joyce8/EMBER2024-capa huggingface dataset:
Function at 0x462808
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
mov esi, edx
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
mov eax, dword [0x475128]
mov eax, dword [eax]
call fcn.00456214
push 2
call sub.kernel32.dll_Sleep_1
call sub.kernel32.dll_GetTickCount_1
mov edx, eax
sub edx, ebx
cmp esi, edx
jle 0x462840
cmp ebx, eax
jg 0x462840
cmp byte [0x476be8], 0
jne 0x462813
pop esi
pop ebx
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
jl 0x433030
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219

Function at 0x408db0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
les ecx, [ebx - 0x36ccefbb]
std
ror byte [edi], 0x95
ror dword [ecx + 0x4d8bfc4d], 0xc
cmp ecx, 0x40
push esi
jg 0x409003
je 0x408fdb
dec ecx
cmp ecx, 0xf
sete byte [eax]
add eax, dword [eax]
add al, cl
or dword [edx + 0x40911091], 0
invalid
xor eax, eax
pop esi
mov esp, ebp
mov esp, 0x24000cc2
std
mov dword [ecx + 0x44], edx
xor eax, eax
jge 0x408dce
in eax, 0x5d
sub al, 0xc
inc esi
mov esp, dword [ebx + 8]
xor ecx, ecx
mov edx, dword [esi + 0x38]
and edx, 4
and byte [esp + eax + 0x3bc1949c], 0xc1
je 0x408e31
lcall 0x6afc, 0x558d0446
add al, 0x52
push 1
push 0xffff
push eax
call dword [0x71c1b8]
cmp eax, 0xffffff8e
mov dword [eax + ebp*8 + 0x74000001], 0xc0f79945
cli
inc esi
invalid
mov edx, dword [ebp + 8]
lea ecx, [ebp + 0x10]
push 4
push ecx
mov eax, dword [edx + 4]
push 0xe20010b1
push 0xffff
push eax
call dword [sym.imp.WSOCK32.dll_setsockopt]
cmp eax, 0x31
jne 0x408e31
sbb dword [ebp - 0x7f], edx
dec esi
add byte [edx], bl
mov cl, byte [edi]
or dword [esi], 0xf8a005a
pop edi
add byte [eax], al
add byte [edi], cl
test ch, dl
add byte [eax], al
mov dl, 9
stc
or ecx, edi
inc ecx
add byte [eax], al
add byte [ecx + 0xf0f8], dh
add byte [ecx + 0xba00f9], al
add byte [edi], cl
test dword [ecx - 0x74ffffcb], esi
jne 0x409038
xor edx, edx
mov ecx, dword [esi + 0x38]
and ecx, 0x200
cmp ecx, 0xc20200
cmp dword [ebp - 0x3e], esp
cmp edx, eax
in al, dx
test byte [ebx], dh
jno 0x409015
add al, byte [eax]
add byte [ecx - 0x3dfdff07], al
add byte [ecx], bh
ret 0xd03b
outsd dx, dword [esi]
mov ecx, dword [esi + 4]
lea eax, [ebp + 0x10]
push 0xffffffffffffff92
push eax
push 1
push 6
push ecx
call dword [0x2d40c1b8]
cmp eax, 0xffffffff
jne 0x409086
mov esi, dword [0x4076d8]
call esi
test eax, eax
insb byte es:[edi], dx
pop es
xchg byte [edi + 0xcc25dce], cl
add byte [0xfc0005d6], bh
or al, byte [eax]
pop esi
mov ecx, dword [ebx + 9]
ret 0xc
mov esi, dword [esi - 0x74a37af0]
inc esi
cmp byte [edi + ecx - 0x80], dh
int3
Function at 0x10002b90
Capabilities:
Check if file exists
Create directory
Get common file path

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
lea esi, [edi + 0x20c]
push esi
push 0x104
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push ebx
call fcn.1000c0b1
add esp, 4
push eax
push esi
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10002be6
push 3
lea eax, [edi + 0x414]
push esi
push eax
call fcn.1001d4a0
add esp, 0xc
test eax, eax
jne 0x10002be6
lea ebx, [eax + 1]
lea ecx, [edi + 0x414]
push 1
push ecx
call fcn.1001cb20
add esp, 8
mov eax, ebx
test ebx, ebx
jne 0x10002c07
mov dword [edi + 0x1040], 0x1001
pop edi
pop esi
pop ebx
ret
Function at 0x10003fd0
Capabilities:
Delete registry value
Set registry value

Disassembly:
push esi
mov esi, ecx
call fcn.1001ebe0
fcomp qword [0x100411c0]
fnstsw ax
test ah, 1
jne 0x10004019
mov eax, dword [esi + 0x628]
cmp eax, 0x16
je 0x10004005
cmp eax, 0x17
je 0x10004005
cmp eax, 0xe
je 0x10004005
call fcn.10024510
pop esi
jmp fcn.100240b0
call fcn.10023f30
test al, al
je 0x10004019
call fcn.10024510
pop esi
jmp fcn.100240b0
pop esi
ret
Function at 0x10004570
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003b6fb
mov eax, dword fs:[0]
push eax
sub esp, 0x230
mov eax, dword [0x1004f0a8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
push 7
lea eax, [ebp - 0x18]
push eax
push 0x3d
lea ecx, [ebp - 0x23c]
mov dword [ebp - 0x18], 0xa1cda68b
mov word [ebp - 0x14], 0xacb4
mov byte [ebp - 0x12], 0xd1
call fcn.1001b390
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x21e]
push edx
mov dword [ebp - 4], 0
mov word [ebp - 0x220], cx
call fcn.1000ae30
mov edi, dword [ebp + 0xc]
lea eax, [edi + edi]
add esp, 0xc
mov ecx, 0x10050e64
mov dword [ebp - 0x228], 1
mov dword [ebp - 0x22c], eax
call fcn.1001b4a0
lea ecx, [ebp - 0x224]
push ecx
push 0x20019
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10004677
lea ecx, [ebp - 0x23c]
call fcn.1001b4a0
lea edx, [ebp - 0x22c]
push edx
lea ecx, [ebp - 0x220]
push ecx
lea edx, [ebp - 0x228]
push edx
push 0
push eax
mov eax, dword [ebp - 0x224]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1000466a
push edi
lea ecx, [ebp - 0x220]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov edx, dword [ebp - 0x224]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x220]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10004680
sub eax, edx
sar eax, 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x23c]
jne 0x100046a7
call fcn.1001b3d0
xor eax, eax
jmp 0x100046b1
call fcn.1001b3d0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000ae1e
mov esp, ebp
pop ebp
ret 8
Function at 0x100046d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x26c
mov eax, dword [0x1004f0a8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x20a]
push ecx
mov dword [ebp - 0x218], 0
mov dword [ebp - 0x210], 0
xor esi, esi
mov word [ebp - 0x20c], ax
call fcn.1000ae30
add esp, 0xc
mov ecx, 0x10050e74
call fcn.1001b4a0
lea edx, [ebp - 0x214]
push edx
push 0x20019
push esi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100047e4
mov ecx, 0x10051064
call fcn.1001b4a0
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [ebp - 0x210]
push ecx
push esi
lea edx, [ebp - 0x218]
push edx
push esi
push eax
mov eax, dword [ebp - 0x214]
push eax
call edi
test eax, eax
jne 0x100047ca
mov ecx, dword [ebp - 0x210]
add ecx, 2
push ecx
call fcn.1000b020
mov esi, eax
add esp, 4
test esi, esi
je 0x100047b3
mov ecx, 0x10051064
call fcn.1001b4a0
lea edx, [ebp - 0x210]
push edx
mov edx, dword [ebp - 0x214]
push esi
lea ecx, [ebp - 0x218]
push ecx
push 0
push eax
push edx
call edi
test eax, eax
jne 0x100047ca
mov eax, dword [ebp - 0x210]
shr eax, 1
push eax
push esi
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov edx, dword [ebp - 0x214]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x100047e4
push esi
call fcn.1000b015
add esp, 4
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100047f0
sub eax, edx
sar eax, 1
je 0x10004888
push 0x40
lea eax, [ebp - 0x268]
push 0
push eax
mov dword [ebp - 0x26c], 0x44
call fcn.1000ae30
add esp, 0xc
lea ecx, [ebp - 0x228]
push ecx
lea edx, [ebp - 0x26c]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.1001f300
mov ecx, dword [ebp - 0x228]
push 0x4e20
push ecx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [ebp - 0x228]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call edi
mov eax, dword [ebp - 0x224]
push eax
call edi
pop edi
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000ae1e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.1000ae1e
mov esp, ebp
pop ebp
ret
Function at 0x10004a10
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa30
mov eax, dword [0x1004f0a8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
push 0x206
mov esi, ecx
push eax
lea ecx, [ebp - 0x412]
push ecx
mov word [ebp - 0x414], ax
call fcn.1000ae30
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x20a]
push eax
mov word [ebp - 0x20c], dx
call fcn.1000ae30
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x61a]
push edx
mov word [ebp - 0x61c], cx
call fcn.1000ae30
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x822]
push ecx
mov word [ebp - 0x824], ax
call fcn.1000ae30
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0xa2a]
push eax
mov word [ebp - 0xa2c], dx
call fcn.1000ae30
add esp, 0x3c
push 0x104
lea ecx, [esi + 0x20c]
push ecx
lea edx, [ebp - 0x414]
push edx
mov dword [ebp - 0xa30], 0
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push 0x14
call fcn.10028ad0
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
add esp, 4
push eax
lea eax, [ebp - 0x414]
push eax
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
lea edx, [ebp - 0x414]
push edx
call ebx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10004bde
push 0x104
lea ecx, [ebp - 0x61c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str.rundll32.exe
lea edx, [ebp - 0x61c]
push edx
call edi
push 0x104
lea eax, [ebp - 0x824]
push eax
lea ecx, [ebp - 0x61c]
push ecx
call ebx
lea edx, [ebp - 0x824]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10004bde
lea eax, [ebp - 0x20c]
push eax
push str._s_Uninstall
lea ecx, [ebp - 0xa2c]
push 0x103
push ecx
call fcn.1000c37d
add esp, 0x10
lea edx, [ebp - 0xa30]
push edx
push 3
push 0x2710
lea eax, [ebp - 0xa2c]
push eax
lea ecx, [ebp - 0x824]
push ecx
mov ecx, esi
call fcn.10004020
lea edx, [ebp - 0x20c]
push 1
push edx
mov esi, eax
call fcn.1001cb20
add esp, 8
test esi, esi
je 0x10004bde
cmp dword [ebp - 0xa30], 0
jne 0x10004bde
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000ae1e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.1000ae1e
mov esp, ebp
pop ebp
ret
Function at 0x10004c00
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003b6fb
mov eax, dword fs:[0]
push eax
sub esp, 0x230
mov eax, dword [0x1004f0a8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
push 7
lea eax, [ebp - 0x18]
push eax
push 0x12
lea ecx, [ebp - 0x23c]
mov dword [ebp - 0x18], 0xd3e7f6fb
mov word [ebp - 0x14], 0xf4d3
mov byte [ebp - 0x12], 0xf8
call fcn.1001b390
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x21e]
push edx
mov dword [ebp - 4], 0
mov word [ebp - 0x220], cx
call fcn.1000ae30
mov edi, dword [ebp + 0xc]
lea eax, [edi + edi]
add esp, 0xc
mov ecx, 0x10050e64
mov dword [ebp - 0x228], 1
mov dword [ebp - 0x22c], eax
call fcn.1001b4a0
lea ecx, [ebp - 0x224]
push ecx
push 0x20019
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10004d07
lea ecx, [ebp - 0x23c]
call fcn.1001b4a0
lea edx, [ebp - 0x22c]
push edx
lea ecx, [ebp - 0x220]
push ecx
lea edx, [ebp - 0x228]
push edx
push 0
push eax
mov eax, dword [ebp - 0x224]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10004cfa
push edi
lea ecx, [ebp - 0x220]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov edx, dword [ebp - 0x224]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x220]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10004d10
sub eax, edx
sar eax, 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x23c]
jne 0x10004d37
call fcn.1001b3d0
xor eax, eax
jmp 0x10004d41
call fcn.1001b3d0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000ae1e
mov esp, ebp
pop ebp
ret 8
Function at 0x10004d60
Capabilities:
Check if file exists
Copy file
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x1004f0a8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push edi
mov edi, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x418], eax
call ebx
test eax, eax
je 0x10004d98
cmp dword [ebp + 0x10], 0
jne 0x10004eb6
push edi
call ebx
test eax, eax
je 0x10004dae
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x10004eb6
push esi
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x20a]
push edx
mov word [ebp - 0x20c], cx
call fcn.1000ae30
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x412]
push ecx
mov word [ebp - 0x414], ax
call fcn.1000ae30
add esp, 0x18
push 0x104
push edi
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push 0x104
lea eax, [ebp - 0x20c]
push str..bak
push eax
call fcn.1001e290
add esp, 0xc
mov esi, 1
lea esp, [esp]
push esi
lea ecx, [ebp - 0x20c]
push ecx
push str._s_d
lea edx, [ebp - 0x414]
push 0x103
push edx
call fcn.1000c37d
add esp, 0x14
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x414]
push ecx
call ebx
test eax, eax
je 0x10004e61
inc esi
cmp esi, 0x64
jl 0x10004e20
push 0x104
lea edx, [ebp - 0x414]
push edx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov edx, dword [ebp - 0x418]
push 0
lea ecx, [ebp - 0x20c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
pop esi
test eax, eax
je 0x10004eb6
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.1000c6ac
add esp, 8
test eax, eax
je 0x10004eb6
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.1000ae1e
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10004ed0
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x1004f0a8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x20a]
push ecx
mov dword [ebp - 0x418], esi
mov word [ebp - 0x20c], ax
call fcn.1000ae30
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x412]
push eax
mov word [ebp - 0x414], dx
call fcn.1000ae30
mov eax, dword [ebp + 0xc]
add esp, 0x18
cmp eax, 0xc
je 0x10004f49
cmp eax, 9
je 0x10004f49
push 0x104
push esi
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
jmp 0x10004f72
lea edx, [ebp - 0x20c]
push 0x104
push edx
call fcn.10025a10
add esp, 8
push esi
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push ebx
push 0x104
lea ecx, [ebp - 0x20c]
push str..bak
push ecx
call fcn.1001e290
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0xc
mov esi, 1
lea ecx, [ecx]
push esi
lea edx, [ebp - 0x20c]
push edx
push str._s_d
lea eax, [ebp - 0x414]
push 0x103
push eax
call fcn.1000c37d
add esp, 0x14
lea ecx, [ebp - 0x414]
push ecx
call edi
lea edx, [ebp - 0x414]
push edx
call ebx
test eax, eax
je 0x10004fdd
inc esi
cmp esi, 0x64
jl 0x10004fa0
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpynW]
push 0x104
lea eax, [ebp - 0x414]
push eax
lea ecx, [ebp - 0x20c]
push ecx
call edi
mov esi, dword [ebp - 0x418]
lea edx, [ebp - 0x20c]
push edx
push esi
call fcn.1000c6ac
add esp, 8
pop ebx
test eax, eax
jne 0x1000504f
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x20c]
push ecx
push esi
call edi
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 0x20c]
push edx
push eax
call fcn.100239e0
add esp, 8
test eax, eax
je 0x1000504f
pop edi
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000ae1e
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.1000ae1e
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10005130
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x10005185
cmp word [edi], 0
je 0x10005185
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10005146
sub eax, edx
sar eax, 1
push esi
mov ecx, 0x10050e64
mov esi, eax
call fcn.1001b4a0
lea ecx, [esi + esi]
push ecx
push edi
push 1
push 0x100412fc
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
neg eax
sbb eax, eax
pop esi
inc eax
pop edi
pop ebp
ret 4
xor eax, eax
pop edi
pop ebp
ret 4
Function at 0x10005190
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x1004f0a8]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x20a]
push ecx
mov word [ebp - 0x20c], ax
call fcn.1000ae30
push 0x10040968
call fcn.1001de50
push eax
push 0x1004ace4
push 0x10041304
lea edx, [ebp - 0x20c]
push 0x103
push edx
call fcn.1000c6df
add esp, 0x24
lea eax, [ebp - 0x20c]
push eax
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push 0x10040968
call fcn.1001e0d0
mov ecx, dword [ebp - 4]
xor ecx, ebp
add esp, 4
mov eax, 1
call fcn.1000ae1e
mov esp, ebp
pop ebp
ret

Function at 0x10005420
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
call fcn.1001d960
mov esi, str.SOFTWAREAppDataLowTencentTBHConfigProperty
test eax, eax
jne 0x10005439
mov esi, str.SOFTWARETencentTBHConfigProperty
mov edi, dword [ebp + 8]
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push edi
push 0
push str.haoqqopen
push str.Switch_Property
call ebx
push eax
push str.haoqqopen
push esi
push SysReAllocString
call fcn.1001e9b0
add esp, 0x10
push edi
push 0
push str.partopen
push str.Switch_Property
call ebx
push eax
push str.partopen
push esi
push SysReAllocString
call fcn.1001e9b0
add esp, 0x10
push edi
push 0
push str.topwordsopen
push str.Switch_Property
call ebx
push eax
push str.topwordsopen
push esi
push SysReAllocString
call fcn.1001e9b0
add esp, 0x10
push edi
push 0
push str.homepagehaoqqopen
push str.Switch_Property
call ebx
push eax
push str.homepagehaoqqopen
push esi
push SysReAllocString
call fcn.1001e9b0
add esp, 0x10
push edi
push 0
push str.centeropen
push str.Switch_Property
call ebx
push eax
push str.centeropen
push esi
push SysReAllocString
call fcn.1001e9b0
add esp, 0x10
push edi
push 0
push str.homeprotectopen
push str.Switch_Property
call ebx
push eax
push str.homeprotectopen
push esi
push SysReAllocString
call fcn.1001e9b0
add esp, 0x10
push edi
push 1
push str.availability
push str.Switch_Property
call ebx
push eax
push str.availability
push esi
push SysReAllocString
call fcn.1001e9b0
add esp, 0x10
push edi
push 1
push str.opennewtab
push str.Switch_Property
call ebx
push eax
push str.opennewtab
push esi
push SysReAllocString
call fcn.1001e9b0
add esp, 0x10
push edi
push 1
push str.openerrorlocal
push str.Switch_Property
call ebx
push eax
push str.openerrorlocal
push esi
push SysReAllocString
call fcn.1001e9b0
add esp, 0x10
push edi
push 0
push str.settingbtnopen
push str.Switch_Property
call ebx
push eax
push str.settingbtnopen
push esi
push SysReAllocString
call fcn.1001e9b0
add esp, 0x10
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret 4
Function at 0x10005840
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003b790
mov eax, dword fs:[0]
push eax
sub esp, 0x90
mov eax, dword [0x1004f0a8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor eax, eax
push 0x7e
mov esi, ecx
push eax
lea ecx, [ebp - 0x92]
push ecx
mov word [ebp - 0x94], ax
call fcn.1000ae30
add esp, 0xc
push 0x40
lea edx, [ebp - 0x94]
push edx
mov ecx, esi
mov edi, 1
mov dword [ebp - 0x98], 0
call fcn.10004570
test eax, eax
je 0x100058cb
lea eax, [ebp - 0x94]
push str.5.0.0.0
push eax
call fcn.1000c2f2
add esp, 8
test eax, eax
jns 0x100058cb
xor edi, edi
mov ecx, 0x10050eb4
call fcn.1001b4a0
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ebx, eax
mov dword [ebp - 0x9c], ebx
test ebx, ebx
je 0x10005904
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x10005904
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x10005955
mov dword [ebp - 4], 0
mov ecx, esi
test edi, edi
je 0x1000591a
call fcn.100048a0
mov edi, eax
jmp 0x10005948
call fcn.10004a10
mov edi, eax
mov dword [ebp - 0x98], edi
test edi, edi
jne 0x10005948
mov ecx, esi
call fcn.100046d0
mov edi, eax
jmp 0x10005948
test ebx, ebx
je 0x10005953
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1000ae1e
mov esp, ebp
pop ebp
ret