joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43c840
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x481288]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 4
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
push 0x471f9c
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x43c880
xor eax, eax
jmp 0x43c961
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 4]
push eax
push 0
push 0x471fc4
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x43c8b2
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x43c961
mov eax, dword [ebp + 8]
push eax
call fcn.00414d31
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jbe 0x43c8f4
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
movzx eax, word [edx + ecx*2 - 2]
cmp eax, 0x5c
je 0x43c8e7
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
movzx eax, word [edx + ecx*2 - 2]
cmp eax, 0x2f
jne 0x43c8f4
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
mov word [edx + ecx*2 - 2], 0
mov word [ebp - 0x218], 0
push 0x206
push 0
lea eax, [ebp - 0x216]
push eax
call fcn.00415680
add esp, 0xc
push 0x471fd4
mov ecx, dword [ebp + 8]
push ecx
push 0x471fe4
push 0x208
push 0x104
lea edx, [ebp - 0x218]
push edx
call fcn.004157ac
add esp, 0x18
lea eax, [ebp - 0x218]
push eax
push 0x104
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.004503e0
add esp, 0xc
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004151d0
mov esp, ebp
pop ebp
ret
Function at 0x43c970
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa40
mov eax, dword [0x481288]
xor eax, ebp
mov dword [ebp - 8], eax
push 0x208
push 0
push 0x4880d0
call fcn.00415680
add esp, 0xc
mov dword [ebp - 4], 0x104
push 0x4880d0
call fcn.00414d31
add esp, 4
test eax, eax
jne 0x43cabe
mov dword [ebp - 4], 0x104
lea eax, [ebp - 4]
push eax
push 0x4880d0
call fcn.00438a40
add esp, 8
push 0x4880d0
call fcn.00414d31
add esp, 4
test eax, eax
jne 0x43c9fd
push 0x471bbc
push 0x208
push 0x104
push 0x4884e0
call fcn.004157ac
add esp, 0x10
jmp 0x43cabe
mov word [ebp - 0x420], 0
push 0x206
push 0
lea ecx, [ebp - 0x41e]
push ecx
call fcn.00415680
add esp, 0xc
mov word [ebp - 0x210], 0
push 0x206
push 0
lea edx, [ebp - 0x20e]
push edx
call fcn.00415680
add esp, 0xc
push 0x471bc0
push 0x4880d0
push 0x471bd0
push 0x208
push 0x104
lea eax, [ebp - 0x420]
push eax
call fcn.004157ac
add esp, 0x18
lea ecx, [ebp - 0x420]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0xffffffff
jne 0x43ca9d
push 0x471be4
push 0x208
push 0x104
push 0x4884e0
call fcn.004157ac
add esp, 0x10
jmp 0x43cabe
push 0x4880d0
push 0x471be8
push 0x208
push 0x104
push 0x4884e0
call fcn.004157ac
add esp, 0x14
push 0x4880d0
call fcn.00414d31
add esp, 4
test eax, eax
jne 0x43cbde
mov dword [ebp - 4], 0x104
lea edx, [ebp - 4]
push edx
push 0x4880d0
call fcn.0043a5f0
add esp, 8
push 0x4880d0
call fcn.00414d31
add esp, 4
test eax, eax
jne 0x43cb1d
push 0x471bfc
push 0x208
push 0x104
push 0x4884e0
call fcn.004157ac
add esp, 0x10
jmp 0x43cbde
mov word [ebp - 0x838], 0
push 0x206
push 0
lea eax, [ebp - 0x836]
push eax
call fcn.00415680
add esp, 0xc
mov word [ebp - 0x628], 0
push 0x206
push 0
lea ecx, [ebp - 0x626]
push ecx
call fcn.00415680
add esp, 0xc
push 0x471c00
push 0x4880d0
push 0x471c10
push 0x208
push 0x104
lea edx, [ebp - 0x838]
push edx
call fcn.004157ac
add esp, 0x18
lea eax, [ebp - 0x838]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0x62c], eax
cmp dword [ebp - 0x62c], 0xffffffff
jne 0x43cbbd
push 0x471c24
push 0x208
push 0x104
push 0x4884e0
call fcn.004157ac
add esp, 0x10
jmp 0x43cbde
push 0x4880d0
push 0x471c28
push 0x208
push 0x104
push 0x4884e0
call fcn.004157ac
add esp, 0x14
push 0x4880d0
call fcn.00414d31
add esp, 4
test eax, eax
jne 0x43cc2f
mov dword [ebp - 4], 0x104
mov word [ebp - 0xa40], 0
push 0x206
push 0
lea ecx, [ebp - 0xa3e]
push ecx
call fcn.00415680
add esp, 0xc
lea edx, [ebp - 0xa40]
push edx
lea eax, [ebp - 4]
push eax
push 0x4880d0
call fcn.0043c840
add esp, 0xc
jmp 0x43cc47
mov dword [ebp - 4], 0x104
lea ecx, [ebp - 4]
push ecx
push 0x4880d0
call fcn.00438830
add esp, 8
push 0x4880d0
call fcn.00414d31
add esp, 4
test eax, eax
jne 0x43cc70
mov dword [ebp - 4], 0x104
lea edx, [ebp - 4]
push edx
push 0x4880d0
call fcn.00438790
add esp, 8
mov eax, 1
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004151d0
mov esp, ebp
pop ebp
ret
Function at 0x43cde0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x481288]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0x104
mov dword [ebp - 0x214], 0
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x210]
push ecx
push 0x474154
push str.052CFB79_9D62_42E3_8A15_DE66C2C97C3E
call sub.Msi.dll_MsiGetPropertyW
test eax, eax
jne 0x43ce7d
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x43ce7b
mov word [ebp - 0x420], 0
push 0x206
push 0
lea eax, [ebp - 0x41e]
push eax
call fcn.00415680
add esp, 0xc
lea ecx, [ebp - 0x420]
push ecx
call fcn.00442cf0
add esp, 4
lea edx, [ebp - 0x420]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
neg eax
sbb eax, eax
add eax, 1
mov dword [ebp - 0x214], eax
jmp 0x43ce87
mov dword [ebp - 0x214], 1
cmp dword [ebp - 0x214], 0
je 0x43ce95
call fcn.0043ccd0
mov eax, 1
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004151d0
mov esp, ebp
pop ebp
ret

Function at 0x43d1e0
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x468c72
mov eax, dword fs:[0]
push eax
sub esp, 0x498
mov eax, dword [0x481288]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x44
push 0
lea eax, [ebp - 0x484]
push eax
call fcn.00415680
add esp, 0xc
mov dword [ebp - 0x484], 0x44
push 0x10
push 0
lea ecx, [ebp - 0x434]
push ecx
call fcn.00415680
add esp, 0xc
push 0x4840b8
lea ecx, [ebp - 0x48c]
call fcn.00431060
mov dword [ebp - 0x498], eax
mov edx, dword [ebp - 0x498]
mov dword [ebp - 0x49c], edx
mov dword [ebp - 4], 0
push 0x4742d8
mov eax, dword [ebp - 0x49c]
push eax
lea ecx, [ebp - 0x490]
push ecx
call fcn.004315f0
add esp, 0xc
mov dword [ebp - 0x4a0], eax
mov edx, dword [ebp - 0x4a0]
mov dword [ebp - 0x4a4], edx
mov byte [ebp - 4], 1
push 0x474204
mov eax, dword [ebp - 0x4a4]
push eax
lea ecx, [ebp - 0x43c]
push ecx
call fcn.004315f0
add esp, 0xc
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x490]
call fcn.004310c0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x48c]
call fcn.004310c0
push 0x4840b8
lea ecx, [ebp - 0x488]
call fcn.00431060
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x43c]
call fcn.004312a0
push eax
push str.__s__supplyid_lu_operator_lu_
push 0x410
push 0x208
lea ecx, [ebp - 0x424]
push ecx
call fcn.004157ac
add esp, 0x1c
lea edx, [ebp - 0x434]
push edx
lea eax, [ebp - 0x484]
push eax
lea ecx, [ebp - 0x488]
call fcn.004312a0
push eax
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x424]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x438], eax
mov edx, dword [ebp - 0x438]
mov dword [ebp - 0x494], edx
lea ecx, [ebp - 0x488]
call fcn.004310c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x43c]
call fcn.004310c0
mov eax, dword [ebp - 0x494]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004151d0
mov esp, ebp
pop ebp
ret
Function at 0x43d480
Capabilities:
Delete file
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x468ce2
mov eax, dword fs:[0]
push eax
sub esp, 0x234
mov eax, dword [0x481288]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov word [ebp - 0x21c], 0
push 0x206
push 0
lea eax, [ebp - 0x21a]
push eax
call fcn.00415680
add esp, 0xc
push 0x472dbc
lea ecx, [ebp - 0x238]
call fcn.004011c0
mov dword [ebp - 4], 0
push 1
push 7
lea ecx, [ebp - 0x21c]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x43d59d
lea edx, [ebp - 0x21c]
push edx
lea ecx, [ebp - 0x238]
call fcn.00403bf0
lea ecx, [ebp - 0x238]
call fcn.00402490
mov dword [ebp - 0x23c], eax
mov eax, dword [ebp - 0x23c]
sub eax, 1
push eax
lea ecx, [ebp - 0x238]
call fcn.00403c70
movzx ecx, word [eax]
cmp ecx, 0x5c
je 0x43d54c
push 0x472dc0
lea ecx, [ebp - 0x238]
call fcn.00403c10
lea ecx, [ebp - 0x238]
call fcn.00401220
push eax
lea edx, [ebp - 0x21c]
push edx
call fcn.00414f38
add esp, 8
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x21c]
push ecx
push 0x472dc4
push 0x208
push 0x104
lea edx, [ebp - 0x21c]
push edx
call fcn.004157ac
add esp, 0x18
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 1
push 0x18
lea ecx, [ebp - 0x21c]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x43d659
lea edx, [ebp - 0x21c]
push edx
lea ecx, [ebp - 0x238]
call fcn.00403bf0
lea ecx, [ebp - 0x238]
call fcn.00402490
mov dword [ebp - 0x240], eax
mov eax, dword [ebp - 0x240]
sub eax, 1
push eax
lea ecx, [ebp - 0x238]
call fcn.00403c70
movzx ecx, word [eax]
cmp ecx, 0x5c
je 0x43d608
push 0x472dd0
lea ecx, [ebp - 0x238]
call fcn.00403c10
lea ecx, [ebp - 0x238]
call fcn.00401220
push eax
lea edx, [ebp - 0x21c]
push edx
call fcn.00414f38
add esp, 8
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x21c]
push ecx
push 0x472dd4
push 0x208
push 0x104
lea edx, [ebp - 0x21c]
push edx
call fcn.004157ac
add esp, 0x18
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x238]
call fcn.00401200
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004151d0
mov esp, ebp
pop ebp
ret
Function at 0x43d9a0
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x468d9a
mov eax, dword fs:[0]
push eax
sub esp, 0x294
mov eax, dword [0x481288]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x284], 0
push 0x24c
push 0
lea eax, [ebp - 0x280]
push eax
call fcn.00415680
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x30]
call fcn.004011c0
mov dword [ebp - 4], 0
push 0x472ba0
lea ecx, [ebp - 0x30]
call fcn.00403c10
lea edx, [ebp - 0x284]
push edx
lea ecx, [ebp - 0x30]
call fcn.00401220
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x43daff
push 0x472ba8
lea eax, [ebp - 0x258]
push eax
call fcn.004160f0
add esp, 8
test eax, eax
jne 0x43da4b
jmp 0x43dadc
push 0x472bac
lea ecx, [ebp - 0x258]
push ecx
call fcn.004160f0
add esp, 8
test eax, eax
jne 0x43da65
jmp 0x43dadc
mov edx, dword [ebp + 8]
push edx
lea ecx, [ebp - 0x2a0]
call fcn.004011c0
mov byte [ebp - 4], 1
push 0x472bb4
lea ecx, [ebp - 0x2a0]
call fcn.00403c10
lea eax, [ebp - 0x258]
push eax
lea ecx, [ebp - 0x2a0]
call fcn.00403c10
mov ecx, dword [ebp - 0x284]
and ecx, 0x10
je 0x43dabb
lea ecx, [ebp - 0x2a0]
call fcn.00401220
push eax
call fcn.0043d9a0
add esp, 4
jmp 0x43dacd
lea ecx, [ebp - 0x2a0]
call fcn.00401220
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2a0]
call fcn.00401200
lea edx, [ebp - 0x284]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x43da2e
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [ebp + 8]
push edx
call fcn.00438d00
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00401200
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004151d0
mov esp, ebp
pop ebp
ret
Function at 0x43dce0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x481288]
xor eax, ebp
mov dword [ebp - 4], eax
mov word [ebp - 0x418], 0
push 0x40e
push 0
lea eax, [ebp - 0x416]
push eax
call fcn.00415680
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
push str._sQQHangReport.lnk
push 0x410
push 0x208
lea edx, [ebp - 0x418]
push edx
call fcn.004157ac
add esp, 0x14
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x4712fc
push 0x471308
call fcn.00437e00
add esp, 8
push 0x47131c
push 0x471328
call fcn.00437e00
add esp, 8
push 0x47133c
push str.0W_vN
call fcn.00437e00
add esp, 8
push 0x471378
call fcn.0043d480
add esp, 4
push 0x47138c
call fcn.0043d480
add esp, 4
push 0
push 0x4713a0
push 0x4713ac
push 0x4713c0
push 0x4713cc
call fcn.00439ec0
add esp, 0x14
push 0
push 0x4713d8
push str.CN_vQ
push 0x4713f8
push 0x471404
call fcn.00439ec0
add esp, 0x14
push 0
push 0x471410
push 0x471420
push 0x471438
push 0x471444
call fcn.00439ec0
add esp, 0x14
push 0x471450
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00439800
add esp, 8
push str..cfc
push connect
call fcn.00439800
add esp, 8
push str.CFC.Package
push connect
call fcn.00439800
add esp, 8
push str.EMOTION.Package
push connect
call fcn.00439800
add esp, 8
push str..eip
push connect
call fcn.00439800
add esp, 8
push str..kip
push connect
call fcn.00439800
add esp, 8
push str.SKIN.Package
push connect
call fcn.00439800
add esp, 8
push 0x4714f0
push connect
call fcn.00439800
add esp, 8
push str.TENCENT
push connect
call fcn.00439800
add esp, 8
push str..cip
push connect
call fcn.00439800
add esp, 8
push str.SCENE.Package
push connect
call fcn.00439800
add esp, 8
push str..uip
push connect
call fcn.00439800
add esp, 8
push str.SUPERBAG.Package
push connect
call fcn.00439800
add esp, 8
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004151d0
mov esp, ebp
pop ebp
ret
Function at 0x43def0
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x838
mov eax, dword [0x481288]
xor eax, ebp
mov dword [ebp - 4], eax
mov word [ebp - 0x828], 0
push 0x206
push 0
lea eax, [ebp - 0x826]
push eax
call fcn.00415680
add esp, 0xc
mov word [ebp - 0x210], 0
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.00415680
add esp, 0xc
mov word [ebp - 0x620], 0
push 0x206
push 0
lea edx, [ebp - 0x61e]
push edx
call fcn.00415680
add esp, 0xc
mov word [ebp - 0x418], 0
push 0x206
push 0
lea eax, [ebp - 0x416]
push eax
call fcn.00415680
add esp, 0xc
push 0x488d00
call fcn.00414d31
add esp, 4
test eax, eax
jbe 0x43e053
push 0x488d00
call fcn.00414d31
add esp, 4
mov dword [ebp - 0x830], eax
mov ecx, dword [ebp - 0x830]
mov dword [ebp - 0x82c], ecx
mov dword [ebp - 0x834], 0
mov edx, dword [ebp - 0x82c]
movzx eax, word [edx*2 + 0x488cfe]
cmp eax, 0x2f
je 0x43dffd
mov ecx, dword [ebp - 0x82c]
movzx edx, word [ecx*2 + 0x488cfe]
cmp edx, 0x5c
je 0x43dffd
cmp dword [ebp - 0x82c], 0
jle 0x43dffd
mov eax, dword [ebp - 0x82c]
sub eax, 1
mov dword [ebp - 0x82c], eax
jmp 0x43dfbd
mov ecx, dword [ebp - 0x834]
cmp ecx, dword [ebp - 0x82c]
jge 0x43e038
mov edx, dword [ebp - 0x834]
mov eax, dword [ebp - 0x834]
mov cx, word [eax*2 + 0x488d00]
mov word [ebp + edx*2 - 0x620], cx
mov edx, dword [ebp - 0x834]
add edx, 1
mov dword [ebp - 0x834], edx
jmp 0x43dffd
cmp dword [ebp - 0x834], 0
jg 0x43e043
jmp 0x43e053
mov eax, dword [ebp - 0x834]
mov word [ebp + eax*2 - 0x622], 0
lea ecx, [ebp - 0x620]
push ecx
call fcn.00414d31
add esp, 4
test eax, eax
jbe 0x43e0c2
lea edx, [ebp - 0x620]
push edx
call fcn.00414d31
add esp, 4
movzx eax, word [ebp + eax*2 - 0x622]
cmp eax, 0x5c
jne 0x43e09b
lea ecx, [ebp - 0x620]
push ecx
call fcn.00414d31
add esp, 4
mov word [ebp + eax*2 - 0x622], 0
lea edx, [ebp - 0x620]
push edx
push str._sSharedAccountConfigConfig.ini
push 0x208
push 0x104
lea eax, [ebp - 0x210]
push eax
call fcn.004157ac
add esp, 0x14
jmp 0x43e0c7
jmp 0x43e186
lea ecx, [ebp - 0x210]
push ecx
call fcn.00414d31
add esp, 4
test eax, eax
jbe 0x43e186
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x43e186
lea eax, [ebp - 0x210]
push eax
push 0x64
lea ecx, [ebp - 0x418]
push ecx
push 0x473748
push 0x47374c
push 0x473760
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea edx, [ebp - 0x418]
push edx
call fcn.00414d31
add esp, 4
test eax, eax
jbe 0x43e186
push 0x473770
lea eax, [ebp - 0x418]
push eax
call fcn.0043d3a0
add esp, 8
mov dword [ebp - 0x838], eax
cmp dword [ebp - 0x838], 0
jl 0x43e15a
mov dword [0x489bac], 1
jmp 0x43e186
cmp dword [ebp + 8], 0
je 0x43e17c
lea ecx, [ebp - 0x210]
push ecx
push 0x473788
push str.HomePage
push str.Startup
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov dword [0x489bac], 0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004151d0
mov esp, ebp
pop ebp
ret
Function at 0x43e1a0
Capabilities:
Check if file exists
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x648
mov eax, dword [0x481288]
xor eax, ebp
mov dword [ebp - 8], eax
mov word [ebp - 0x210], 0
push 0x206
push 0
lea eax, [ebp - 0x20e]
push eax
call fcn.00415680
add esp, 0xc
mov word [ebp - 0x420], 0
push 0x206
push 0
lea ecx, [ebp - 0x41e]
push ecx
call fcn.00415680
add esp, 0xc
mov word [ebp - 0x628], 0
push 0x206
push 0
lea edx, [ebp - 0x626]
push edx
call fcn.00415680
add esp, 0xc
mov dword [ebp - 4], 0x104
lea eax, [ebp - 0x214]
push eax
push 0x20019
push 0
push str.SoftwareTencentTTraveler
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43e2a6
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x210]
push edx
push 0
push 0
push str.ConfigPath
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x43e2a6
lea ecx, [ebp - 0x210]
push ecx
call fcn.00414d31
add esp, 4
test eax, eax
jbe 0x43e2a6
lea edx, [ebp - 0x210]
push edx
call fcn.00414d31
add esp, 4
movzx eax, word [ebp + eax*2 - 0x212]
cmp eax, 0x5c
jne 0x43e2a6
lea ecx, [ebp - 0x210]
push ecx
call fcn.00414d31
add esp, 4
mov word [ebp + eax*2 - 0x212], 0
lea edx, [ebp - 0x210]
push edx
call fcn.00414d31
add esp, 4
test eax, eax
ja 0x43e34e
push 0
lea eax, [ebp - 0x644]
push eax
call fcn.00433bb0
add esp, 8
lea ecx, [ebp - 0x644]
call fcn.00401220
push eax
lea ecx, [ebp - 0x210]
push ecx
call fcn.00414f38
add esp, 8
lea edx, [ebp - 0x210]
push edx
call fcn.00414d31
add esp, 4
movzx eax, word [ebp + eax*2 - 0x212]
cmp eax, 0x5c
jne 0x43e31e
lea ecx, [ebp - 0x210]
push ecx
call fcn.00414d31
add esp, 4
mov word [ebp + eax*2 - 0x212], 0
lea edx, [ebp - 0x210]
push edx
push str._sTencentTencentTraveler100
push 0x208
push 0x104
lea eax, [ebp - 0x210]
push eax
call fcn.004157ac
add esp, 0x14
lea ecx, [ebp - 0x644]
call fcn.00401200
lea ecx, [ebp - 0x210]
push ecx
call fcn.00414d31
add esp, 4
test eax, eax
jbe 0x43e434
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x43e434
lea eax, [ebp - 0x210]
push eax
push str._sTtConf.dat
push 0x208
push 0x104
lea ecx, [ebp - 0x420]
push ecx
call fcn.004157ac
add esp, 0x14
lea edx, [ebp - 0x420]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x43e434
lea eax, [ebp - 0x420]
push eax
push 0x64
lea ecx, [ebp - 0x628]
push ecx
push 0x473498
push 0x47349c
push 0x4734bc
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0x4734cc
lea edx, [ebp - 0x628]
push edx
call fcn.0043d3a0
add esp, 8
mov dword [ebp - 0x648], eax
cmp dword [ebp - 0x648], 0
jl 0x43e408
mov dword [0x489bac], 1
jmp 0x43e434
cmp dword [ebp + 8], 0
je 0x43e42a
lea eax, [ebp - 0x420]
push eax
push 0x4734e4
push str.strHomePageUrl
push str.COMMON
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov dword [0x489bac], 0
mov ecx, dword [ebp - 0x214]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004151d0
mov esp, ebp
pop ebp
ret
Function at 0x43e450
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x481288]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov word [ebp - 0x218], 0
push 0x206
push 0
lea eax, [ebp - 0x216]
push eax
call fcn.00415680
add esp, 0xc
mov dword [ebp - 4], 0x104
lea ecx, [ebp - 8]
push ecx
push 0x20019
push 0
push 0x473368
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x43e4aa
jmp 0x43e509
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push 0x4733bc
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x43e4d8
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x43e509
push 0x4733d4
lea eax, [ebp - 0x218]
push eax
call fcn.0043d3a0
add esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jl 0x43e4ff
mov dword [0x489bac], 1
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004151d0
mov esp, ebp
pop ebp
ret
Function at 0x43e690
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4691c1
mov eax, dword fs:[0]
push eax
sub esp, 0x2b0
mov eax, dword [0x481288]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x284], 0
push 0x24c
push 0
lea eax, [ebp - 0x280]
push eax
call fcn.00415680
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x30]
call fcn.004011c0
mov dword [ebp - 4], 0
push 0x472cb0
lea ecx, [ebp - 0x30]
call fcn.00403c10
lea edx, [ebp - 0x284]
push edx
lea ecx, [ebp - 0x30]
call fcn.00401220
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x43e812
mov eax, dword [ebp - 0x284]
and eax, 0x10
je 0x43e799
lea ecx, [ebp - 0x258]
push ecx
call fcn.0043ceb0
add esp, 4
movzx edx, al
test edx, edx
jne 0x43e797
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x2a0]
call fcn.004011c0
mov byte [ebp - 4], 1
push 0x472cb8
lea ecx, [ebp - 0x2a0]
call fcn.00403c10
lea ecx, [ebp - 0x258]
push ecx
lea ecx, [ebp - 0x2a0]
call fcn.00403c10
lea ecx, [ebp - 0x2a0]
call fcn.00401220
push eax
call fcn.0043d9a0
add esp, 4
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2a0]
call fcn.00401200
jmp 0x43e7ef
mov edx, dword [ebp + 8]
push edx
lea ecx, [ebp - 0x2bc]
call fcn.004011c0
mov byte [ebp - 4], 2
push 0x472cbc
lea ecx, [ebp - 0x2bc]
call fcn.00403c10
lea eax, [ebp - 0x258]
push eax
lea ecx, [ebp - 0x2bc]
call fcn.00403c10
lea ecx, [ebp - 0x2bc]
call fcn.00401220
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2bc]
call fcn.00401200
lea ecx, [ebp - 0x284]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x43e71e
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x472cc0
mov ecx, dword [ebp + 8]
push ecx
call fcn.0043d690
add esp, 8
push str.Com.Tencent.QQMusic
mov edx, dword [ebp + 8]
push edx
call fcn.0043d690
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00401200
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004151d0
mov esp, ebp
pop ebp
ret