x4ccb69
push dword [ebp - 4]
push dword [ebp + 0xc]
push dword [ebp + 8]
push str._s_s_X.tmp
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.0040c249
add esp, 0x18
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4ccb2f
leave
ret
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
leave
ret

Function at 0x5156b1
Capabilities:
Get common file path
Get file system object information

Disassembly:
push esi
mov esi, ecx
call fcn.00405260
call fcn.00409d74
cmp dword [eax + 0x14], 0
jne 0x5156cc
mov ecx, esi
pop esi
jmp fcn.00514f21
pop esi
ret
Function at 0x559241
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00558ef2

Function at 0x55924c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0055907c

Function at 0x401000
Capabilities:
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x400
push ebx
push ebp
push esi
push edi
mov ebx, eax
xor edi, edi
xor eax, eax
mov dword [esp + eax*4 + 0x10], eax
inc eax
cmp eax, 0x100
jl 0x401010
xor ecx, ecx
lea esi, [ecx + 2]
xor edx, edx
mov eax, ecx
mov ebp, 0xf
div ebp
movzx eax, byte [edx + ebx]
add eax, edi
add eax, dword [esp + ecx*4 + 0x10]
mov edi, eax
and edi, 0x800000ff
jns 0x401048
dec edi
or edi, 0xffffff00
inc edi
mov al, byte [esp + ecx*4 + 0x10]
mov edx, dword [esp + edi*4 + 0x10]
mov dword [esp + ecx*4 + 0x10], edx
movzx eax, al
mov dword [esp + edi*4 + 0x10], eax
xor edx, edx
lea eax, [esi - 1]
div ebp
movzx edx, byte [edx + ebx]
add edx, edi
add edx, dword [esp + ecx*4 + 0x14]
mov edi, edx
and edi, 0x800000ff
jns 0x40107e
dec edi
or edi, 0xffffff00
inc edi
mov al, byte [esp + ecx*4 + 0x14]
mov edx, dword [esp + edi*4 + 0x10]
movzx eax, al
mov dword [esp + ecx*4 + 0x14], edx
mov dword [esp + edi*4 + 0x10], eax
xor edx, edx
mov eax, esi
div ebp
movzx edx, byte [edx + ebx]
add edx, dword [esp + ecx*4 + 0x18]
add edi, edx
and edi, 0x800000ff
jns 0x4010b1
dec edi
or edi, 0xffffff00
inc edi
mov al, byte [esp + ecx*4 + 0x18]
mov edx, dword [esp + edi*4 + 0x10]
mov dword [esp + ecx*4 + 0x18], edx
movzx eax, al
mov dword [esp + edi*4 + 0x10], eax
xor edx, edx
lea eax, [esi + 1]
div ebp
movzx edx, byte [edx + ebx]
add edx, edi
add edx, dword [esp + ecx*4 + 0x1c]
mov edi, edx
and edi, 0x800000ff
jns 0x4010e7
dec edi
or edi, 0xffffff00
inc edi
mov al, byte [esp + ecx*4 + 0x1c]
mov edx, dword [esp + edi*4 + 0x10]
mov dword [esp + ecx*4 + 0x1c], edx
movzx eax, al
add esi, 4
add ecx, 4
cmp esi, 0x102
mov dword [esp + edi*4 + 0x10], eax
jl 0x401021
mov eax, dword [esp + 0x418]
xor edx, edx
test eax, eax
jbe 0x40118a
mov ebp, dword [esp + 0x414]
inc ecx
and ecx, 0x800000ff
jns 0x401131
dec ecx
or ecx, 0xffffff00
inc ecx
mov esi, dword [esp + ecx*4 + 0x10]
add edi, esi
and edi, 0x800000ff
jns 0x401147
dec edi
or edi, 0xffffff00
inc edi
mov bl, byte [esp + ecx*4 + 0x10]
mov esi, dword [esp + edi*4 + 0x10]
mov dword [esp + ecx*4 + 0x10], esi
movzx esi, bl
mov dword [esp + edi*4 + 0x10], esi
mov ebx, dword [esp + ecx*4 + 0x10]
add ebx, esi
and ebx, 0x800000ff
jns 0x401170
dec ebx
or ebx, 0xffffff00
inc ebx
movzx ebx, byte [esp + ebx*4 + 0x10]
xor byte [edx + ebp], bl
inc edx
cmp edx, eax
jb 0x401120
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x400
ret
mov eax, dword [esp + 0x414]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x400
ret
Function at 0xb28193
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub edx, 0x6ecb376b
xor edx, 0x525e0b60
cmp cx, si
test di, 0x4513
xor ebx, edx
test ebx, 0x72973aed
clc
cmc
add esi, edx
jmp 0xad44a0
jmp esi
push eax
push ebp
mov eax, 0x584b415d
not ah
cmovle ebp, ebp
push edx
cwd
push ecx
movsx dx, ah
pushfd
push ebx
push edi
rcr bh, 0x9c
push esi
setge cl
mov ecx, 0
push ecx
rcr ax, cl
movsx eax, ax
clc
mov ebp, dword [esp + 0x28]
stc
ror ebp, 3
sbb si, 0x4bf
lea ebp, [ebp + 0x2e8350f4]
lahf
shr di, 0x4f
not ebp
xor ebp, 0x33c916f5
not ebp
xadd si, bx
bswap ebp
lea ebp, [ebp + 0x36292532]
test ecx, ebp
btc dx, 0x39
add ah, 0x73
bswap ebp
movzx edx, bx
lea ebp, [ebp + ecx]
cmp ebx, 0x497e51a5
mov edi, esp
lea esp, [esp - 0xc0]
rdtsc
bsf dx, bx
and ebx, ebx
mov ebx, ebp
sal dl, 0xe2
rcl dh, cl
rdtsc
mov eax, 0
shl esi, 0xb0
sub ebx, eax
lea esi, [0xb28229]
mov edx, dword [ebp]
stc
add ebp, 4
xor edx, ebx
clc
stc
jmp 0xb8f49c
rol edx, 3
test edi, 0x89615b5
sub edx, 0x27c13d0e
test dh, 0x83
cmc
bswap edx
jmp 0x9c9826
Function at 0x401c40
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x840
mov eax, dword [0x42d030]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
push 0x208
lea eax, [ebp - 0x41a]
push esi
push eax
mov word [ebp - 0x41c], si
call fcn.0041ecbc
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x41c]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x208
lea edx, [ebp - 0x20e]
push esi
push edx
mov word [ebp - 0x210], si
call fcn.0041ecbc
push 0x208
lea eax, [ebp - 0x626]
push esi
push eax
mov word [ebp - 0x628], si
call fcn.0041ecbc
push 0x208
lea ecx, [ebp - 0x832]
push esi
push ecx
mov word [ebp - 0x834], si
call fcn.0041ecbc
lea edx, [ebp - 0x628]
push edx
lea eax, [ebp - 0x41c]
push eax
lea edx, [ebp - 0x834]
lea ecx, [ebp - 0x210]
call fcn.00401860
xor ecx, ecx
xor eax, eax
add esp, 0x2c
cmp word [ebp - 0x210], si
mov edx, 1
mov dword [ebp - 0x840], edx
mov dword [ebp - 0x83c], ecx
mov dword [ebp - 0x838], eax
je 0x401d56
lea ecx, [ebp - 0x838]
push ecx
lea edx, [ebp - 0x83c]
push edx
lea eax, [ebp - 0x840]
push eax
lea eax, [ebp - 0x210]
call fcn.00401b90
add esp, 0xc
test eax, eax
jne 0x401d44
lea edx, [esi + 1]
xor ecx, ecx
jmp 0x401d56
mov eax, dword [ebp - 0x838]
mov ecx, dword [ebp - 0x83c]
mov edx, dword [ebp - 0x840]
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea edx, [ebp - 0x41c]
lea ecx, [ebp - 0x628]
call fcn.004011a0
add esp, 0x10
call fcn.00401770
mov eax, dword [0x42ddf4]
cmp eax, esi
pop esi
je 0x401d8a
mov dword [eax + 0x1c], 0x2710
call fcn.00401770
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 1
call fcn.0041e838
mov esp, ebp
pop ebp
ret
Function at 0x401de0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41ff00
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x42d030]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
xor esi, esi
mov dword [ebp - 0x14], esi
lea eax, [ebp - 0x10]
push eax
push 0x20006
push esi
push str.SoftwareTencentQQPCMgr_
mov dword [ebp - 4], esi
push SysStringLen
mov dword [ebp - 0x10], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x401eec
mov edi, dword [ebp - 0x10]
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x10], esi
mov edx, edi
lea esi, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.00402740
test eax, eax
jne 0x401eb2
lea ecx, [ebp - 0x18]
push ecx
mov ecx, ebx
call fcn.004020b0
mov edx, dword [ebp + 8]
mov esi, dword [ebp - 0x10]
push 4
lea eax, [ebp - 0x14]
push eax
push 4
push 0
push ebx
push esi
mov dword [ebp - 0x14], edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test esi, esi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x401e8a
push esi
call ebx
xor esi, esi
mov dword [ebp - 0x10], esi
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
mov dword [ebp - 0x14], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401ebb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x401ebb
mov esi, dword [ebp - 0x10]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x401ec6
push edi
call ebx
xor edi, edi
jmp 0x401ec9
mov edi, dword [ebp - 0x1c]
test esi, esi
je 0x401ed0
push esi
call ebx
test edi, edi
je 0x401ed7
push edi
call ebx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x401f00
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.SOFTWARETencentQQPCMgrQMDL
push SysStringLen
mov dword [edi], 0
mov dword [ebp - 4], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x401f5e
push esi
mov esi, dword [ebp - 4]
lea ecx, [ebp - 8]
push ecx
push edi
lea edx, [ebp - 0xc]
push edx
push eax
mov eax, dword [ebp + 8]
push eax
push esi
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test esi, esi
je 0x401f5d
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x402610
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, eax
mov eax, dword [ebp + 8]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x402628
pop edi
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x40265c
mov ecx, dword [ebp + 8]
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, esi
and edi, 0xf
jbe 0x402658
cmp esi, eax
jae 0x40265c
sub edi, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x402648
cmp esi, eax
jb 0x402662
pop esi
xor eax, eax
pop edi
pop ebp
ret
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebp
ret

Function at 0x402a40
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.SOFTWARETencentQQPCMgrCrashCount
push SysStringLen
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x402a9f
mov esi, dword [ebp - 4]
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x10]
push eax
push 0
push str.QMDLCrashCount
push esi
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test esi, esi
je 0x402a9f
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
test esi, esi
mov edi, dword [ebp - 8]
je 0x402aad
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x402b40
Capabilities:
Check mutex on windows

Disassembly:
cmp dword [0x42d3d8], 0
je 0x402b4f
mov eax, 1
ret
push str.Global416FCF35_5ADB_4312_B26B_2A82D35479F7
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
test eax, eax
mov dword [0x42d3d8], eax
je 0x402b8e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x402b49
mov eax, dword [0x42d3d8]
test eax, eax
je 0x402b8e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x42d3d8], 0
xor eax, eax
ret
Function at 0x4035b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41fe99
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x42d030]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], ebx
mov eax, dword [0x42da34]
mov edx, dword [eax + 0xc]
mov ecx, 0x42da34
mov dword [ebp - 0x10], ebx
call edx
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x10]
push eax
push 0x20019
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionInternet_Settings
mov dword [ebp - 4], ebx
push 0x80000001
mov dword [ebp - 0x14], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x40369e
mov eax, dword [esi]
sub eax, 0x10
mov ecx, 1
sub ecx, dword [eax + 0xc]
mov eax, dword [eax + 8]
sub eax, 0x800
or eax, ecx
jge 0x403647
mov ecx, 0x800
mov eax, esi
call fcn.00402470
mov eax, dword [esi]
mov edx, dword [ebp - 0x10]
lea ecx, [ebp - 0x18]
push ecx
push eax
push ebx
push ebx
push str.AutoConfigURL
push edx
mov dword [ebp - 0x18], 0x1000
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [esi]
cmp edx, ebx
jne 0x403670
xor eax, eax
jmp 0x403686
mov eax, edx
lea edi, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x403675
sub eax, edi
sar eax, 1
js 0x4036b2
cmp eax, dword [edx - 8]
jg 0x4036b2
mov dword [edx - 0xc], eax
mov ecx, dword [esi]
mov word [ecx + eax*2], bx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.00402710
int3
Function at 0x404860
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
lea eax, [ebp - 8]
push eax
push 0x20006
xor esi, esi
push esi
push str.SoftwareTencentQQPCMgr_
push SysStringLen
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x4048e7
mov edx, dword [ebp - 8]
push ebx
mov dword [ebp - 4], esi
push edi
lea esi, [ebp - 4]
mov edi, edx
call fcn.00402740
test eax, eax
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 4]
jne 0x4048ce
mov ecx, dword [ebp + 8]
push 4
lea edx, [ebp + 8]
push edx
push 4
push 0
push str.QMRestartFlag
push esi
mov dword [ebp + 8], ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test esi, esi
je 0x4048ce
push esi
call ebx
xor esi, esi
test edi, edi
je 0x4048d7
push edi
call ebx
xor edi, edi
test esi, esi
je 0x4048de
push esi
call ebx
test edi, edi
je 0x4048e5
push edi
call ebx
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 4