joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401690
Capabilities:
Check for time delay via gettickcount
Query service status
Start service

Disassembly:
sub esp, 0x24
push esi
push edi
xor edi, edi
push 0xf003f
push edi
push edi
mov dword [esp + 0x14], edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
test esi, esi
mov dword [esp + 0xc], esi
je 0x4017b7
mov eax, dword [esp + 0x30]
push ebx
push 0xf01ff
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebx, eax
test ebx, ebx
je 0x401790
push edi
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
je 0x4017a0
lea ecx, [esp + 0x14]
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x401785
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push ebp
call edi
mov ebp, dword [esp + 0x2c]
mov esi, eax
cmp dword [esp + 0x1c], 2
jne 0x40176f
mov eax, 0xcccccccd
mul dword [esp + 0x30]
shr edx, 3
cmp edx, 0x3e8
jae 0x401728
mov edx, 0x3e8
jmp 0x401735
cmp edx, 0x2710
jbe 0x401735
mov edx, 0x2710
push edx
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [esp + 0x18]
push edx
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x40176f
cmp dword [esp + 0x2c], ebp
jbe 0x40175c
call edi
mov ebp, dword [esp + 0x2c]
mov esi, eax
jmp 0x401768
call edi
mov ecx, dword [esp + 0x30]
sub eax, esi
cmp eax, ecx
ja 0x40176f
cmp dword [esp + 0x1c], 2
je 0x40170d
mov eax, dword [esp + 0x1c]
pop ebp
cmp eax, 4
jne 0x401781
mov dword [esp + 0xc], 1
mov esi, dword [esp + 0x10]
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, dword [esp + 0xc]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, edi
pop ebx
pop edi
pop esi
add esp, 0x24
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x420
jne 0x401785
mov dword [esp + 0xc], 1
jmp 0x401785
mov eax, edi
pop edi
pop esi
add esp, 0x24
ret

Function at 0x4017c0
Capabilities:
Stop service

Disassembly:
sub esp, 0x1c
push ebx
push edi
xor ebx, ebx
push 0xf003f
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
je 0x40182f
mov eax, dword [esp + 0x28]
push ebp
push esi
push 0x20
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebp, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
test esi, esi
je 0x401822
lea ecx, [esp + 0x10]
push ecx
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov eax, dword [esp + 0x14]
cmp eax, 1
je 0x40181a
cmp eax, 3
jne 0x40181f
push 0x78
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ebx, 1
push esi
call ebp
push edi
call ebp
pop esi
pop ebp
mov eax, ebx
pop edi
pop ebx
add esp, 0x1c
ret
mov eax, ebx
pop edi
pop ebx
add esp, 0x1c
ret
Function at 0x401e10
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x25c
push edi
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
mov dword [esp + 4], eax
mov ecx, 0x40
mov dword [esp + 8], eax
lea edi, [esp + 0x59]
mov dword [esp + 0xc], eax
push 0x104
mov dword [esp + 0x14], eax
mov byte [esp + 0x5c], al
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x5c]
mov dword [esp + 0x18], 0x44
push ecx
push 0
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x58]
lea eax, [esp + 0x15c]
push edx
push str.__s___Restart
push 0x104
push eax
call sub.MSVCRT.dll__snprintf
add esp, 0x10
lea ecx, [esp + 4]
lea edx, [esp + 0x14]
lea eax, [esp + 0x15c]
push ecx
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
pop edi
jne 0x401eb1
add esp, 0x25c
ret
mov ecx, dword [esp]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [esp + 8]
push edx
call esi
mov eax, 1
pop esi
add esp, 0x25c
ret

Function at 0x401ee0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x110
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x11]
mov byte [esp + 0x10], 0
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x419908
mov dword [esp + 8], 0
mov dword [esp + 0x10], 4
stosb byte es:[edi], al
call fcn.00402a40
push eax
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov ecx, dword [esp + 0x118]
lea edx, [esp + 0x10]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 8]
lea ecx, [esp + 0x10]
push eax
push 1
push 0
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
pop edi
jge 0x401f61
xor eax, eax
add esp, 0x110
ret
mov ecx, dword [esp + 4]
lea edx, [esp + 8]
push esi
lea eax, [esp + 4]
push edx
push eax
push 0
push 0
push str.Start
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 8]
mov esi, eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jge 0x401f9b
xor eax, eax
add esp, 0x110
ret
mov ecx, dword [esp]
xor eax, eax
cmp ecx, 3
sete al
add esp, 0x110
ret
Function at 0x401fb0
Capabilities:
Set registry value

Disassembly:
sub esp, 0x10c
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], 0
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x419908
mov dword [esp + 0xc], 2
stosb byte es:[edi], al
call fcn.00402a40
push eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov ecx, dword [esp + 0x114]
lea edx, [esp + 0xc]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 4]
lea ecx, [esp + 0xc]
push eax
push 2
push 0
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
pop edi
jge 0x402029
xor eax, eax
add esp, 0x10c
ret
mov eax, dword [esp]
push esi
lea edx, [esp + 8]
push 4
push edx
push 4
push 0
push str.Start
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 4]
mov esi, eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
setge al
pop esi
add esp, 0x10c
ret

Function at 0x402070
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x128
push esi
push edi
mov ecx, 0x49
xor eax, eax
lea edi, [esp + 0xc]
mov dword [esp + 8], 0
rep stosd dword es:[edi], eax
xor edi, edi
push edi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x4020a9
pop edi
xor eax, eax
pop esi
add esp, 0x128
ret
lea eax, [esp + 8]
push ebx
push eax
push esi
mov dword [esp + 0x14], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x402100
mov ebx, dword [esp + 0x138]
lea ecx, [esp + 0x30]
push ebx
push ecx
call sub.MSVCRT.dll__mbsicmp
add esp, 8
test eax, eax
je 0x4020fb
lea edx, [esp + 0xc]
push edx
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x402100
lea eax, [esp + 0x30]
push ebx
push eax
call sub.MSVCRT.dll__mbsicmp
add esp, 8
test eax, eax
jne 0x4020da
mov edi, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop ebx
pop edi
pop esi
add esp, 0x128
ret
Function at 0x402120
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x25c
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x5d]
mov byte [esp + 0x5c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x18]
mov dword [esp + 0x18], 0x44
rep stosd dword es:[edi], eax
mov dword [esp + 8], eax
lea ecx, [esp + 0x5c]
mov dword [esp + 0xc], eax
push 0x104
mov dword [esp + 0x14], eax
push ecx
push eax
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov esi, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
lea edx, [esp + 0x5c]
push edx
call esi
lea eax, [esp + 0x5c]
push eax
call esi
mov ecx, 0x419828
call fcn.00402a40
lea ecx, [esp + 0x5c]
push eax
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
mov ecx, 0x419898
call fcn.00402a40
push eax
call fcn.00402070
add esp, 4
test eax, eax
jne 0x40223a
mov ecx, 0x419838
call fcn.00402a40
push eax
call fcn.00401ee0
add esp, 4
test eax, eax
je 0x40223a
lea edx, [esp + 0x5c]
lea eax, [esp + 0x160]
push edx
push str.__s___restart
push 0x104
push eax
call sub.MSVCRT.dll__snprintf
add esp, 0x10
lea ecx, [esp + 8]
lea edx, [esp + 0x18]
lea eax, [esp + 0x160]
push ecx
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x40223a
mov ecx, dword [esp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [esp + 0xc]
push edx
call esi
pop edi
mov eax, 1
pop esi
add esp, 0x25c
ret
pop edi
xor eax, eax
pop esi
add esp, 0x25c
ret
Function at 0x402250
Capabilities:
Delete registry key
Move file

Disassembly:
sub esp, 0x208
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x10d]
mov byte [esp + 0x10c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 9]
mov byte [esp + 8], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x419858
stosb byte es:[edi], al
call fcn.00402a40
push 0x24
mov ecx, 0x419988
mov esi, eax
call fcn.00402a40
push eax
push esi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
cmp eax, 6
pop esi
jne 0x402394
mov ecx, 0x419888
call fcn.00402a40
push eax
call fcn.004017c0
add esp, 4
mov ecx, 0x419888
call fcn.00402a40
push eax
call fcn.00401630
add esp, 4
mov ecx, 0x419818
call fcn.00402a40
push eax
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
lea eax, [esp + 0x104]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x104]
push 0x104
lea edx, [esp + 4]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
lea eax, [esp]
push str..del
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [esp]
push 1
lea edx, [esp + 0x108]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
lea eax, [esp]
push 0
push eax
call fcn.00403e50
add esp, 8
mov ecx, 0x419838
call fcn.00402a40
push eax
call fcn.00401ee0
add esp, 4
test eax, eax
je 0x40237c
mov ecx, 0x419838
call fcn.00402a40
push eax
call fcn.00401fb0
add esp, 4
push 2
mov ecx, 0x41b238
call fcn.00404840
mov eax, 1
add esp, 0x208
ret
xor eax, eax
add esp, 0x208
ret

Function at 0x402d60
Capabilities:
Check os version

Disassembly:
sub esp, 0x94
lea eax, [esp]
mov dword [esp], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x10], 2
jne 0x402d94
cmp dword [esp + 4], 5
jne 0x402d94
mov ecx, dword [esp + 8]
mov eax, 1
cmp ecx, eax
je 0x402d96
xor eax, eax
add esp, 0x94
ret

Function at 0x402da0
Capabilities:
Check os version

Disassembly:
sub esp, 0x94
lea eax, [esp]
mov dword [esp], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x10], 2
jne 0x402dd3
cmp dword [esp + 4], 6
jb 0x402dd3
mov eax, 1
add esp, 0x94
ret
xor eax, eax
add esp, 0x94
ret

Function at 0x402e30
Capabilities:
Query or enumerate registry value

Disassembly:
push edi
mov edi, dword [esp + 8]
test edi, edi
je 0x402e85
mov eax, dword [esp + 0xc]
test eax, eax
je 0x402e85
dec eax
push esi
mov ecx, 0x41a9b8
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], eax
call fcn.00402a40
mov esi, eax
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x14]
push edi
push ecx
mov ecx, 0x41a9f8
call fcn.00402a40
push eax
push esi
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
neg eax
sbb eax, eax
pop esi
inc eax
pop edi
ret
xor eax, eax
pop edi
ret
Function at 0x4030e0
Capabilities:
Get file version info

Disassembly:
sub esp, 0x34
push ebx
push ebp
push esi
mov esi, ecx
push 0
lea ebp, [esi + 0x30]
push ebp
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
jne 0x403100
pop esi
pop ebp
pop ebx
add esp, 0x34
ret
push edi
push ebx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ecx, ebx
mov edi, eax
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [esi + 8], edi
add esp, 4
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esi + 8]
push eax
push ebx
push 0
push ebp
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
pop edi
jne 0x40313a
pop esi
pop ebp
pop ebx
add esp, 0x34
ret
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
call fcn.00402f50
test eax, eax
jne 0x403151
pop esi
pop ebp
pop ebx
add esp, 0x34
ret
mov eax, dword [esp + 0x14]
push 0x104
mov edx, eax
mov word [esi + 0xe], ax
mov eax, dword [esp + 0x1c]
shr edx, 0x10
mov ecx, eax
mov word [esi + 0x12], ax
mov eax, dword [esp + 0x20]
mov word [esi + 0xc], dx
shr ecx, 0x10
mov edx, eax
mov word [esi + 0x16], ax
mov eax, dword [esp + 0x24]
mov word [esi + 0x10], cx
mov ecx, eax
mov word [esi + 0x1a], ax
mov eax, dword [esp + 0x2c]
shr ecx, 0x10
shr edx, 0x10
mov word [esi + 0x18], cx
mov ecx, dword [esp + 0x30]
mov word [esi + 0x14], dx
mov edx, dword [esp + 0x28]
mov dword [esi + 0x24], ecx
lea ecx, [esi + 0x134]
mov dword [esi + 0x1c], edx
mov edx, dword [esp + 0x34]
mov dword [esi + 0x20], eax
mov eax, dword [esp + 0x38]
push ecx
push 0x4174a0
mov ecx, esi
mov dword [esi + 0x28], edx
mov dword [esi + 0x2c], eax
call fcn.00402ff0
test eax, eax
jne 0x4031db
pop esi
pop ebp
pop ebx
add esp, 0x34
ret
lea edx, [esi + 0x33c]
push 0x104
push edx
push 0x417490
mov ecx, esi
call fcn.00402ff0
test eax, eax
jne 0x4031fe
pop esi
pop ebp
pop ebx
add esp, 0x34
ret
lea eax, [esi + 0x238]
push 0x104
push eax
push 0x417484
mov ecx, esi
call fcn.00402ff0
neg eax
sbb eax, eax
pop esi
pop ebp
pop ebx
neg eax
add esp, 0x34
ret
Function at 0x4033b0
Capabilities:
Check if file exists
Delete file
Get common file path
Move file

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x410
test eax, eax
push esi
mov esi, dword [esp + 0x418]
push edi
je 0x4033e0
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x4033e0
pop edi
mov eax, 1
pop esi
add esp, 0x410
ret
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x4033f9
pop edi
mov eax, 1
pop esi
add esp, 0x410
ret
call fcn.00402d50
test eax, eax
je 0x403425
push esi
call fcn.004035e0
add esp, 4
push 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
neg eax
sbb eax, eax
pop edi
neg eax
pop esi
add esp, 0x410
ret
mov al, byte [0x41ad24]
test al, al
jne 0x40344e
push 0x104
push 0x41ad24
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.wininit.ini
push 0x41ad24
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x10d]
mov byte [esp + 0x10c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 9]
mov byte [esp + 8], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x10c]
push 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test eax, eax
je 0x4035d1
lea ecx, [esp + 0x10c]
push ecx
call fcn.004035e0
lea edx, [esp + 0x110]
lea eax, [esp + 0xc]
push edx
push str.NUL_s_n
push 0x103
push eax
call sub.MSVCRT.dll__snprintf
push 0x4174d4
push 0x41ad24
call sub.MSVCRT.dll_fopen
mov esi, eax
add esp, 0x1c
test esi, esi
jne 0x4034f7
push 0x4174d0
push 0x41ad24
call sub.MSVCRT.dll_fopen
mov esi, eax
add esp, 8
test esi, esi
je 0x4035d1
push esi
call sub.MSVCRT.dll_rewind
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x215]
mov byte [esp + 0x214], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push esi
lea ecx, [esp + 0x218]
push 0x208
push ecx
stosb byte es:[edi], al
call sub.MSVCRT.dll_fgets
add esp, 0x10
test eax, eax
je 0x403572
lea edx, [esp + 0x210]
push edx
call sub.MSVCRT.dll__strlwr
lea eax, [esp + 0x214]
push str._rename_
push eax
call sub.MSVCRT.dll_strstr
add esp, 0xc
test eax, eax
jne 0x4035a2
push esi
lea ecx, [esp + 0x214]
push 0x208
push ecx
call sub.MSVCRT.dll_fgets
add esp, 0xc
test eax, eax
jne 0x403532
push esi
push str._rename__n
call sub.MSVCRT.dll_fputs
lea edx, [esp + 0x10]
push esi
push edx
call sub.MSVCRT.dll_fputs
add esp, 0x10
push esi
call sub.MSVCRT.dll_fclose
add esp, 4
mov eax, 1
pop edi
pop esi
add esp, 0x410
ret
push 2
push 0
push esi
call sub.MSVCRT.dll_fseek
lea eax, [esp + 0x14]
push esi
push eax
call sub.MSVCRT.dll_fputs
add esp, 0x14
push esi
call sub.MSVCRT.dll_fclose
add esp, 4
mov eax, 1
pop edi
pop esi
add esp, 0x410
ret
pop edi
xor eax, eax
pop esi
add esp, 0x410
ret
Function at 0x403d90
Capabilities:
Check if file exists
Create directory

Disassembly:
sub esp, 0x104
push esi
mov esi, dword [esp + 0x10c]
test esi, esi
push edi
je 0x403e3a
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x403e3a
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x403dd4
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
pop edi
pop esi
add esp, 0x104
ret
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 9]
mov byte [esp + 8], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x104
lea eax, [esp + 0xc]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashA]
lea edx, [esp + 8]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
mov edi, dword [esp + 0x114]
lea eax, [esp + 8]
push edi
push eax
call fcn.00403d90
add esp, 8
test eax, eax
je 0x403e3a
push edi
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
pop edi
pop esi
add esp, 0x104
ret
pop edi
xor eax, eax
pop esi
add esp, 0x104
ret

Function at 0x403e50
Capabilities:
Move file

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
test edi, edi
je 0x403e63
push edi
call fcn.004035e0
add esp, 4
mov esi, dword [esp + 0x10]
test esi, esi
je 0x403e74
push esi
call fcn.004035e0
add esp, 4
call fcn.00402d50
test eax, eax
je 0x403e93
xor eax, eax
test esi, esi
setne al
add eax, 4
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
pop edi
pop esi
ret
push esi
push edi
call fcn.00403ea0
add esp, 8
pop edi
pop esi
ret
Function at 0x404ec0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
call fcn.00402da0
test eax, eax
mov eax, str.SOFTWAREAppDataLowTencentQQToolbarAction
jne 0x404ed6
mov eax, str.SOFTWARETencentQQToolbarAction
lea ecx, [esp]
lea edx, [esp + 8]
push ecx
lea ecx, [esp + 8]
push edx
push ecx
push str.Insttm
push eax
push 0x80000001
mov dword [esp + 0x1c], 3
mov dword [esp + 0x18], 4
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
je 0x404f10
xor eax, eax
add esp, 0xc
ret
mov eax, dword [esp + 8]
add esp, 0xc
ret

Function at 0x405050
Capabilities:
Check if file exists
Delete file

Disassembly:
sub esp, 0x104
push esi
mov edx, ecx
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 9]
mov byte [esp + 8], 0
push 0x103
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0xc]
add edx, 4
push eax
push edx
call fcn.00406110
add esp, 0xc
lea ecx, [esp + 8]
mov esi, eax
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x4050b0
lea edx, [esp + 8]
push edx
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
test eax, eax
jne 0x4050b0
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, esi
pop edi
pop esi
add esp, 0x104
ret

Function at 0x405ae0
Capabilities:
Check os version

Disassembly:
sub esp, 0x94
push edi
mov ecx, 0x24
xor eax, eax
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
lea eax, [esp + 4]
mov dword [esp + 4], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
pop edi
je 0x405b9a
mov eax, dword [esp + 0x10]
cmp eax, 1
jne 0x405b2c
cmp dword [esp + 4], 4
jne 0x405b9a
mov eax, 1
add esp, 0x94
ret
cmp eax, 2
jne 0x405b9a
mov eax, dword [esp + 4]
cmp eax, 5
jne 0x405b70
mov eax, dword [esp + 8]
test eax, eax
jne 0x405b4e
mov eax, 2
add esp, 0x94
ret
cmp eax, 1
jne 0x405b5f
mov eax, 3
add esp, 0x94
ret
cmp eax, 2
jne 0x405b9a
mov eax, 4
add esp, 0x94
ret
cmp eax, 6
jne 0x405b9a
mov eax, dword [esp + 8]
test eax, eax
jne 0x405b89
mov eax, 5
add esp, 0x94
ret
cmp eax, 1
jne 0x405b9a
mov eax, 6
add esp, 0x94
ret
xor eax, eax
add esp, 0x94
ret
Function at 0x405c90
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x18
mov eax, dword [0x4124a4]
mov edx, dword [0x4124ac]
push esi
push edi
mov edi, ecx
mov dword [esp + 0x10], eax
mov ecx, dword [0x4124a8]
mov eax, dword [0x4124b0]
mov dword [esp + 0x14], ecx
mov ecx, 0x41ba80
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], eax
mov dword [esp + 8], 0x10
call fcn.00402a40
lea ecx, [esp + 8]
mov esi, eax
lea edx, [esp + 0x10]
push ecx
lea eax, [esp + 0x10]
push edx
push eax
mov ecx, 0x41ba70
call fcn.00402a40
push eax
push esi
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x405d2b
mov eax, dword [esp + 0x24]
test eax, eax
je 0x405d1e
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov dword [eax], ecx
mov ecx, dword [esp + 0x18]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x1c]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
pop edi
mov eax, 1
pop esi
add esp, 0x18
ret 8
mov eax, dword [esp + 0x28]
test eax, eax
je 0x405d47
mov eax, dword [esp + 0x24]
mov ecx, edi
push eax
call fcn.00405d60
pop edi
pop esi
add esp, 0x18
ret 8
pop edi
xor eax, eax
pop esi
add esp, 0x18
ret 8

Function at 0x405d60
Capabilities:
Set registry value

Disassembly:
sub esp, 0x10
lea eax, [esp]
push eax
call dword [sym.imp.ole32.dll_CoCreateGuid]
test eax, eax
je 0x405d7a
xor eax, eax
add esp, 0x10
ret 4
push esi
mov ecx, 0x41ba80
call fcn.00402a40
lea ecx, [esp + 4]
push 0x10
push ecx
push 3
mov ecx, 0x41ba70
mov esi, eax
call fcn.00402a40
push eax
push esi
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
mov eax, dword [esp + 0x18]
pop esi
test eax, eax
je 0x405dcb
mov edx, dword [esp]
mov ecx, dword [esp + 4]
mov dword [eax], edx
mov edx, dword [esp + 8]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0xc]
mov dword [eax + 8], edx
mov dword [eax + 0xc], ecx
mov eax, 1
add esp, 0x10
ret 4

Function at 0x405de0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push esi
mov ecx, 0x41ba80
mov dword [esp + 4], 0
mov dword [esp + 8], 2
call fcn.00402a40
mov esi, eax
lea eax, [esp + 8]
lea ecx, [esp + 4]
push eax
lea edx, [esp + 0x10]
push ecx
push edx
mov ecx, 0x41ba60
call fcn.00402a40
push eax
push esi
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
mov ax, word [esp + 4]
pop esi
add esp, 0xc
ret