joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414170
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x414
mov eax, dword [0x44a2b8]
xor eax, esp
mov dword [esp + 0x410], eax
push 0x206
lea eax, [esp + 6]
push 0
push eax
mov word [esp + 0xc], 0
call fcn.00429d70
push 0x206
lea ecx, [esp + 0x21a]
push 0
push ecx
mov word [esp + 0x220], 0
call fcn.00429d70
push 0x44f018
push str._sBin
push 0x208
lea edx, [esp + 0x24]
push 0x104
push edx
call fcn.00425032
push str.QQCRM.exe
lea eax, [esp + 0x30]
push eax
push 0x441ab4
push 0x208
lea ecx, [esp + 0x244]
push 0x104
push ecx
call fcn.00425032
add esp, 0x44
cmp dword [0x44d6b8], 1
jne 0x414222
lea edx, [esp + 0x208]
push 0x441b18
push edx
call dword [sym.imp.QQVistaHelper.dll_void___cdecl_RunAsUser_wchar_t___wchar_t__]
add esp, 8
jmp 0x41423d
push 5
lea eax, [esp + 4]
push eax
push 0
lea ecx, [esp + 0x214]
push ecx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [esp + 0x410]
xor ecx, esp
mov eax, 1
call fcn.00424e88
add esp, 0x414
ret

Function at 0x414260
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x620
mov eax, dword [0x44a2b8]
xor eax, esp
mov dword [esp + 0x61c], eax
mov eax, 0x44dd48
push esi
lea edx, [eax + 2]
xor esi, esi
nop
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x414280
sub eax, edx
sar eax, 1
je 0x4143a4
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push 0x44dd48
call edi
test eax, eax
je 0x4143a3
push 0x44f018
push 0x44dd48
call fcn.004255c9
add esp, 8
test eax, eax
je 0x4143a3
push 0x206
lea eax, [esp + 0x12]
push esi
push eax
mov word [esp + 0x18], si
call fcn.00429d70
push 0x206
lea ecx, [esp + 0x226]
push esi
push ecx
mov word [esp + 0x22c], si
call fcn.00429d70
push 0x206
lea edx, [esp + 0x43a]
push esi
push edx
mov word [esp + 0x440], si
call fcn.00429d70
push 0x44dd48
push str._sPlugin
push 0x208
lea eax, [esp + 0x3c]
push 0x104
push eax
call fcn.00425032
lea esi, [esp + 0x44]
call fcn.0041b9a0
push 0x44dd48
push str._sBin
push 0x208
lea ecx, [esp + 0x258]
push 0x104
push ecx
call fcn.00425032
add esp, 0x4c
lea esi, [esp + 0x214]
call fcn.0041b9a0
push 0x44dd48
push str._sUsers
push 0x208
lea edx, [esp + 0x428]
push 0x104
push edx
call fcn.00425032
add esp, 0x14
lea eax, [esp + 0x41c]
push eax
call edi
test eax, eax
jne 0x4143a3
mov esi, 0x44dd48
call fcn.0041b9a0
pop edi
mov ecx, dword [esp + 0x620]
pop esi
xor ecx, esp
call fcn.00424e88
add esp, 0x620
ret
Function at 0x4159b0
Capabilities:
Check os version
Create thread

Disassembly:
sub esp, 0x12c
mov eax, dword [0x44a2b8]
xor eax, esp
mov dword [esp + 0x128], eax
push esi
push 0x11c
lea eax, [esp + 0xc]
push 0
push eax
call fcn.00429d70
add esp, 0xc
lea ecx, [esp + 8]
push ecx
mov dword [esp + 0xc], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x415a04
cmp dword [esp + 0xc], 6
mov dword [esp + 8], 0x114
jae 0x415a04
call fcn.004155f0
cmp dword [esp + 0x134], 0
je 0x415a34
push 0
push 0
push 0
push 0x415ef0
push 0
push 0
mov dword [0x44efa8], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x44efa4], eax
jmp 0x415a39
call fcn.00415ba0
call fcn.00413fc0
call fcn.004164b0
call fcn.0041e2c0
cmp dword [0x4514bc], 0
mov esi, eax
je 0x415a99
cmp esi, 5
je 0x415a5c
test esi, esi
jne 0x415a61
call fcn.00413d50
cmp esi, 3
jne 0x415a6f
push 1
call fcn.0041e630
jmp 0x415a96
cmp esi, 1
jne 0x415a7c
push esi
call fcn.0041e930
jmp 0x415a96
cmp esi, 2
jne 0x415a8a
push 1
call fcn.0041f1b0
jmp 0x415a96
cmp esi, 4
jne 0x415a99
push 1
call fcn.0041f410
add esp, 4
mov ecx, dword [esp + 0x12c]
pop esi
xor ecx, esp
mov eax, 1
call fcn.00424e88
add esp, 0x12c
ret

Function at 0x415ac0
Capabilities:
Create process on windows
Delete registry value
Persist via run registry key

Disassembly:
sub esp, 0x424
mov eax, dword [0x44a2b8]
xor eax, esp
mov dword [esp + 0x41c], eax
push esi
push edi
lea edi, [esp + 0x10]
mov esi, str.YP_FOREXE_SHORTCUT_DIR
call fcn.0041ba50
lea edi, [esp + 0x218]
mov esi, str.YP_FOREXE_SHORTCUT_NAME
call fcn.0041ba50
cmp dword [0x4514cc], 0
je 0x415b19
push 5
push 0x44f018
push 0
push str.whatsnew.txt
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov edi, ebx
call fcn.00413e20
test ebx, ebx
jne 0x415b69
cmp dword [0x4514d0], ebx
jne 0x415b62
lea eax, [esp + 0xc]
push eax
push 0x20006
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [esp + 0xc]
push str.QQCRM
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.004143c0
jmp 0x415b6e
call fcn.00414d70
call fcn.0041c640
call fcn.00415f30
mov ecx, dword [esp + 0x424]
pop edi
pop esi
xor ecx, esp
mov eax, 1
call fcn.00424e88
add esp, 0x424
ret
Function at 0x4164b0
Capabilities:
Get common file path
Get startup folder

Disassembly:
push 0xffffffffffffffff
push 0x43e076
mov eax, dword fs:[0]
push eax
sub esp, 0x44c
mov eax, dword [0x44a2b8]
xor eax, esp
mov dword [esp + 0x448], eax
push ebx
push esi
push edi
mov eax, dword [0x44a2b8]
xor eax, esp
push eax
lea eax, [esp + 0x45c]
mov dword fs:[0], eax
xor edi, edi
push 0x206
lea eax, [esp + 0x4e]
push edi
push eax
mov word [esp + 0x54], di
call fcn.00429d70
add esp, 0xc
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], edi
mov word [esp + 0x14], di
mov dword [esp + 0x464], edi
mov dword [esp + 0x44], 7
mov dword [esp + 0x40], edi
mov word [esp + 0x30], di
push 1
push 0x1a
lea ecx, [esp + 0x50]
push ecx
push edi
mov byte [esp + 0x474], 1
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x41656e
lea eax, [esp + 0x48]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x416550
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 0x4c]
push edx
lea esi, [esp + 0x18]
call fcn.00401d00
mov eax, dword [esp + 0x24]
cmp eax, edi
jne 0x416598
push 2
push 0x4433bc
lea esi, [esp + 0x34]
call fcn.00401d00
push 0xffffffffffffffff
push edi
mov eax, esi
lea ecx, [esp + 0x18]
call fcn.00401da0
mov eax, dword [esp + 0x24]
lea esi, [eax - 1]
cmp esi, eax
jbe 0x4165a4
call fcn.0042588d
mov eax, dword [esp + 0x14]
mov ebx, 8
cmp dword [esp + 0x28], ebx
jae 0x4165b7
lea eax, [esp + 0x14]
cmp word [eax + esi*2], 0x5c
je 0x4165ce
push 1
push 0x4420e8
lea ecx, [esp + 0x18]
call fcn.0040ff40
push 0x206
lea eax, [esp + 0x256]
push edi
push eax
mov word [esp + 0x25c], di
call fcn.00429d70
mov eax, dword [esp + 0x20]
add esp, 0xc
cmp dword [esp + 0x28], ebx
jae 0x4165fa
lea eax, [esp + 0x14]
push str.QQCRM.ini
push str.QQCRM
push str.Tencent
push eax
push 0x4433d8
push 0x208
lea ecx, [esp + 0x268]
push 0x104
push ecx
call fcn.00425032
add esp, 0x20
lea edx, [esp + 0x250]
push edx
push 0x442654
push str.ShowNewFeature
push str.STAT
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
cmp dword [esp + 0x44], ebx
jb 0x416659
mov eax, dword [esp + 0x30]
push eax
call fcn.004250ac
add esp, 4
cmp dword [esp + 0x28], ebx
mov dword [esp + 0x44], 7
mov dword [esp + 0x40], edi
mov word [esp + 0x30], di
jb 0x41667d
mov ecx, dword [esp + 0x14]
push ecx
call fcn.004250ac
add esp, 4
mov ecx, dword [esp + 0x45c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x448]
xor ecx, esp
call fcn.00424e88
add esp, 0x458
ret

Function at 0x417110
Capabilities:
Get common file path

Disassembly:
sub esp, 0x210
mov eax, dword [0x44a2b8]
xor eax, esp
mov dword [esp + 0x20c], eax
lea eax, [esp]
push eax
push 0x1a
push 0
mov dword [esp + 0xc], 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov edx, dword [esp]
lea ecx, [esp + 4]
push ecx
push edx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
push str.TencentQQMisc
lea eax, [esp + 8]
push eax
push 0x441ab4
push 0x208
push 0x104
push esi
call fcn.00425032
mov ecx, dword [esp + 0x224]
add esp, 0x18
xor ecx, esp
xor eax, eax
call fcn.00424e88
add esp, 0x210
ret
Function at 0x417190
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x680
mov eax, dword [0x44a2b8]
xor eax, esp
mov dword [esp + 0x67c], eax
mov eax, dword [esp + 0x684]
push ebx
push ebp
mov ebp, dword [esp + 0x690]
push esi
push edi
mov edi, 1
lea esi, [esp + 0x484]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], edi
call fcn.00417110
push 0x441c20
mov ecx, esi
push ecx
push 0x441ab4
push 0x208
lea edx, [esp + 0x28c]
push 0x104
push edx
call fcn.00425032
xor ebx, ebx
push 0x1fe
lea eax, [esp + 0x9a]
push ebx
push eax
mov word [esp + 0xa0], bx
call fcn.00429d70
add esp, 0x24
lea ecx, [esp + 0x27c]
push ecx
push 0x100
lea edx, [esp + 0x84]
push edx
push 0x441b18
push str.ScanOpt
push 0x441c3c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp eax, ebx
jne 0x417248
mov eax, edi
jmp 0x417358
cmp eax, 0x80
jne 0x417350
push 0x3f
lea eax, [esp + 0x41]
push ebx
push eax
mov byte [esp + 0x48], bl
call fcn.00429d70
lea ecx, [esp + 0x48]
push ecx
lea edx, [esp + 0x8c]
push edx
mov ebx, 0x80
call fcn.00416e90
add esp, 0x14
test eax, eax
je 0x417350
xor eax, eax
mov byte [esp + 0x18], al
mov dword [esp + 0x19], eax
mov dword [esp + 0x1d], eax
mov dword [esp + 0x21], eax
mov dword [esp + 0x25], eax
mov dword [esp + 0x29], eax
mov dword [esp + 0x2d], eax
mov dword [esp + 0x31], eax
mov dword [esp + 0x35], eax
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x1c]
push ecx
call fcn.00416fd0
add esp, 8
test eax, eax
je 0x417350
lea edx, [esp + 0x18]
push edx
lea ebx, [esp + 0x14]
call fcn.00417060
add esp, 4
test eax, eax
je 0x41734c
mov eax, dword [esp + 0x10]
cmp eax, 0x541a
je 0x417304
cmp eax, 0x5f52
je 0x4172fd
xor ecx, ecx
cmp eax, 0x5fd8
sete cl
add ecx, edi
mov edi, ecx
jmp 0x417306
mov edi, 3
jmp 0x417306
xor edi, edi
lea edx, [esp + 0x27c]
push edx
push 0
push str.EnvirType
push 0x441c3c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
sub eax, 0x708b
je 0x417343
sub eax, 0x65
je 0x41733a
sub eax, 0x2a
jne 0x41733a
mov dword [ebp], 2
jmp 0x417350
mov dword [ebp], 0
jmp 0x417350
mov dword [ebp], 1
jmp 0x417350
mov edi, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [eax], edi
xor eax, eax
mov ecx, dword [esp + 0x68c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00424e88
add esp, 0x680
ret
Function at 0x418b90
Capabilities:
Get common file path

Disassembly:
sub esp, 0x534
mov eax, dword [0x44a2b8]
xor eax, esp
mov dword [esp + 0x530], eax
push str.49.48.0.2798.0
push 0x441d18
push 0x208
push 0x104
push 0x450260
call fcn.00425032
push 0x206
lea eax, [esp + 0x342]
push 0
push eax
mov word [esp + 0x348], 0
call fcn.00429d70
push 0x206
lea ecx, [esp + 0x146]
push 0
push ecx
mov dword [esp + 0x2c], 0x104
mov word [esp + 0x14c], 0
call fcn.00429d70
add esp, 0x2c
push 0
push 0x25
lea edx, [esp + 0x128]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x418c36
mov ecx, dword [esp + 0x530]
xor ecx, esp
call fcn.00424e88
add esp, 0x534
ret
lea eax, [esp + 0x120]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x418c40
sub eax, edx
push esi
sar eax, 1
mov esi, 0x5c
cmp word [esp + eax*2 + 0x122], si
je 0x418c87
lea eax, [esp + 0x124]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x418c70
sub eax, edx
sar eax, 1
mov word [esp + eax*2 + 0x124], si
lea eax, [esp + 0x124]
push eax
push str._smsi.dll
push 0x208
mov ecx, eax
push 0x104
push ecx
call fcn.00425032
add esp, 0x14
push 0
push 0
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x338]
push eax
lea ecx, [esp + 0x134]
push ecx
call sub.Msi.dll_MsiMessageBoxW
test eax, eax
jne 0x418d4f
lea edx, [esp + 0x32c]
push 0x2e
push edx
call fcn.00425bae
add eax, 2
push 0x2e
push eax
call fcn.00425bae
add eax, 2
push 0x2e
push eax
call fcn.00425bae
lea ecx, [esp + 0x344]
sub eax, ecx
sar eax, 1
add eax, eax
push eax
mov edx, ecx
push edx
push 0x450670
call fcn.00428690
push 0x11c
lea eax, [esp + 0x30]
push 0
push eax
call fcn.00429d70
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
add esp, 0x30
lea ecx, [esp + 8]
push ecx
mov dword [esp + 0xc], 0x11c
call esi
test eax, eax
jne 0x418d67
lea edx, [esp + 8]
push edx
mov dword [esp + 0xc], 0x114
call esi
test eax, eax
jne 0x418d67
xor eax, eax
pop esi
mov ecx, dword [esp + 0x530]
xor ecx, esp
call fcn.00424e88
add esp, 0x534
ret
mov eax, dword [esp + 0x18]
sub eax, 0
je 0x418db2
sub eax, 1
je 0x418dab
sub eax, 1
jne 0x418dce
movzx eax, word [esp + 0x11c]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push eax
push ecx
push edx
push str._d._d._d
push 0x208
push 0x104
push 0x450468
call fcn.00425032
add esp, 0x1c
jmp 0x418dce
push str.Windows_98_or_95
jmp 0x418db7
push str.Windows_3.1
push 0x208
push 0x104
push 0x450468
call fcn.00425032
add esp, 0x10
mov ecx, dword [esp + 0x534]
pop esi
xor ecx, esp
mov eax, 1
call fcn.00424e88
add esp, 0x534
ret
Function at 0x418df0
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
sub esp, 0x344
mov eax, dword [0x44a2b8]
xor eax, esp
mov dword [esp + 0x33c], eax
push esi
push edi
push 0x11c
lea eax, [esp + 0x1c]
push 0
push eax
call fcn.00429d70
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
add esp, 0xc
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x1c], 0x11c
call esi
test eax, eax
jne 0x418e56
lea edx, [esp + 0x18]
push edx
mov dword [esp + 0x1c], 0x114
call esi
test eax, eax
jne 0x418e56
push eax
call fcn.00407d10
mov ecx, 0x443794
jmp 0x418ff9
mov eax, dword [esp + 0x28]
sub eax, 0
je 0x418fed
mov edi, 1
sub eax, edi
je 0x418fc8
sub eax, edi
jne 0x419021
mov dword [0x44d6b8], eax
mov eax, dword [esp + 0x1c]
cmp eax, 6
jb 0x418e8c
mov dword [0x44d6b8], edi
cmp eax, 5
jbe 0x418eaa
mov eax, edi
pop edi
pop esi
mov ecx, dword [esp + 0x33c]
xor ecx, esp
call fcn.00424e88
add esp, 0x344
ret
cmp eax, 4
ja 0x418ed5
push 0
call fcn.00407d10
add esp, 4
push 0x10
push 0x441840
xor esi, esi
call fcn.00408090
add esp, 8
mov dword [0x45087c], edi
jmp 0x419017
cmp eax, 5
jne 0x418ef2
cmp dword [esp + 0x20], 0
jne 0x418ef2
cmp word [esp + 0x12c], 2
mov dword [0x44ef74], edi
jb 0x418eaf
call fcn.0041bbb0
test eax, eax
jne 0x418f2a
push eax
call fcn.00407d10
add esp, 4
push 0x10
push 0x4437bc
xor esi, esi
call fcn.00408090
add esp, 8
mov dword [0x450878], 4
mov dword [0x45087c], edi
jmp 0x419021
lea eax, [esp + 0xc]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftInternet_Explorer
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x418f9b
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x13c]
push edx
lea eax, [esp + 0x1c]
push eax
push 0
push str.Version
push ecx
mov dword [esp + 0x2c], 4
mov dword [esp + 0x28], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x418f9b
lea ecx, [esp + 0x138]
mov eax, str.6.0.0.0
call fcn.0041cf00
test eax, eax
jle 0x418e91
push 0
call fcn.00407d10
add esp, 4
push 0x10
push 0x443860
xor esi, esi
call fcn.00408090
add esp, 8
mov dword [0x450878], 7
mov dword [0x45087c], edi
jmp 0x419021
push 0
call fcn.00407d10
add esp, 4
push 0x10
push 0x4418d4
push 0
mov ecx, 0x441840
call fcn.00407d60
mov dword [0x45087c], edi
jmp 0x419014
push 0
call fcn.00407d10
mov ecx, 0x441840
add esp, 4
push 0x10
push 0x4418d4
push 0
call fcn.00407d60
mov dword [0x45087c], 1
add esp, 0xc
mov dword [0x450878], 5
mov ecx, dword [esp + 0x344]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.00424e88
add esp, 0x344
ret

Function at 0x419180
Capabilities:
Create thread

Disassembly:
mov eax, dword [0x44e590]
push 0
push 0
push eax
push 0x41cd50
push 0
push 0
mov dword [0x45151c], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x451524], eax
mov eax, 1
ret
Function at 0x4191b0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 0x210
mov eax, dword [0x44a2b8]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebx
mov ebx, dword [esp + 0x218]
push ebp
mov ebp, dword [esp + 0x220]
lea eax, [esp + 8]
push eax
push 0xf003f
push 0
push ebp
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41927f
mov edx, dword [esp + 8]
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
push 0x104
lea ecx, [esp + 0x18]
push ecx
xor esi, esi
push esi
push edx
call edi
test eax, eax
jne 0x41923f
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
push ecx
call fcn.004191b0
add esp, 8
test eax, eax
je 0x419270
mov eax, dword [esp + 0x10]
push 0x104
lea edx, [esp + 0x18]
push edx
add esi, 1
push esi
push eax
call edi
test eax, eax
je 0x419210
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebp
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.00424e88
add esp, 0x210
ret
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x419257
mov ecx, dword [esp + 0x214]
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.00424e88
add esp, 0x210
ret

Function at 0x4192a0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x210
mov eax, dword [0x44a2b8]
xor eax, esp
mov dword [esp + 0x20c], eax
push esi
lea eax, [esp + 4]
push eax
push 0x1a
push 0
mov dword [esp + 0x10], 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov edx, dword [esp + 4]
lea ecx, [esp + 8]
push ecx
push edx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
lea eax, [esp + 8]
push eax
push str._sTencentQQCRMAUTemp
push 0x208
mov ecx, eax
push 0x104
push ecx
call fcn.00425032
add esp, 0x14
lea esi, [esp + 8]
call fcn.0041b9a0
mov ecx, dword [esp + 0x210]
pop esi
xor ecx, esp
mov eax, 1
call fcn.00424e88
add esp, 0x210
ret
Function at 0x41a450
Capabilities:
Delete file

Disassembly:
sub esp, 0x824
mov eax, dword [0x44a2b8]
xor eax, esp
mov dword [esp + 0x820], eax
push esi
xor esi, esi
push 0x40e
lea eax, [esp + 0x41a]
push esi
push eax
mov word [esp + 0x420], si
call fcn.00429d70
push 0x40e
lea ecx, [esp + 0x16]
push esi
push ecx
mov word [esp + 0x1c], si
call fcn.00429d70
push edi
push str._sChatRoom.exe
push 0x410
lea edx, [esp + 0x438]
push 0x208
push edx
call fcn.00425032
add esp, 0x2c
lea eax, [esp + 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
push str._sChat
push 0x410
lea ecx, [esp + 0x10]
push 0x208
push ecx
call fcn.00425032
lea esi, [esp + 0x18]
call fcn.0041b9a0
push edi
push str._sChatSkin
push 0x410
mov edx, esi
push 0x208
push edx
call fcn.00425032
call fcn.0041b9a0
push edi
push str._sChatRoomDll
push 0x410
mov eax, esi
push 0x208
push eax
call fcn.00425032
add esp, 0x3c
call fcn.0041b9a0
mov ecx, dword [esp + 0x824]
pop esi
xor ecx, esp
mov eax, 1
call fcn.00424e88
add esp, 0x824
ret
Function at 0x41a540
Capabilities:
Delete file
Get common file path
Query or enumerate registry value

Disassembly:
sub esp, 0xc44
mov eax, dword [0x44a2b8]
xor eax, esp
mov dword [esp + 0xc40], eax
push esi
push edi
xor edi, edi
push 0x206
lea eax, [esp + 0x226]
push edi
push eax
mov esi, ecx
mov dword [esp + 0x1c], 4
mov word [esp + 0x22c], di
call fcn.00429d70
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
push 0x20019
push edi
push str.SOFTWARETencentQQDoctor
push closesocket
mov dword [esp + 0x28], 0x104
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41a5d9
lea edx, [esp + 0x14]
push edx
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x224]
push eax
lea ecx, [esp + 0x18]
push ecx
push edi
push str.Install
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x41a5f2
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0xc40]
xor ecx, esp
call fcn.00424e88
add esp, 0xc44
ret
lea eax, [esp + 0x220]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x41a600
sub eax, edx
sar eax, 1
je 0x41a5d9
movzx ecx, word [esp + eax*2 + 0x21e]
cmp cx, 0x5c
lea eax, [esp + eax*2 + 0x21e]
je 0x41a62c
cmp cx, 0x2f
jne 0x41a62f
mov word [eax], di
lea ecx, [esp + 0x220]
push esi
push ecx
call fcn.004255c9
add esp, 8
test eax, eax
jne 0x41a784
push ebx
push ebp
push str.SOFTWARETencentQQDoctor
push closesocket
call fcn.004191b0
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallQQ
push closesocket
call fcn.004191b0
mov esi, 0x44487c
call fcn.0041d8f0
push esi
call fcn.0041d6a0
add esp, 0x14
lea edx, [esp + 0x10]
push edx
push 0x17
mov dword [esp + 0x18], edi
push edi
mov edi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
call edi
mov ecx, dword [esp + 0x10]
mov ebx, dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
lea eax, [esp + 0x20]
push eax
push ecx
call ebx
push 0x444890
lea edx, [esp + 0x24]
push edx
push 0x441ab4
push 0x410
lea eax, [esp + 0x440]
push 0x208
push eax
call fcn.00425032
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileW]
add esp, 0x18
lea ecx, [esp + 0x430]
push ecx
call ebp
push 0x4448ac
lea edx, [esp + 0x24]
push edx
push 0x441ab4
push 0x410
lea eax, [esp + 0x850]
push 0x208
push eax
call fcn.00425032
add esp, 0x18
lea esi, [esp + 0x840]
call fcn.0041b9a0
lea ecx, [esp + 0x10]
push ecx
push 2
push 0
call edi
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x20]
push edx
push eax
call ebx
push 0x444890
lea ecx, [esp + 0x24]
push ecx
push 0x441ab4
push 0x410
lea edx, [esp + 0x440]
push 0x208
push edx
call fcn.00425032
add esp, 0x18
lea eax, [esp + 0x430]
push eax
call ebp
push 0x4448ac
lea ecx, [esp + 0x24]
push ecx
push 0x441ab4
push 0x410
push 0x208
mov edx, esi
push edx
call fcn.00425032
add esp, 0x18
call fcn.0041b9a0
pop ebp
pop ebx
mov ecx, dword [esp + 0xc48]
pop edi
pop esi
xor ecx, esp
mov eax, 1
call fcn.00424e88
add esp, 0xc44
ret
Function at 0x41a860
Capabilities:
Delete file

Disassembly:
sub esp, 0x414
mov eax, dword [0x44a2b8]
xor eax, esp
mov dword [esp + 0x410], eax
push esi
push edi
push 0x40e
lea eax, [esp + 0xe]
push 0
push eax
mov esi, ecx
mov word [esp + 0x14], 0
call fcn.00429d70
push esi
push str._sQQHangReport.lnk
push 0x410
lea ecx, [esp + 0x20]
push 0x208
push ecx
call fcn.00425032
add esp, 0x20
lea edx, [esp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, 0x442c08
call fcn.0041d8f0
mov esi, str.CN_vQ
call fcn.0041d8f0
mov esi, str.0W_vN
call fcn.0041d8f0
push 0x442c08
call fcn.0041d6a0
push str.CN_vQ
call fcn.0041d6a0
mov edi, 0x44494c
mov esi, 0x444964
call fcn.0041d9d0
mov edi, str.CN_vQ
mov esi, str.CN_vAx
call fcn.0041d9d0
mov edi, 0x44497c
call fcn.0041d9d0
push str.SOFTWARETencentQQCRM
push closesocket
call fcn.004191b0
push str..cfc
push closesocket
call fcn.004191b0
push str.CFC.Package
push closesocket
call fcn.004191b0
push str.EMOTION.Package
push closesocket
call fcn.004191b0
push str..eip
push closesocket
call fcn.004191b0
push str..kip
push closesocket
call fcn.004191b0
push str.SKIN.Package
push closesocket
call fcn.004191b0
add esp, 0x40
push 0x444a3c
push closesocket
call fcn.004191b0
push str.TENCENT
push closesocket
call fcn.004191b0
push str..cip
push closesocket
call fcn.004191b0
push str.SCENE.Package
push closesocket
call fcn.004191b0
push str..uip
push closesocket
call fcn.004191b0
push str.SUPERBAG.Package
push closesocket
call fcn.004191b0
add esp, 0x30
mov eax, 1
pop edi
mov ecx, dword [esp + 0x414]
pop esi
xor ecx, esp
call fcn.00424e88
add esp, 0x414
ret