joyce8/EMBER2024-capa huggingface dataset:
Function at 0x428290
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
je 0x4282c0
mov edi, dword [esi + 4]
push 0
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x4282b0
xor al, al
jmp 0x4282bc
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne al
xor al, 1
mov byte [esi], al
push dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
call fcn.00428230
mov edi, eax
add esp, 4
test edi, edi
je 0x4282e2
push dword [ebp + 0x10]
lea ecx, [esi + 4]
call fcn.004064f0
mov byte [esi], 1
mov eax, edi
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x428340
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0x10]
mov edx, 0x400000
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], ecx
mov dword [ebx], 0
nop
cmp esi, 0x400000
mov dword [ebp + 0x10], 0
push 0
mov eax, esi
cmova eax, edx
lea edx, [ebp + 0x10]
push edx
push eax
push edi
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp + 0x10]
add dword [ebx], ecx
test eax, eax
je 0x4283a8
test ecx, ecx
je 0x42839d
add edi, ecx
mov edx, 0x400000
sub esi, ecx
mov ecx, dword [ebp - 4]
jne 0x428360
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x428890
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
mov dword [ecx + 0x30], 0
lea esi, [ecx + 0x70]
mov dword [ecx + 0x4c], 0
xor edx, edx
mov dword [ecx + 0x20], 0
mov dword [ecx + 0x2c], 0x20
mov dword [ecx + 0x54], 1
mov dword [ecx + 0x48], 4
mov dword [ecx + 0x58], 0
mov ecx, edx
lea esi, [esi + 4]
and ecx, 1
mov eax, edx
dec ecx
shr eax, 1
not ecx
inc edx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
dec eax
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
dec eax
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
dec eax
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
dec eax
not eax
and eax, 0xedb88320
xor eax, ecx
mov dword [esi - 4], eax
cmp edx, 0x100
jb 0x4288c7
pop esi
ret

Function at 0x42c9d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, 0x100
mov dword [ebp - 4], ecx
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
or edx, esi
add edi, edi
mov ecx, esi
and ecx, edi
mov eax, edx
add ecx, esi
shr eax, 8
add eax, ecx
mov ecx, dword [ebp - 4]
movzx ecx, word [ecx + eax*2]
mov eax, edx
shr eax, 7
add edx, edx
and eax, 1
shr ecx, 4
neg eax
sar eax, 4
and eax, 0x7f
xor ecx, eax
mov eax, dword [ebp + 0xc]
add ebx, dword [eax + ecx*4]
mov ecx, edx
xor ecx, edi
not ecx
and esi, ecx
cmp edx, 0x10000
jb 0x42c9e6
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42ccc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov dword [ebp - 0x14], edi
movzx esi, word [edi]
movzx ecx, word [edi + 2]
mov eax, esi
shr eax, 4
xor esi, 0x7f0
shr esi, 4
mov eax, dword [ebx + eax*4]
mov dword [ebp - 0xc], eax
mov eax, ecx
shr eax, 4
xor ecx, 0x7f0
shr ecx, 4
mov eax, dword [ebx + eax*4]
add eax, dword [ebx + esi*4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebx + ecx*4]
add eax, dword [ebx + esi*4]
xor esi, esi
mov dword [ebp - 0x18], eax
mov dword [ebp + 0x10], esi
cmp esi, dword [ebp + 8]
jae 0x42ce34
mov edx, esi
mov dword [ebp - 8], 0
mov esi, dword [ebp - 8]
or edx, 8
nop dword [eax]
mov eax, dword [ebp - 4]
mov ecx, edx
shr ecx, 1
and edx, 1
neg edx
sar edx, 4
and edx, 0x7f
lea eax, [ecx + eax*8]
movzx eax, word [edi + eax*2 + 4]
shr eax, 4
xor eax, edx
mov edx, ecx
add esi, dword [ebx + eax*4]
cmp edx, 1
jne 0x42cd30
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 0xc]
add eax, esi
mov esi, dword [ebp + 0x10]
mov dword [ecx + esi*4], eax
inc esi
mov dword [ebp + 0x10], esi
cmp esi, 8
jb 0x42cd14
cmp esi, 0x10
jae 0x42cdda
lea eax, [esi - 8]
mov dword [ebp - 8], eax
nop dword [eax + eax]
cmp esi, dword [ebp + 8]
jae 0x42ce34
mov edx, eax
xor esi, esi
or edx, 8
mov eax, dword [ebp - 4]
mov ecx, edx
shr ecx, 1
and edx, 1
neg edx
sar edx, 4
and edx, 0x7f
lea eax, [ecx + eax*8]
movzx eax, word [edi + eax*2 + 0x104]
shr eax, 4
xor eax, edx
mov edx, ecx
add esi, dword [ebx + eax*4]
cmp edx, 1
jne 0x42cd90
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
add eax, esi
mov esi, dword [ebp + 0x10]
mov dword [ecx + esi*4], eax
inc esi
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp + 0x10], esi
mov dword [ebp - 8], eax
cmp esi, 0x10
jb 0x42cd80
cmp esi, dword [ebp + 8]
jae 0x42ce34
lea eax, [esi - 0x10]
mov dword [ebp - 8], eax
mov esi, dword [ebp - 0x14]
xor edi, edi
or eax, 0x100
nop
mov edx, eax
and eax, 1
shr edx, 1
neg eax
sar eax, 4
and eax, 0x7f
movzx ecx, word [esi + edx*2 + 0x204]
shr ecx, 4
xor ecx, eax
mov eax, edx
add edi, dword [ebx + ecx*4]
cmp eax, 1
jne 0x42cdf0
mov esi, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x18]
add eax, edi
mov dword [ecx + esi*4], eax
inc esi
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp + 0x10], esi
mov dword [ebp - 8], eax
cmp esi, dword [ebp + 8]
jb 0x42cde5
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42e990
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor eax, eax
mov dword [ebp - 0x10], ecx
lea edx, [ecx + 0x32550]
mov dword [ebp - 8], eax
push esi
mov dword [ebp - 0xc], edx
push edi
nop word [eax + eax]
xor ebx, ebx
mov dword [ebp - 4], 4
mov edi, eax
lea eax, [ebx + 1]
nop
movzx edx, word [ecx + eax*2 + 0x32bf4]
mov esi, edi
and esi, 1
shr edx, 4
mov ecx, esi
shr edi, 1
neg ecx
add eax, eax
sar ecx, 4
or eax, esi
and ecx, 0x7f
xor edx, ecx
mov ecx, dword [ebp - 0x10]
add ebx, dword [ecx + edx*4 + 0x30ea0]
sub dword [ebp - 4], 1
jne 0x42e9c0
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
mov dword [edx], ebx
add edx, 4
mov dword [ebp - 0xc], edx
cmp eax, 0x10
jb 0x42e9b0
pop edi
pop esi
mov dword [ecx + 0x32590], 0
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42ea20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x511070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov ebx, 4
push edi
mov edi, ecx
mov dword [ebp - 0x208], ebx
nop dword [eax]
nop word [eax + eax]
movzx ecx, byte [edi + ebx + 0x306a0]
mov esi, 1
mov eax, ecx
mov dword [ebp - 0x218], ecx
mov edx, ecx
shr eax, 1
dec eax
mov dword [ebp - 0x20c], 0
and edx, 1
mov dword [ebp - 0x210], eax
or edx, 2
mov ecx, eax
shl edx, cl
mov ecx, ebx
sub ecx, edx
mov dword [ebp - 0x214], edx
test eax, eax
je 0x42eaf0
mov ebx, eax
mov eax, esi
mov edx, ecx
sub eax, dword [ebp - 0x218]
and edx, 1
add eax, dword [ebp - 0x214]
add esi, esi
shr ecx, 1
or esi, edx
mov dword [ebp - 0x210], ecx
movzx ecx, word [edi + eax*2 + 0x32b0e]
mov eax, edx
neg eax
shr ecx, 4
sar eax, 4
and eax, 0x7f
xor ecx, eax
mov eax, dword [ebp - 0x20c]
add eax, dword [edi + ecx*4 + 0x30ea0]
mov ecx, dword [ebp - 0x210]
mov dword [ebp - 0x20c], eax
sub ebx, 1
jne 0x42ea94
mov ebx, dword [ebp - 0x208]
jmp 0x42eaf2
xor eax, eax
mov dword [ebp + ebx*4 - 0x204], eax
inc ebx
mov dword [ebp - 0x208], ebx
cmp ebx, 0x80
jb 0x42ea50
lea eax, [ebp - 0x204]
mov dword [ebp - 0x21c], edi
sub eax, edi
mov dword [ebp - 0x210], 4
lea esi, [edi + 0x31950]
sub eax, 0x31d50
lea edx, [edi + 0x31d58]
mov dword [ebp - 0x208], esi
mov dword [ebp - 0x20c], edx
mov dword [ebp - 0x218], eax
nop word [eax + eax]
xor ebx, ebx
mov dword [ebp - 0x214], ebx
cmp dword [edi + 0x32594], ebx
jbe 0x42ebc0
mov eax, ebx
xor esi, esi
mov ebx, dword [ebp - 0x21c]
or eax, 0x40
nop dword [eax]
mov edx, eax
and eax, 1
shr edx, 1
neg eax
sar eax, 4
and eax, 0x7f
movzx ecx, word [ebx + edx*2 + 0x32910]
shr ecx, 4
xor ecx, eax
mov eax, edx
add esi, dword [edi + ecx*4 + 0x30ea0]
cmp eax, 1
jne 0x42eb70
mov ebx, dword [ebp - 0x214]
mov eax, dword [ebp - 0x208]
mov dword [eax + ebx*4], esi
inc ebx
mov dword [ebp - 0x214], ebx
cmp ebx, dword [edi + 0x32594]
jb 0x42eb60
mov edx, dword [ebp - 0x20c]
mov esi, eax
mov ecx, 0xe
cmp dword [edi + 0x32594], ecx
jbe 0x42ebe6
nop dword [eax]
mov eax, ecx
shr eax, 1
shl eax, 4
sub eax, 0x50
add dword [esi + ecx*4], eax
inc ecx
cmp ecx, dword [edi + 0x32594]
jb 0x42ebd0
mov eax, dword [esi]
mov ecx, 4
mov ebx, dword [ebp - 0x218]
mov dword [edx - 8], eax
mov eax, dword [esi + 4]
mov dword [edx - 4], eax
mov eax, dword [esi + 8]
mov dword [edx], eax
mov eax, dword [esi + 0xc]
mov dword [edx + 4], eax
add edx, 8
nop word [eax + eax]
movzx eax, byte [edi + ecx + 0x306a0]
lea edx, [edx + 4]
inc ecx
mov eax, dword [esi + eax*4]
add eax, dword [edx + ebx - 4]
mov dword [edx - 4], eax
cmp ecx, 0x80
jb 0x42ec10
mov edx, dword [ebp - 0x20c]
add esi, 0x100
sub dword [ebp - 0x21c], 0xffffff80
add edx, 0x200
sub ebx, 0x200
mov dword [ebp - 0x208], esi
sub dword [ebp - 0x210], 1
mov dword [ebp - 0x20c], edx
mov dword [ebp - 0x218], ebx
jne 0x42eb50
mov ecx, dword [ebp - 4]
mov dword [edi + 0x3bcf8], 0
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.004a474b
mov esp, ebp
pop ebp
ret
Function at 0x42fbe0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
mov esi, ecx
push eax
push 0
push dword [ebp + 8]
push edx
push 0
push 0
call fcn.004ae850
add esp, 0x18
mov dword [esi], eax
pop esi
test eax, eax
je 0x42fc0a
xor eax, eax
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ecx, 1
cmovne ecx, eax
mov eax, ecx
mov esp, ebp
pop ebp
ret

Function at 0x42fd20
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
jne 0x42fd3c
mov eax, dword [ebp - 4]
jmp 0x42fe17
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
shr ecx, 3
xor eax, 0xffffffff
test ecx, ecx
je 0x42fdf2
push ebp
mov ebp, ecx
xor edx, edx
xor ecx, ecx
nop
mov ebx, dword [esi]
add esi, 4
mov dl, bl
mov cl, bh
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x4e7c10]
shr ebx, 0x10
xor eax, edi
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x4e7c10]
mov dl, bl
xor eax, edi
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x4e7c10]
mov cl, bh
xor eax, edi
mov ebx, dword [esi]
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x4e7c10]
add esi, 4
xor eax, edi
mov dl, bl
mov cl, bh
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x4e7c10]
shr ebx, 0x10
xor eax, edi
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x4e7c10]
mov dl, bl
xor eax, edi
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x4e7c10]
mov cl, bh
xor eax, edi
xor cl, al
shr eax, 8
xor eax, dword [ecx*4 + 0x4e7c10]
dec ebp
jne 0x42fd5c
pop ebp
mov ecx, dword [ebp + 0x10]
xor edx, edx
and ecx, 7
je 0x42fe0e
mov dl, byte [esi]
inc esi
xor dl, al
shr eax, 8
xor eax, dword [edx*4 + 0x4e7c10]
dec ecx
jne 0x42fdfc
xor eax, 0xffffffff
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4300e0
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d300b
mov eax, dword fs:[0]
push eax
sub esp, 0xe0
mov eax, dword [0x511070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ebx, dword [ebp + 8]
lea eax, [esi + 0x50]
mov ecx, eax
mov dword [esi + 0x4c], 7
mov dword [ebp - 0xe8], eax
call fcn.0041caa0
lea eax, [esi + 0x54]
mov ecx, eax
mov dword [ebp - 0xe4], eax
call fcn.0041caa0
lea ecx, [esi + 0x58]
call fcn.0041caa0
lea eax, [esi + 0x5c]
mov ecx, eax
mov dword [ebp - 0xec], eax
call fcn.0041caa0
mov byte [esi + 0x48], 0
test ebx, ebx
je 0x4302c4
mov dword [ebp - 0xd8], 0
push 0x100
lea ecx, [ebp - 0xd8]
mov dword [ebp - 4], 0
call fcn.00433320
mov edi, dword [ebp - 0xd8]
lea eax, [esi + 0x4c]
push eax
lea eax, [ebp - 0xe0]
mov dword [ebp - 0xdc], 0x44
push eax
push edi
lea eax, [ebp - 0xdc]
mov dword [ebp - 0xe0], 0x80
push eax
lea eax, [ebp - 0x54]
push eax
push ebx
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x430222
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x430280
cmp dword [ebp - 0xdc], 0x44
jbe 0x4301df
push 0x80004005
call fcn.0041ce60
mov eax, dword [ebp - 0xe0]
cmp eax, 0x80
jbe 0x4301fe
push eax
lea ecx, [ebp - 0xd8]
call fcn.00432400
mov edi, dword [ebp - 0xd8]
lea eax, [esi + 0x4c]
push eax
lea eax, [ebp - 0xe0]
push eax
push edi
lea eax, [ebp - 0xdc]
push eax
lea eax, [ebp - 0x54]
push eax
push ebx
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
je 0x430280
lea eax, [ebp - 0x54]
mov byte [esi + 0x48], 1
push eax
lea eax, [esi + 4]
push eax
push dword [ebp - 0xdc]
call dword [sym.imp.ADVAPI32.dll_CopySid]
test eax, eax
je 0x430280
mov ecx, dword [ebp - 0xe4]
push edi
call fcn.0041cdf0
mov ecx, dword [ebp - 0xe8]
push ebx
call fcn.0041cdf0
mov ecx, dword [ebp - 0xec]
push 0
call fcn.0041cdf0
lea eax, [ebp - 0xd4]
cmp dword [ebp - 0xd8], eax
je 0x43027c
lea ecx, [ebp - 0xd8]
call fcn.00433350
mov al, 1
jmp 0x4302c6
lea ecx, [esi + 0x50]
mov dword [esi + 0x4c], 7
call fcn.0041caa0
lea ecx, [esi + 0x54]
call fcn.0041caa0
lea ecx, [esi + 0x58]
call fcn.0041caa0
lea ecx, [esi + 0x5c]
call fcn.0041caa0
lea eax, [ebp - 0xd4]
mov byte [esi + 0x48], 0
cmp dword [ebp - 0xd8], eax
je 0x4302c4
lea ecx, [ebp - 0xd8]
call fcn.00433350
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a474b
mov esp, ebp
pop ebp
ret 8
Function at 0x4333b0
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x511070]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.WS2_32.dll_ntohl]
push esi
mov esi, ecx
mov dword [ebp - 0x18], edx
push edi
mov dword [ebp - 0x20], eax
push dword [esi]
call ebx
push dword [esi + 4]
mov edi, eax
call ebx
mov ebx, dword [ebp - 0x18]
xor esi, esi
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x14]
sub ebx, eax
nop dword [eax]
lea eax, [ebx + esi*4]
push dword [ebp + eax - 0x14]
call dword [sym.imp.WS2_32.dll_ntohl]
mov dword [ebp + esi*4 - 0x14], eax
inc esi
cmp esi, 4
jl 0x4333f0
mov ebx, dword [ebp - 0x1c]
mov edx, 0xe3779b90
mov esi, 0x10
mov ecx, edi
mov eax, edi
shr ecx, 5
add ecx, dword [ebp - 8]
shl eax, 4
add eax, dword [ebp - 0xc]
xor ecx, eax
lea eax, [edx + edi]
xor ecx, eax
sub ebx, ecx
mov ecx, ebx
mov eax, ebx
shl ecx, 4
add ecx, dword [ebp - 0x14]
shr eax, 5
add eax, dword [ebp - 0x10]
xor ecx, eax
lea eax, [edx + ebx]
xor ecx, eax
lea edx, [edx + 0x61c88647]
sub edi, ecx
sub esi, 1
jne 0x433414
mov esi, dword [sym.imp.WS2_32.dll_htonl]
push edi
call esi
mov edi, dword [ebp - 0x20]
push ebx
mov dword [edi], eax
call esi
mov ecx, dword [ebp - 4]
mov dword [edi + 4], eax
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.004a474b
mov esp, ebp
pop ebp
ret
Function at 0x4378e0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d3ba0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x511070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push str._commandSetSimpleVersionConfig
lea ecx, [ebp - 0x14]
xor esi, esi
call fcn.0041c9e0
mov dword [ebp - 4], esi
lea eax, [ebp - 0x14]
push dword [0x5153b0]
push str.__SimpleVersion_ld
push eax
call fcn.00438800
add esp, 0xc
lea ecx, [ebp - 0x14]
push 0x10
push str.__FromInstaller
call fcn.0041c4b0
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x43794a
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x10]
call fcn.0041c9e0
push 0xf
push str.QQPCSoftCmd.exe
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.0041c4b0
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4379a8
push str.5958793A_5C0C_4a22_812A_72065C3D975D
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov edx, dword [ebp - 0x14]
mov edi, eax
mov ecx, dword [ebp - 0x10]
push 0
push 0
push 0x7530
call fcn.0048eb00
add esp, 0xc
mov esi, eax
test edi, edi
je 0x4379a8
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push dword [0x5153b0]
push dword [ebp - 0x14]
push dword [ebp - 0x10]
push str.CVersionChecker::RunExe_Path_s__strParam_s__dwSimpleVersion_lu__bRet_d
push 0x515408
call fcn.0048c0f0
mov byte [ebp - 4], 0
or edi, 0xffffffff
mov edx, dword [ebp - 0x10]
add esp, 0x18
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4379e8
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x437a07
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x437a20
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d2658
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x511070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov ebx, ecx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0
call fcn.0041bef0
mov ecx, eax
test ecx, ecx
jne 0x437a6b
push 0x80004005
call fcn.0041ce60
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x10], esi
push 0
push edi
mov dword [ebp - 4], 0
call fcn.004ae3cc
add esp, 8
cmp eax, 0xffffffff
je 0x437baa
call dword [sym.imp.KERNEL32.dll_GetVersion]
lea ecx, [ebp - 0x10]
cmp al, 5
jbe 0x437b17
push 0x24
push str.advfirewall_firewall_add_rule_name_
call fcn.0041cd40
mov edx, dword [ebp + 8]
test edx, edx
jne 0x437ab5
xor ecx, ecx
jmp 0x437acf
mov ecx, edx
lea esi, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x437ac0
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x10]
call fcn.0041c4b0
push 0x13
push str.___dirin_program_
lea ecx, [ebp - 0x10]
call fcn.0041c4b0
test edi, edi
jne 0x437af0
xor ecx, ecx
jmp 0x437b04
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x437af5
sub ecx, edx
sar ecx, 1
push ecx
push edi
lea ecx, [ebp - 0x10]
call fcn.0041c4b0
push 0xe
push str.__actionallow
jmp 0x437b90
push 0x25
push str.firewall_add_allowedprogram_program_
call fcn.0041cd40
test edi, edi
jne 0x437b2b
xor ecx, ecx
jmp 0x437b3f
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x437b30
sub ecx, edx
sar ecx, 1
push ecx
push edi
lea ecx, [ebp - 0x10]
call fcn.0041c4b0
push 8
push str.__name_
lea ecx, [ebp - 0x10]
call fcn.0041c4b0
mov edx, dword [ebp + 8]
test edx, edx
jne 0x437b63
xor ecx, ecx
jmp 0x437b7f
mov ecx, edx
lea esi, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x437b70
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x10]
call fcn.0041c4b0
push 0x19
push str.__modeENABLE_profileALL
lea ecx, [ebp - 0x10]
call fcn.0041c4b0
push 2
push 0x4edd0c
lea ecx, [ebp - 0x10]
call fcn.0041c4b0
mov esi, dword [ebp - 0x10]
add esi, 0xfffffff0
mov ecx, esi
call fcn.0041c6e0
add eax, 0x10
mov dword [ebx], eax
or eax, 0xffffffff
mov dword [ebp - 4], eax
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x437bd1
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x439810
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x511070]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x20a
lea eax, [ebp - 0x210]
mov dword [0x515c5c], 0x4edef8
push 0
push eax
mov dword [ebp - 0x214], 0
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x218], 0x208
call fcn.004a73c0
add esp, 0xc
lea eax, [ebp - 0x214]
push eax
push 0x20019
push 0
push str.SOFTWARETencentQQPC2Mgr
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4398c6
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x21c]
push eax
push 0
push str.InstallDir
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
neg eax
sbb eax, eax
inc eax
mov dword [0x515c60], eax
mov eax, dword [ebp - 0x214]
test eax, eax
je 0x4398c6
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, 0x515c5c
xor ecx, ebp
call fcn.004a474b
mov esp, ebp
pop ebp
ret
Function at 0x43a810
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d3e78
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x511070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push dword [ebp + 8]
lea ecx, [ebp + 8]
call fcn.0041c9e0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
cmp dword [eax - 4], 1
jle 0x43a85e
push dword [eax - 0xc]
lea ecx, [ebp + 8]
call fcn.0041cb00
mov eax, dword [ebp + 8]
lea ecx, [esi + 0x44]
push ecx
push esi
push dword [ebp + 0xc]
push 0
push 0
push 0
push 0
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ecx, dword [ebp + 8]
mov esi, eax
push dword [ecx - 8]
push ecx
call fcn.004aa82a
mov edx, eax
add esp, 8
test edx, edx
js 0x43a8da
mov ecx, dword [ebp + 8]
cmp edx, dword [ecx - 8]
jg 0x43a8da
mov dword [ecx - 0xc], edx
xor ecx, ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0xffffffff
mov word [eax + edx*2], cx
or eax, 0xffffffff
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x43a8c6
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8
push 0x80070057
call fcn.0041ce60
int3