joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b870
Capabilities:
Get disk information

Disassembly:
sub esp, 0x414
mov eax, dword [0x44a2b8]
xor eax, esp
mov dword [esp + 0x410], eax
push esi
push 0x206
lea eax, [esp + 0x212]
push 0
push eax
mov esi, ecx
mov word [esp + 0x218], 0
call fcn.00429d70
push 0x206
lea ecx, [esp + 0x16]
push 0
push ecx
mov word [esp + 0x1c], 0
call fcn.00429d70
push esi
push 0x441d18
push 0x208
lea edx, [esp + 0x230]
push 0x104
push edx
call fcn.00425032
add esp, 0x2c
lea eax, [esp + 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathStripToRootW]
lea eax, [esp + 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40b8f5
sub eax, edx
sar eax, 1
je 0x40ba90
cmp word [esp + eax*2 + 0x20a], 0x5c
je 0x40b933
lea ecx, [esp + 0x20c]
push ecx
push 0x44210c
push 0x208
push 0x104
lea edx, [esp + 0x14]
push edx
jmp 0x40b94f
lea eax, [esp + 0x20c]
push eax
push 0x441d18
push 0x208
push 0x104
lea ecx, [esp + 0x14]
push ecx
call fcn.00425032
lea eax, [esp + 0x18]
add esp, 0x14
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40b960
sub eax, edx
sar eax, 1
mov edx, eax
je 0x40b9dd
movzx ecx, word [esi + edx*2]
test cx, cx
je 0x40b9dd
movzx ecx, cx
nop
cmp cx, 0x2f
je 0x40ba93
cmp cx, 0x3a
je 0x40ba93
cmp cx, 0x2a
je 0x40ba93
cmp cx, 0x3f
je 0x40ba93
cmp cx, 0x22
je 0x40ba93
cmp cx, 0x3c
je 0x40ba93
cmp cx, 0x3e
je 0x40ba93
cmp cx, 0x7c
je 0x40ba93
movzx ecx, word [esi + eax*2 + 2]
add eax, 1
test cx, cx
jne 0x40b980
push edi
xor edi, edi
test edx, edx
jbe 0x40ba2e
cmp word [esi + edx*2], di
lea eax, [esi + edx*2]
mov ecx, edx
je 0x40ba1a
nop
movzx eax, word [eax]
cmp ax, 0x5c
jne 0x40ba04
test edi, edi
jne 0x40ba0d
mov edi, 1
jmp 0x40ba06
xor edi, edi
mov word [esi + edx*2], ax
add edx, 1
add ecx, 1
cmp word [esi + ecx*2], 0
lea eax, [esi + ecx*2]
jne 0x40b9f0
cmp edx, ecx
jge 0x40ba2e
sub ecx, edx
xor eax, eax
shr ecx, 1
lea edi, [esi + edx*2]
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov esi, dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
lea edx, [esp + 8]
push edx
call esi
lea eax, [esp + 8]
push eax
call esi
cmp eax, 3
pop edi
je 0x40ba78
lea ecx, [esp + 4]
push ecx
call esi
cmp eax, 2
je 0x40ba78
lea edx, [esp + 4]
push edx
call esi
cmp eax, 4
je 0x40ba78
lea eax, [esp + 4]
push eax
call esi
cmp eax, 6
je 0x40ba78
lea ecx, [esp + 4]
push ecx
call esi
cmp eax, 5
jne 0x40ba90
xor eax, eax
pop esi
mov ecx, dword [esp + 0x410]
xor ecx, esp
call fcn.00424e88
add esp, 0x414
ret
or eax, 0xffffffff
mov ecx, dword [esp + 0x414]
pop esi
xor ecx, esp
call fcn.00424e88
add esp, 0x414
ret
Function at 0x40bb20
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x20c
mov eax, dword [0x44a2b8]
xor eax, esp
mov dword [esp + 0x208], eax
push edi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x104
lea eax, [esp + 8]
push eax
push 0x414
push esi
call edi
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jne 0x40bb70
xor eax, eax
pop edi
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.00424e88
add esp, 0x20c
ret
lea ecx, [esp + 4]
call fcn.0040b870
test eax, eax
jne 0x40bb58
lea ecx, [esp + 4]
push ecx
push 0x414
push esi
call edi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov ecx, dword [esp + 0x20c]
pop edi
xor ecx, esp
mov eax, 1
call fcn.00424e88
add esp, 0x20c
ret
Function at 0x40c150
Capabilities:
Get installed programs
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x42c
mov eax, dword [0x44a2b8]
xor eax, esp
mov dword [esp + 0x428], eax
mov eax, dword [esp + 0x434]
push ebp
mov ebp, dword [esp + 0x434]
push esi
lea ecx, [esp + 0x10]
push ecx
push 0x20019
xor esi, esi
push esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
push closesocket
mov dword [esp + 0x30], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x40c1b2
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x428]
xor ecx, esp
call fcn.00424e88
add esp, 0x42c
ret
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [esp + 0xc], esi
lea ecx, [ecx]
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x14]
push 0x104
lea edx, [esp + 0x28]
push edx
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x40c307
mov eax, 0x51
cmp word [esp + 0x24], ax
jne 0x40c2fa
cmp word [esp + 0x26], ax
jne 0x40c2fa
cmp word [esp + 0x28], 0x43
jne 0x40c2fa
cmp word [esp + 0x2a], 0x52
jne 0x40c2fa
cmp word [esp + 0x2c], 0x4d
jne 0x40c2fa
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x10]
push edx
push 0x20019
push 0
lea eax, [esp + 0x30]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40c2fa
lea edx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x230]
push eax
lea ecx, [esp + 0x24]
push ecx
push 0
push str.DisplayIcon
push edx
mov dword [esp + 0x34], 4
mov dword [esp + 0x30], 0x104
call edi
test eax, eax
jne 0x40c2ef
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x22c]
push eax
push ecx
call fcn.004255c9
add esp, 8
test eax, eax
jne 0x40c2ef
lea edx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x230]
push eax
lea ecx, [esp + 0x24]
push ecx
push 0
push str.DisplayName
push edx
call edi
test eax, eax
jne 0x40c2ef
push 0x104
lea eax, [esp + 0x230]
push eax
push ebp
call fcn.00424e97
lea ecx, [esp + 0x30]
push ecx
push 0x441d18
push 0x208
push 0x104
push 0x44fa40
call fcn.00425032
add esp, 0x20
mov esi, 1
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add dword [esp + 0xc], 1
test esi, esi
je 0x40c1c0
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x434]
pop edi
mov eax, esi
pop esi
pop ebp
xor ecx, esp
call fcn.00424e88
add esp, 0x42c
ret
Function at 0x40d7c0
Capabilities:
Create directory
Delete directory

Disassembly:
push 0xffffffffffffffff
push 0x43dd9b
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x44a2b8]
xor eax, esp
mov dword [esp + 0x224], eax
push esi
push edi
mov eax, dword [0x44a2b8]
xor eax, esp
push eax
lea eax, [esp + 0x234]
mov dword fs:[0], eax
xor edi, edi
push 0x206
lea eax, [esp + 0x2e]
push edi
push eax
mov word [esp + 0x34], di
call fcn.00429d70
add esp, 0xc
push edi
push 0x441b18
lea esi, [esp + 0x14]
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], edi
mov word [esp + 0x18], di
call fcn.00401d00
mov eax, 0x44f220
mov dword [esp + 0x23c], edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x40d842
sub eax, edx
sar eax, 1
push eax
push 0x44f220
lea esi, [esp + 0x14]
call fcn.00401d00
mov eax, dword [esp + 0x20]
lea esi, [eax - 1]
cmp esi, eax
jbe 0x40d870
call fcn.0042588d
cmp dword [esp + 0x24], 8
mov eax, dword [esp + 0x10]
jae 0x40d87f
lea eax, [esp + 0x10]
cmp word [eax + esi*2], 0x5c
je 0x40d896
push 1
push 0x4420e8
lea ecx, [esp + 0x14]
call fcn.0040ff40
push 0xd
push str.temp09qqtest_
lea ecx, [esp + 0x14]
call fcn.0040ff40
cmp dword [esp + 0x24], 8
mov ecx, dword [esp + 0x10]
jae 0x40d8b5
lea ecx, [esp + 0x10]
lea edx, [esp + 0x28]
lea esp, [esp]
movzx eax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
cmp ax, di
jne 0x40d8c0
push edi
lea ecx, [esp + 0x2c]
push ecx
push edi
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov esi, eax
neg esi
lea edx, [esp + 0x28]
sbb esi, esi
push edx
add esi, 1
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
cmp dword [esp + 0x24], 8
jb 0x40d906
mov eax, dword [esp + 0x10]
push eax
call fcn.004250ac
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x234]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x224]
xor ecx, esp
call fcn.00424e88
add esp, 0x234
ret
Function at 0x40dd30
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x43e13b
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x44a2b8]
xor eax, esp
mov dword [esp + 0x224], eax
push ebx
push esi
push edi
mov eax, dword [0x44a2b8]
xor eax, esp
push eax
lea eax, [esp + 0x238]
mov dword fs:[0], eax
mov edi, ecx
call fcn.0040fd60
push 1
push 0x2e
lea eax, [esp + 0x34]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x40de2e
lea eax, [esp + 0x2c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40dd91
sub eax, edx
sar eax, 1
push eax
lea ecx, [esp + 0x30]
push ecx
mov esi, edi
call fcn.00401d00
mov eax, dword [edi + 0x14]
lea esi, [eax - 1]
cmp esi, eax
jbe 0x40ddbc
call fcn.0042588d
cmp dword [edi + 0x18], 8
jb 0x40ddc7
mov eax, dword [edi + 4]
jmp 0x40ddca
lea eax, [edi + 4]
cmp word [eax + esi*2], 0x5c
je 0x40dddf
push 1
push 0x4420e8
mov ecx, edi
call fcn.0040ff40
push 0xe
push str.TencentQQCRM_
mov ecx, edi
call fcn.0040ff40
push edi
mov ebx, str.UserDataInfo.ini
lea esi, [esp + 0x14]
call fcn.004100d0
add esp, 4
push 0xffffffffffffffff
push 0
mov ecx, edi
mov dword [esp + 0x248], 0
call fcn.00401da0
cmp dword [esp + 0x28], 8
jb 0x40de29
mov edx, dword [esp + 0x14]
push edx
call fcn.004250ac
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x238]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x224]
xor ecx, esp
call fcn.00424e88
add esp, 0x234
ret
Function at 0x40e860
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x43e3b8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x44a2b8]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
push edi
mov eax, dword [0x44a2b8]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
call fcn.0040d7c0
test eax, eax
jne 0x40e8b5
push 0x10
push 0x4418d4
push ebx
mov ecx, 0x4426a0
call fcn.00407d60
add esp, 0xc
xor eax, eax
jmp 0x40e99b
cmp dword [0x44d6b8], 1
jne 0x40e8dc
push 1
xor edi, edi
call fcn.0040d930
add esp, 4
test eax, eax
jne 0x40e899
push 2
call fcn.0040d930
add esp, 4
test eax, eax
jne 0x40e899
mov eax, 0x44f428
lea edx, [eax + 2]
xor esi, esi
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x40e8e6
sub eax, edx
sar eax, 1
je 0x40e996
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], esi
mov word [esp + 0x14], si
lea ecx, [esp + 0x10]
mov dword [esp + 0x38], esi
call fcn.0040dd30
test eax, eax
jne 0x40e935
cmp dword [esp + 0x28], 8
jb 0x40e931
mov eax, dword [esp + 0x14]
push eax
call fcn.004250ac
add esp, 4
xor eax, eax
jmp 0x40e99b
cmp dword [esp + 0x28], 8
mov eax, dword [esp + 0x14]
jae 0x40e944
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x40e959
call fcn.0040e720
test eax, eax
jne 0x40e96b
push esi
mov edi, 0x44f428
call fcn.0040d930
add esp, 4
test eax, eax
je 0x40e98d
push 0x10
push 0x4418d4
push ebx
mov ecx, 0x4426e8
call fcn.00407d60
add esp, 0xc
lea esi, [esp + 0x10]
call fcn.00401cd0
xor eax, eax
jmp 0x40e99b
lea esi, [esp + 0x10]
call fcn.00401cd0
mov eax, 1
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00424e88
add esp, 0x30
ret
Function at 0x40e9c0
Capabilities:
Delete directory
Get disk information
Get disk size

Disassembly:
sub esp, 0x858
mov eax, dword [0x44a2b8]
xor eax, esp
mov dword [esp + 0x854], eax
mov eax, dword [esp + 0x85c]
push ebx
push ebp
push esi
mov dword [esp + 0x20], eax
mov eax, 0x44f428
push edi
lea edx, [eax + 2]
xor esi, esi
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x40e9f0
sub eax, edx
sar eax, 1
je 0x40ec44
push 0x44f220
push 0x44f428
call fcn.004255c9
add esp, 8
test eax, eax
je 0x40ec44
push 0x206
lea ecx, [esp + 0x46]
push esi
push ecx
mov word [esp + 0x4c], si
call fcn.00429d70
add esp, 0xc
push 0x206
lea edx, [esp + 0x24e]
push esi
push edx
mov word [esp + 0x254], si
call fcn.00429d70
add esp, 0xc
push 0x44f220
push 0x441d18
push 0x208
lea eax, [esp + 0x4c]
push 0x104
push eax
call fcn.00425032
add esp, 0x14
lea ecx, [esp + 0x40]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathStripToRootW]
lea eax, [esp + 0x40]
lea edx, [eax + 2]
jmp 0x40ea90
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x40ea90
sub eax, edx
sar eax, 1
je 0x40eaeb
cmp word [esp + eax*2 + 0x3e], 0x5c
je 0x40eac7
lea edx, [esp + 0x40]
push edx
push 0x44210c
push 0x208
push 0x104
lea eax, [esp + 0x258]
push eax
jmp 0x40eae3
lea ecx, [esp + 0x40]
push ecx
push 0x441d18
push 0x208
push 0x104
lea edx, [esp + 0x258]
push edx
call fcn.00425032
add esp, 0x14
lea eax, [esp + 0x248]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 4
je 0x40ec44
push 0x44f220
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], 0x1388
call fcn.0040d2d0
push 0x206
lea ecx, [esp + 0x456]
mov ebx, eax
mov edi, edx
push esi
push ecx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], edi
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], esi
mov dword [esp + 0x3c], esi
mov dword [esp + 0x40], esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
mov word [esp + 0x45c], si
call fcn.00429d70
add esp, 0xc
push 3
lea edx, [esp + 0x454]
push 0x44f220
push edx
call fcn.00424e97
add esp, 0xc
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x45c]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov ecx, dword [esp + 0x1c]
push 1
push esi
push esi
push ecx
call fcn.00435da0
mov ecx, dword [esp + 0x18]
xor ebp, ebp
add eax, ecx
movzx ecx, word [0x44f220]
adc edx, ebp
movzx ebp, word [0x44f018]
sub ecx, ebp
je 0x40ebc8
cmp ecx, 0xffffffe0
je 0x40ebc8
cmp ecx, 0x20
jne 0x40ebd0
sub eax, dword [0x44b224]
sbb edx, esi
cmp edx, edi
jg 0x40ec44
jl 0x40ebda
cmp eax, ebx
jae 0x40ec44
push 0x206
lea edx, [esp + 0x65e]
push esi
push edx
mov word [esp + 0x664], si
call fcn.00429d70
fild qword [esp + 0x44]
fld qword [0x445b80]
add esp, 4
lea eax, [esp + 0x660]
fmul st(1), st(0)
fmulp st(1)
fstp qword [esp]
push 0x442738
push 0x208
push 0x104
push eax
call fcn.00425032
mov ecx, dword [esp + 0x3c]
push 0x10
push 0x4418d4
push ecx
lea ecx, [esp + 0x67c]
call fcn.00407d60
add esp, 0x24
xor eax, eax
jmp 0x40ec49
mov eax, 1
mov ecx, dword [esp + 0x864]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00424e88
add esp, 0x858
ret
Function at 0x40fc70
Capabilities:
Get file version info

Disassembly:
sub esp, 8
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
xor edi, edi
push edi
push ebp
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
cmp esi, edi
je 0x40fcf1
push ebx
push esi
call fcn.0042565f
mov ebx, eax
add esp, 4
cmp ebx, edi
je 0x40fce7
push ebx
push esi
push edi
push ebp
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x40fcde
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
push ecx
push 0x4420e8
push ebx
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x40fcde
mov edx, dword [esp + 0x10]
mov eax, dword [edx + 8]
mov ecx, eax
shr ecx, 0x10
movzx edi, cl
imul edi, edi, 0x64
movzx edx, al
add edi, edx
push ebx
call fcn.0042565a
add esp, 4
pop ebx
mov eax, edi
pop edi
pop esi
pop ebp
add esp, 8
ret
mov eax, edi
pop edi
pop esi
pop ebp
add esp, 8
ret

Function at 0x4100d0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x43e108
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push edi
mov eax, dword [0x44a2b8]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov eax, dword [esp + 0x38]
xor edi, edi
push 0xffffffffffffffff
push edi
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], edi
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], edi
mov word [esp + 0x18], di
call fcn.00401da0
mov eax, ebx
mov dword [esp + 0x30], edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x410124
sub eax, edx
sar eax, 1
push eax
push ebx
lea ecx, [esp + 0x14]
call fcn.0040ff40
push 0xffffffffffffffff
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
push edi
mov ecx, esi
mov word [esi + 4], di
call fcn.00401da0
cmp dword [esp + 0x24], 8
jb 0x41016a
mov eax, dword [esp + 0x10]
push eax
call fcn.004250ac
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
add esp, 0x2c
ret
Function at 0x412b50
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x21c
mov eax, dword [0x44a2b8]
xor eax, esp
mov dword [esp + 0x218], eax
push ebx
push esi
push edi
push 0x104
lea eax, [esp + 0x1c]
mov esi, ecx
push eax
push esi
mov dword [esp + 0x20], esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
xor ebx, ebx
push esi
lea esi, [esp + 0x10]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
call fcn.00412010
add esp, 4
test eax, eax
je 0x412c48
mov edi, dword [esp + 0xc]
cmp edi, ebx
jne 0x412baa
call fcn.0042588d
mov esi, dword [esp + 0x10]
cmp esi, dword [edi + 8]
jb 0x412bb8
call fcn.0042588d
mov ebx, dword [esi]
mov edi, dword [ebx + 0x10]
add ebx, 0xc
cmp edi, dword [ebx + 8]
jbe 0x412bd0
call fcn.0042588d
lea ebx, [ebx]
mov esi, dword [ebx + 8]
cmp dword [ebx + 4], esi
jbe 0x412bdd
call fcn.0042588d
test ebx, ebx
je 0x412be5
cmp ebx, ebx
je 0x412bea
call fcn.0042588d
cmp edi, esi
je 0x412c48
test ebx, ebx
jne 0x412bf7
call fcn.0042588d
cmp edi, dword [ebx + 8]
jb 0x412c01
call fcn.0042588d
mov esi, dword [edi]
mov ecx, dword [esi]
push ecx
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
cmp eax, dword [esp + 0x22c]
jne 0x412c1b
cmp dword [esi + 0x10], 0
jne 0x412c2a
cmp edi, dword [ebx + 8]
jb 0x412c25
call fcn.0042588d
add edi, 4
jmp 0x412bd0
mov esi, dword [esi]
push esi
push esi
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
movzx edx, ax
mov eax, dword [esp + 0x18]
push edx
push 0x111
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [esp + 0x224]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00424e88
add esp, 0x21c
ret

Function at 0x413d50
Capabilities:
Set registry value

Disassembly:
sub esp, 0x210
mov eax, dword [0x44a2b8]
xor eax, esp
mov dword [esp + 0x20c], eax
lea eax, [esp]
push eax
push 0x20006
push 0
push str.SoftwareMicrosoftInternet_ExplorerMain
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x413d9a
xor eax, eax
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.00424e88
add esp, 0x210
ret
push str.http:__www.qq.com_
lea ecx, [esp + 8]
push 0x208
push ecx
call fcn.00425a49
lea eax, [esp + 0x10]
add esp, 0xc
lea edx, [eax + 2]
jmp 0x413dc0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x413dc0
mov ecx, dword [esp]
sub eax, edx
sar eax, 1
lea edx, [eax + eax]
push edx
lea eax, [esp + 8]
push eax
push 1
push 0
push str.Start_Page
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x413d83
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x20c]
xor ecx, esp
mov eax, 1
call fcn.00424e88
add esp, 0x210
ret
Function at 0x413e20
Capabilities:
Delete registry value
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x41c
mov eax, dword [0x44a2b8]
xor eax, esp
mov dword [esp + 0x418], eax
push esi
push 0x206
lea eax, [esp + 0x12]
push 0
push eax
mov dword [esp + 0x14], 0x104
mov word [esp + 0x18], 0
call fcn.00429d70
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
add esp, 0xc
lea ecx, [esp + 4]
push ecx
push 0x20006
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push closesocket
call esi
test eax, eax
jne 0x413f4d
mov ecx, dword [esp + 4]
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x10]
push eax
push 0
push 0
push str.QQCRM
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push str.QQCRM.exe
push 0x44f018
push str.__sBin_s_
push 0x208
lea edx, [esp + 0x224]
push 0x104
push edx
call fcn.00425032
lea eax, [esp + 0x22c]
push eax
lea ecx, [esp + 0x28]
push ecx
call fcn.004255c9
add esp, 0x20
test eax, eax
je 0x413f65
cmp dword [0x4514d0], 0
jne 0x413f02
test edi, edi
je 0x413f65
lea edx, [esp + 0xc]
push 0x441b18
push edx
call fcn.004255c9
add esp, 8
test eax, eax
je 0x413f65
lea eax, [esp + 0x214]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x413f10
sub eax, edx
mov edx, dword [esp + 4]
sar eax, 1
add eax, eax
push eax
lea ecx, [esp + 0x218]
push ecx
push 1
push 0
push str.QQCRM
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x413f65
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop esi
mov ecx, dword [esp + 0x418]
xor ecx, esp
call fcn.00424e88
add esp, 0x41c
ret
lea ecx, [esp + 4]
push ecx
push 0x20006
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push closesocket
call esi
test edi, edi
jne 0x413f91
mov edx, dword [esp + 4]
push 0x442df8
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x41c]
pop esi
xor ecx, esp
mov eax, 1
call fcn.00424e88
add esp, 0x41c
ret
Function at 0x413fc0
Capabilities:
Set registry value

Disassembly:
sub esp, 0x41c
mov eax, dword [0x44a2b8]
xor eax, esp
mov dword [esp + 0x418], eax
push ebp
push esi
push edi
lea edi, [esp + 0x14]
mov esi, str.YP_FOREXE_REG_PATH
call fcn.0041ba50
lea eax, [esp + 0x10]
push eax
push 0x20006
push 0
mov ecx, edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push ecx
push closesocket
call edi
test eax, eax
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
je 0x41401c
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x18]
push eax
push closesocket
call ebp
mov ecx, dword [esp + 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x1c
push str.49.48.0.2798.0
push 1
push 0
push str.version
push ecx
call esi
test eax, eax
je 0x414057
pop edi
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x418]
xor ecx, esp
call fcn.00424e88
add esp, 0x41c
ret
mov eax, 0x44f018
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x414060
sub eax, edx
sar eax, 1
lea edx, [eax + eax]
mov eax, dword [esp + 0x10]
push edx
push 0x44f018
push 1
push 0
push str.Install
push eax
call esi
test eax, eax
jne 0x41403d
mov ecx, dword [esp + 0x10]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
call ebx
push str.QQCRM.exe
push 0x44f018
push str._sBin_s
push 0x208
lea edx, [esp + 0x230]
push 0x104
push edx
call fcn.00425032
add esp, 0x18
lea eax, [esp + 0x10]
push eax
push 0x20006
push 0
push str.SoftwareTencentPlatForm_Type_List6
push closesocket
call edi
test eax, eax
je 0x4140f0
lea ecx, [esp + 0x10]
push ecx
push str.SoftwareTencentPlatForm_Type_List6
push closesocket
call ebp
mov edx, dword [esp + 0x10]
push 0xa
push str.QQCRM
push 1
push 0
push str.TypeName
push edx
call esi
test eax, eax
jne 0x414143
lea eax, [esp + 0x220]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x414115
sub eax, edx
mov edx, dword [esp + 0x10]
sar eax, 1
add eax, eax
push eax
lea ecx, [esp + 0x224]
push ecx
push 1
push 0
push str.TypePath
push edx
call esi
test eax, eax
je 0x414147
xor eax, eax
jmp 0x414153
mov eax, dword [esp + 0x10]
push eax
call ebx
mov eax, 1
mov ecx, dword [esp + 0x428]
pop ebx
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.00424e88
add esp, 0x41c
ret