joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e8ae
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x40e8df
call fcn.00412bb7
mov dword [eax], esi
call fcn.00412ba4
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.0040dfa1
add esp, 0x14
push 0x16
pop eax
jmp 0x40e934
test dword [ebp + 0xc], 0xfffffff9
jne 0x40e8bb
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x40e90c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00412bca
pop ecx
call fcn.00412ba4
mov eax, dword [eax]
jmp 0x40e934
test al, 0x10
jne 0x40e932
test al, 1
je 0x40e932
test byte [ebp + 0xc], 2
je 0x40e932
call fcn.00412bb7
mov dword [eax], 5
call fcn.00412ba4
mov dword [eax], 0xd
jmp 0x40e903
xor eax, eax
pop esi
pop ebp
ret

Function at 0x41c8cc
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004125c1
and dword [ebp - 4], 0
cmp dword [0x43f424], 0
mov ebx, eax
jne 0x41c97d
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x41ca2e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x41ca2e
push eax
call fcn.0041254f
mov dword [esp], 0x435fb4
push edi
mov dword [0x43f424], eax
call esi
push eax
call fcn.0041254f
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x43f428], eax
call esi
push eax
call fcn.0041254f
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x43f42c], eax
call esi
push eax
call fcn.0041254f
pop ecx
mov dword [0x43f434], eax
test eax, eax
je 0x41c97d
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0041254f
pop ecx
mov dword [0x43f430], eax
mov eax, dword [0x43f430]
cmp eax, ebx
je 0x41c9d5
cmp dword [0x43f434], ebx
je 0x41c9d5
push eax
call fcn.004125ca
push dword [0x43f434]
mov esi, eax
call fcn.004125ca
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x41c9d5
test edi, edi
je 0x41c9d5
call esi
test eax, eax
je 0x41c9cc
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x41c9cc
test byte [ebp - 0xc], 1
jne 0x41c9d5
or dword [ebp + 0x10], 0x200000
jmp 0x41ca0e
mov eax, dword [0x43f428]
cmp eax, ebx
je 0x41ca0e
push eax
call fcn.004125ca
pop ecx
test eax, eax
je 0x41ca0e
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x41ca0e
mov eax, dword [0x43f42c]
cmp eax, ebx
je 0x41ca0e
push eax
call fcn.004125ca
pop ecx
test eax, eax
je 0x41ca0e
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x43f424]
call fcn.004125ca
pop ecx
test eax, eax
je 0x41ca2e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x41ca30
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41ffa0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x43d150]
xor eax, ebp
mov dword [ebp - 0x14], eax
push 0x104
lea eax, [ebp - 0x220]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea ecx, [ebp - 0x10]
call fcn.0040bb80
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0041fed0
add esp, 8
test eax, eax
jne 0x41ffea
jmp 0x4200c1
lea ecx, [ebp - 0x10]
call fcn.0040bba0
mov ecx, dword [eax]
mov dword [ebp - 0x224], ecx
lea ecx, [ebp - 8]
call fcn.0040bb80
lea edx, [ebp - 0x230]
push edx
mov ecx, dword [ebp - 0x224]
add ecx, 0xc
call fcn.0040ba30
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
jmp 0x420035
push 0
lea eax, [ebp - 0x238]
push eax
lea ecx, [ebp - 8]
call fcn.0040bbc0
lea ecx, [ebp - 0x240]
push ecx
mov ecx, dword [ebp - 0x224]
add ecx, 0xc
call fcn.0040bae0
push eax
lea ecx, [ebp - 8]
call fcn.0040aa00
movzx edx, al
test edx, edx
je 0x4200c1
lea ecx, [ebp - 8]
call fcn.0040bba0
mov eax, dword [eax]
mov dword [ebp - 0x228], eax
mov ecx, dword [ebp - 0x228]
mov edx, dword [ecx]
push edx
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
cmp eax, dword [ebp + 0xc]
jne 0x4200bc
mov eax, dword [ebp - 0x228]
cmp dword [eax + 0x10], 0
je 0x4200bc
mov ecx, dword [ebp - 0x228]
mov edx, dword [ecx]
push edx
mov eax, dword [ebp - 0x228]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
and eax, 0xffff
movzx edx, ax
push edx
push 0x111
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x4200c1
jmp 0x420024
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0040cf89
mov esp, ebp
pop ebp
ret

Function at 0x420f50
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
mov eax, dword [0x43f550]
push eax
push 0x420d80
push 2
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [0x441284], eax
pop ebp
ret
Function at 0x4212e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0x10]
push eax
movzx ecx, word [ebp + 0xc]
push ecx
mov edx, dword [0x440a20]
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x42130c
xor eax, eax
jmp 0x4213c6
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [0x440a20]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [0x440a20]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x421340
xor eax, eax
jmp 0x4213c6
mov ecx, dword [ebp - 0x10]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.0040d320
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
push 0
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
push 0
mov edx, dword [ebp - 0x14]
push edx
call fcn.0040b820
add esp, 8
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ecx + 8]
call eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov edx, dword [ebp + 8]
cmp dword [edx], 0
jne 0x4213c1
xor eax, eax
jmp 0x4213c6
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x4213f0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44c
mov eax, dword [0x43d150]
xor eax, ebp
mov dword [ebp - 0x24], eax
mov ax, word [0x437404]
mov word [ebp - 0x230], ax
push 0x206
push 0
lea ecx, [ebp - 0x22e]
push ecx
call fcn.0040dc60
add esp, 0xc
mov dword [ebp - 0x14], 0x104
mov dword [ebp - 0x20], 0
lea edx, [ebp - 0x440]
push edx
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x444]
push edx
lea eax, [ebp - 0x448]
push eax
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x234]
push edx
lea eax, [ebp - 0x20]
push eax
push 0
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x230]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], 0
jmp 0x42148c
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
cmp edx, dword [ebp - 0x20]
jae 0x421518
mov dword [ebp - 0xc], 0x100
lea eax, [ebp - 0x440]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 0x438]
push edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x421513
lea edx, [ebp - 0x44c]
push edx
lea eax, [ebp - 0x438]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov edx, dword [ebp - 0x44c]
push edx
call fcn.004213f0
add esp, 4
mov eax, dword [ebp - 0x44c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x438]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x421483
mov ecx, dword [ebp - 0x24]
xor ecx, ebp
call fcn.0040cf89
mov esp, ebp
pop ebp
ret
Function at 0x421530
Capabilities:
Create directory
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x43d150]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0x100
lea eax, [ebp - 4]
push eax
push str.SoftwareSogouExplorer
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x42156a
or eax, 0xffffffff
jmp 0x421604
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 0x210]
push edx
lea eax, [ebp - 8]
push eax
push 0
push 0x436f74
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x42159f
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0xfffffffe
jmp 0x421604
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
lea ecx, [ebp - 0x210]
push ecx
call fcn.0040e937
add esp, 8
cmp eax, 0xffffffff
jne 0x4215c6
mov eax, 0xfffffffd
jmp 0x421604
lea edx, [ebp - 0x210]
push edx
push str._splugins
push 0x104
mov eax, dword [ebp + 8]
push eax
call fcn.0040d685
add esp, 0x10
push 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.0040e937
add esp, 8
cmp eax, 0xffffffff
jne 0x421602
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor eax, eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040cf89
mov esp, ebp
pop ebp
ret

Function at 0x421620
Capabilities:
Create directory
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x43d150]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0x100
lea eax, [ebp - 4]
push eax
push str.SoftwareMaxthon3
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x42165a
or eax, 0xffffffff
jmp 0x4216f4
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 0x210]
push edx
lea eax, [ebp - 8]
push eax
push 0
push str.Folder
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x42168f
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0xfffffffe
jmp 0x4216f4
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
lea ecx, [ebp - 0x210]
push ecx
call fcn.0040e937
add esp, 8
cmp eax, 0xffffffff
jne 0x4216b6
mov eax, 0xfffffffd
jmp 0x4216f4
lea edx, [ebp - 0x210]
push edx
push str._sCoreWebkitNpplugins
push 0x104
mov eax, dword [ebp + 8]
push eax
call fcn.0040d685
add esp, 0x10
push 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.0040e937
add esp, 8
cmp eax, 0xffffffff
jne 0x4216f2
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor eax, eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040cf89
mov esp, ebp
pop ebp
ret
Function at 0x421710
Capabilities:
Create directory
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x43d150]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0x100
lea eax, [ebp - 4]
push eax
push str.SOFTWARETencentQQBrowser
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x42174a
or eax, 0xffffffff
jmp 0x42185e
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 0x418]
push edx
lea eax, [ebp - 8]
push eax
push 0
push str.Install
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x421782
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0xfffffffe
jmp 0x42185e
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
lea ecx, [ebp - 0x418]
push ecx
call fcn.0040e937
add esp, 8
cmp eax, 0xffffffff
jne 0x4217ac
mov eax, 0xfffffffd
jmp 0x42185e
lea edx, [ebp - 0x418]
push edx
push str._sBin
push 0x104
lea eax, [ebp - 0x218]
push eax
call fcn.0040d685
add esp, 0x10
push 0
lea ecx, [ebp - 0x218]
push ecx
call fcn.0040e937
add esp, 8
cmp eax, 0xffffffff
jne 0x421820
lea edx, [ebp - 0x418]
push edx
push 0x436ea4
push 0x104
mov eax, dword [ebp + 8]
push eax
call fcn.0040d685
add esp, 0x10
push 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.0040e937
add esp, 8
cmp eax, 0xffffffff
jne 0x42181e
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x42185c
lea eax, [ebp - 0x418]
push eax
push str._sBinplugins
push 0x104
mov ecx, dword [ebp + 8]
push ecx
call fcn.0040d685
add esp, 0x10
push 0
mov edx, dword [ebp + 8]
push edx
call fcn.0040e937
add esp, 8
cmp eax, 0xffffffff
jne 0x42185c
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor eax, eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040cf89
mov esp, ebp
pop ebp
ret
Function at 0x421870
Capabilities:
Create directory
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x43d150]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0x100
lea eax, [ebp - 4]
push eax
push str.SOFTWAREApple_Computer__Inc.Safari
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x4218aa
or eax, 0xffffffff
jmp 0x421944
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 0x210]
push edx
lea eax, [ebp - 8]
push eax
push 0
push str.InstallDir
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x4218df
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0xfffffffe
jmp 0x421944
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
lea ecx, [ebp - 0x210]
push ecx
call fcn.0040e937
add esp, 8
cmp eax, 0xffffffff
jne 0x421906
mov eax, 0xfffffffd
jmp 0x421944
lea edx, [ebp - 0x210]
push edx
push 0x436dd4
push 0x104
mov eax, dword [ebp + 8]
push eax
call fcn.0040d685
add esp, 0x10
push 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.0040e937
add esp, 8
cmp eax, 0xffffffff
jne 0x421942
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor eax, eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040cf89
mov esp, ebp
pop ebp
ret

Function at 0x421960
Capabilities:
Create directory
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x43d150]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0x100
lea eax, [ebp - 4]
push eax
push str.SoftwareOpera_Software
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x42199a
or eax, 0xffffffff
jmp 0x421a34
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 0x210]
push edx
lea eax, [ebp - 8]
push eax
push 0
push str.Last_Install_Path
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x4219cf
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0xfffffffe
jmp 0x421a34
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
lea ecx, [ebp - 0x210]
push ecx
call fcn.0040e937
add esp, 8
cmp eax, 0xffffffff
jne 0x4219f6
mov eax, 0xfffffffd
jmp 0x421a34
lea edx, [ebp - 0x210]
push edx
push 0x436dc0
push 0x104
mov eax, dword [ebp + 8]
push eax
call fcn.0040d685
add esp, 0x10
push 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.0040e937
add esp, 8
cmp eax, 0xffffffff
jne 0x421a32
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor eax, eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040cf89
mov esp, ebp
pop ebp
ret
Function at 0x421a50
Capabilities:
Create directory
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x43d150]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0x100
lea eax, [ebp - 4]
push eax
push 0x436c00
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x421aa2
lea ecx, [ebp - 4]
push ecx
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallGoogle_Chrome
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x421aa2
or eax, 0xffffffff
jmp 0x421b3c
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 8]
push ecx
push 0
push str.InstallLocation
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x421ad7
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0xfffffffe
jmp 0x421b3c
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
lea edx, [ebp - 0x210]
push edx
call fcn.0040e937
add esp, 8
cmp eax, 0xffffffff
jne 0x421afe
mov eax, 0xfffffffd
jmp 0x421b3c
lea eax, [ebp - 0x210]
push eax
push 0x436d3c
push 0x104
mov ecx, dword [ebp + 8]
push ecx
call fcn.0040d685
add esp, 0x10
push 0
mov edx, dword [ebp + 8]
push edx
call fcn.0040e937
add esp, 8
cmp eax, 0xffffffff
jne 0x421b3a
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor eax, eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040cf89
mov esp, ebp
pop ebp
ret
Function at 0x421b50
Capabilities:
Create directory
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa18
mov eax, dword [0x43d150]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x814], 0x100
lea eax, [ebp - 4]
push eax
push str.SOFTWAREMozillaMozilla_Firefox
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x421b8d
or eax, 0xffffffff
jmp 0x421cbd
lea ecx, [ebp - 0x814]
push ecx
lea edx, [ebp - 0xa18]
push edx
lea eax, [ebp - 8]
push eax
push 0
push str.CurrentVersion
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x421bc8
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0xfffffffe
jmp 0x421cbd
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0xa18]
push ecx
push str.SOFTWAREMozillaMozilla_Firefox_sMain
push 0x400
lea edx, [ebp - 0x810]
push edx
call fcn.0040d685
add esp, 0x10
mov dword [ebp - 0x814], 0x100
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x810]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x421c20
mov eax, 0xfffffffd
jmp 0x421cbd
lea edx, [ebp - 0x814]
push edx
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 8]
push ecx
push 0
push 0x436adc
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x421c58
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0xfffffffc
jmp 0x421cbd
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
lea edx, [ebp - 0x810]
push edx
call fcn.0040e937
add esp, 8
cmp eax, 0xffffffff
jne 0x421c7f
mov eax, 0xfffffffb
jmp 0x421cbd
lea eax, [ebp - 0x810]
push eax
push 0x436bbc
push 0x104
mov ecx, dword [ebp + 8]
push ecx
call fcn.0040d685
add esp, 0x10
push 0
mov edx, dword [ebp + 8]
push edx
call fcn.0040e937
add esp, 8
cmp eax, 0xffffffff
jne 0x421cbb
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor eax, eax
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0040cf89
mov esp, ebp
pop ebp
ret
Function at 0x421cd0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x43d150]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0x100
lea eax, [ebp - 8]
push eax
push str.http_shellopencommand
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x421d07
or eax, 0xffffffff
jmp 0x421d7c
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x218]
push edx
lea eax, [ebp - 0xc]
push eax
push 0
push 0x436a54
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x421d3c
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0xfffffffe
jmp 0x421d7c
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x436ad8
lea ecx, [ebp - 0x218]
push ecx
call fcn.0040ec42
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x421d6a
mov eax, 0xfffffffd
jmp 0x421d7c
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0040e005
add esp, 8
xor eax, eax
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0040cf89
mov esp, ebp
pop ebp
ret

Function at 0x421d90
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x43d150]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
push str.SOFTWAREMozillaPlugins_tenpay.com__s
push 0x104
lea ecx, [ebp - 0x210]
push ecx
call fcn.0040d685
add esp, 0x10
lea edx, [ebp - 0x210]
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040cf89
mov esp, ebp
pop ebp
ret

Function at 0x421de0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov dword [ebp - 0x3c], 0
push 0x38
push 0
lea eax, [ebp - 0x38]
push eax
call fcn.0040dc60
add esp, 0xc
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], 0x40
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], str.regsvr32.exe
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
lea edx, [ebp - 0x3c]
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esp, ebp
pop ebp
ret

Function at 0x421e60
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x26
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
cmp dword [ebp - 4], 0
je 0x421e9e
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
push str.Common_FilesTencentPaycenter
mov eax, dword [ebp + 8]
push eax
call fcn.0040dfd7
add esp, 8
mov esp, ebp
pop ebp
ret