joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409720
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x5e8f64]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
push 0x208
push esi
push eax
mov dword [ebp - 0x418], esi
call fcn.0055dd80
push 0x208
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.0055dd80
add esp, 0x18
mov dword [ebp - 0x41c], 0x208
lea eax, [ebp - 0x418]
push eax
push 0x20019
push esi
push str.SOFTWARETencentMobileGamePCVDI_100
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x409855
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push str.InstallPath
push dword [ebp - 0x418]
call esi
cmp word [ebp - 0x20c], 0
jne 0x4097cb
xor ecx, ecx
jmp 0x4097e3
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4097d4
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x20c]
mov ecx, edi
push eax
call fcn.00404cf0
lea eax, [ebp - 0x41c]
mov dword [ebp - 0x41c], 0x208
push eax
lea eax, [ebp - 0x414]
push eax
push 0
push 0
push str.Version
push dword [ebp - 0x418]
call esi
cmp word [ebp - 0x414], 0
jne 0x409829
xor ecx, ecx
jmp 0x409841
lea ecx, [ebp - 0x414]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x409832
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x414]
mov ecx, ebx
push eax
call fcn.00404cf0
mov esi, 1
mov eax, dword [ebp - 0x418]
test eax, eax
je 0x409866
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0055ab0a
mov esp, ebp
pop ebp
ret 0xc
Function at 0x409880
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x5e8f64]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
push 0x208
push esi
push eax
mov dword [ebp - 0x418], esi
call fcn.0055dd80
push 0x208
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.0055dd80
add esp, 0x18
mov dword [ebp - 0x41c], 0x208
lea eax, [ebp - 0x418]
push eax
push 0x20019
push esi
push str.SOFTWARETencentMobileGamePCVDI_0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4099b5
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push str.InstallPath
push dword [ebp - 0x418]
call esi
cmp word [ebp - 0x20c], 0
jne 0x40992b
xor ecx, ecx
jmp 0x409943
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x409934
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x20c]
mov ecx, edi
push eax
call fcn.00404cf0
lea eax, [ebp - 0x41c]
mov dword [ebp - 0x41c], 0x208
push eax
lea eax, [ebp - 0x414]
push eax
push 0
push 0
push str.Version
push dword [ebp - 0x418]
call esi
cmp word [ebp - 0x414], 0
jne 0x409989
xor ecx, ecx
jmp 0x4099a1
lea ecx, [ebp - 0x414]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x409992
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x414]
mov ecx, ebx
push eax
call fcn.00404cf0
mov esi, 1
mov eax, dword [ebp - 0x418]
test eax, eax
je 0x4099c6
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0055ab0a
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4099e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x5e8f64]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
push 0x208
push esi
push eax
mov dword [ebp - 0x418], esi
call fcn.0055dd80
push 0x208
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.0055dd80
add esp, 0x18
mov dword [ebp - 0x41c], 0x208
lea eax, [ebp - 0x418]
push eax
push 0x20019
push esi
push str.SOFTWARETencentMobileGamePCAOW_Rootfs_0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x409b15
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push str.InstallPath
push dword [ebp - 0x418]
call esi
cmp word [ebp - 0x20c], 0
jne 0x409a8b
xor ecx, ecx
jmp 0x409aa3
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x409a94
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x20c]
mov ecx, edi
push eax
call fcn.00404cf0
lea eax, [ebp - 0x41c]
mov dword [ebp - 0x41c], 0x208
push eax
lea eax, [ebp - 0x414]
push eax
push 0
push 0
push str.Version
push dword [ebp - 0x418]
call esi
cmp word [ebp - 0x414], 0
jne 0x409ae9
xor ecx, ecx
jmp 0x409b01
lea ecx, [ebp - 0x414]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x409af2
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x414]
mov ecx, ebx
push eax
call fcn.00404cf0
mov esi, 1
mov eax, dword [ebp - 0x418]
test eax, eax
je 0x409b26
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0055ab0a
mov esp, ebp
pop ebp
ret 0xc

Function at 0x409b40
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x5e8f64]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
xor esi, esi
push 0x208
push esi
push eax
mov dword [ebp - 0x210], esi
call fcn.0055dd80
add esp, 0xc
mov dword [ebp - 0x214], 0x208
lea eax, [ebp - 0x210]
push eax
push 0x20019
push esi
push str.SoftwareTencentMobileGamePC
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x409c03
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push esi
push 0x5bc96c
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x409c03
cmp word [ebp - 0x20c], si
jne 0x409bd2
xor ecx, ecx
jmp 0x409bef
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x409be0
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x20c]
mov ecx, edi
push eax
call fcn.00404cf0
mov esi, 1
mov eax, dword [ebp - 0x210]
test eax, eax
je 0x409c14
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.0055ab0a
mov esp, ebp
pop ebp
ret 4
Function at 0x410870
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
push dword [edi]
push 1
push dword [edi + 8]
push esi
call fcn.0056ce74
mov ecx, dword [edi + 8]
add esp, 0x10
cmp eax, 1
mov eax, ecx
cdq
sete bl
idiv dword [edi + 0x18]
mov byte [ebp - 1], bl
mov dword [edi + 0x1c], eax
test bl, bl
je 0x4109d1
add dword [edi + 0x14], ecx
mov edx, 0x18
push 0xffffffffffffffff
push eax
mov eax, dword [edi + 0x24]
push ecx
mov ecx, esp
push ecx
mov dword [ecx], eax
mov eax, esp
lea ecx, [edi + 0x20]
mov dword [eax], str.read
call fcn.0040eba0
mov ecx, dword [edi + 0x1c]
add esp, 0x10
mov edx, dword [edi + 0x18]
xor ebx, ebx
xor eax, eax
mov dword [ebp - 8], edx
test ecx, ecx
je 0x410976
dec ecx
mov dword [ebp - 0xc], ecx
xor ecx, ecx
cmp dword [ebp - 8], 1
jne 0x4108f7
cmp byte [esi], cl
jmp 0x4108fa
cmp word [esi], cx
sete cl
test ecx, ecx
je 0x410924
test eax, eax
je 0x41091d
cmp esi, eax
je 0x41091d
mov ecx, esi
imul edx, ebx
sub ecx, eax
push ecx
push eax
sub eax, edx
push eax
call fcn.0055cf50
add esp, 0xc
mov edx, dword [edi + 0x18]
inc ebx
lea eax, [edx + esi]
mov ecx, dword [ebp - 0xc]
add esi, edx
test ecx, ecx
jne 0x4108e7
test eax, eax
je 0x41094a
cmp esi, eax
je 0x41094a
mov ecx, dword [edi + 0x18]
sub esi, eax
imul ecx, ebx
push esi
push eax
sub eax, ecx
push eax
call fcn.0055cf50
add esp, 0xc
test ebx, ebx
je 0x410976
push 0xffffffffffffffff
push ebx
push ecx
mov eax, esp
mov edx, 1
push ecx
lea ecx, [edi + 0x20]
mov dword [eax], 0
mov eax, esp
mov dword [eax], str.nulls_removed
call fcn.0040eba0
add esp, 0x10
sub dword [edi + 0x1c], ebx
cmp dword [edi + 0x18], 1
jle 0x4109c5
test byte [edi + 4], 0x80
je 0x4109c5
mov ecx, dword [edi + 0x1c]
test ecx, ecx
je 0x4109a2
mov edx, dword [ebp + 8]
nop dword [eax]
movzx eax, word [edx + ecx*2 - 2]
dec ecx
rol ax, 8
mov word [edx + ecx*2], ax
test ecx, ecx
jne 0x410990
push 0xffffffffffffffff
push 0xffffffffffffffff
push ecx
mov esi, esp
xor edx, edx
push ecx
lea ecx, [edi + 0x20]
mov dword [esi], 0
mov esi, esp
mov dword [esi], str.endian_swap
call fcn.0040eba0
add esp, 0x10
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, edi
call fcn.00410680
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x410e30
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp + 8], 0
mov esi, edx
mov eax, dword [edi + 0x18]
mov ebx, dword [edi + 0x1c]
imul eax, ebx
mov dword [edi + 8], eax
mov eax, dword [ebp + 0xc]
test eax, eax
cmovne esi, eax
test byte [edi + 4], 0x80
je 0x410ed5
test edx, edx
jne 0x410e93
xor ecx, ecx
mov eax, ebx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0042afcb
mov ecx, dword [edi + 0x1c]
mov ebx, eax
add ecx, ecx
mov dword [ebp + 8], ebx
push ecx
push esi
push ebx
call fcn.0055d800
add esp, 0x10
mov edx, ebx
mov esi, ebx
mov ecx, dword [edi + 0x1c]
test ecx, ecx
je 0x410eb2
nop word [eax + eax]
movzx eax, word [edx + ecx*2 - 2]
dec ecx
rol ax, 8
mov word [edx + ecx*2], ax
test ecx, ecx
jne 0x410ea0
push 0xffffffffffffffff
push 0xffffffffffffffff
push ecx
mov eax, esp
xor edx, edx
push ecx
lea ecx, [edi + 0x20]
mov dword [eax], 0
mov eax, esp
mov dword [eax], str.endian_swap
call fcn.0040eba0
add esp, 0x10
push dword [edi]
push 1
push dword [edi + 8]
push esi
call fcn.0056d15c
add esp, 0x10
cmp eax, 1
mov eax, dword [ebp + 8]
sete bl
test eax, eax
je 0x410efb
push eax
call fcn.0042afd4
add esp, 4
test bl, bl
je 0x410f34
mov eax, dword [edi + 8]
mov edx, 0x18
add dword [edi + 0x14], eax
push 0xffffffffffffffff
push dword [edi + 0x1c]
push ecx
mov ecx, dword [edi + 0x24]
mov esi, esp
push ecx
mov dword [esi], ecx
mov ecx, esp
mov dword [ecx], str.write
lea ecx, [edi + 0x20]
call fcn.0040eba0
add esp, 0x10
mov al, bl
pop edi
pop esi
pop ebx
pop ebp
ret 8
mov ecx, edi
call fcn.00410680
pop edi
pop esi
mov al, bl
pop ebx
pop ebp
ret 8
Function at 0x418980
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x41898b
xor eax, eax
pop ebp
ret
push esi
mov esi, dword [ebp + 8]
not ecx
cmp esi, 8
jb 0x418a47
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x5bd3f0]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x5bd3f0]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x5bd3f0]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x5bd3f0]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x5bd3f0]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x5bd3f0]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x5bd3f0]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x5bd3f0]
sub edi, 1
jne 0x4189a0
pop edi
test esi, esi
je 0x418a6a
nop dword [eax + eax]
movzx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x5bd3f0]
sub esi, 1
jne 0x418a50
not ecx
mov eax, ecx
pop esi
pop ebp
ret
Function at 0x418d60
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
cmp byte [esi + 0x2d], 0
je 0x418e38
mov eax, dword [esi + 0x3c]
mov ebx, dword [ebp + 0xc]
test eax, eax
je 0x418d94
cmp dword [esi + 0x40], ebx
jae 0x418d94
push eax
call fcn.0042afd4
add esp, 4
mov dword [esi + 0x3c], 0
cmp dword [esi + 0x3c], 0
jne 0x418dac
lea eax, [ebx + ebx]
push eax
call fcn.0042afcb
add esp, 4
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], ebx
push ebx
push edi
push dword [esi + 0x3c]
call fcn.0055d800
xor edx, edx
add esp, 0xc
mov dword [ebp + 8], edx
test ebx, ebx
je 0x418e35
mov eax, dword [esi + 0x3c]
mov ecx, dword [esi + 0x30]
shr ecx, 8
mov bl, byte [edx + eax]
mov edx, dword [esi + 0x38]
mov edi, edx
movsx eax, bl
and edi, 0xfffd
xor eax, dword [esi + 0x30]
or edi, 2
movzx eax, al
mov eax, dword [eax*4 + 0x5bd3f0]
xor eax, ecx
mov ecx, edi
mov dword [esi + 0x30], eax
xor ecx, 1
movzx eax, al
add eax, dword [esi + 0x34]
imul eax, eax, 0x8088405
imul ecx, edi
inc eax
mov dword [esi + 0x34], eax
shr eax, 0x18
xor eax, edx
shr ecx, 8
movzx eax, al
xor cl, bl
shr edx, 8
xor edx, dword [eax*4 + 0x5bd3f0]
mov dword [esi + 0x38], edx
mov edx, dword [ebp + 8]
mov eax, dword [esi + 0x3c]
mov byte [edx + eax], cl
inc edx
mov dword [ebp + 8], edx
cmp edx, dword [ebp + 0xc]
jb 0x418dc2
mov edi, dword [esi + 0x3c]
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x418e76
mov edx, dword [esi + 0x24]
mov ebx, dword [ebp + 0xc]
lea eax, [edx + ebx]
cmp eax, dword [esi + 0x28]
jb 0x418e5d
pop edi
mov dword [esi + 0x14], 0x30000
xor eax, eax
pop esi
pop ebx
pop ebp
ret 8
push ebx
add ecx, edx
push edi
push ecx
call fcn.0055d800
add esp, 0xc
mov eax, ebx
add dword [esi + 0x24], ebx
pop edi
pop esi
pop ebx
pop ebp
ret 8
mov eax, dword [esi + 4]
test eax, eax
je 0x418e98
push 0
lea ecx, [ebp + 8]
push ecx
push dword [ebp + 0xc]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
pop ebp
ret 8
pop edi
mov dword [esi + 0x14], 0x1000000
xor eax, eax
pop esi
pop ebx
pop ebp
ret 8
Function at 0x419160
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov edx, dword [edi + 0x78]
test edx, edx
je 0x4191bd
mov ecx, dword [edi + 0x80]
mov ebx, dword [edi + 0x7c]
cmp ecx, ebx
jae 0x419205
mov esi, dword [ebp + 8]
lea eax, [ecx + edx]
sub ebx, ecx
cmp ebx, dword [ebp + 0xc]
cmova ebx, dword [ebp + 0xc]
push ebx
push eax
push esi
call fcn.0055d800
mov ecx, dword [edi + 0x6c]
mov edx, esi
add dword [edi + 0x80], ebx
add dword [edi + 0x68], ebx
push ebx
call fcn.00418980
add esp, 0x10
mov dword [edi + 0x6c], eax
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [edi + 0x70]
test eax, eax
je 0x4191fe
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 4]
push 0
push ecx
push dword [ebp + 0xc]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x419205
mov esi, dword [ebp - 4]
mov edx, ebx
mov ecx, dword [edi + 0x6c]
add dword [edi + 0x68], esi
push esi
call fcn.00418980
add esp, 4
mov dword [edi + 0x6c], eax
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [edi + 0x14], 0x1000000
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x419faa
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edi
mov ebx, dword [edi + 0x2c]
mov eax, dword [edi + 0x2c]
mov edx, dword [edi + 0x3c]
add eax, 0xfffffefa
sub edx, dword [edi + 0x74]
add eax, ebx
sub edx, dword [edi + 0x6c]
mov dword [ebp - 0xc], edx
cmp dword [edi + 0x6c], eax
jb 0x41a049
mov ecx, dword [edi + 0x38]
push ebx
lea eax, [ecx + ebx]
push eax
push ecx
call fcn.0055d800
mov ecx, dword [edi + 0x4c]
add esp, 0xc
mov eax, dword [edi + 0x44]
sub dword [edi + 0x70], ebx
sub dword [edi + 0x6c], ebx
sub dword [edi + 0x5c], ebx
mov edi, ecx
mov dword [ebp - 8], ecx
lea esi, [eax + ecx*2]
lea esi, [esi - 2]
xor ecx, ecx
movzx edx, word [esi]
mov eax, edx
sub eax, ebx
cmp edx, ebx
movzx eax, ax
cmovae ecx, eax
mov word [esi], cx
sub edi, 1
jne 0x419ffe
mov edi, dword [ebp - 4]
mov eax, dword [edi + 0x40]
mov edi, ebx
lea esi, [eax + ebx*2]
lea esi, [esi - 2]
xor ecx, ecx
movzx edx, word [esi]
mov eax, edx
sub eax, ebx
cmp edx, ebx
movzx eax, ax
cmovae ecx, eax
mov word [esi], cx
sub edi, 1
jne 0x41a025
mov edx, dword [ebp - 0xc]
mov edi, dword [ebp - 4]
add edx, ebx
mov esi, dword [edi]
cmp dword [esi + 4], 0
je 0x41a173
mov eax, dword [edi + 0x74]
add eax, dword [edi + 0x6c]
add eax, dword [edi + 0x38]
mov dword [ebp - 0xc], eax
mov eax, dword [esi + 4]
cmp eax, edx
mov ecx, eax
cmova ecx, edx
mov dword [ebp - 8], ecx
test ecx, ecx
jne 0x41a076
xor eax, eax
jmp 0x41a0c7
sub eax, ecx
mov dword [esi + 4], eax
mov eax, dword [esi + 0x1c]
mov eax, dword [eax + 0x18]
cmp eax, 1
jne 0x41a093
mov edx, dword [esi]
push ecx
mov ecx, dword [esi + 0x30]
call fcn.0041d6d5
jmp 0x41a0ab
cmp eax, 2
jne 0x41a0af
mov edx, dword [esi]
test edx, edx
jne 0x41a0a2
xor eax, eax
jmp 0x41a0ac
push ecx
mov ecx, dword [esi + 0x30]
call fcn.0041d920
pop ecx
mov dword [esi + 0x30], eax
push dword [ebp - 8]
push dword [esi]
push dword [ebp - 0xc]
call fcn.0055d800
mov eax, dword [ebp - 8]
add esp, 0xc
add dword [esi], eax
add dword [esi + 8], eax
add dword [edi + 0x74], eax
cmp dword [edi + 0x74], 3
jb 0x41a0ef
mov edx, dword [edi + 0x6c]
mov eax, dword [edi + 0x38]
mov ecx, dword [edi + 0x58]
movzx esi, byte [edx + eax]
mov dword [edi + 0x48], esi
movzx eax, byte [edx + eax + 1]
shl esi, cl
xor esi, eax
and esi, dword [edi + 0x54]
mov dword [edi + 0x48], esi
cmp dword [edi + 0x74], 0x106
jae 0x41a104
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x419fbb
mov ecx, dword [edi + 0x16c0]
mov ebx, dword [edi + 0x3c]
cmp ecx, ebx
jae 0x41a173
mov esi, dword [edi + 0x6c]
add esi, dword [edi + 0x74]
cmp ecx, esi
jae 0x41a143
mov eax, 0x102
sub ebx, esi
cmp ebx, eax
cmova ebx, eax
mov eax, dword [edi + 0x38]
push ebx
add eax, esi
push 0
push eax
call fcn.0055dd80
lea eax, [ebx + esi]
add esp, 0xc
mov dword [edi + 0x16c0], eax
jmp 0x41a173
lea eax, [esi + 0x102]
cmp ecx, eax
jae 0x41a173
mov eax, dword [edi + 0x38]
sub esi, ecx
sub ebx, ecx
add esi, 0x102
cmp esi, ebx
cmova esi, ebx
add eax, ecx
push esi
push 0
push eax
call fcn.0055dd80
add esp, 0xc
add dword [edi + 0x16c0], esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41a929
Capabilities:
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x5e8f64]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x20c], ebx
test ebx, ebx
jne 0x41a952
push 0xfffffffffffffffd
pop eax
jmp 0x41aa9a
cmp dword [ebp + 0xc], 0
jg 0x41a95c
push 0xfffffffffffffffc
jmp 0x41a94c
cmp dword [ebp + 0x10], 0
jne 0x41a966
push 0xfffffffffffffffb
jmp 0x41a94c
push edi
mov edi, dword [ebp + 0x14]
test edi, edi
jg 0x41a972
push 0xfffffffffffffffa
jmp 0x41a979
cmp dword [ebp + 0xc], edi
jge 0x41a97f
push 0xfffffffffffffff9
pop eax
jmp 0x41aa99
push esi
xor esi, esi
mov edx, esi
mov ecx, esi
mov al, byte [edx + str.C6642F75_8DBE_473d_A98B_940F84EF702C]
mov byte [ebp + ecx - 0x204], al
lea eax, [edx + 1]
cdq
mov dword [ebp - 0x208], 0x26
idiv dword [ebp - 0x208]
mov byte [ebp + ecx - 0x104], cl
inc ecx
cmp ecx, 0x100
jl 0x41a986
mov ebx, esi
mov edi, esi
mov dl, byte [ebp + edi - 0x104]
movzx eax, byte [ebp + edi - 0x204]
add ebx, eax
movzx ecx, dl
add ebx, ecx
and ebx, 0x800000ff
jns 0x41a9e1
dec ebx
or ebx, 0xffffff00
inc ebx
mov al, byte [ebp + ebx - 0x104]
mov byte [ebp + ebx - 0x104], dl
mov byte [ebp + edi - 0x104], al
inc edi
cmp edi, 0x100
jl 0x41a9bb
mov edi, dword [ebp + 0x14]
mov eax, esi
mov ebx, dword [ebp - 0x20c]
test edi, edi
jle 0x41aa96
mov edx, dword [ebp + 0x10]
sub edx, ebx
inc eax
and eax, 0x800000ff
jns 0x41aa26
dec eax
or eax, 0xffffff00
inc eax
mov dword [ebp - 0x208], eax
movzx eax, byte [ebp + eax - 0x104]
add esi, eax
and esi, 0x800000ff
jns 0x41aa46
dec esi
or esi, 0xffffff00
inc esi
mov eax, dword [ebp - 0x208]
mov cl, byte [ebp + esi - 0x104]
mov al, byte [ebp + eax - 0x104]
mov byte [ebp + esi - 0x104], al
mov eax, dword [ebp - 0x208]
mov byte [ebp + eax - 0x104], cl
movzx eax, byte [ebp + esi - 0x104]
movzx ecx, cl
add ecx, eax
movzx eax, cl
mov al, byte [ebp + eax - 0x104]
xor al, byte [edx + ebx]
mov byte [ebx], al
inc ebx
mov eax, dword [ebp - 0x208]
sub edi, 1
jne 0x41aa17
xor eax, eax
pop esi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0055ab0a
mov esp, ebp
pop ebp
ret
Function at 0x426f40
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor edi, edi
mov esi, ecx
cmp dword [ebp + 0x10], 1
jb 0x426f8f
mov ecx, dword [esi]
test ecx, ecx
je 0x426f5e
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esi], edi
mov ecx, dword [0x5e9c98]
test ecx, ecx
jne 0x426f77
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ecx, eax
mov dword [0x5e9c98], ecx
movzx eax, word [ebp + 8]
push 0x5ca3a8
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 8], eax
test eax, eax
jne 0x426f99
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0xc
push ebx
push eax
push dword [0x5e9c98]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
jne 0x426fbf
push eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop ebx
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
test eax, eax
jne 0x426fe1
push ebx
xor edi, edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop ebx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
push dword [ebp + 8]
push dword [0x5e9c98]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 4]
mov edx, eax
call fcn.00426df0
mov dword [esi], eax
test eax, eax
je 0x427026
mov ecx, eax
call fcn.00421b50
mov ecx, dword [esi]
mov dword [esi + 0x10], eax
call fcn.00421b80
mov dword [esi + 0x14], eax
mov edi, 1
mov eax, dword [ebp + 0x10]
mov dword [esi + 8], 1
mov dword [esi + 0xc], eax
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop ebx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x429dd0
Capabilities:
Read file via mapping

Disassembly:
push esi
push str.GlobalFA6FBBB1_8C8E_43b1_B8EC_35573A94C231
push 0
push 6
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov dword [esi], eax
test eax, eax
je 0x429e0c
push 0
push 0
push 0
push 6
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 4], eax
test eax, eax
jne 0x429e10
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0
xor eax, eax
pop esi
ret
mov dword [esi + 8], eax
mov eax, 1
pop esi
ret

Function at 0x429ef0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x20019
push 0
push str.SOFTWARETencentQQPCMgr
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [0x5f4850], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x429f6b
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
mov dword [ebp - 0xc], 4
push eax
push 0
push 0
push str.EnableLogToView
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x429f62
movzx eax, byte [0x5f4850]
mov ecx, 1
cmp dword [ebp - 8], ecx
cmove eax, ecx
mov byte [0x5f4850], al
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret