joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41acf0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x628
mov eax, dword [0x44a2b8]
xor eax, esp
mov dword [esp + 0x624], eax
push 0x40e
lea eax, [esp + 0x21a]
push 0
push eax
mov word [esp + 0x220], 0
call fcn.00429d70
push 0x206
lea ecx, [esp + 0x1e]
push 0
push ecx
mov dword [esp + 0x1c], 4
mov dword [esp + 0x20], 0x104
mov word [esp + 0x24], 0
call fcn.00429d70
push 0x441b18
push 0x44fa40
call fcn.004255c9
add esp, 0x20
test eax, eax
je 0x41ae06
push esi
push str.Components
push 0x44fa40
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall
push str._s_s_s_s
push 0x410
lea edx, [esp + 0x22c]
push 0x208
push edx
call fcn.00425032
add esp, 0x20
lea eax, [esp]
push eax
push 0x20019
push 0
lea ecx, [esp + 0x220]
push ecx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41ae06
lea edx, [esp + 8]
push edx
mov edx, dword [esp + 4]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0xc]
push ecx
push 0
push str.Installed
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41ae06
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0xc]
push ecx
call fcn.00425664
add esp, 4
mov ecx, dword [esp + 0x624]
xor ecx, esp
call fcn.00424e88
add esp, 0x628
ret
mov ecx, dword [esp + 0x624]
xor ecx, esp
xor eax, eax
call fcn.00424e88
add esp, 0x628
ret

Function at 0x41ae20
Capabilities:
Set registry value

Disassembly:
sub esp, 0x828
mov eax, dword [0x44a2b8]
xor eax, esp
mov dword [esp + 0x824], eax
push 0x40e
lea eax, [esp + 0xa]
push 0
push eax
mov word [esp + 0x10], 0
call fcn.00429d70
push 0x40e
lea ecx, [esp + 0x426]
push 0
push ecx
mov word [esp + 0x42c], 0
call fcn.00429d70
push 0x441b18
push 0x44fa40
call fcn.004255c9
add esp, 0x20
test eax, eax
je 0x41af48
push 0
push 0x44361c
push 0x410
lea edx, [esp + 0x420]
push 0x208
push edx
call fcn.00425032
push esi
push str.Components
push 0x44fa40
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall
push str._s_s_s_s
push 0x410
lea eax, [esp + 0x30]
push 0x208
push eax
call fcn.00425032
add esp, 0x34
lea ecx, [esp]
push ecx
push 0x20006
push 0
lea edx, [esp + 0x10]
push edx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x41af01
lea eax, [esp]
push eax
lea ecx, [esp + 8]
push ecx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
lea eax, [esp + 0x414]
lea edx, [eax + 2]
jmp 0x41af10
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41af10
mov ecx, dword [esp]
sub eax, edx
sar eax, 1
lea edx, [eax + eax]
push edx
lea eax, [esp + 0x418]
push eax
push 1
push 0
push str.Installed
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x824]
xor ecx, esp
call fcn.00424e88
add esp, 0x828
ret
Function at 0x41afd0
Capabilities:
Delete file

Disassembly:
mov eax, 0x104c
call fcn.00436370
mov eax, dword [0x44a2b8]
xor eax, esp
mov dword [esp + 0x1044], eax
push esi
push edi
xor esi, esi
push 0x40e
lea eax, [esp + 0x82e]
push esi
push eax
mov word [esp + 0x834], si
call fcn.00429d70
add esp, 0xc
push 0x40e
lea ecx, [esp + 0xc3e]
push esi
push ecx
mov word [esp + 0xc44], si
call fcn.00429d70
add esp, 0xc
push 0x40e
lea edx, [esp + 0x41e]
push esi
push edx
mov word [esp + 0x424], si
call fcn.00429d70
add esp, 0xc
push 0x40e
lea eax, [esp + 0xe]
push esi
push eax
mov word [esp + 0x14], si
call fcn.00429d70
add esp, 0xc
push ebx
push str._suninst.exe
push 0x410
lea ecx, [esp + 0x834]
push 0x208
push ecx
call fcn.00425032
add esp, 0x14
lea edx, [esp + 0x828]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x44fa40
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall
push 0x441ab4
push 0x410
lea eax, [esp + 0xc48]
push 0x208
push eax
call fcn.00425032
lea ecx, [esp + 0xc50]
push ecx
push closesocket
call fcn.004191b0
mov edi, 0x444c38
mov esi, 0x444964
call fcn.0041d9d0
mov edi, 0x444c50
mov esi, str.CN_vAx
call fcn.0041d9d0
lea edx, [esp + 0x438]
push edx
mov ecx, ebx
call fcn.00424360
add esp, 0x24
lea eax, [esp + 0x418]
push 0x441b18
push eax
call fcn.004255c9
add esp, 8
test eax, eax
je 0x41b147
lea esi, [esp + 0x418]
call fcn.0041b9a0
lea ecx, [esp + 8]
push ecx
mov ecx, ebx
call fcn.004245d0
add esp, 4
lea edx, [esp + 8]
push 0x441b18
push edx
call fcn.004255c9
add esp, 8
test eax, eax
je 0x41b147
lea esi, [esp + 8]
call fcn.0041b9a0
push ebx
mov ecx, str..tmp
call fcn.00419320
mov ecx, dword [esp + 0x1050]
add esp, 4
pop edi
pop esi
xor ecx, esp
call fcn.00424e88
add esp, 0x104c
ret

Function at 0x41b170
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x420
mov eax, dword [0x44a2b8]
xor eax, esp
mov dword [esp + 0x41c], eax
push 0x40e
lea eax, [esp + 0x12]
push 0
push eax
mov dword [esp + 0x14], 4
mov dword [esp + 0x10], 0x104
mov word [esp + 0x18], 0
call fcn.00429d70
add esp, 0xc
lea ecx, [esp]
push ecx
push 0x20019
push 0
push str.SOFTWARETencentQQMusic
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41b266
lea edx, [esp + 4]
push edx
mov edx, dword [esp + 4]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ecx
push 0
push str.Install
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41b25c
lea eax, [esp + 0xc]
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41b200
sub eax, edx
sar eax, 1
je 0x41b25c
movzx ecx, word [esp + eax*2 + 0xa]
cmp cx, 0x5c
lea eax, [esp + eax*2 + 0xa]
je 0x41b226
cmp cx, 0x2f
jne 0x41b22b
mov word [eax], 0
lea eax, [esp + 0xc]
push esi
push eax
call fcn.004255c9
add esp, 8
test eax, eax
jne 0x41b25c
mov eax, 1
mov dword [0x45150c], eax
mov ecx, dword [esp + 0x41c]
xor ecx, esp
call fcn.00424e88
add esp, 0x420
ret
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x41c]
xor ecx, esp
xor eax, eax
call fcn.00424e88
add esp, 0x420
ret
Function at 0x41b5a0
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
sub esp, 0x420
mov eax, dword [0x44a2b8]
xor eax, esp
mov dword [esp + 0x41c], eax
push 0x206
lea eax, [esp + 0x12]
push 0
push eax
mov word [esp + 0x18], 0
call fcn.00429d70
push str.QQCRM.exe
push 0x44f018
push str._sBin_s
push 0x208
lea ecx, [esp + 0x28]
push 0x104
push ecx
call fcn.00425032
add esp, 0x24
lea edx, [esp]
push edx
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsShellNoRoamMUICache
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x41b628
xor eax, eax
mov ecx, dword [esp + 0x41c]
xor ecx, esp
call fcn.00424e88
add esp, 0x420
ret
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x218]
push ecx
mov ecx, dword [esp + 8]
lea edx, [esp + 0xc]
push edx
push 0
lea eax, [esp + 0x1c]
push eax
push ecx
mov dword [esp + 0x1c], 4
mov dword [esp + 0x20], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41b688
lea edx, [esp + 0x214]
push edx
push str.Bizqq
call fcn.004255c9
add esp, 8
test eax, eax
jne 0x41b688
mov ecx, dword [esp]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x41c]
xor ecx, esp
mov eax, 1
call fcn.00424e88
add esp, 0x420
ret
Function at 0x41b6b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x214
mov eax, dword [0x44a2b8]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
push edi
push 0x208
push 0
push 0x44f018
call fcn.00429d70
mov ebx, 0x104
mov eax, 0x44f018
add esp, 0xc
mov dword [esp + 8], ebx
lea edx, [eax + 2]
jmp 0x41b6f0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41b6f0
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
sub eax, edx
sar eax, 1
jne 0x41b7ae
push esi
lea esi, [esp + 0xc]
mov dword [esp + 0xc], ebx
call fcn.0041bd80
mov eax, 0x44f018
lea edx, [eax + 2]
pop esi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41b722
sub eax, edx
sar eax, 1
je 0x41b777
push 0x206
lea eax, [esp + 0x16]
push 0
push eax
mov word [esp + 0x1c], cx
call fcn.00429d70
push str.QQCRM.exe
push 0x44f018
push str._sBin_s
push 0x208
lea ecx, [esp + 0x2c]
push ebx
push ecx
call fcn.00425032
add esp, 0x24
lea edx, [esp + 0x10]
push edx
call edi
cmp eax, 0xffffffff
jne 0x41b791
push 0x441b18
push 0x208
push ebx
push 0x44f428
call fcn.00425032
add esp, 0x10
jmp 0x41b7ae
push 0x44f018
push 0x442658
push 0x208
push ebx
push 0x44f428
call fcn.00425032
add esp, 0x14
mov eax, 0x44f018
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41b7b6
sub eax, edx
sar eax, 1
jne 0x41b8a1
lea eax, [esp + 8]
mov dword [esp + 8], ebx
push eax
mov ebx, 0x44f018
call fcn.0041be90
mov eax, ebx
add esp, 4
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41b7e6
sub eax, edx
sar eax, 1
jne 0x41b818
push 0x441b18
push 0x208
push 0x104
push 0x44f428
call fcn.00425032
add esp, 0x10
jmp 0x41b8a1
push 0x206
lea ecx, [esp + 0x16]
push 0
push ecx
mov word [esp + 0x1c], 0
call fcn.00429d70
push str.QQCRM.exe
push 0x44f018
push str._sBin_s
push 0x208
lea edx, [esp + 0x2c]
push 0x104
push edx
call fcn.00425032
add esp, 0x24
lea eax, [esp + 0x10]
push eax
call edi
cmp eax, 0xffffffff
jne 0x41b880
push 0x441b18
push 0x208
push 0x104
push 0x44f428
call fcn.00425032
add esp, 0x10
jmp 0x41b8a1
push 0x44f018
push 0x442658
push 0x208
push 0x104
push 0x44f428
call fcn.00425032
add esp, 0x14
mov eax, 0x44f018
pop edi
lea edx, [eax + 2]
pop ebx
jmp 0x41b8b0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41b8b0
sub eax, edx
sar eax, 1
jne 0x41b8d5
lea ecx, [esp]
push ecx
mov dword [esp + 4], 0x104
call fcn.0041c170
add esp, 4
call fcn.0041b5a0
mov ecx, dword [esp + 0x210]
xor ecx, esp
mov eax, 1
call fcn.00424e88
add esp, 0x214
ret
Function at 0x41b900
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x60
push esi
push 0x44
lea eax, [esp + 0x1c]
push 0
push eax
call fcn.00429d70
add esp, 0xc
mov eax, 1
mov dword [esp + 0x44], eax
mov word [esp + 0x48], ax
xor eax, eax
lea ecx, [esp + 8]
push ecx
mov ecx, dword [esp + 0x70]
lea edx, [esp + 0x1c]
push edx
mov edx, dword [esp + 0x70]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x78]
push eax
push 0
push 0
push 0
push 0
push 0
push ecx
push edx
mov dword [esp + 0x40], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x41b992
cmp dword [esp + 0x74], 0
je 0x41b97e
mov eax, dword [esp + 8]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [esp + 0xc]
push edx
call esi
pop esi
add esp, 0x60
ret

Function at 0x41b9a0
Capabilities:
Delete file
Move file

Disassembly:
sub esp, 0x22c
mov eax, dword [0x44a2b8]
xor eax, esp
mov dword [esp + 0x228], eax
push 0x208
lea eax, [esp + 0x24]
push 0
push eax
call fcn.00429d70
push 0
push esi
push str._s_c
push 0x208
lea ecx, [esp + 0x3c]
push 0x104
push ecx
call fcn.00425032
xor eax, eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov word [esp + 0x40], ax
mov dword [esp + 0x24], eax
add esp, 0x24
lea eax, [esp]
lea edx, [esp + 0x20]
push eax
mov dword [esp + 8], 3
mov word [esp + 0x14], 0x14
mov dword [esp + 0xc], edx
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ecx, dword [esp + 0x228]
neg eax
sbb eax, eax
xor ecx, esp
add eax, 1
call fcn.00424e88
add esp, 0x22c
ret
Function at 0x41ba50
Capabilities:
Reference sql statements

Disassembly:
sub esp, 0x424
mov eax, dword [0x44a2b8]
xor eax, esp
mov dword [esp + 0x420], eax
push str.QQCRM2.msi
push 0x44cb80
push 0x441ab4
push 0x208
lea eax, [esp + 0x20]
push 0x104
push eax
call fcn.00425032
add esp, 0x18
lea ecx, [esp + 4]
push ecx
push 0
lea edx, [esp + 0x18]
push edx
call sub.Msi.dll_MsiOpenProductW
test eax, eax
jne 0x41bb62
push esi
push str.SELECT_Value_FROM_Property_WHERE_Property_s
push 0x208
lea eax, [esp + 0x224]
push 0x104
push eax
call fcn.00425032
mov eax, dword [esp + 0x18]
add esp, 0x14
lea ecx, [esp]
push ecx
lea edx, [esp + 0x21c]
push edx
push eax
call sub.Msi.dll_MsiEnumClientsA
test eax, eax
jne 0x41bb58
mov edx, dword [esp]
push eax
push edx
call sub.Msi.dll_MsiViewModify
test eax, eax
mov eax, dword [esp]
jne 0x41bb52
lea edx, [esp + 8]
push edx
push eax
call sub.Msi.dll_MsiDatabaseIsTablePersistentA
test eax, eax
je 0x41bb27
mov ecx, dword [esp]
push ecx
call sub.Msi.dll_MsiConfigureFeatureFromDescriptorA
mov edx, dword [esp + 4]
push edx
call sub.Msi.dll_MsiConfigureFeatureFromDescriptorA
xor eax, eax
mov ecx, dword [esp + 0x420]
xor ecx, esp
call fcn.00424e88
add esp, 0x424
ret
mov ecx, dword [esp + 8]
lea eax, [esp + 0xc]
push eax
push edi
push 1
push ecx
mov dword [esp + 0x1c], 0x104
call sub.Msi.dll_MsiRecordSetStreamA
test eax, eax
mov edx, dword [esp + 8]
push edx
je 0x41bb79
call sub.Msi.dll_MsiConfigureFeatureFromDescriptorA
mov eax, dword [esp]
push eax
call sub.Msi.dll_MsiConfigureFeatureFromDescriptorA
mov ecx, dword [esp + 4]
push ecx
call sub.Msi.dll_MsiConfigureFeatureFromDescriptorA
xor eax, eax
mov ecx, dword [esp + 0x420]
xor ecx, esp
call fcn.00424e88
add esp, 0x424
ret
call sub.Msi.dll_MsiConfigureFeatureFromDescriptorA
mov eax, dword [esp]
push eax
call sub.Msi.dll_MsiConfigureFeatureFromDescriptorA
mov ecx, dword [esp + 4]
push ecx
call sub.Msi.dll_MsiConfigureFeatureFromDescriptorA
mov ecx, dword [esp + 0x420]
xor ecx, esp
mov eax, 1
call fcn.00424e88
add esp, 0x424
ret

Function at 0x41bbb0
Capabilities:
Delete registry key

Disassembly:
push ecx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push str.test_qq_
push closesocket
call edi
lea eax, [esp + 8]
push eax
push str.test_qq_
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov esi, eax
neg esi
push str.test_qq_
sbb esi, esi
push closesocket
add esi, 1
call edi
pop edi
mov eax, esi
pop esi
pop ecx
ret
Function at 0x41bc60
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x41c
mov eax, dword [0x44a2b8]
xor eax, esp
mov dword [esp + 0x418], eax
push esi
push edi
push 0x618
push 0
push ebx
call fcn.00429d70
add esp, 0xc
lea edi, [esp + 0x10]
mov esi, str.ProductCode
call fcn.0041ba50
lea eax, [esp + 8]
push eax
lea ecx, [ebx + 0x208]
push ecx
push str.Language
mov edx, edi
push edx
mov dword [esp + 0x18], 0x104
call sub.Msi.dll_MsiGetPropertyW
test eax, eax
je 0x41bcd2
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x418]
xor ecx, esp
call fcn.00424e88
add esp, 0x41c
ret
lea eax, [esp + 8]
push eax
lea ecx, [ebx + 0x410]
push ecx
push str.ProductName
lea edx, [esp + 0x1c]
push edx
mov dword [esp + 0x18], 0x104
call sub.Msi.dll_MsiGetPropertyW
test eax, eax
jne 0x41bcb9
lea edi, [esp + 0x218]
mov esi, str.YP_FOREXE_REG_PATH
call fcn.0041ba50
lea eax, [esp + 0xc]
push eax
push 0x20019
push 0
mov ecx, edi
push ecx
push closesocket
mov dword [esp + 0x1c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41bd57
lea edx, [esp + 8]
push edx
push ebx
push eax
push eax
mov eax, dword [esp + 0x1c]
push str.version
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x41bd57
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x420]
pop edi
pop esi
xor ecx, esp
mov eax, 1
call fcn.00424e88
add esp, 0x41c
ret

Function at 0x41bd80
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x214
mov eax, dword [0x44a2b8]
xor eax, esp
mov dword [esp + 0x210], eax
lea eax, [esp]
push eax
push 0x20019
push 0
push str.SoftwareTencentQQCRM
push closesocket
mov dword [esp + 0x18], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x41bdd2
xor eax, eax
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.00424e88
add esp, 0x214
ret
mov edx, dword [esp]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
push 0x44f018
lea ecx, [esp + 0x10]
push ecx
push 0
push str.Install
push edx
call edi
test eax, eax
mov eax, dword [esp + 4]
je 0x41be18
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.00424e88
add esp, 0x214
ret
push esi
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x10]
push edx
push 0
push str.version
push eax
call edi
test eax, eax
je 0x41be5e
mov ecx, dword [esp + 4]
push ecx
mov dword [0x44f018], 0
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.00424e88
add esp, 0x214
ret
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x214]
pop edi
xor ecx, esp
mov eax, 1
call fcn.00424e88
add esp, 0x214
ret
Function at 0x41bef0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x214
mov eax, dword [0x44a2b8]
xor eax, esp
mov dword [esp + 0x210], eax
lea eax, [esp]
push eax
push 0x20019
push 0
push str.SoftwareTencentQQCRM
push closesocket
mov dword [esp + 0x18], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41bf54
mov edx, dword [esp]
push esi
push 0x44e158
lea ecx, [esp + 0xc]
push ecx
push eax
push str.Install
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x41bf6b
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.00424e88
add esp, 0x214
ret
mov eax, 0x44e158
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41bf73
sub eax, edx
sar eax, 1
je 0x41bfa2
movzx ecx, word [eax*2 + 0x44e156]
cmp cx, 0x5c
je 0x41bf98
cmp cx, 0x2f
jne 0x41bfa2
mov word [eax*2 + 0x44e156], 0
push 0x206
lea ecx, [esp + 0xe]
push 0
push ecx
mov word [esp + 0x14], 0
call fcn.00429d70
push str.QQCRM.exe
push 0x44e158
push 0x441ab4
push 0x208
lea edx, [esp + 0x24]
push 0x104
push edx
call fcn.00425032
lea eax, [esp + 0x2c]
push eax
push ebx
call fcn.0040c150
mov ecx, dword [esp + 0x2c]
add esp, 0x2c
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x210]
xor ecx, esp
mov eax, 1
call fcn.00424e88
add esp, 0x214
ret

Function at 0x41c010
Capabilities:
Get common file path
Get program files directory

Disassembly:
sub esp, 0x418
mov eax, dword [0x44a2b8]
xor eax, esp
mov dword [esp + 0x414], eax
push esi
xor esi, esi
push 0x206
lea eax, [esp + 0xe]
push esi
push eax
mov word [esp + 0x14], si
call fcn.00429d70
push 0x206
lea ecx, [esp + 0x222]
push esi
push ecx
mov word [esp + 0x228], si
call fcn.00429d70
add esp, 0x18
lea edx, [esp + 4]
push edx
push 0x26
push esi
mov dword [esp + 0x10], esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov ecx, dword [esp + 4]
lea eax, [esp + 8]
push eax
push ecx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
lea eax, [esp + 8]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x41c083
sub eax, edx
sar eax, 1
je 0x41c0aa
lea ecx, [esp + eax*2 + 6]
movzx eax, word [ecx]
cmp ax, 0x5c
je 0x41c0a7
cmp ax, 0x2f
jne 0x41c0aa
mov word [ecx], si
push str.QQCRM
push str.Tencent
lea edx, [esp + 0x10]
push edx
push str._s_s_s
push 0x104
lea eax, [esp + 0x224]
push 0x104
push eax
call fcn.00425032
mov eax, 0x44f018
add esp, 0x1c
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x41c0e0
sub eax, edx
sar eax, 1
je 0x41c10d
movzx ecx, word [eax*2 + 0x44f016]
cmp cx, 0x5c
je 0x41c105
cmp cx, 0x2f
jne 0x41c10d
mov word [eax*2 + 0x44f016], si
push 0x44f018
lea ecx, [esp + 0x214]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
pop esi
jne 0x41c150
push str.BizQQ
push str.Tencent
lea edx, [esp + 0xc]
push edx
push str._s_s_s
push 0x104
push 0x104
push 0x44f018
call fcn.00425032
add esp, 0x1c
mov ecx, dword [esp + 0x414]
xor ecx, esp
call fcn.00424e88
add esp, 0x418
ret
Function at 0x41c170
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ecx
lea eax, [esp]
push eax
push 0x26
push 0
mov dword [esp + 0xc], 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov ecx, dword [esp]
push 0x44f018
push ecx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov eax, 0x44f018
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41c1a0
sub eax, edx
sar eax, 1
je 0x41c1cf
movzx ecx, word [eax*2 + 0x44f016]
cmp cx, 0x5c
je 0x41c1c5
cmp cx, 0x2f
jne 0x41c1cf
mov word [eax*2 + 0x44f016], 0
mov edx, dword [esp + 8]
mov eax, dword [edx]
push str.BizQQ
push str.Tencent
push 0x44f018
push str._s_s_s
push eax
push eax
push 0x44f018
call fcn.00425032
mov eax, 1
add esp, 0x20
ret
Function at 0x41c640
Capabilities:
Set registry value

Disassembly:
sub esp, 0x62c
mov eax, dword [0x44a2b8]
xor eax, esp
mov dword [esp + 0x628], eax
push ebx
push ebp
push esi
push edi
lea esi, [esp + 0x228]
call fcn.00417110
mov ecx, esi
call fcn.0041db10
push str.EnvirConf.ini
mov eax, esi
push eax
push 0x441ab4
push 0x208
lea ecx, [esp + 0x440]
push 0x104
push ecx
call fcn.00425032
add esp, 0x18
lea edx, [esp + 0x430]
push edx
push 0x442654
push str.FirstOpenLoginPanel
push str.Option
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea edi, [esp + 0x20]
mov esi, str.YP_FOREXE_REG_PATH
call fcn.0041ba50
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [esp + 0x10]
push eax
push 0x20006
push 0
mov ecx, edi
push ecx
push closesocket
call ebx
test eax, eax
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
je 0x41c6f2
lea edx, [esp + 0x10]
push edx
mov eax, edi
push eax
push closesocket
call ebp
mov ecx, dword [esp + 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 4
push 0x4514b0
push 4
push 0
push str.nUseEnviroment
push ecx
call esi
mov edx, dword [esp + 0x10]
push 4
push 0x4514b8
push 4
push 0
push str.nQQGame
push edx
call esi
mov eax, dword [esp + 0x10]
push 4
push 0x4514bc
push 4
push 0
push str.nQQCom
push eax
call esi
mov ecx, dword [esp + 0x10]
push 4
push 0x4514c0
push 4
push 0
push str.nShortcutDesktop
push ecx
call esi
mov edx, dword [esp + 0x10]
push 4
push 0x4514c4
push 4
push 0
push str.nShortcutQuickLaunch
push edx
call esi
mov eax, dword [esp + 0x10]
push 4
push 0x4514c8
push 4
push 0
push str.nRunExe
push eax
call esi
mov ecx, dword [esp + 0x10]
push 4
push 0x4514cc
push 4
push 0
push str.nShowNewFeature
push ecx
call esi
mov edx, dword [esp + 0x10]
push 4
push 0x4514d0
push 4
push 0
push str.nStartRunExe
push edx
call esi
mov eax, dword [0x451504]
test eax, eax
mov dword [esp + 0x14], 0
je 0x41c7c9
mov dword [esp + 0x14], 1
mov ecx, dword [0x451508]
test ecx, ecx
je 0x41c7d8
or dword [esp + 0x14], 2
cmp dword [0x4514f4], 0
je 0x41c7ea
test eax, eax
jne 0x41c7ea
or dword [esp + 0x14], 4
cmp dword [0x4514f0], 0
je 0x41c7fc
test ecx, ecx
jne 0x41c7fc
or dword [esp + 0x14], 8
mov ecx, dword [esp + 0x10]
push 4
lea eax, [esp + 0x18]
push eax
push 4
push 0
push str.nShowSo
push ecx
call esi
mov edx, dword [esp + 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
call edi
lea eax, [esp + 0x18]
push eax
push 0x20006
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push closesocket
mov dword [esp + 0x30], 0x6a
call ebx
test eax, eax
je 0x41c855
lea ecx, [esp + 0x18]
push ecx
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push closesocket
call ebp
mov eax, dword [esp + 0x18]
push 2
lea edx, [esp + 0x20]
push edx
push 3
push 0
push str.Owner_ID
push eax
call esi
mov ecx, dword [esp + 0x18]
push ecx
call edi
mov ecx, dword [esp + 0x638]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
mov eax, 1
call fcn.00424e88
add esp, 0x62c
ret