joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41f060
Capabilities:
Create directory
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x43a170]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0x100
lea eax, [ebp - 4]
push eax
push str.SOFTWAREApple_Computer__Inc.Safari
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x41f09a
or eax, 0xffffffff
jmp 0x41f134
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 0x210]
push edx
lea eax, [ebp - 8]
push eax
push 0
push str.InstallDir
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x41f0cf
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0xfffffffe
jmp 0x41f134
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
lea ecx, [ebp - 0x210]
push ecx
call fcn.0040beb6
add esp, 8
cmp eax, 0xffffffff
jne 0x41f0f6
mov eax, 0xfffffffd
jmp 0x41f134
lea edx, [ebp - 0x210]
push edx
push 0x433cb4
push 0x104
mov eax, dword [ebp + 8]
push eax
call fcn.0040abd5
add esp, 0x10
push 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.0040beb6
add esp, 8
cmp eax, 0xffffffff
jne 0x41f132
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor eax, eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040a4cd
mov esp, ebp
pop ebp
ret

Function at 0x41f150
Capabilities:
Create directory
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x43a170]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0x100
lea eax, [ebp - 4]
push eax
push str.SoftwareOpera_Software
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x41f18a
or eax, 0xffffffff
jmp 0x41f224
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 0x210]
push edx
lea eax, [ebp - 8]
push eax
push 0
push str.Last_Install_Path
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x41f1bf
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0xfffffffe
jmp 0x41f224
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
lea ecx, [ebp - 0x210]
push ecx
call fcn.0040beb6
add esp, 8
cmp eax, 0xffffffff
jne 0x41f1e6
mov eax, 0xfffffffd
jmp 0x41f224
lea edx, [ebp - 0x210]
push edx
push 0x433ca0
push 0x104
mov eax, dword [ebp + 8]
push eax
call fcn.0040abd5
add esp, 0x10
push 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.0040beb6
add esp, 8
cmp eax, 0xffffffff
jne 0x41f222
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor eax, eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040a4cd
mov esp, ebp
pop ebp
ret
Function at 0x41f240
Capabilities:
Create directory
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x43a170]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0x100
lea eax, [ebp - 4]
push eax
push 0x433ae0
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x41f292
lea ecx, [ebp - 4]
push ecx
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallGoogle_Chrome
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x41f292
or eax, 0xffffffff
jmp 0x41f32c
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 8]
push ecx
push 0
push str.InstallLocation
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x41f2c7
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0xfffffffe
jmp 0x41f32c
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
lea edx, [ebp - 0x210]
push edx
call fcn.0040beb6
add esp, 8
cmp eax, 0xffffffff
jne 0x41f2ee
mov eax, 0xfffffffd
jmp 0x41f32c
lea eax, [ebp - 0x210]
push eax
push 0x433c1c
push 0x104
mov ecx, dword [ebp + 8]
push ecx
call fcn.0040abd5
add esp, 0x10
push 0
mov edx, dword [ebp + 8]
push edx
call fcn.0040beb6
add esp, 8
cmp eax, 0xffffffff
jne 0x41f32a
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor eax, eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040a4cd
mov esp, ebp
pop ebp
ret
Function at 0x41f340
Capabilities:
Create directory
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa18
mov eax, dword [0x43a170]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x814], 0x100
lea eax, [ebp - 4]
push eax
push str.SOFTWAREMozillaMozilla_Firefox
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x41f37d
or eax, 0xffffffff
jmp 0x41f4ad
lea ecx, [ebp - 0x814]
push ecx
lea edx, [ebp - 0xa18]
push edx
lea eax, [ebp - 8]
push eax
push 0
push str.CurrentVersion
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x41f3b8
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0xfffffffe
jmp 0x41f4ad
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0xa18]
push ecx
push str.SOFTWAREMozillaMozilla_Firefox_sMain
push 0x400
lea edx, [ebp - 0x810]
push edx
call fcn.0040abd5
add esp, 0x10
mov dword [ebp - 0x814], 0x100
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x810]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x41f410
mov eax, 0xfffffffd
jmp 0x41f4ad
lea edx, [ebp - 0x814]
push edx
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 8]
push ecx
push 0
push 0x4339bc
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x41f448
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0xfffffffc
jmp 0x41f4ad
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
lea edx, [ebp - 0x810]
push edx
call fcn.0040beb6
add esp, 8
cmp eax, 0xffffffff
jne 0x41f46f
mov eax, 0xfffffffb
jmp 0x41f4ad
lea eax, [ebp - 0x810]
push eax
push 0x433a9c
push 0x104
mov ecx, dword [ebp + 8]
push ecx
call fcn.0040abd5
add esp, 0x10
push 0
mov edx, dword [ebp + 8]
push edx
call fcn.0040beb6
add esp, 8
cmp eax, 0xffffffff
jne 0x41f4ab
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor eax, eax
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0040a4cd
mov esp, ebp
pop ebp
ret
Function at 0x41f4c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x43a170]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0x100
lea eax, [ebp - 8]
push eax
push str.http_shellopencommand
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x41f4f7
or eax, 0xffffffff
jmp 0x41f56c
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x218]
push edx
lea eax, [ebp - 0xc]
push eax
push 0
push 0x4339b4
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x41f52c
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0xfffffffe
jmp 0x41f56c
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x4339b8
lea ecx, [ebp - 0x218]
push ecx
call fcn.0040c1c1
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x41f55a
mov eax, 0xfffffffd
jmp 0x41f56c
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0040b555
add esp, 8
xor eax, eax
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0040a4cd
mov esp, ebp
pop ebp
ret

Function at 0x41f580
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov dword [ebp - 0x3c], 0
push 0x38
push 0
lea eax, [ebp - 0x38]
push eax
call fcn.0040b1b0
add esp, 0xc
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], 0x40
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], str.regsvr32.exe
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
lea edx, [ebp - 0x3c]
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esp, ebp
pop ebp
ret

Function at 0x41f600
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x26
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
cmp dword [ebp - 4], 0
je 0x41f63e
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
push str.Common_FilesTencentPaycenter
mov eax, dword [ebp + 8]
push eax
call fcn.0040b527
add esp, 8
mov esp, ebp
pop ebp
ret

Function at 0x41f650
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x43a170]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x210]
push eax
call fcn.0041f600
add esp, 4
lea ecx, [ebp - 0x210]
push ecx
push str._sWhatsnew.txt
push 0x104
lea edx, [ebp - 0x418]
push edx
call fcn.0040abd5
add esp, 0x10
push 5
push 0
lea eax, [ebp - 0x418]
push eax
push str.notepad.exe
push 0x434d04
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a4cd
mov esp, ebp
pop ebp
ret
Function at 0x41f990
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x43a170]
xor eax, ebp
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x210]
push eax
call fcn.0041f4c0
add esp, 4
test eax, eax
je 0x41f9be
or eax, 0xffffffff
jmp 0x41fa5a
push 0x433c34
lea ecx, [ebp - 0x210]
push ecx
call fcn.00401000
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x41f9e2
mov eax, 0xfffffffe
jmp 0x41fa5a
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x210]
sub edx, eax
sar edx, 1
mov dword [ebp - 8], edx
xor ecx, ecx
mov edx, dword [ebp - 8]
mov word [ebp + edx*2 - 0x210], cx
push 0
lea eax, [ebp - 0x210]
push eax
call fcn.0040beb6
add esp, 8
cmp eax, 0xffffffff
jne 0x41fa1c
mov eax, 0xfffffffd
jmp 0x41fa5a
lea ecx, [ebp - 0x210]
push ecx
push 0x433b64
push 0x104
mov edx, dword [ebp + 8]
push edx
call fcn.0040abd5
add esp, 0x10
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.0040beb6
add esp, 8
cmp eax, 0xffffffff
jne 0x41fa58
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor eax, eax
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0040a4cd
mov esp, ebp
pop ebp
ret

Function at 0x41fa70
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x43a170]
xor eax, ebp
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x210]
push eax
call fcn.0041f4c0
add esp, 4
test eax, eax
je 0x41fa9e
or eax, 0xffffffff
jmp 0x41fb3a
push 0x433ab4
lea ecx, [ebp - 0x210]
push ecx
call fcn.00401000
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x41fac2
mov eax, 0xfffffffe
jmp 0x41fb3a
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x210]
sub edx, eax
sar edx, 1
mov dword [ebp - 8], edx
xor ecx, ecx
mov edx, dword [ebp - 8]
mov word [ebp + edx*2 - 0x210], cx
push 0
lea eax, [ebp - 0x210]
push eax
call fcn.0040beb6
add esp, 8
cmp eax, 0xffffffff
jne 0x41fafc
mov eax, 0xfffffffd
jmp 0x41fb3a
lea ecx, [ebp - 0x210]
push ecx
push 0x433acc
push 0x104
mov edx, dword [ebp + 8]
push edx
call fcn.0040abd5
add esp, 0x10
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.0040beb6
add esp, 8
cmp eax, 0xffffffff
jne 0x41fb38
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor eax, eax
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0040a4cd
mov esp, ebp
pop ebp
ret

Function at 0x41fb50
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x43a170]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.00429cf0
push eax
push str.https:__www.tenpay.com__ADTAGTENPAY.CLIENT.SETUP._s
push 0x104
lea eax, [ebp - 0x210]
push eax
call fcn.0040abd5
add esp, 0x10
push 1
push 0
push 0
lea ecx, [ebp - 0x210]
push ecx
push 0x434c54
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a4cd
mov esp, ebp
pop ebp
ret
Function at 0x41fbb0
Capabilities:
Delete registry key
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x43a170]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x214]
push eax
push str.SYSTEMCurrentControlSetServicesTenpayKeyboard
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x41fc0c
mov ecx, dword [ebp - 0x214]
push ecx
call fcn.0041eb90
add esp, 4
push 0x43481c
mov edx, dword [ebp - 0x214]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x214]
push ecx
push str.SYSTEMCurrentControlSetControlClass4D36E96B_E325_11CE_BFC1_08002BE10318
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x41fd35
mov dword [ebp - 0x21c], 0x208
lea edx, [ebp - 0x21c]
push edx
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x218]
push ecx
push 0
push 0x4348bc
mov edx, dword [ebp - 0x214]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41fd28
mov eax, dword [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x210]
push ecx
call fcn.0041f6c0
add esp, 8
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0xffffffff
je 0x41fd28
push str.TenpayKeyboard
call fcn.0040b196
add esp, 4
add eax, 1
mov dword [ebp - 0x224], eax
mov edx, dword [ebp - 0x220]
add edx, dword [ebp - 0x224]
shl edx, 1
mov eax, dword [ebp - 0x21c]
sub eax, edx
push eax
mov ecx, dword [ebp - 0x220]
lea edx, [ebp + ecx*2 - 0x210]
mov eax, dword [ebp - 0x224]
lea ecx, [edx + eax*2]
push ecx
mov edx, dword [ebp - 0x220]
lea eax, [ebp + edx*2 - 0x210]
push eax
call fcn.0040a870
add esp, 0xc
mov ecx, dword [ebp - 0x224]
shl ecx, 1
mov edx, dword [ebp - 0x21c]
sub edx, ecx
mov dword [ebp - 0x21c], edx
mov eax, dword [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x210]
push ecx
mov edx, dword [ebp - 0x218]
push edx
push 0
push str.UpperFilters
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 0x214]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a4cd
mov esp, ebp
pop ebp
ret
Function at 0x420930
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x490
mov eax, dword [0x43a170]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0x100
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallTenpay_Security_Control
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
je 0x42096a
or eax, 0xffffffff
jmp 0x420a94
call fcn.00429d60
push eax
push 0x434a30
push 0x434a40
push 0x78
lea ecx, [ebp - 0x88]
push ecx
call fcn.0040ae00
add esp, 0x14
lea edx, [ebp - 0x88]
push edx
mov eax, dword [ebp - 8]
push eax
lea ecx, [ebp - 0x490]
push ecx
call fcn.0040abd5
add esp, 0xc
mov edx, dword [ebp - 8]
push edx
lea eax, [ebp - 0x490]
push eax
push 1
push 0
push str.DisplayName
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
call fcn.00429d60
push eax
mov edx, dword [ebp - 8]
push edx
lea eax, [ebp - 0x490]
push eax
call fcn.0040abd5
add esp, 0xc
mov ecx, dword [ebp - 8]
push ecx
lea edx, [ebp - 0x490]
push edx
push 1
push 0
push str.DisplayVersion
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x434a84
mov ecx, dword [ebp - 8]
push ecx
lea edx, [ebp - 0x490]
push edx
call fcn.0040abd5
add esp, 0xc
mov eax, dword [ebp - 8]
push eax
lea ecx, [ebp - 0x490]
push ecx
push 1
push 0
push str.Publisher
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea eax, [ebp - 0x290]
push eax
call fcn.0041f600
add esp, 4
lea ecx, [ebp - 0x290]
push ecx
push str._suninstall.exe
mov edx, dword [ebp - 8]
push edx
lea eax, [ebp - 0x490]
push eax
call fcn.0040abd5
add esp, 0x10
mov ecx, dword [ebp - 8]
push ecx
lea edx, [ebp - 0x490]
push edx
push 1
push 0
push str.UninstallString
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
call fcn.0041eb70
call fcn.0041fd50
movzx ecx, ax
test ecx, ecx
je 0x420a92
call fcn.0041fbb0
xor eax, eax
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0040a4cd
mov esp, ebp
pop ebp
ret
Function at 0x420ad0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42fd2f
mov eax, dword fs:[0]
push eax
sub esp, 0x4b0
mov eax, dword [0x43a170]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2a8], 0
lea eax, [ebp - 0x2a8]
push eax
push 0x10
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
cmp dword [ebp - 0x2a8], 0
jne 0x420b27
or eax, 0xffffffff
jmp 0x420c75
lea ecx, [ebp - 0x21c]
push ecx
mov edx, dword [ebp - 0x2a8]
push edx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
lea eax, [ebp - 0x21c]
push eax
push 0x434b9c
push 0x104
lea ecx, [ebp - 0x4b4]
push ecx
call fcn.0040abd5
add esp, 0x10
push 1
lea ecx, [ebp - 0x2a4]
call fcn.00406150
mov dword [ebp - 4], 0
push 0x40
push 2
lea edx, [ebp - 0x4b4]
push edx
lea ecx, [ebp - 0x2a4]
call fcn.00406270
mov eax, dword [ebp - 0x2a4]
mov ecx, dword [eax + 4]
lea ecx, [ebp + ecx - 0x2a4]
call fcn.00405670
movzx edx, al
test edx, edx
je 0x420bc8
mov dword [ebp - 0x4b8], 0xfffffffe
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2a4]
call fcn.00405b40
mov eax, dword [ebp - 0x4b8]
jmp 0x420c75
push 0x405aa0
push str._InternetShortcut_
lea eax, [ebp - 0x2a4]
push eax
call fcn.004083c0
add esp, 8
mov ecx, eax
call fcn.00405bc0
push 0x405aa0
push str.IconFileC:Program_FilesCommon_FilesTencentPaycenter_tenpay.ico
lea ecx, [ebp - 0x2a4]
push ecx
call fcn.004083c0
add esp, 8
mov ecx, eax
call fcn.00405bc0
push 0x405aa0
push str.URLhttps:__www.tenpay.com__ADTAGTENPAY.CLIENT.ICO.DESKTOP
lea edx, [ebp - 0x2a4]
push edx
call fcn.004083c0
add esp, 8
mov ecx, eax
call fcn.00405bc0
push 0x405aa0
push str.IconIndex0
lea eax, [ebp - 0x2a4]
push eax
call fcn.004083c0
add esp, 8
mov ecx, eax
call fcn.00405bc0
lea ecx, [ebp - 0x2a4]
call fcn.004062c0
mov dword [ebp - 0x4bc], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2a4]
call fcn.00405b40
mov eax, dword [ebp - 0x4bc]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040a4cd
mov esp, ebp
pop ebp
ret
Function at 0x420c90
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42fd62
mov eax, dword fs:[0]
push eax
sub esp, 0x4b0
mov eax, dword [0x43a170]
xor eax, ebp
mov dword [ebp - 0x98], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2a8], 0
lea eax, [ebp - 0x2a8]
push eax
push 6
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
cmp dword [ebp - 0x2a8], 0
jne 0x420cea
or eax, 0xffffffff
jmp 0x420e58
lea ecx, [ebp - 0x2a4]
push ecx
mov edx, dword [ebp - 0x2a8]
push edx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
lea eax, [ebp - 0x2a4]
push eax
push 0x434ae8
push 0x104
lea ecx, [ebp - 0x4b4]
push ecx
call fcn.0040abd5
add esp, 0x10
push 1
lea ecx, [ebp - 0x94]
call fcn.00406150
mov dword [ebp - 4], 0
push 0x40
push 2
lea edx, [ebp - 0x4b4]
push edx
lea ecx, [ebp - 0x94]
call fcn.00406270
mov eax, dword [ebp - 0x94]
mov ecx, dword [eax + 4]
lea ecx, [ebp + ecx - 0x94]
call fcn.00405670
movzx edx, al
test edx, edx
je 0x420d8b
mov dword [ebp - 0x4b8], 0xfffffffe
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.00405b40
mov eax, dword [ebp - 0x4b8]
jmp 0x420e58
push 0x405aa0
push str._DEFAULT_
lea eax, [ebp - 0x94]
push eax
call fcn.004083c0
add esp, 8
mov ecx, eax
call fcn.00405bc0
push 0x405aa0
push str.BASEURLhttps:__www.tenpay.com_
lea ecx, [ebp - 0x94]
push ecx
call fcn.004083c0
add esp, 8
mov ecx, eax
call fcn.00405bc0
push 0x405aa0
push 0x434b40
lea edx, [ebp - 0x94]
push edx
call fcn.004083c0
add esp, 8
mov ecx, eax
call fcn.00405bc0
push 0x405aa0
push str.URLhttps:__www.tenpay.com_
lea eax, [ebp - 0x94]
push eax
call fcn.004083c0
add esp, 8
mov ecx, eax
call fcn.00405bc0
push 0x405aa0
push str.IconFilehttps:__www.tenpay.com_favicon.ico
lea ecx, [ebp - 0x94]
push ecx
call fcn.004083c0
add esp, 8
mov ecx, eax
call fcn.00405bc0
lea ecx, [ebp - 0x94]
call fcn.004062c0
mov dword [ebp - 0x4bc], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.00405b40
mov eax, dword [ebp - 0x4bc]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x98]
xor ecx, ebp
call fcn.0040a4cd
mov esp, ebp
pop ebp
ret

Function at 0x420e80
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x43a170]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x210]
push eax
call fcn.0041f600
add esp, 4
push 0
lea ecx, [ebp - 0x210]
push ecx
call fcn.0040beb6
add esp, 8
cmp eax, 0xffffffff
jne 0x420ec7
push 0
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [ebp - 0x210]
push eax
push 0
mov ecx, dword [0x43c550]
push ecx
call fcn.00425710
add esp, 0xc
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a4cd
mov esp, ebp
pop ebp
ret
Function at 0x420ef0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 1
mov eax, dword [0x43e270]
push eax
push 0x30
push 0x7f1
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x43d400
push 0x7f1
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
cmp dword [0x43cbc4], 0
je 0x420f4a
push 5
push 0x7f1
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x420f62
push 0
push 0x7f1
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebp
ret

Function at 0x420fd0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 5
push 0
push 0
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
push 5
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebp
ret