joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404490
Capabilities:
Enumerate process modules
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x67c
mov eax, dword [0x43fdf0]
xor eax, ebp
mov dword [ebp - 0xc], eax
push str.CCheckEnvirDlg::CheckYYDLL__check_yy_checker.dll_begin.
call fcn.004010c0
add esp, 4
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 4], eax
mov dword [ebp - 0x240], 0
push 0x228
push 0
lea eax, [ebp - 0x23c]
push eax
call fcn.00423050
add esp, 0xc
mov dword [ebp - 0x240], 0x22c
lea ecx, [ebp - 0x240]
push ecx
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.dll_Process32FirstW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x404638
mov dword [ebp - 0x668], 0
push 0x424
push 0
lea eax, [ebp - 0x664]
push eax
call fcn.00423050
add esp, 0xc
mov ecx, dword [ebp - 0x238]
push ecx
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x670], eax
mov dword [ebp - 0x668], 0x428
lea edx, [ebp - 0x668]
push edx
mov eax, dword [ebp - 0x670]
push eax
call sub.KERNEL32.dll_Module32FirstW
mov dword [ebp - 0x66c], eax
cmp dword [ebp - 0x66c], 0
je 0x404620
lea ecx, [ebp - 0x648]
push ecx
lea ecx, [ebp - 0x674]
call fcn.00404910
push str.yy_checker.dll
lea ecx, [ebp - 0x674]
call fcn.00404b70
test eax, eax
jne 0x4045f7
lea edx, [ebp - 0x448]
push edx
lea ecx, [ebp - 0x678]
call fcn.00404910
lea ecx, [ebp - 0x678]
call fcn.00403550
push eax
call fcn.00404350
add esp, 4
movzx eax, al
test eax, eax
jne 0x4045ec
push str.CCheckEnvirDlg::CheckYYDLL__check_yy_checker.dll_return_true.
call fcn.004010c0
add esp, 4
mov byte [ebp - 0x679], 1
lea ecx, [ebp - 0x678]
call fcn.00403180
lea ecx, [ebp - 0x674]
call fcn.00403180
mov al, byte [ebp - 0x679]
jmp 0x404651
lea ecx, [ebp - 0x678]
call fcn.00403180
lea ecx, [ebp - 0x668]
push ecx
mov edx, dword [ebp - 0x670]
push edx
call sub.KERNEL32.dll_Module32NextW
mov dword [ebp - 0x66c], eax
lea ecx, [ebp - 0x674]
call fcn.00403180
jmp 0x40455a
lea eax, [ebp - 0x240]
push eax
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_Process32NextW
mov dword [ebp - 8], eax
jmp 0x4044f9
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.CCheckEnvirDlg::CheckYYDLL__check_yy_checker.dll_return_false.
call fcn.004010c0
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00422e00
mov esp, ebp
pop ebp
ret

Function at 0x404660
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x4349b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x441200], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xb7
jne 0x40469b
push str.CCheckEnvirDlg::CheckSetupExist__return_true.
call fcn.004010c0
add esp, 4
mov al, 1
jmp 0x40469d
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x4053f0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0
push 0
push 0
push str.http:__www.duowan.com
push 0x434bf8
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4059c0
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
mov eax, dword [0x43fdf0]
xor eax, ebp
mov dword [ebp - 0x28], eax
cmp dword [ebp + 8], 0
je 0x4059e7
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4059ee
mov al, 1
jmp 0x405b26
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x405b24
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0x23c], eax
mov eax, dword [ebp - 0x23c]
and eax, 0xfffffffe
mov dword [ebp - 0x23c], eax
mov ecx, dword [ebp - 0x23c]
and ecx, 0xfffffffd
mov dword [ebp - 0x23c], ecx
mov edx, dword [ebp - 0x23c]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x405a54
mov al, 1
jmp 0x405b26
xor edx, edx
mov word [ebp - 0x238], dx
push 0x20a
push 0
lea eax, [ebp - 0x236]
push eax
call fcn.00423050
add esp, 0xc
push 0x104
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x238]
push edx
call fcn.004232f5
add esp, 0xc
push 0x1e
push 0
lea eax, [ebp - 0x20]
push eax
call fcn.00423050
add esp, 0xc
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 3
lea ecx, [ebp - 0x238]
mov dword [ebp - 0x18], ecx
mov edx, 0x614
mov word [ebp - 0x10], dx
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x405b24
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x240]
call fcn.00404910
mov edx, dword [ebp + 0xc]
push edx
lea ecx, [ebp - 0x240]
call fcn.004049b0
lea ecx, [ebp - 0x240]
call fcn.00403550
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.00405b40
add esp, 8
neg eax
sbb eax, eax
add eax, 1
mov byte [ebp - 0x241], al
lea ecx, [ebp - 0x240]
call fcn.00403180
mov al, byte [ebp - 0x241]
jmp 0x405b26
mov al, 1
mov ecx, dword [ebp - 0x28]
xor ecx, ebp
call fcn.00422e00
mov esp, ebp
pop ebp
ret
Function at 0x405b40
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44c
mov eax, dword [0x43fdf0]
xor eax, ebp
mov dword [ebp - 8], eax
xor eax, eax
mov word [ebp - 0x448], ax
push 0x20a
push 0
lea ecx, [ebp - 0x446]
push ecx
call fcn.00423050
add esp, 0xc
push 0x102
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x448]
push eax
call fcn.004232f5
add esp, 0xc
xor ecx, ecx
mov word [ebp - 0x218], cx
push 0x20a
push 0
lea edx, [ebp - 0x216]
push edx
call fcn.00423050
add esp, 0xc
push 0x102
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x218]
push ecx
call fcn.004232f5
add esp, 0xc
push 0x1e
push 0
lea edx, [ebp - 0x238]
push edx
call fcn.00423050
add esp, 0xc
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x234], 4
lea eax, [ebp - 0x448]
mov dword [ebp - 0x230], eax
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x22c], ecx
mov edx, 0x614
mov word [ebp - 0x228], dx
lea eax, [ebp - 0x238]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x405c5b
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x405c5b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x44c], eax
cmp dword [ebp - 0x44c], 0
jne 0x405c53
mov dword [ebp - 0x44c], 1
mov eax, dword [ebp - 0x44c]
jmp 0x405c5d
xor eax, eax
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00422e00
mov esp, ebp
pop ebp
ret

Function at 0x406180
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [ebp - 0x30], ecx
cmp dword [ebp + 0xc], 1
jne 0x40620b
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x28]
call fcn.0040ddb0
push 0
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea ecx, [ebp - 0x28]
call fcn.00404bb0
cmp eax, 1
jne 0x4061e2
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx + 0x74]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 4]
push ecx
push 0x4068d0
push 0
push 0
call fcn.00422f9d
add esp, 0x18
mov edx, dword [ebp - 0x30]
mov dword [edx + 0x74], eax
jmp 0x4061f7
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0x74]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov dword [ebp - 0x2c], 0
lea ecx, [ebp - 0x28]
call fcn.0040dde0
mov eax, dword [ebp - 0x2c]
jmp 0x40622f
push 0
push 0
mov edx, dword [ebp - 0x30]
mov eax, dword [edx + 4]
push eax
push 0x406b00
push 0
push 0
call fcn.00422f9d
add esp, 0x18
mov ecx, dword [ebp - 0x30]
mov dword [ecx + 0x6c], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x406240
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov dword [ebp - 0x34], ecx
lea ecx, [ebp - 8]
call fcn.00403510
mov ecx, 0x441210
call fcn.00403550
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.00420610
add esp, 8
mov ecx, eax
call fcn.00401550
push eax
lea ecx, [ebp - 8]
call fcn.00402c60
lea ecx, [ebp - 0x30]
call fcn.00401130
push str.temp
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 4]
push edx
call fcn.004083c0
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 0x34]
call fcn.00406500
mov ecx, dword [ebp - 4]
push ecx
push 0x434f10
call fcn.004010c0
add esp, 8
push str.updatefiles
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x14]
push eax
call fcn.004083c0
lea ecx, [ebp - 0x14]
push ecx
mov ecx, dword [ebp - 0x34]
call fcn.00406500
mov edx, dword [ebp - 0x14]
push edx
push 0x434f5c
call fcn.004010c0
add esp, 8
push str.oem.txt
push 0x441210
lea eax, [ebp - 0x10]
push eax
call fcn.004083c0
push str.ProductInfo.txt
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0xc]
push edx
call fcn.004083c0
lea ecx, [ebp - 0x10]
call fcn.00403550
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 0x10]
push eax
push 0x434fc4
call fcn.004010c0
add esp, 8
lea ecx, [ebp - 0xc]
call fcn.00403550
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0xc]
push ecx
push str.Delete_temp_directory__s
call fcn.004010c0
add esp, 8
lea ecx, [ebp - 0xc]
call fcn.00403180
lea ecx, [ebp - 0x10]
call fcn.00403180
lea ecx, [ebp - 0x14]
call fcn.00403180
lea ecx, [ebp - 4]
call fcn.00403180
lea ecx, [ebp - 8]
call fcn.00403180
mov esp, ebp
pop ebp
ret

Function at 0x406370
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
call fcn.00406240
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x6c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
mov edx, dword [ebp - 4]
push edx
push 0x406cf0
push 0
push 0
call fcn.00422f9d
add esp, 0x18
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x70], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10

Function at 0x406450
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x18]
add ecx, 4
call fcn.00408440
push 2
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0xc]
call fcn.00403220
mov ecx, eax
call fcn.00403550
push eax
lea ecx, [ebp - 8]
call fcn.00408aa0
push 1
lea ecx, [ebp - 8]
call fcn.00408420
lea ecx, [ebp - 4]
call fcn.00403510
lea edx, [ebp - 4]
push edx
call fcn.00406400
add esp, 4
push 0x43504c
lea ecx, [ebp - 4]
call fcn.004049b0
push 0x435050
lea ecx, [ebp - 4]
call fcn.004049b0
lea ecx, [ebp - 4]
call fcn.00403550
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x70]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 4]
call fcn.00403180
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x406500
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x270
mov eax, dword [0x43fdf0]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x270], ecx
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 4]
call fcn.00402c10
push str..
lea ecx, [ebp - 4]
call fcn.004049b0
lea ecx, [ebp - 0x258]
push ecx
lea ecx, [ebp - 4]
call fcn.00403550
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0xffffffff
je 0x4066a4
lea edx, [ebp - 0x22c]
push edx
lea ecx, [ebp - 0x264]
call fcn.00404910
push 0x43506c
lea ecx, [ebp - 0x264]
call fcn.00404b70
test eax, eax
je 0x406595
push 0x435070
lea ecx, [ebp - 0x264]
call fcn.00404b70
test eax, eax
jne 0x4065a7
lea ecx, [ebp - 0x264]
call fcn.00403180
jmp 0x40667b
mov eax, dword [ebp - 0x258]
and eax, 0x10
je 0x40661f
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x268]
call fcn.00402c10
push 0x435078
lea ecx, [ebp - 0x268]
call fcn.004049b0
lea edx, [ebp - 0x264]
push edx
lea ecx, [ebp - 0x268]
call fcn.00408390
lea eax, [ebp - 0x268]
push eax
mov ecx, dword [ebp - 0x270]
call fcn.00406500
lea ecx, [ebp - 0x268]
call fcn.00403550
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea ecx, [ebp - 0x268]
call fcn.00403180
lea ecx, [ebp - 0x264]
call fcn.00403180
jmp 0x40667b
lea ecx, [ebp - 0x264]
push ecx
push 0x43507c
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x26c]
push eax
call fcn.004083c0
push eax
lea ecx, [ebp - 0x260]
push ecx
call fcn.004084a0
lea ecx, [ebp - 0x26c]
call fcn.00403180
lea ecx, [ebp - 0x260]
call fcn.00403550
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x260]
call fcn.00403180
lea ecx, [ebp - 0x264]
call fcn.00403180
lea edx, [ebp - 0x258]
push edx
mov eax, dword [ebp - 0x25c]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x40655b
mov ecx, dword [ebp - 0x25c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp - 4]
call fcn.00403180
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00422e00
mov esp, ebp
pop ebp
ret 4
Function at 0x4066c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov dword [ebp - 0x50], ecx
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x50]
add ecx, 4
call fcn.00408440
lea ecx, [ebp - 0x24]
push ecx
lea ecx, [ebp - 0x14]
call fcn.00403a80
mov dword [ebp - 0x18], 0x122
push 1
lea edx, [ebp - 0x24]
push edx
mov ecx, dword [ebp - 0x50]
add ecx, 4
call fcn.00408500
push 0x41e
lea eax, [ebp - 0x40]
push eax
mov ecx, dword [ebp - 0x50]
add ecx, 4
call fcn.00403220
mov ecx, eax
call fcn.00403550
push eax
lea ecx, [ebp - 0x10]
call fcn.00408aa0
lea ecx, [ebp - 0x38]
push ecx
lea ecx, [ebp - 0x10]
call fcn.00408550
lea edx, [ebp - 0x38]
push edx
mov ecx, dword [ebp - 0x50]
add ecx, 4
call fcn.00408570
mov dword [ebp - 0x30], 0x1f5
push 1
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x10]
call fcn.00408500
push 1
mov ecx, dword [ebp - 0x50]
add ecx, 4
call fcn.004085b0
push 0x3023
lea ecx, [ebp - 0x44]
push ecx
lea ecx, [ebp - 0x14]
call fcn.00403220
mov ecx, eax
call fcn.00403550
push eax
lea ecx, [ebp - 0x3c]
call fcn.00408aa0
push 0
lea ecx, [ebp - 0x3c]
call fcn.004048f0
push 0
lea ecx, [ebp - 0x14]
call fcn.00403200
push eax
lea ecx, [ebp - 0xc]
call fcn.00403cb0
push 1
push 0xf060
lea ecx, [ebp - 0xc]
call fcn.00403d00
lea ecx, [ebp - 0xc]
call fcn.004057b0
push 2
lea edx, [ebp - 0x48]
push edx
lea ecx, [ebp - 0x14]
call fcn.00403220
mov ecx, eax
call fcn.00403550
push eax
lea ecx, [ebp - 8]
call fcn.00408aa0
push 0
lea ecx, [ebp - 8]
call fcn.00408420
push 0
push 0
mov eax, dword [ebp - 0x50]
mov ecx, dword [eax + 4]
push ecx
push 0x4068d0
push 0
push 0
call fcn.00422f9d
add esp, 0x18
mov edx, dword [ebp - 0x50]
mov dword [edx + 0x74], eax
lea ecx, [ebp - 4]
call fcn.00403510
push 0x110
lea ecx, [ebp - 4]
call fcn.004036c0
push 0x441210
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x28]
push ecx
call fcn.004084a0
mov ecx, 0x441210
call fcn.00403550
push eax
mov ecx, dword [ebp - 0x50]
add ecx, 0x64
call fcn.004031e0
lea ecx, [ebp - 0x28]
call fcn.00403550
push eax
mov ecx, dword [ebp - 0x50]
add ecx, 0x5c
call fcn.00408b10
push 1
mov ecx, dword [ebp - 0x50]
add ecx, 0x60
call fcn.00408b80
mov dword [ebp - 0x4c], 0
lea ecx, [ebp - 0x28]
call fcn.00403180
lea ecx, [ebp - 4]
call fcn.00403180
lea ecx, [ebp - 0xc]
call fcn.00403cd0
mov eax, dword [ebp - 0x4c]
mov esp, ebp
pop ebp
ret
Function at 0x4074b0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x20], ecx
lea eax, [ebp - 4]
push eax
push 0x43560c
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x407515
mov ecx, 0x441210
call fcn.00403550
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.0042336b
add esp, 4
shl eax, 1
push eax
mov edx, dword [ebp - 0x10]
push edx
push 1
push 0
push 0x435634
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x407522
push str.CSetupDecompressPage::WriteRegedit__RegCreateKey_STR_YY_REG_LOCATION_fail.
call fcn.004010c0
add esp, 4
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall
lea ecx, [ebp - 8]
call fcn.00404910
push 0x435750
lea ecx, [ebp - 8]
call fcn.004049b0
push 0x435754
lea ecx, [ebp - 8]
call fcn.004049b0
lea edx, [ebp - 4]
push edx
lea ecx, [ebp - 8]
call fcn.00403550
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x407673
push 0x43575c
push 0x435778
push 0x441210
lea eax, [ebp - 0x1c]
push eax
call fcn.004083c0
push eax
lea ecx, [ebp - 0x14]
push ecx
call fcn.004083c0
lea ecx, [ebp - 0x1c]
call fcn.00403180
lea ecx, [ebp - 0x14]
call fcn.00403550
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
push edx
call fcn.0042336b
add esp, 4
shl eax, 1
push eax
mov eax, dword [ebp - 0x18]
push eax
push 1
push 0
push 0x43577c
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x43579c
call fcn.0042336b
add esp, 4
shl eax, 1
push eax
push 0x4357a4
push 1
push 0
push str.DisplayName
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x4357c4
call fcn.0042336b
add esp, 4
shl eax, 1
push eax
push 0x4357d0
push 1
push 0
push str.Publisher
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x4357f0
call fcn.0042336b
add esp, 4
shl eax, 1
push eax
push str.http:__www.yy.com_
push 1
push 0
push str.URLInfoAbout
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x43585c
call fcn.0042336b
add esp, 4
shl eax, 1
push eax
push 0x435870
push 1
push 0
push str.DisplayVersion
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea ecx, [ebp - 0x14]
call fcn.00403180
jmp 0x407680
push str.CSetupDecompressPage::WriteRegedit__RegCreateKey_strUninstallKey_fail.
call fcn.004010c0
add esp, 4
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 8]
call fcn.00403180
mov esp, ebp
pop ebp
ret
Function at 0x408040
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov dword [ebp - 0x68], ecx
push str.CSetupDecompressPage::_do3XUpdate_begin.
call fcn.004010c0
add esp, 4
push str.yywizard.exe
push 0x436118
push 0x441210
lea eax, [ebp - 0x64]
push eax
call fcn.004083c0
push eax
lea ecx, [ebp - 4]
push ecx
call fcn.004083c0
lea ecx, [ebp - 0x64]
call fcn.00403180
mov dword [ebp - 0x60], 0
push 0x40
push 0
lea edx, [ebp - 0x5c]
push edx
call fcn.00423050
add esp, 0xc
mov dword [ebp - 0x14], 0
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x60], 0x44
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x60]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 4]
call fcn.00403550
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x40810b
push 0xffffffffffffffff
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push str.CSetupDecompressPage::_do3XUpdate__wait_finish.
call fcn.004010c0
add esp, 4
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.CSetupDecompressPage::_do3XUpdate_finish.
call fcn.004010c0
add esp, 4
lea ecx, [ebp - 4]
call fcn.00403180
mov esp, ebp
pop ebp
ret
Function at 0x40cbf0
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov dword [ebp - 0x20], ecx
push 3
lea eax, [ebp - 4]
push eax
mov ecx, 0x441210
call fcn.00408770
push 8
call fcn.00423e61
add esp, 4
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 8], ecx
push 0
push 0
mov edx, dword [ebp - 8]
push edx
lea ecx, [ebp - 4]
call fcn.00403550
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x40cc57
mov eax, dword [ebp + 8]
fldz
fstp qword [eax]
mov byte [ebp - 0x11], 0
lea ecx, [ebp - 4]
call fcn.00403180
mov al, byte [ebp - 0x11]
jmp 0x40cce1
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov eax, dword [ecx + 4]
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x2c], ecx
and dword [ebp - 0x24], 0x7fffffff
fild qword [ebp - 0x28]
and dword [ebp - 0x2c], 0x80000000
mov dword [ebp - 0x30], 0
fild qword [ebp - 0x30]
fchs
faddp st(1)
fdiv qword [0x436d88]
mov edx, dword [ebp + 8]
fstp qword [edx]
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.00422a1a
add esp, 4
mov dword [ebp - 8], 0
mov edx, dword [ebp + 8]
fld qword [0x436d20]
fcomp qword [edx]
fnstsw ax
test ah, 0x41
jp 0x40ccc9
mov dword [ebp - 0x34], 1
jmp 0x40ccd0
mov dword [ebp - 0x34], 0
mov al, byte [ebp - 0x34]
mov byte [ebp - 0x19], al
lea ecx, [ebp - 4]
call fcn.00403180
mov al, byte [ebp - 0x19]
mov esp, ebp
pop ebp
ret 4
Function at 0x40d500
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov dword [ebp - 0x40], ecx
cmp dword [ebp - 0x40], 0
je 0x40d51a
mov eax, dword [ebp - 0x40]
sub eax, 0x50
mov dword [ebp - 0x44], eax
jmp 0x40d521
mov dword [ebp - 0x44], 0
mov ecx, dword [ebp - 0x44]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 1
cmp dword [ebp + 0x14], 0
je 0x40d5ad
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x3c]
push eax
mov ecx, dword [ebp - 8]
add ecx, 4
call fcn.00403220
mov ecx, eax
call fcn.00403550
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x14], 0xffffffff
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp + 0xc]
call fcn.0040bab0
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x40d59c
mov eax, dword [ebp - 0xc]
add eax, 1
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov dword [ebp - 0x14], eax
push 0xffffffffffffffff
mov ecx, dword [ebp + 0xc]
call fcn.00403860
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0xc]
jge 0x40d5ab
mov dword [ebp - 4], 0
jmp 0x40d5c8
mov ecx, dword [ebp + 0xc]
call fcn.00403550
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 8]
add ecx, 4
call fcn.0040ba80
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40d5e3
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
add ecx, 0x50
call fcn.0040d7e0
jmp 0x40d646
cmp dword [ebp + 0x14], 0
je 0x40d646
cmp dword [ebp + 0x18], 0
je 0x40d646
mov ecx, dword [ebp + 0xc]
call fcn.00403530
cmp eax, dword [ebp + 0x1c]
jle 0x40d646
mov dword [ebp - 0x38], 1
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0xc]
call fcn.00403530
mov dword [ebp - 0x30], eax
mov edx, dword [ebp + 0x1c]
mov dword [ebp - 0x2c], edx
lea eax, [ebp - 0x38]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 8]
add ecx, 0x50
call fcn.0040d840
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 0x18