joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40fcc1
Capabilities:
Check if file exists
Get common file path
Get program files directory

Disassembly:
push 0x10
mov eax, 0x43cd71
call fcn.00423c0f
mov esi, ecx
mov dword [ebp - 0x10], esi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], ebx
call fcn.004014a4
mov edi, dword [ebp + 8]
mov ecx, edi
push eax
call fcn.004012ba
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x18]
inc ebx
push eax
mov dword [ebp - 0x14], ebx
call fcn.0040fb9f
push eax
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.004109f9
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.0040153a
mov eax, dword [edi]
cmp dword [eax - 0xc], 0
jne 0x40fd45
lea eax, [ebp - 0x18]
mov ecx, esi
push eax
call fcn.0040f6cf
push eax
mov ecx, edi
mov dword [ebp - 4], 2
call fcn.004109f9
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.0040153a
mov eax, dword [edi]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp dword [eax - 0xc], 0
jne 0x40fdd1
push 0x104
mov ecx, edi
call fcn.0040a05d
push 0x104
mov ecx, edi
mov esi, eax
call fcn.0040a095
push esi
xor eax, eax
push eax
push eax
push 0x26
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push ecx
mov ecx, edi
call fcn.00410d60
mov edx, dword [0x4552bc]
lea ecx, [ebp - 0x18]
call fcn.0041d295
mov dword [ebp - 4], 3
mov ecx, edi
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
call fcn.004111af
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.0040153a
push edi
call fcn.0040f647
cmp dword [edi], 0
je 0x40fdc7
push dword [edi]
call ebx
test eax, eax
jne 0x40fdce
mov ecx, edi
call fcn.00410d2b
mov esi, dword [ebp - 0x10]
mov eax, dword [edi]
cmp dword [eax - 0xc], 0
jne 0x40fe53
push 0x444e50
lea edx, [esi + 0xc]
lea ecx, [ebp - 0x18]
call fcn.00410cc6
pop ecx
push eax
mov ecx, edi
mov dword [ebp - 4], 4
call fcn.004109f9
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.0040153a
mov edx, dword [0x4552b8]
lea ecx, [ebp - 0x18]
call fcn.0041d295
mov dword [ebp - 4], 5
mov ecx, edi
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
call fcn.004111af
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.0040153a
push edi
call fcn.0040f647
cmp dword [edi], 0
je 0x40fe4c
push dword [edi]
call ebx
test eax, eax
jne 0x40fe53
mov ecx, edi
call fcn.00410d2b
mov ecx, dword [edi]
cmp dword [ecx - 0xc], 0
je 0x40fe64
push edi
lea ecx, [esi + 8]
call fcn.004109f9
mov eax, edi
call fcn.00423bdd
ret 4
Function at 0x410208
Capabilities:
Encode data using xor
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
mov eax, dword [0x4524c8]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edi, edi
push edi
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
mov dword [ebp - 0x264], esi
cmp esi, 0xffffffff
je 0x410340
lea eax, [ebp - 0x254]
mov dword [ebp - 0x254], 0x22c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
jmp 0x410331
mov dword [ebp - 0x258], edi
cmp dword [ebx], edi
je 0x410323
mov eax, ebx
push dword [eax]
lea ecx, [ebp - 0x20]
call fcn.004031f5
cmp dword [ebp - 0xc], 8
lea edx, [ebp - 0x20]
mov ecx, dword [ebp - 0x10]
lea edi, [ebp - 0x20]
cmovae edx, dword [ebp - 0x20]
lea eax, [ebp - 0x20]
cmovae edi, dword [ebp - 0x20]
cmovae eax, dword [ebp - 0x20]
lea ecx, [edx + ecx*2]
cmp edi, ecx
je 0x4102da
and dword [ebp - 0x25c], 0
mov edx, ecx
and dword [ebp - 0x260], 0
sub edx, edi
inc edx
shr edx, 1
cmp edi, ecx
cmova edx, dword [ebp - 0x260]
test edx, edx
je 0x4102da
mov esi, dword [ebp - 0x25c]
sub edi, eax
mov cx, word [edi + eax]
xor cx, 0x19
inc esi
mov word [eax], cx
lea eax, [eax + 2]
cmp esi, edx
jne 0x4102c1
mov esi, dword [ebp - 0x264]
cmp dword [ebp - 0xc], 8
lea ecx, [ebp - 0x230]
push 0x104
lea eax, [ebp - 0x20]
cmovae eax, dword [ebp - 0x20]
push ecx
push eax
call fcn.00422646
add esp, 0xc
test eax, eax
je 0x410355
xor edi, edi
lea ecx, [ebp - 0x20]
push edi
push 1
call fcn.00403735
mov eax, dword [ebp - 0x258]
inc eax
mov dword [ebp - 0x258], eax
lea eax, [ebx + eax*4]
cmp dword [eax], edi
jne 0x41026a
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x41025a
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041e2e9
mov esp, ebp
pop ebp
ret 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 1
lea ecx, [ebp - 0x20]
call fcn.00403735
xor eax, eax
inc eax
jmp 0x410342

Function at 0x4113a2
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4113fb
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4113ec
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [ebp + 8]
lea ecx, [esi + eax]
and edx, 0xf
jbe 0x4113e8
cmp esi, ecx
jae 0x4113ec
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec edx
jne 0x4113d8
cmp esi, ecx
jb 0x4113f0
xor eax, eax
jmp 0x4113fa
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x41174d
Capabilities:
Get file version info

Disassembly:
push 0x14
mov eax, 0x43cf16
call fcn.00423c0f
mov esi, ecx
xor edi, edi
test esi, esi
jne 0x411768
xor eax, eax
jmp 0x4118f4
push 0
push esi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x411761
add eax, 8
push eax
mov dword [ebp - 0x18], eax
call fcn.0041dad6
mov ebx, eax
pop ecx
test ebx, ebx
je 0x411761
push dword [ebp - 0x18]
push 0
push ebx
call fcn.0041e3e0
add esp, 0xc
push ebx
push dword [ebp - 0x1c]
push 0
push esi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x4118eb
and dword [ebp - 0x10], edi
lea ecx, [ebp - 0x18]
and dword [ebp - 0x14], edi
mov edx, 0x446d80
call fcn.0041d295
mov esi, eax
and dword [ebp - 4], 0
mov ecx, dword [esi]
cmp dword [ecx - 4], 1
jle 0x4117d9
push dword [ecx - 0xc]
mov ecx, esi
call fcn.0040a116
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [esi]
push ebx
call dword [sym.imp.VERSION.dll_VerQueryValueW]
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.0040153a
mov eax, dword [ebp - 0x10]
push 2
pop edx
test eax, eax
jne 0x41186f
push str.762A792A5E2A582A432A442A4D2A6C2A432A462A4F2A632A442A4C2A452A762A1A2A1E2A1A2A132A1A2A1E2A482A1A2A762A792A5A2A4F2A492A432A4B2A462A682A5F2A432A462A4E2A2A2A
lea ecx, [ebp - 0x18]
call fcn.00410971
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
call fcn.0041d295
mov esi, eax
mov byte [ebp - 4], 2
mov ecx, dword [esi]
cmp dword [ecx - 4], 1
jle 0x41183a
push dword [ecx - 0xc]
mov ecx, esi
call fcn.0040a116
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [esi]
push ebx
call dword [sym.imp.VERSION.dll_VerQueryValueW]
mov ecx, dword [ebp - 0x1c]
lea ecx, [ecx - 0x10]
call fcn.0040153a
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.0040153a
mov eax, dword [ebp - 0x10]
push 2
pop edx
test eax, eax
je 0x4118b0
xor ecx, ecx
inc eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0041dad6
mov esi, eax
mov eax, dword [ebp - 0x10]
push eax
push dword [ebp - 0x14]
inc eax
push eax
push esi
call fcn.0042312b
mov eax, dword [ebp - 0x10]
xor ecx, ecx
push esi
mov word [esi + eax*2], cx
call fcn.0041f5d0
push esi
mov edi, eax
call fcn.0041f5a6
add esp, 0x1c
test edi, edi
jne 0x4118eb
and dword [ebp - 0x20], 0
lea eax, [ebp - 0x20]
and dword [ebp - 0x1c], 0
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x444e50
push ebx
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x4118eb
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4118eb
cmp word [eax + 0xa], 9
jne 0x4118eb
cmp word [eax + 8], 3
mov ecx, 0x3ff
cmove edi, ecx
push ebx
call fcn.0041f5a6
pop ecx
mov eax, edi
call fcn.00423bdd
ret
Function at 0x4120ee
Capabilities:
Parse pe header
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
push edi
test eax, eax
je 0x4121d3
xor ebx, ebx
cmp word [eax], bx
je 0x4121d3
push ebx
push ebx
push 3
push ebx
xor edi, edi
inc edi
push edi
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x4121d3
push 0
lea ecx, [ebp + 8]
mov dword [ebp + 8], ebx
push ecx
push 0x40
lea ebx, [esi + 4]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4121d3
mov eax, 0x5a4d
cmp word [ebx], ax
jne 0x4121d3
cmp dword [esi + 0x40], 0
jle 0x4121d3
push ecx
push dword [esi + 0x40]
mov ecx, esi
call fcn.004126b0
test eax, eax
je 0x4121d3
push 0
lea eax, [ebp + 8]
push eax
push 0xf8
lea ebx, [esi + 0x44]
push ebx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4121d3
cmp dword [ebx], 0x4550
jne 0x4121d3
mov eax, 0x100
test word [esi + 0x48], ax
je 0x4121d3
add eax, 0xb
cmp word [esi + 0x5c], ax
jne 0x4121d3
mov ecx, esi
call fcn.004121dd
test eax, eax
je 0x4121d3
mov ecx, esi
call fcn.004122e3
test eax, eax
je 0x4121cd
mov ecx, esi
call fcn.0041235f
test eax, eax
je 0x4121cd
mov ecx, esi
call fcn.00412581
test eax, eax
jne 0x4121cf
xor edi, edi
mov eax, edi
jmp 0x4121d5
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8
Function at 0x4121dd
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x4524c8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor eax, eax
push edi
mov dword [ebp - 0x30], esi
cmp dword [esi], 0xffffffff
je 0x4122ce
and dword [ebp - 0x38], eax
and dword [ebp - 0x34], eax
cmp ax, word [esi + 0x4a]
jae 0x4122cb
push 0x28
pop ebx
push ebx
lea eax, [ebp - 0x2c]
push 0
push eax
call fcn.0041e3e0
add esp, 0xc
lea eax, [ebp - 0x38]
push 0
push eax
push ebx
lea eax, [ebp - 0x2c]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 0x38], ebx
jne 0x4122df
mov ecx, dword [ebp - 0x24]
xor edx, edx
mov edi, dword [esi + 0x7c]
mov eax, ecx
div edi
test edx, edx
je 0x412255
sub edi, edx
add ecx, edi
mov dword [ebp - 0x24], ecx
lea ebx, [esi + 0x170]
mov ecx, dword [ebx + 4]
lea eax, [ebp - 0x2c]
cmp eax, ecx
jae 0x412290
cmp dword [ebx], eax
ja 0x412290
sub eax, dword [ebx]
push 0x28
pop edi
cdq
idiv edi
mov edi, eax
cmp ecx, dword [ebx + 8]
jne 0x412280
push ecx
mov ecx, ebx
call fcn.00412961
imul eax, edi, 0x28
mov edi, dword [ebx + 4]
add eax, dword [ebx]
test edi, edi
je 0x4122af
mov esi, eax
jmp 0x4122a7
cmp ecx, dword [ebx + 8]
jne 0x41229d
push ecx
mov ecx, ebx
call fcn.00412961
mov edi, dword [ebx + 4]
test edi, edi
je 0x4122af
lea esi, [ebp - 0x2c]
push 0xa
pop ecx
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x30]
push 0x28
pop eax
add dword [ebx + 4], eax
mov ebx, dword [ebp - 0x34]
movzx eax, word [esi + 0x4a]
inc ebx
push 0x28
mov dword [ebp - 0x34], ebx
cmp ebx, eax
pop ebx
jl 0x412213
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041e2e9
mov esp, ebp
pop ebp
ret
xor eax, eax
jmp 0x4122ce

Function at 0x4122e3
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
cmp dword [esi], 0xffffffff
jne 0x4122f4
xor eax, eax
jmp 0x412359
push ebx
xor ebx, ebx
cmp dword [esi + 0xbc], ebx
je 0x412356
cmp dword [esi + 0xc0], ebx
je 0x412356
push 0x28
lea edi, [esi + 0x13c]
push ebx
push edi
call fcn.0041e3e0
add esp, 0xc
mov ecx, esi
push dword [esi + 0xbc]
call fcn.004126d9
cmp eax, 0xffffffff
je 0x412356
push ecx
push eax
mov ecx, esi
mov dword [ebp - 4], ebx
call fcn.004126b0
test eax, eax
je 0x412356
push ebx
lea eax, [ebp - 4]
push eax
push 0x28
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
xor eax, eax
cmp dword [ebp - 4], 0x28
sete al
jmp 0x412358
xor eax, eax
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41235f
Capabilities:
Read file on windows

Disassembly:
push 0x3c
mov eax, 0x43cf39
call fcn.00423c42
mov esi, ecx
and dword [ebp - 0x44], 0
lea ebx, [esi + 0x164]
and dword [ebp - 0x40], 0
mov eax, dword [ebx + 4]
mov edi, dword [ebx]
cmp edi, eax
je 0x41239e
mov ebx, eax
push 0
push 1
mov ecx, edi
call fcn.00402015
add edi, 0x28
cmp edi, ebx
jne 0x412386
lea ebx, [esi + 0x164]
mov eax, dword [ebx]
mov ecx, esi
mov dword [ebx + 4], eax
push dword [esi + 0x158]
call fcn.004126d9
cmp eax, 0xffffffff
jne 0x4123bc
xor eax, eax
jmp 0x41244e
push ecx
push eax
mov ecx, esi
call fcn.004126b0
test eax, eax
je 0x4123b5
xor eax, eax
mov edi, eax
cmp dword [esi + 0x150], eax
jbe 0x41244b
mov dword [ebp - 0x28], 0xf
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x3c], al
push eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x44]
push eax
push 4
lea eax, [ebp - 0x40]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 0x44], 4
jne 0x412454
mov eax, dword [ebp - 0x40]
test eax, eax
je 0x41242f
push eax
mov ecx, esi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x20], eax
call fcn.004126d9
mov dword [ebp - 0x24], eax
mov ecx, ebx
mov ax, word [esi + 0x14c]
add ax, di
mov word [ebp - 0x1c], ax
lea eax, [ebp - 0x3c]
push eax
call fcn.0041286e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
push 0
push 1
call fcn.00402015
inc edi
push 0
pop eax
cmp edi, dword [esi + 0x150]
jb 0x4123d5
xor eax, eax
inc eax
call fcn.00423bf1
ret
push 0
push 1
lea ecx, [ebp - 0x3c]
call fcn.00402015
jmp 0x4123b5
Function at 0x412581
Capabilities:
Read file on windows

Disassembly:
push 0x2c
mov eax, 0x43cf93
call fcn.00423c42
mov esi, ecx
push dword [esi + 0x15c]
call fcn.004126d9
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4125a8
xor eax, eax
jmp 0x412699
push dword [esi + 0x160]
mov ecx, esi
call fcn.004126d9
mov edi, eax
cmp edi, 0xffffffff
je 0x4125a1
and dword [ebp - 0x34], 0
cmp dword [esi + 0x154], 0
jbe 0x412696
push ecx
push ebx
mov ecx, esi
call fcn.004126b0
test eax, eax
je 0x4125a1
xor eax, eax
push eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x2c]
push eax
push 4
lea eax, [ebp - 0x38]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 0x2c], 4
jne 0x4125a1
push dword [ebp - 0x38]
mov ecx, esi
call fcn.004126d9
cmp eax, 0xffffffff
je 0x41267d
push eax
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
call fcn.004124e4
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0
je 0x41266d
push ecx
push edi
mov ecx, esi
call fcn.004126b0
test eax, eax
je 0x41269f
and dword [ebp - 0x30], 0
lea eax, [ebp - 0x2c]
push 0
push eax
push 2
lea eax, [ebp - 0x30]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 0x2c], 2
jne 0x41269f
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
mov ecx, esi
cmovae eax, dword [ebp - 0x28]
push eax
mov ax, word [esi + 0x14c]
add ax, word [ebp - 0x30]
movzx eax, ax
push eax
call fcn.00412465
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
push 0
push 1
call fcn.00402015
mov eax, dword [ebp - 0x34]
add ebx, 4
inc eax
add edi, 2
mov dword [ebp - 0x34], eax
cmp eax, dword [esi + 0x154]
jb 0x4125cd
xor eax, eax
inc eax
call fcn.00423bf1
ret
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.00402015
jmp 0x4125a1

Function at 0x412bf5
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
test edi, edi
je 0x412c53
test ebx, ebx
je 0x412c53
mov esi, dword [ebp + 8]
test esi, esi
je 0x412c53
and dword [ebp - 4], 0
lea eax, [ebp - 4]
and dword [ebp - 8], 0
push eax
push 0x40
push esi
push edi
mov dword [0x4551f0], 1
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x412c53
push esi
push ebx
push edi
call fcn.0041e470
add esp, 0xc
lea ecx, [ebp - 8]
push ecx
push dword [ebp - 4]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
xor eax, eax
inc eax
jmp 0x412c55
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4135c9
Capabilities:
Delete registry value

Disassembly:
push 0x14
mov eax, 0x43d014
call fcn.00423c0f
lea ecx, [ebp - 0x10]
call fcn.00415ba1
push ecx
xor ebx, ebx
mov esi, esp
mov dword [ebp - 4], ebx
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.004110bc
add eax, 0x10
mov ecx, ebx
mov dword [esi], eax
call fcn.00415f66
pop ecx
lea ecx, [ebp - 0x14]
call fcn.00415ee3
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.004109f9
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.0040153a
push ecx
mov ecx, dword [ebp - 0x10]
mov esi, esp
lea ecx, [ecx - 0x10]
call fcn.004110bc
xor ecx, ecx
add eax, 0x10
inc ecx
mov dword [esi], eax
call fcn.00415f66
pop ecx
call fcn.00415cdf
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov edx, 0x44b3b0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x14]
call fcn.00416fff
sub esp, 0x14
push dword [eax]
push ecx
lea ecx, [ebp - 0x20]
call fcn.00411534
mov ecx, dword [ebp - 0x14]
mov ebx, eax
neg ebx
sbb bl, bl
add ecx, 0xfffffff0
call fcn.0040153a
inc bl
je 0x4136a1
mov edx, str.9097954401ACCMYkyr1nW3iDYQuC8OB1q453uqyT3t6An1PjVCKjE4GNnqDk9n_ONbIEIldOeND04D8dVzNTgm5mMLztd3rhAHgH7gC32PVDbpuq1wzAJkppeRobUnz1iJSkzmBOrG9DpHQgXGYMaCw4OBQHGPz89kqL2vnnX7qmRSSzp8k4fc00PKt_0g3v9qa6dQVBK4
lea ecx, [ebp - 0x14]
call fcn.00416fff
push dword [eax]
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.0040153a
lea ecx, [ebp - 0x20]
call fcn.00404145
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.0040153a
call fcn.00423bdd
ret
Function at 0x413763
Capabilities:
Check if file exists
Delete file
Delete registry key
Delete registry value
Move file

Disassembly:
push 0xc
mov eax, 0x43d06a
call fcn.00423c0f
xor ebx, ebx
mov dword [ebp - 0x10], ebx
call fcn.00415830
lea ecx, [ebp - 0x14]
call fcn.00415051
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x14]
cmp dword [eax - 0xc], ebx
je 0x4137b0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4137b0
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4137b0
push 4
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov edx, str.SpesmarlIlnclzs
lea ecx, [ebp - 0x18]
call fcn.0041733f
push ebx
lea ecx, [ebp - 0x10]
push ecx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push dword [eax]
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ecx, dword [ebp - 0x18]
mov ebx, eax
neg ebx
sbb bl, bl
add ecx, 0xfffffff0
call fcn.0040153a
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc bl
je 0x413843
mov edx, 0x44b7ac
lea ecx, [ebp - 0x18]
call fcn.0041733f
push dword [eax]
push dword [ebp - 0x10]
call esi
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.0040153a
mov edx, str.NgQ9
lea ecx, [ebp - 0x18]
call fcn.0041733f
push dword [eax]
push dword [ebp - 0x10]
call esi
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.0040153a
push dword [ebp - 0x10]
call edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
jmp 0x413845
xor ebx, ebx
mov edx, str.SpesmarlIlnclzs
lea ecx, [ebp - 0x18]
call fcn.0041733f
push ebx
lea ecx, [ebp - 0x10]
push ecx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push dword [eax]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ecx, dword [ebp - 0x18]
mov ebx, eax
neg ebx
sbb bl, bl
add ecx, 0xfffffff0
call fcn.0040153a
inc bl
je 0x4138cc
mov edx, 0x44b7ac
lea ecx, [ebp - 0x18]
call fcn.0041733f
push dword [eax]
push dword [ebp - 0x10]
call esi
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.0040153a
mov edx, str.NgQ9
lea ecx, [ebp - 0x18]
call fcn.0041733f
push dword [eax]
push dword [ebp - 0x10]
call esi
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.0040153a
push dword [ebp - 0x10]
call edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
jmp 0x4138ce
xor ebx, ebx
push ebx
lea eax, [ebp - 0x10]
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push str.SoftwareTencentTodayDo
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x413902
push str.Udte
push dword [ebp - 0x10]
call esi
push dword [ebp - 0x10]
call edi
mov dword [ebp - 0x10], ebx
push str.SoftwareTencentReport
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.0040153a
call fcn.00423bdd
ret
Function at 0x413923
Capabilities:
Check if file exists
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x43d09d
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x4524c8]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
call fcn.004135c9
lea ecx, [esp + 8]
call fcn.00414e11
xor esi, esi
mov dword [esp + 0x20], esi
mov ecx, dword [esp + 8]
cmp dword [ecx - 0xc], esi
je 0x413986
call fcn.00414980
test eax, eax
je 0x413986
mov ecx, dword [esp + 8]
push 3
push esi
push esi
push 0x65
pop edx
call fcn.0041468f
add esp, 0xc
lea ecx, [esp + 0xc]
call fcn.00415051
mov byte [esp + 0x20], 1
mov eax, dword [esp + 0xc]
cmp dword [eax - 0xc], 0
je 0x4139c4
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4139c4
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4139c4
push 4
push esi
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea ecx, [esp + 0x10]
call fcn.00414c77
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x24], 2
call fcn.004109f9
mov byte [esp + 0x20], 1
mov ecx, dword [esp + 0x10]
lea ecx, [ecx - 0x10]
call fcn.0040153a
mov ecx, dword [esp + 8]
cmp dword [ecx - 0xc], esi
je 0x413a12
call fcn.00414980
test eax, eax
je 0x413a12
mov ecx, dword [esp + 8]
push 3
push esi
push esi
push 0x65
pop edx
call fcn.0041468f
add esp, 0xc
call fcn.00413763
mov ecx, dword [esp + 0xc]
add ecx, 0xfffffff0
call fcn.0040153a
mov ecx, dword [esp + 8]
add ecx, 0xfffffff0
call fcn.0040153a
xor eax, eax
inc eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret