joyce8/EMBER2024-capa huggingface dataset:
Function at 0x448d22
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
lea eax, [ebp - 4]
push eax
push 0x20019
xor edi, edi
push edi
push str.SOFTWAREliebao
push reloc.OLEAUT32.dll_SysReAllocString
xor ebx, ebx
mov dword [ebp - 4], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x448dab
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 8]
push eax
push edi
push str.ProgramPath
push dword [ebp - 4]
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], 0x204
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x448dab
cmp dword [ebp - 8], 1
jne 0x448dab
cmp dword [ebp - 0xc], 6
jb 0x448dab
push esi
call dword [sym.imp.MSVCR80.dll_wcslen]
movzx eax, word [esi + eax*2 - 2]
cmp ax, 0x5c
pop ecx
je 0x448da8
cmp ax, 0x2f
je 0x448da8
push 0x5115d4
push esi
call dword [sym.imp.MSVCR80.dll_wcscat]
pop ecx
pop ecx
xor ebx, ebx
inc ebx
cmp dword [ebp - 4], edi
je 0x448db9
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, ebx
pop ebx
leave
ret

Function at 0x449014
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
lea eax, [ebp - 4]
push eax
push 0x20019
xor ebx, ebx
push ebx
push str.SOFTWAREkbasesrv
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4490a7
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 8]
push eax
push ebx
push str.ProgramPath
push dword [ebp - 4]
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], 0x204
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4490a7
cmp dword [ebp - 8], 1
jne 0x4490a7
cmp dword [ebp - 0xc], 6
jb 0x4490a7
push esi
call dword [sym.imp.MSVCR80.dll_wcslen]
movzx eax, word [esi + eax*2 - 2]
cmp ax, 0x5c
pop ecx
je 0x4490a0
cmp ax, 0x2f
je 0x4490a0
push 0x5115d4
push 0x204
push esi
call dword [sym.imp.MSVCR80.dll_wcscat_s]
add esp, 0xc
mov dword [ebp - 0x10], 1
cmp dword [ebp - 4], ebx
pop ebx
je 0x4490b6
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x10]
leave
ret

Function at 0x4491d5
Capabilities:
Create thread

Disassembly:
push edi
xor edi, edi
cmp dword [esi + 0x24], edi
jne 0x449247
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateEventW]
push edi
push edi
push 1
push edi
call ebx
cmp eax, edi
mov dword [esi + 0x1c], eax
je 0x44921a
push edi
push edi
push 1
push edi
call ebx
cmp eax, edi
mov dword [esi + 0x20], eax
je 0x44921a
push edi
push edi
push esi
push 0x4493a6
push edi
push edi
call dword [sym.imp.MSVCR80.dll__beginthreadex]
add esp, 0x18
cmp eax, edi
mov dword [esi + 0x18], eax
jne 0x44923f
mov eax, dword [esi + 0x1c]
cmp eax, edi
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x44922d
push eax
call ebx
mov dword [esi + 0x1c], edi
mov eax, dword [esi + 0x20]
cmp eax, edi
je 0x44923a
push eax
call ebx
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
jmp 0x449246
mov dword [esi + 0x24], 1
pop ebx
pop edi
ret
Function at 0x44a659
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
lea eax, [ebp - 4]
push eax
push 0x20019
xor ebx, ebx
push ebx
push 0x515780
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x44a6ec
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 8]
push eax
push ebx
push str.Install_Path
push dword [ebp - 4]
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], 0x204
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x44a6ec
cmp dword [ebp - 8], 1
jne 0x44a6ec
cmp dword [ebp - 0xc], 6
jb 0x44a6ec
push esi
call dword [sym.imp.MSVCR80.dll_wcslen]
movzx eax, word [esi + eax*2 - 2]
cmp ax, 0x5c
pop ecx
je 0x44a6e5
cmp ax, 0x2f
je 0x44a6e5
push 0x5115d4
push 0x204
push esi
call dword [sym.imp.MSVCR80.dll_wcscat_s]
add esp, 0xc
mov dword [ebp - 0x10], 1
cmp dword [ebp - 4], ebx
pop ebx
je 0x44a6fb
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x10]
leave
ret

Function at 0x44a7cb
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
lea eax, [ebp - 4]
push eax
push 0x20019
xor ebx, ebx
push ebx
push str.SOFTWAREMyDriversDriverGenius
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x44a85e
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 8]
push eax
push ebx
push str.AppPath
push dword [ebp - 4]
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], 0x204
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x44a85e
cmp dword [ebp - 8], 1
jne 0x44a85e
cmp dword [ebp - 0xc], 6
jb 0x44a85e
push esi
call dword [sym.imp.MSVCR80.dll_wcslen]
movzx eax, word [esi + eax*2 - 2]
cmp ax, 0x5c
pop ecx
je 0x44a857
cmp ax, 0x2f
je 0x44a857
push 0x5115d4
push 0x204
push esi
call dword [sym.imp.MSVCR80.dll_wcscat_s]
add esp, 0xc
mov dword [ebp - 0x10], 1
cmp dword [ebp - 4], ebx
pop ebx
je 0x44a86d
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x10]
leave
ret
Function at 0x44aa41
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
lea eax, [ebp - 4]
push eax
push 0x20019
xor edi, edi
push edi
push str.SOFTWAREkingsoftAntivirus
push reloc.OLEAUT32.dll_SysReAllocString
xor ebx, ebx
mov dword [ebp - 4], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x44aaca
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 8]
push eax
push edi
push str.ProgramPath
push dword [ebp - 4]
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], 0x204
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x44aaca
cmp dword [ebp - 8], 1
jne 0x44aaca
cmp dword [ebp - 0xc], 6
jb 0x44aaca
push esi
call dword [sym.imp.MSVCR80.dll_wcslen]
movzx eax, word [esi + eax*2 - 2]
cmp ax, 0x5c
pop ecx
je 0x44aac7
cmp ax, 0x2f
je 0x44aac7
push 0x5115d4
push esi
call dword [sym.imp.MSVCR80.dll_wcscat]
pop ecx
pop ecx
xor ebx, ebx
inc ebx
cmp dword [ebp - 4], edi
je 0x44aad8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, ebx
pop ebx
leave
ret

Function at 0x44b34d
Capabilities:
Create thread

Disassembly:
push 0x18
call sub.MSVCR80.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
xor ecx, ecx
cmp eax, ecx
jne 0x44b35e
xor eax, eax
ret
mov edx, dword [esp + 4]
push ecx
push ecx
mov dword [eax], edx
mov edx, dword [esp + 0x18]
push eax
mov dword [eax + 0x10], edx
mov edx, dword [esp + 0x14]
push 0x44b38d
mov dword [eax + 8], edx
mov edx, dword [esp + 0x1c]
push ecx
push ecx
mov dword [eax + 0xc], edx
call dword [sym.imp.MSVCR80.dll__beginthreadex]
add esp, 0x18
ret
Function at 0x44b603
Capabilities:
Get file version info

Disassembly:
push ebp
lea ebp, [esp - 0x198]
sub esp, 0x218
mov eax, dword [0x5550ec]
xor eax, ebp
mov dword [ebp + 0x194], eax
mov eax, dword [ebp + 0x1a0]
push ebx
push edi
push dword [esi]
mov dword [ebp - 0x78], eax
call dword [sym.imp.MSVCR80.dll_free]
and dword [esi], 0
lea ebx, [esi + 0xc]
mov dword [esp], 0x50b288
lea edi, [esi + 8]
and dword [edi], 0
push ebx
call fcn.00402d02
push dword [ebp - 0x78]
call dword [sym.imp.MSVCR80.dll_wcslen]
test eax, eax
pop ecx
je 0x44b6ed
and dword [ebp - 0x7c], 0
push 0x103
push dword [ebp - 0x78]
lea eax, [ebp - 0x74]
push 0x104
push eax
call dword [sym.imp.MSVCR80.dll_wcsncpy_s]
add esp, 0x10
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x74]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
mov dword [ebp - 0x78], eax
je 0x44b6ed
push eax
call dword [sym.imp.MSVCR80.dll_malloc]
pop ecx
push eax
push dword [ebp - 0x78]
mov dword [esi], eax
push dword [ebp - 0x7c]
lea eax, [ebp - 0x74]
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x44b6ed
and dword [ebp - 0x80], 0
push edi
lea eax, [ebp - 0x80]
push eax
push 0x51593c
push dword [esi]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x44b6ed
cmp dword [edi], 4
jb 0x44b6ed
mov eax, dword [ebp - 0x80]
mov eax, dword [eax]
mov ecx, eax
movzx eax, ax
shr ecx, 0x10
push ecx
push eax
push str._04x_04x
mov eax, ebx
call fcn.00401a17
xor eax, eax
add esp, 0xc
inc eax
jmp 0x44b6ef
xor eax, eax
mov ecx, dword [ebp + 0x194]
pop edi
xor ecx, ebp
pop ebx
call fcn.004d6e66
add ebp, 0x198
leave
ret 4
Function at 0x44b992
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x5550ec]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 0x84], eax
xor ecx, ecx
movzx eax, byte [ecx + str.80_]
mov esi, dword [ebp + 0xc]
mov edx, eax
sar eax, 3
movsx eax, byte [eax + esi]
and edx, 7
movzx edx, word [edx*2 + 0x5551e8]
test eax, edx
setne al
mov byte [ebp + ecx - 0x74], al
inc ecx
cmp ecx, 0x38
jl 0x44b9b5
mov dword [ebp - 0x80], ebx
mov dword [ebp - 0x7c], 0x78
mov dword [ebp - 0x78], 0x7c
mov eax, dword [ebp - 0x80]
mov ecx, dword [ebp - 0x78]
mov esi, dword [ebp - 0x7c]
movzx eax, byte [eax + 0x555290]
lea ecx, [ebp + ecx - 0x104]
lea esi, [ebp + esi - 0x104]
mov dword [ecx], ebx
mov dword [esi], ebx
xor edx, edx
mov edi, eax
cmp edi, 0x1c
jge 0x44ba24
mov bl, byte [ebp + edi - 0x74]
jmp 0x44ba2b
mov bl, byte [ebp + edi - 0x90]
mov byte [ebp + edx - 0x3c], bl
inc edx
inc edi
cmp edx, 0x1c
jl 0x44ba19
push 0x1c
pop edi
add eax, edi
cmp eax, 0x38
jge 0x44ba46
mov dl, byte [ebp + eax - 0x74]
jmp 0x44ba4d
mov dl, byte [ebp + eax - 0x90]
mov byte [ebp + edi - 0x3c], dl
inc edi
inc eax
cmp edi, 0x38
jl 0x44ba3b
xor ebx, ebx
xor eax, eax
lea edx, [eax + 0x5552b8]
movzx edi, byte [edx - 0x18]
cmp byte [ebp + edi - 0x3c], bl
je 0x44ba75
mov edi, dword [eax*4 + 0x5551f8]
or dword [esi], edi
movzx edx, byte [edx]
cmp byte [ebp + edx - 0x3c], bl
je 0x44ba87
mov edx, dword [eax*4 + 0x5551f8]
or dword [ecx], edx
inc eax
cmp eax, 0x18
jl 0x44ba5c
sub dword [ebp - 0x78], 8
inc dword [ebp - 0x80]
sub dword [ebp - 0x7c], 8
cmp dword [ebp - 0x78], 0xfffffffc
jg 0x44b9f3
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 0x84]
call fcn.0044bac5
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004d6e66
leave
ret 8
Function at 0x44bb77
Capabilities:
Encode data using xor
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov ecx, dword [eax + 4]
mov eax, edx
shr eax, 4
xor eax, ecx
and eax, 0xf0f0f0f
xor ecx, eax
shl eax, 4
xor edx, eax
mov eax, edx
shr eax, 0x10
xor eax, ecx
and eax, 0xffff
xor ecx, eax
shl eax, 0x10
xor edx, eax
mov eax, ecx
shr eax, 2
xor eax, edx
and eax, 0x33333333
xor edx, eax
shl eax, 2
xor ecx, eax
mov eax, ecx
shr eax, 8
xor eax, edx
and eax, 0xff00ff
xor edx, eax
shl eax, 8
xor eax, ecx
rol eax, 1
mov ecx, eax
push ebx
xor ecx, edx
and ecx, 0xaaaaaaaa
push esi
xor eax, ecx
push edi
xor ecx, edx
rol ecx, 1
push 0x3f
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 8
pop edi
mov ecx, dword [ebp + 0xc]
mov esi, eax
ror esi, 4
xor esi, dword [ecx]
add ecx, 4
mov edx, esi
shr edx, 0x18
mov ebx, esi
shr ebx, 0x10
and ebx, edi
and edx, edi
mov edx, dword [edx*4 + 0x5552d0]
or edx, dword [ebx*4 + 0x5554d0]
mov ebx, esi
shr ebx, 8
and ebx, edi
or edx, dword [ebx*4 + 0x5556d0]
and esi, edi
or edx, dword [esi*4 + 0x5558d0]
mov esi, dword [ecx]
add ecx, 4
mov dword [ebp + 0xc], ecx
xor esi, eax
mov ecx, esi
shr ecx, 0x18
and ecx, edi
mov ecx, dword [ecx*4 + 0x5553d0]
mov ebx, esi
shr ebx, 0x10
and ebx, edi
or ecx, dword [ebx*4 + 0x5555d0]
mov ebx, esi
shr ebx, 8
and ebx, edi
or ecx, dword [ebx*4 + 0x5557d0]
and esi, edi
or ecx, dword [esi*4 + 0x5559d0]
or ecx, edx
xor dword [ebp - 4], ecx
mov esi, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
ror esi, 4
xor esi, dword [ecx]
add ecx, 4
mov edx, esi
shr edx, 0x18
mov ebx, esi
shr ebx, 0x10
and ebx, edi
and edx, edi
mov edx, dword [edx*4 + 0x5552d0]
or edx, dword [ebx*4 + 0x5554d0]
mov ebx, esi
shr ebx, 8
and ebx, edi
or edx, dword [ebx*4 + 0x5556d0]
and esi, edi
or edx, dword [esi*4 + 0x5558d0]
mov esi, dword [ecx]
xor esi, dword [ebp - 4]
add ecx, 4
mov dword [ebp + 0xc], ecx
mov ecx, esi
shr ecx, 0x18
and ecx, edi
mov ecx, dword [ecx*4 + 0x5553d0]
mov ebx, esi
shr ebx, 0x10
and ebx, edi
or ecx, dword [ebx*4 + 0x5555d0]
mov ebx, esi
shr ebx, 8
and ebx, edi
or ecx, dword [ebx*4 + 0x5557d0]
and esi, edi
or ecx, dword [esi*4 + 0x5559d0]
or ecx, edx
xor eax, ecx
dec dword [ebp - 8]
jne 0x44bbf2
ror eax, 1
mov edx, eax
xor edx, dword [ebp - 4]
pop edi
and edx, 0xaaaaaaaa
xor eax, edx
xor edx, dword [ebp - 4]
ror edx, 1
mov ecx, edx
shr ecx, 8
xor ecx, eax
and ecx, 0xff00ff
xor eax, ecx
shl ecx, 8
xor edx, ecx
mov ecx, edx
shr ecx, 2
xor ecx, eax
and ecx, 0x33333333
xor eax, ecx
shl ecx, 2
xor edx, ecx
mov ecx, eax
shr ecx, 0x10
xor ecx, edx
and ecx, 0xffff
xor edx, ecx
shl ecx, 0x10
xor eax, ecx
mov ecx, eax
shr ecx, 4
xor ecx, edx
and ecx, 0xf0f0f0f
mov esi, ecx
shl esi, 4
xor esi, eax
mov eax, dword [ebp + 8]
mov dword [eax], esi
xor ecx, edx
pop esi
mov dword [eax + 4], ecx
pop ebx
leave
ret 8
Function at 0x44bda0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
push ebx
push esi
mov esi, eax
mov eax, dword [ebp + 0x10]
mov ebx, dword [eax]
push edi
lea edi, [ebx + 1]
cmp edi, dword [esi + 0xc]
jbe 0x44be0b
push edi
call fcn.004d64b6
test eax, eax
pop ecx
mov dword [ebp - 8], eax
jne 0x44bddc
push dword [esi + 4]
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
and dword [esi + 4], 0
and dword [esi + 0xc], 0
pop ecx
jmp 0x44be0b
mov eax, dword [esi + 4]
test eax, eax
je 0x44be02
push dword [esi + 0xc]
push eax
push dword [ebp - 8]
call sub.MSVCR80.dll_memcpy
push dword [esi + 4]
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
and dword [esi + 4], 0
add esp, 0x10
and dword [esi + 0xc], 0
mov eax, dword [ebp - 8]
mov dword [esi + 4], eax
mov dword [esi + 0xc], edi
xor ecx, ecx
cmp dword [esi + 0xc], ecx
ja 0x44be1e
mov eax, dword [ebp + 0x10]
mov dword [eax], ecx
xor eax, eax
jmp 0x44beeb
mov esi, dword [esi + 4]
mov eax, ebx
cdq
and edx, 7
add eax, edx
mov edi, eax
sar edi, 3
shl edi, 3
mov dword [ebp - 0xc], esi
jne 0x44be43
mov eax, dword [ebp + 0x10]
mov dword [eax], ecx
mov byte [esi], 0
jmp 0x44bee9
push edi
push dword [ebp + 0xc]
push esi
call sub.MSVCR80.dll_memcpy
mov eax, edi
cdq
and edx, 7
add eax, edx
mov ebx, eax
sar ebx, 3
add esp, 0xc
dec ebx
mov byte [esi + edi], 0
js 0x44bec7
lea eax, [esi + ebx*8]
mov dword [ebp + 0xc], eax
test ebx, ebx
jle 0x44be79
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff8
mov dword [ebp - 8], eax
jmp 0x44be80
mov dword [ebp - 8], 0x555ad0
cmp dword [ebp + 0xc], 0
je 0x44bea9
push dword [ebp + 8]
lea eax, [ebp - 0x8c]
push eax
call fcn.0044b992
lea eax, [ebp - 0x8c]
push eax
mov eax, dword [ebp + 0xc]
mov esi, eax
call fcn.0044b913
mov esi, dword [ebp - 0xc]
xor eax, eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 8]
mov dl, byte [eax + edx]
add ecx, eax
xor byte [ecx], dl
inc eax
cmp eax, 8
jl 0x44beab
sub dword [ebp + 0xc], 8
dec ebx
test ebx, ebx
jge 0x44be6c
mov ecx, dword [ebp + 0x10]
mov dword [ecx], edi
mov dl, byte [esi + edi - 1]
movzx edx, dl
lea eax, [edi - 1]
sub edi, edx
jmp 0x44bee3
test eax, eax
jl 0x44bee7
mov byte [eax + esi], 0
dec eax
cmp eax, edi
jge 0x44beda
sub dword [ecx], edx
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x44d90f
Capabilities:
Get common file path
Get startup folder

Disassembly:
push 4
mov eax, 0x4f18d2
call fcn.004d766c
mov eax, dword [0x55a320]
mov ecx, 0x55a320
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
xor edi, edi
push 0x104
lea esi, [ebp - 0x10]
mov dword [ebp - 4], edi
call fcn.00401918
mov ebx, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push eax
push edi
push edi
push 0x19
push edi
call ebx
cmp dword [ebp - 0x10], edi
jne 0x44d957
xor eax, eax
jmp 0x44d961
push dword [ebp - 0x10]
call dword [sym.imp.MSVCR80.dll_wcslen]
pop ecx
lea edx, [ebp - 0x10]
call fcn.00401385
mov edi, dword [ebp + 8]
add edi, 0x18
lea eax, [ebp - 0x10]
call fcn.00402a4c
push 0x104
lea esi, [ebp - 0x10]
call fcn.00401918
push eax
xor edi, edi
push edi
push edi
push 0x10
push edi
call ebx
mov esi, dword [ebp - 0x10]
cmp esi, edi
jne 0x44d999
xor eax, eax
jmp 0x44d9a1
push esi
call dword [sym.imp.MSVCR80.dll_wcslen]
pop ecx
lea edx, [ebp - 0x10]
call fcn.00401385
mov edi, dword [ebp + 8]
add edi, 0x1c
lea eax, [ebp - 0x10]
call fcn.00402a4c
lea eax, [esi - 0x10]
call fcn.004012f9
call fcn.004d7744
ret 4
Function at 0x4503ba
Capabilities:
Parse credit card information

Disassembly:
push 0x1c
mov eax, 0x4edb0c
call fcn.004d766c
xor edx, edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x24], vtable.CBufferT_wchar_t_.0
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x18], edx
xor ebx, ebx
mov dword [ebp - 4], edx
inc ebx
mov edi, dword [ebp + 8]
cmp word [edi + 0xa8], dx
jne 0x4503f9
cmp dword [edi + 0xac], ebx
je 0x4505a2
mov eax, dword [edi + 0xac]
cmp eax, edx
jne 0x450467
cmp word [edi + 0xb8], 0x7b
jne 0x450419
cmp dword [edi + 0xbc], ebx
je 0x45057e
cmp word [edi + 0xb8], 0x3f
jne 0x45042f
cmp dword [edi + 0xbc], ebx
je 0x45057e
cmp word [edi + 0xb8], 0x2a
jne 0x450445
cmp dword [edi + 0xbc], ebx
je 0x45057e
cmp word [edi + 0xb8], 0x2b
jne 0x45045b
cmp dword [edi + 0xbc], ebx
je 0x45057e
movzx eax, word [edi + 0xa8]
jmp 0x450561
cmp eax, ebx
jne 0x4503e1
movzx ecx, word [edi + 0xa8]
movzx eax, cx
cmp ax, 0x29
je 0x4505a2
cmp ax, 0x7c
je 0x4505a2
cmp dword [ebp - 0x1c], edx
jg 0x4505ab
cmp ax, 0x28
je 0x4505df
cmp ax, 0x5b
je 0x450614
cmp ax, 0x2e
je 0x450614
cmp ax, 0x77
je 0x450614
cmp ax, 0x57
je 0x450614
cmp ax, 0x73
je 0x450614
cmp ax, 0x53
je 0x450614
cmp ax, 0x64
je 0x450614
cmp ax, 0x44
je 0x450614
cmp ax, 0x5e
je 0x450607
cmp ax, 0x24
je 0x450607
cmp ax, 0x41
je 0x450607
cmp ax, 0x5a
je 0x450607
cmp ax, 0x7a
je 0x450607
cmp ax, 0x62
je 0x450607
cmp ax, 0x42
je 0x450607
cmp ax, 0x47
je 0x450607
cmp ax, 0x5c
je 0x4505fd
cmp ax, 0x6b
je 0x4505fd
cmp ax, 0x67
je 0x4505fd
movzx eax, cx
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea esi, [ebp - 0x24]
call fcn.00451ff1
mov eax, edi
call fcn.0044eef7
xor edx, edx
jmp 0x4503e1
cmp dword [ebp - 0x1c], edx
jne 0x4505a5
movzx eax, word [edi + 0xa8]
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
lea esi, [ebp - 0x24]
call fcn.00451ff1
mov eax, edi
call fcn.0044eef7
xor edx, edx
cmp dword [ebp - 0x1c], edx
jle 0x45062c
push 0x20
call sub.MSVCR80.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
test esi, esi
pop ecx
je 0x450620
mov ecx, dword [ebp - 0x18]
test ecx, ecx
jne 0x4505c5
mov ecx, 0x5160f0
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov edx, eax
and edx, 8
push edx
and eax, 0x10
push eax
mov eax, dword [ebp - 0x1c]
push ecx
call fcn.00451b1f
jmp 0x450622
push dword [ebp + 0xc]
mov ecx, edi
call fcn.00450d1f
lea ecx, [ebp - 0x24]
mov esi, eax
call fcn.0044e354
mov eax, esi
call fcn.004d7744
ret 8
push dword [ebp + 0xc]
call fcn.004518b1
jmp 0x4505e9
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
call fcn.0045174d
jmp 0x4505e9
push dword [ebp + 0xc]
mov ecx, edi
call fcn.00450828
jmp 0x4505e9
xor eax, eax
push eax
mov eax, edi
call fcn.0044fd0c
jmp 0x4505e9
xor eax, eax
mov ecx, edi
call fcn.0044fa48
jmp 0x4505e9
Function at 0x45271a
Capabilities:
Check if file exists

Disassembly:
push 8
mov eax, 0x4f62b8
call fcn.004d766c
mov eax, dword [0x55a320]
mov ecx, 0x55a320
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
lea edi, [ebp - 0x10]
call fcn.0045279f
test eax, eax
mov edi, dword [ebp - 0x10]
je 0x45278f
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push edi
call esi
test eax, eax
je 0x45278f
lea eax, [ebp - 0x14]
push str.QQPCTray.exe
push eax
lea ecx, [ebp - 0x10]
call fcn.004065f0
pop ecx
pop ecx
push dword [eax]
call esi
mov esi, eax
mov eax, dword [ebp - 0x14]
neg esi
sbb esi, esi
add eax, 0xfffffff0
neg esi
call fcn.004012f9
lea eax, [edi - 0x10]
call fcn.004012f9
mov eax, esi
jmp 0x452799
lea eax, [edi - 0x10]
call fcn.004012f9
xor eax, eax
call fcn.004d7744
ret

Function at 0x45279f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x198]
sub esp, 0x218
mov eax, dword [0x5550ec]
xor eax, ebp
mov dword [ebp + 0x194], eax
push esi
lea eax, [ebp - 0x78]
push eax
push 0x20219
xor esi, esi
push esi
push str.SOFTWARETencentQQPCMgr
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x78], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x45287e
push 0x206
lea eax, [ebp - 0x72]
push esi
push eax
mov dword [ebp - 0x80], esi
mov word [ebp - 0x74], si
call sub.MSVCR80.dll_memset
add esp, 0xc
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x80]
push eax
push esi
push str.InstallDir
push dword [ebp - 0x78]
mov dword [ebp - 0x7c], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x452875
cmp dword [ebp - 0x80], 1
jne 0x452875
cmp dword [ebp - 0x7c], 2
jb 0x452875
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x7c]
shr eax, 1
mov word [ebp + eax*2 - 0x74], si
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.MSVCR80.dll_wcslen]
cmp eax, 1
pop ecx
jb 0x452866
lea eax, [ebp + eax*2 - 0x76]
movzx ecx, word [eax]
cmp cx, 0x5c
je 0x452863
cmp cx, 0x2f
jne 0x452866
mov word [eax], si
lea eax, [ebp - 0x74]
push eax
push edi
call fcn.00402d02
xor eax, eax
inc eax
jmp 0x452880
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp + 0x194]
xor ecx, ebp
pop esi
call fcn.004d6e66
add ebp, 0x198
leave
ret
Function at 0x45295e
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor ebx, ebx
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
cmp eax, ebx
mov dword [edi + 0x60], eax
jne 0x4529d6
cmp dword [0x55ac14], ebx
je 0x4529cf
push str.init_failure__because__create_event_failure
push 0x511610
push str.KCmppGlobalMonitor::Init
push 0x5115dc
lea eax, [ebp - 4]
push eax
push 0x5115d8
mov dword [ebp - 4], 0x1e
call fcn.004022da
call fcn.00402322
call fcn.00423ea4
call fcn.00402322
call fcn.00402322
call fcn.00402322
call fcn.00402322
mov esi, eax
call fcn.0040234b
xor eax, eax
jmp 0x452a5a
push ebx
push ebx
push edi
push 0x452b96
push ebx
push ebx
call dword [sym.imp.MSVCR80.dll__beginthreadex]
add esp, 0x18
cmp eax, ebx
mov dword [edi + 0x5c], eax
jne 0x452a57
cmp dword [0x55ac14], ebx
je 0x452a46
push str.init_failure__because__create_thread_failure
push 0x511610
push str.KCmppGlobalMonitor::Init
push 0x5115dc
lea eax, [ebp - 4]
push eax
push 0x5115d8
mov dword [ebp - 4], 0x26
call fcn.004022da
call fcn.00402322
call fcn.00423ea4
call fcn.00402322
call fcn.00402322
call fcn.00402322
call fcn.00402322
mov esi, eax
call fcn.0040234b
push dword [edi + 0x60]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 0x60], ebx
jmp 0x4529cf
xor eax, eax
inc eax
pop esi
pop ebx
leave
ret