joyce8/EMBER2024-capa huggingface dataset:
Function at 0x435b30
Capabilities:
Hide graphical window

Disassembly:
push esi
push edi
push eax
push 0
push 0
push closesocket
push closesocket
push closesocket
push closesocket
push 0xcf0000
push str.TENCENT_INSTLLER_WINDOW
push str.TENCENT_INSTLLER
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov esi, eax
test esi, esi
jne 0x435b6a
pop esi
ret
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
mov dword [edi], esi
mov eax, 1
pop esi
ret

Function at 0x436a00
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x453cc8
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x468100]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [ebp - 4], ebx
xor eax, eax
push ebx
lea ecx, [ebp + 8]
mov word [ebp - 0x2c], ax
push ecx
mov esi, 7
or eax, 0xffffffff
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], ebx
call fcn.00401690
lea edx, [ebp - 0x4c]
push edx
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 1
push eax
lea edi, [ebx + 1]
mov dword [ebp - 0x4c], 0x5c
call fcn.004150e0
cmp eax, 0xffffffff
je 0x436ada
push eax
xor ecx, ecx
lea esi, [ebp - 0x48]
lea edx, [ebp - 0x2c]
call fcn.004150b0
mov edi, eax
lea esi, [ebp - 0x2c]
mov byte [ebp - 4], 2
call fcn.0040a9d0
mov edi, 8
mov byte [ebp - 4], 1
cmp dword [ebp - 0x34], edi
jb 0x436aa7
mov ecx, dword [ebp - 0x48]
push ecx
call fcn.0043e7d7
add esp, 4
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x4c], esp
push ebx
lea eax, [ebp - 0x2c]
xor edx, edx
push eax
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], ebx
or eax, 0xffffffff
mov word [ecx], dx
call fcn.00401690
call fcn.00436a00
add esp, 0x1c
mov esi, 7
jmp 0x436adf
mov edi, 8
mov eax, dword [ebp + 8]
cmp dword [ebp + 0x1c], edi
jae 0x436aea
lea eax, [ebp + 8]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x436b36
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x436b36
cmp dword [ebp - 0x18], edi
jb 0x436b14
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.0043e7d7
add esp, 4
xor edx, edx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], ebx
mov word [ebp - 0x2c], dx
cmp dword [ebp + 0x1c], edi
jb 0x436b31
mov eax, dword [ebp + 8]
push eax
call fcn.0043e7d7
add esp, 4
or eax, 0xffffffff
jmp 0x436b66
cmp dword [ebp - 0x18], edi
jb 0x436b47
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.0043e7d7
add esp, 4
xor edx, edx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], ebx
mov word [ebp - 0x2c], dx
cmp dword [ebp + 0x1c], edi
jb 0x436b64
mov eax, dword [ebp + 8]
push eax
call fcn.0043e7d7
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043e1c4
mov esp, ebp
pop ebp
ret
Function at 0x436d70
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [edi + 0x98], ebx
je 0x436d86
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, eax
push esi
lea esi, [ecx + 2]
lea esp, [esp]
mov dx, word [ecx]
add ecx, 2
cmp dx, bx
jne 0x436d90
sub ecx, esi
sar ecx, 1
push ecx
lea esi, [edi + 0x10]
call fcn.004017a0
cmp dword [edi + 8], ebx
jne 0x436dbb
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [edi + 8], eax
mov eax, dword [edi + 8]
cmp eax, ebx
jne 0x436dca
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov ecx, dword [edi + 0x94]
cmp ecx, ebx
je 0x436de9
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
mov dword [edi + 0x94], ebx
call fcn.00437b60
test eax, eax
je 0x436e09
push 0x5c
call fcn.0043e884
add esp, 4
cmp eax, ebx
je 0x436e3b
mov esi, eax
call fcn.00438d40
jmp 0x436e3d
push 0x30
call fcn.0043e884
add esp, 4
cmp eax, ebx
je 0x436e3b
mov dword [eax], vtable.QQDectector::CWininetFile.0
mov dword [eax + 0x20], 7
mov dword [eax + 0x1c], ebx
xor ecx, ecx
mov word [eax + 0xc], cx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0x28], ebx
mov dword [eax + 0x2c], ebx
jmp 0x436e3d
xor eax, eax
lea edx, [ebp - 4]
push edx
push ebx
push edi
push 0x4372a0
push ebx
push ebx
mov dword [edi + 0x94], eax
mov dword [edi + 0x98], 1
mov dword [ebp - 4], ebx
call fcn.004421d2
add esp, 0x18
mov dword [edi + 0xc], eax
cmp eax, ebx
jne 0x436e72
mov dword [edi + 0x98], ebx
xor ecx, ecx
cmp eax, ebx
setne cl
pop esi
pop ebx
mov eax, ecx
mov esp, ebp
pop ebp
ret
Function at 0x437140
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x468100]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, ecx
xor ecx, ecx
mov ebx, edx
push 0x410
push ecx
lea edx, [ebp - 0x416]
push edx
mov dword [ebp - 0x420], ebx
mov dword [ebp - 0x41c], eax
mov word [ebp - 0x418], cx
call fcn.00442420
add esp, 0xc
lea eax, [ebp - 0x418]
push eax
push 0x208
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x2f
push esi
call fcn.0043f35f
mov edi, eax
add esp, 8
test edi, edi
je 0x43726a
mov ebx, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0x4612f0
lea ecx, [ebp - 0x418]
push ecx
call ebx
sub esp, 0x1c
mov esi, esp
xor edx, edx
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
lea eax, [ebp - 0x418]
mov word [esi], dx
mov dword [ebp - 0x424], esp
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4371f0
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x418]
call fcn.004017a0
call fcn.00436a00
add esp, 0x1c
add edi, 2
push edi
lea eax, [ebp - 0x418]
push eax
call ebx
lea eax, [ebp - 0x418]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x437230
mov esi, dword [ebp - 0x420]
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x418]
call fcn.004017a0
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x437256
sub eax, edx
sar eax, 1
push eax
mov eax, edi
jmp 0x43727f
push 0
mov eax, 0x45a7a4
mov esi, ebx
call fcn.004017a0
push 0
mov eax, 0x45a7a4
mov esi, dword [ebp - 0x41c]
call fcn.004017a0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043e1c4
mov esp, ebp
pop ebp
ret
Function at 0x437a20
Capabilities:
Check if file exists
Copy file
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x468100]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor eax, eax
push 0x208
mov ebx, ecx
push eax
lea ecx, [ebp - 0x20e]
push ecx
mov word [ebp - 0x210], ax
call fcn.00442420
lea edx, [ebp - 0x210]
add esp, 0xc
mov eax, edi
sub edx, edi
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x437a63
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x437ad6
sub esp, 0x1c
mov esi, esp
mov dword [esi + 0x10], eax
xor ecx, ecx
lea eax, [ebp - 0x210]
mov dword [esi + 0x14], 7
mov dword [ebp - 0x214], esp
mov word [esi], cx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x437ab3
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x210]
call fcn.004017a0
call fcn.00436a00
add esp, 0x1c
lea esi, [ebx + 0x2c]
mov ebx, 8
cmp dword [esi + 0x14], ebx
jb 0x437ae7
mov eax, dword [esi]
jmp 0x437ae9
mov eax, esi
push 0
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
cmp dword [ebp + 0xc], 0
mov edi, eax
je 0x437b09
cmp dword [esi + 0x14], ebx
jb 0x437b02
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043e1c4
mov esp, ebp
pop ebp
ret 8

Function at 0x437b60
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x468100]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x118
lea eax, [ebp - 0x11c]
push 0
push eax
call fcn.00442420
add esp, 0xc
lea ecx, [ebp - 0x120]
push ecx
mov dword [ebp - 0x120], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x437be9
mov eax, dword [ebp - 0x11c]
cmp eax, 5
jne 0x437bbe
mov eax, dword [ebp - 0x118]
cmp eax, 1
jne 0x437bd0
cmp word [ebp - 0xc], ax
jae 0x437be9
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043e1c4
mov esp, ebp
pop ebp
ret
test eax, eax
jne 0x437be9
cmp word [ebp - 0xc], 3
jae 0x437be9
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043e1c4
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 1
call fcn.0043e1c4
mov esp, ebp
pop ebp
ret
Function at 0x439a20
Capabilities:
Check http status code
Check internet connectivity via wininet
Create http request
Get http content length
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x463368
push 0x446280
mov eax, dword fs:[0]
push eax
sub esp, 0x264
mov eax, dword [0x468100]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov edx, ecx
mov dword [ebp - 0x54], edx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x64], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x4c], ecx
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x40], ebx
mov ecx, 8
mov esi, 0x46146c
lea edi, [ebp - 0x3c]
rep movsd dword es:[edi], dword [esi]
xor ecx, ecx
mov dword [ebp - 0x60], ecx
xor esi, esi
xor edi, edi
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x50], 4
cmp eax, ecx
jne 0x439aa2
xor eax, eax
jmp 0x439bf2
mov eax, dword [edx]
mov ecx, edx
mov edx, dword [eax + 0xc]
call edx
mov dword [ebp - 4], ebx
push 0
lea eax, [ebp - 0x60]
push eax
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
test byte [ebp - 0x60], 0x20
je 0x439acc
mov dword [ebp - 4], 0xfffffffe
jmp 0x439be3
mov edx, dword [ebp - 0x4c]
test edx, edx
je 0x439af8
mov eax, edx
lea ebx, [eax + 2]
jmp 0x439ae0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x439ae0
sub eax, ebx
sar eax, 1
je 0x439af8
mov esi, 3
mov edi, edx
push 0
push 0
push edi
push esi
push 0x461398
call dword [sym.imp.WININET.dll_InternetOpenW]
mov ebx, eax
mov dword [ebp - 0x48], ebx
test ebx, ebx
je 0x439ac0
push 0
push 0x84000100
push 0xffffffffffffffff
lea ecx, [ebp - 0x3c]
push ecx
mov edx, dword [ebp - 0x64]
push edx
push ebx
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
mov esi, eax
mov dword [ebp - 0x40], esi
test esi, esi
je 0x439bc0
xor eax, eax
mov word [ebp - 0x274], ax
push 0x208
push eax
lea ecx, [ebp - 0x272]
push ecx
call fcn.00442420
add esp, 0xc
mov dword [ebp - 0x68], 0x208
push 0
lea edx, [ebp - 0x68]
push edx
mov eax, dword [ebp - 0x274]
push eax
push 0x2f
push esi
mov edi, dword [sym.imp.WININET.dll_HttpQueryInfoW]
call edi
mov dword [ebp - 0x5c], 0
push 0
lea ecx, [ebp - 0x50]
push ecx
lea edx, [ebp - 0x5c]
push edx
push 0x20000013
push esi
call edi
test eax, eax
je 0x439bc0
cmp dword [ebp - 0x5c], 0xc8
jne 0x439bc0
push 0
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x58]
push ecx
push 0x20000005
push esi
call edi
test eax, eax
je 0x439bb9
mov edx, dword [ebp - 0x58]
mov eax, dword [ebp - 0x54]
mov dword [eax + 0x28], edx
mov dword [ebp - 0x44], 1
mov dword [ebp - 4], 0xfffffffe
jmp 0x439be6
mov esi, dword [ebp - 0x40]
mov eax, dword [ebp - 0x54]
mov dword [eax + 4], ebx
mov dword [eax + 8], esi
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0043e1c4
mov esp, ebp
pop ebp
ret 8
Function at 0x439d70
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x468100]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x49f080], 0
jne 0x439df7
xor eax, eax
push 0x208
push eax
lea ecx, [ebp - 0x20e]
push ecx
mov word [ebp - 0x210], ax
call fcn.00442420
add esp, 0xc
push 0x104
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x4614a8
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
xor edx, edx
test eax, eax
setne dl
mov dword [0x49f080], eax
mov eax, edx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043e1c4
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 1
call fcn.0043e1c4
mov esp, ebp
pop ebp
ret

Function at 0x43a110
Capabilities:
Create directory
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push 0x8001
mov edi, 2
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0x51a0c8
push 0x2004
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x51a0c8
call fcn.0043a810
push 0x51a0c8
call fcn.0043a4b0
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x43a179
push 0x51a0c8
call fcn.0043b000
push 0
push 0x51a0c8
call esi
push 0x51a0c8
push 0x5160c0
call fcn.0043a5e0
test eax, eax
jne 0x43a1d6
push 0x1fff
push 0x51a0c8
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.Temp
push 0x51a0c8
call fcn.0043a800
push 0x51a0c8
call fcn.0043a810
push 0x51a0c8
call fcn.0043a4b0
test eax, eax
je 0x43a206
push 0x51a0c8
call fcn.0043b000
push 0
push 0x51a0c8
call esi
push 0x51a0c8
push 0x5160c0
call fcn.0043a5e0
test eax, eax
je 0x43a206
push 0x5160c0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push eax
push ecx
call fcn.0043bb70
test eax, eax
jne 0x43a208
call fcn.0043ba00
push 1
mov esi, eax
call fcn.0043a920
pop edi
mov eax, esi
pop esi
pop ebp
ret
mov eax, edi
pop edi
pop esi
pop ebp
ret

Function at 0x43a3d0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
sub esp, 0x10
lea eax, [ebp - 0x10]
push eax
push 0x469dc0
push 0
push 0
push 0
push 0
push 0
push 0
push ecx
push 0
mov dword [0x469dc0], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x43a40b
mov esp, ebp
pop ebp
ret 4
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret 4

Function at 0x43a5a0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edx, dword [ebp + 0x10]
lea ecx, [eax + 1]
push 0
neg ecx
sbb ecx, ecx
and ecx, eax
mov eax, dword [ebp + 0xc]
push ecx
push edx
push 0
push 1
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
pop esi
pop ebp
ret 0xc
Function at 0x43a5e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x468100]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x64
mov edi, edi
mov eax, dword [0x457674]
mov ecx, dword [0x457678]
dec esi
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x1a
div ecx
push edi
push 0
add word [ebp - 8], dx
lea edx, [ebp - 0xc]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x43a651
test esi, esi
jne 0x43a600
mov word [edi], ax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043e1c4
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043e1c4
mov esp, ebp
pop ebp
ret 8

Function at 0x43a670
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x18]
xor eax, eax
neg edx
push esi
mov esi, dword [ebp + 0x14]
sbb edx, edx
lea ecx, [ebp + 0x14]
push ecx
mov ecx, dword [ebp + 8]
and edx, 0x100
or edx, 0x20019
push edx
push eax
mov word [esi], ax
mov eax, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43a6f0
mov ecx, dword [ebp + 0x10]
lea edx, [ebp + 0x18]
push edx
mov edx, dword [ebp + 0x14]
push esi
lea eax, [ebp + 0xc]
push eax
push 0
push ecx
push edx
mov dword [ebp + 0x18], 0x4008
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x43a6d8
mov eax, dword [ebp + 0xc]
cmp eax, 1
je 0x43a6dd
cmp eax, 2
je 0x43a6dd
xor eax, eax
mov word [esi], ax
mov edx, dword [ebp + 0x14]
xor ecx, ecx
push edx
mov word [esi + 0x4006], cx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
ret 0x14

Function at 0x43a920
Capabilities:
Check if file exists
Get file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
je 0x43a94b
mov eax, dword [0x468028]
cmp eax, 0xffffffff
je 0x43a93b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x468028], 0xffffffff
mov esp, ebp
pop ebp
ret 4
cmp dword [0x4a00a8], 0
je 0x43aa05
cmp word [0x4a90e0], 0
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
je 0x43a9c8
cmp dword [0x468028], 0xffffffff
jne 0x43a9d1
push 0x4a90e0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 4
push 0x40000000
push 0x4a90e0
mov esi, eax
call fcn.0043a5a0
mov dword [0x468028], eax
cmp eax, 0xffffffff
je 0x43aa03
cmp esi, 0xffffffff
jne 0x43a9bb
push 0
lea ecx, [ebp - 4]
push ecx
push 2
lea edx, [ebp + 8]
push edx
push eax
mov dword [ebp + 8], 0xfeff
call edi
mov eax, dword [0x468028]
push 2
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [0x468028], 0xffffffff
je 0x43aa03
push 0x457690
push 0x4a00c0
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x4a00c0
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0
lea ecx, [ebp + 8]
push ecx
lea edx, [eax + eax]
mov eax, dword [0x468028]
push edx
push 0x4a00c0
push eax
call edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x43b080
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push 0x2004
push eax
push 0x469e08
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push 0x469e08
call fcn.0043a4f0
mov esi, eax
test esi, esi
jne 0x43b0af
xor eax, eax
pop esi
pop ebp
ret 4
push esi
call fcn.0043a810
test byte [0x4a0088], 0x80
je 0x43b0cb
movzx eax, word [esi]
test ax, ax
je 0x43b0a8
cmp eax, 0x5c
je 0x43b0a8
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
sub esi, 0x469e08
push 0x469e08
sar esi, 1
call edi
mov ebx, dword [sym.imp.USER32.dll_CharPrevW]
cmp eax, esi
jle 0x43b148
lea esp, [esp]
push 0x46de10
push 0x469e08
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x43b115
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
test byte [0x46de10], 0x10
je 0x43b190
push 0x469e08
call edi
lea eax, [eax*2 + 0x469e08]
cmp word [eax], 0x5c
je 0x43b138
push eax
push 0x469e08
call ebx
cmp eax, 0x469e08
ja 0x43b123
xor ecx, ecx
push 0x469e08
mov word [eax], cx
call edi
cmp eax, esi
jg 0x43b0f0
push 0x469e08
call edi
lea edx, [eax*2 + 0x469e08]
push edx
push 0x469e08
call ebx
cmp word [eax], 0x5c
je 0x43b174
push 0x45b4a4
push 0x469e08
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x469e08
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
pop edi
pop ebx
pop esi
mov eax, ecx
pop ebp
ret 4
pop edi
pop ebx
xor eax, eax
pop esi
pop ebp
ret 4
Function at 0x43ba00
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push edi
mov edi, dword [0x4a0058]
push 6
call fcn.0043aaf0
test eax, eax
je 0x43ba25
call eax
movzx eax, ax
push eax
push 0x5160c0
call fcn.0043a700
jmp 0x43ba81
xor eax, eax
push eax
push 0x47a080
push eax
push str.Control_PanelDesktopResourceLocale
push closesocket
mov dword [0x5160c0], 0x780030
mov word [0x5160c4], ax
call fcn.0043a670
cmp word [0x47a080], 0
jne 0x43ba72
push 0
push 0x47a080
push 0x457aac
push str..DEFAULTControl_PanelInternational
push reloc.WS2_32.dll_closesocket
call fcn.0043a670
push 0x47a080
push 0x5160c0
call fcn.0043a800
call fcn.0043b7a0
mov ecx, dword [0x4a0088]
and ecx, 0x20
push 0x50a0a8
mov dword [0x4a0020], ecx
call fcn.0043b080
test eax, eax
jne 0x43bb40
mov ecx, dword [edi + 0x30]
test ecx, ecx
je 0x43bb40
mov edx, dword [edi + 0x34]
push eax
mov eax, dword [0x4a0070]
push 0x4a10c0
lea edx, [eax + edx*2]
push edx
lea eax, [eax + ecx*2]
mov ecx, dword [edi + 0x2c]
push eax
push ecx
call fcn.0043a670
mov ax, word [0x4a10c0]
test ax, ax
je 0x43bb40
push esi
mov esi, 0x4a10c0
cmp ax, 0x22
jne 0x43bafa
push 0x22
mov esi, 0x4a10c2
push esi
call fcn.0043a470
xor edx, edx
mov word [eax], dx
push esi
call fcn.0043a7f0
lea eax, [esi + eax*2 - 8]
cmp eax, esi
jbe 0x43bb2e
push str..exe
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x43bb2e
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x43bb28
test al, 0x10
jne 0x43bb2e
push esi
call fcn.0043b040
push esi
call fcn.0043b000
push eax
push 0x50a0a8
call fcn.0043a7d0
pop esi
push 0x50a0a8
call fcn.0043b080
test eax, eax
jne 0x43bb5c
mov eax, dword [edi + 0x3c]
push eax
push 0x50a0a8
call fcn.0043b1a0
xor ebx, ebx
call fcn.0043b970
neg eax
sbb eax, eax
pop edi
and eax, 8
pop ebx
ret
Function at 0x43bda0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x468100]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [0x4a0050]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x214]
push eax
or ecx, 8
push ecx
push 0
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43be7e
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
push 0x105
lea edx, [ebp - 0x210]
push edx
push eax
mov eax, dword [ebp - 0x214]
push eax
call esi
test eax, eax
jne 0x43be3a
nop
cmp dword [ebp + 0x10], 0
mov edx, dword [ebp - 0x214]
jne 0x43be72
push 0
lea ecx, [ebp - 0x210]
push ecx
push edx
call fcn.0043bda0
test eax, eax
jne 0x43be3a
mov ecx, dword [ebp - 0x214]
push 0x105
lea eax, [ebp - 0x210]
push eax
push 0
push ecx
call esi
test eax, eax
je 0x43be00
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 2
call fcn.0043aaf0
test eax, eax
je 0x43be91
mov ecx, dword [0x4a0050]
push 0
push ecx
push ebx
push edi
call eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043e1c4
mov esp, ebp
pop ebp
ret 0xc
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043e1c4
mov esp, ebp
pop ebp
ret 0xc
cmp dword [0x4a0050], 0
jne 0x43be79
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x43be79
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043e1c4
mov esp, ebp
pop ebp
ret 0xc