joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1004c05
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0100380d
xor ebx, ebx
cmp dword [0x100a5c4], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x1004cdc
push 0x100186c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x1004c47
xor eax, eax
jmp 0x1004da0
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1001860
push edi
call esi
cmp eax, ebx
je 0x1004c40
push eax
call fcn.010037a2
mov dword [esp], 0x1001850
push edi
mov dword [0x100a5c4], eax
call esi
push eax
call fcn.010037a2
mov dword [esp], 0x100183c
push edi
mov dword [0x100a5c8], eax
call esi
push eax
call fcn.010037a2
mov dword [0x100a5cc], eax
lea eax, [ebp - 8]
push eax
call fcn.010029c8
test eax, eax
pop ecx
pop ecx
je 0x1004caa
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0100461b
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x1004cdc
push 0x1001820
push edi
call esi
push eax
call fcn.010037a2
cmp eax, ebx
pop ecx
mov dword [0x100a5d4], eax
je 0x1004cdc
push 0x1001808
push edi
call esi
push eax
call fcn.010037a2
pop ecx
mov dword [0x100a5d0], eax
mov eax, dword [0x100a5d0]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x1004d55
cmp dword [0x100a5d4], esi
je 0x1004d55
push eax
call fcn.0100381b
pop ecx
call eax
cmp eax, ebx
je 0x1004d22
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x100a5d4]
call fcn.0100381b
pop ecx
call eax
test eax, eax
je 0x1004d22
test byte [ebp - 0x18], 1
jne 0x1004d55
lea eax, [ebp - 0xc]
push eax
call fcn.01002a09
test eax, eax
pop ecx
je 0x1004d3d
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0100461b
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x1004d4c
or dword [ebp + 0x10], 0x200000
jmp 0x1004d86
or dword [ebp + 0x10], 0x40000
jmp 0x1004d86
mov eax, dword [0x100a5c8]
cmp eax, esi
je 0x1004d86
push eax
call fcn.0100381b
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x1004d86
mov eax, dword [0x100a5cc]
cmp eax, esi
je 0x1004d86
push dword [ebp - 4]
push eax
call fcn.0100381b
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x100a5c4]
call fcn.0100381b
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1007ed5
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x1009178]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0xc]
xor edi, edi
push eax
mov dword [ebp - 0xc], edi
call fcn.010029c8
test eax, eax
pop ecx
je 0x1007f0a
push edi
push edi
push edi
push edi
push edi
call fcn.0100461b
add esp, 0x14
push 4
pop eax
call fcn.01008140
mov dword [ebp - 0x14], esp
push 0x1c
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x1008018
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov esi, dword [ebp - 0xc]
mov ebx, dword [ebp - 0x58]
dec esi
neg esi
sbb esi, esi
and esi, 0x103
inc esi
cmp dword [ebp - 0xc], 2
mov dword [ebp - 8], edi
jne 0x1007f91
push 0x10022f8
mov dword [ebp - 0x10], edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp eax, edi
je 0x1007f91
push 0x1002234
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, edi
je 0x1007f91
lea ecx, [ebp - 0x10]
push ecx
mov dword [ebp - 0x10], edi
call eax
cmp eax, 1
jne 0x1007f91
mov eax, dword [ebp - 0x10]
cmp eax, edi
jbe 0x1007f91
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
lea edi, [ebx - 1]
push edi
push dword [ebp - 8]
call fcn.01003126
add esp, 0xc
test eax, eax
jl 0x1008018
not edi
and dword [ebp - 8], edi
je 0x1007fc3
lea eax, [ebp - 8]
push eax
push ebx
push dword [ebp - 8]
call fcn.01003126
add esp, 0xc
test eax, eax
jl 0x1008018
lea eax, [ebx + ebx]
cmp dword [ebp - 8], eax
jae 0x1007fce
mov dword [ebp - 8], eax
lea edi, [ebx - 1]
not edi
and edi, dword [ebp - 0x14]
sub edi, dword [ebp - 8]
cmp dword [ebp - 0xc], 1
jne 0x1007fe2
push 0x11
pop ebx
mov eax, dword [ebp - 0x18]
add ebx, eax
cmp edi, ebx
jb 0x1008018
push 4
push 0x1000
push dword [ebp - 8]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
je 0x1008018
lea eax, [ebp - 0x1c]
push eax
push esi
push dword [ebp - 8]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1008018
xor eax, eax
inc eax
jmp 0x100801a
xor eax, eax
lea esp, [ebp - 0x68]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01002856
leave
ret
Function at 0x4012a2
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x414bb8
call sub.MSVCRT.dll__EH_prolog
sub esp, 0x810
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, ecx
xor ebx, ebx
xor edi, edi
cmp eax, ebx
mov dword [esi + 0x61c], eax
jne 0x401300
lea ecx, [ebp - 0x1c]
call fcn.00402361
push ebx
lea ecx, [ebp - 0x1c]
push dword [0x41e564]
mov dword [ebp - 4], ebx
call fcn.004045f5
cmp eax, 1
jne 0x401387
mov eax, dword [ebp - 0x10]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
mov dword [esi + 0x620], eax
call fcn.00402395
mov ecx, esi
call fcn.004016a1
test eax, eax
je 0x401393
cmp dword [esi + 0x61c], ebx
jne 0x401376
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0x81a]
mov word [ebp - 0x81c], bx
rep stosd dword es:[edi], eax
mov ecx, 0x41ff78
stosw word es:[edi], ax
call fcn.00409b11
push eax
mov ecx, 0x41fe58
call fcn.004099ca
push eax
push str.http:__toolbar.soso.com_T4_client_sosouninstall.html_cin_s_s
lea eax, [ebp - 0x81c]
push 0x3ff
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x14
lea eax, [ebp - 0x81c]
push 5
push ebx
push ebx
push eax
push 0x41c168
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 2
mov ecx, 0x41ee40
call fcn.00408df3
push 1
pop edi
jmp 0x401393
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00402395
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8

Function at 0x4014ac
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and dword [ebp - 4], 0
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push edi
mov ebx, str.ntdll.dll
push str.NtEnumerateKey
push ebx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
test eax, eax
mov dword [0x41e56c], eax
je 0x4015a2
push str.NtOpenKey
push ebx
call esi
push eax
call edi
test eax, eax
mov dword [0x41e568], eax
je 0x4015a2
push str.NtDeleteKey
push ebx
call esi
push eax
call edi
test eax, eax
mov dword [0x41e570], eax
je 0x4015a2
push str.NtClose
push ebx
call esi
push eax
call edi
test eax, eax
mov dword [0x41e574], eax
je 0x4015a2
push str.ZwQueryKey
push ebx
call esi
push eax
call edi
xor ebx, ebx
mov dword [0x41e57c], eax
cmp eax, ebx
je 0x4015a2
mov edi, dword [ebp + 8]
mov esi, dword [sym.imp.MSVCRT.dll_wcslen]
push edi
mov dword [ebp - 8], edi
call esi
shl eax, 1
push edi
mov word [ebp - 0xc], ax
call esi
shl eax, 1
mov word [ebp - 0xa], ax
lea eax, [ebp - 0xc]
pop ecx
mov dword [ebp - 0x1c], eax
pop ecx
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 4]
push 0x10000000
push eax
mov dword [ebp - 0x24], 0x18
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x18], 0x40
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
call dword [0x41e568]
test eax, eax
jl 0x4015a2
push dword [ebp - 4]
call fcn.004013a6
pop ecx
push dword [ebp - 4]
call dword [0x41e574]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401f12
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
push ebx
push esi
push edi
xor edx, edx
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x20a]
mov word [ebp - 0x20c], dx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov esi, 0x104
lea eax, [ebp - 0x20c]
push esi
push eax
mov dword [ebp - 4], edx
push edx
mov ebx, 0x80000003
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
cmp eax, 0x103
je 0x401fcb
push esi
lea eax, [ebp - 0x20c]
push 0x41c6e0
push eax
call fcn.00405dde
and word [ebp - 0x414], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x412]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.0040a573
lea eax, [ebp - 0x414]
push esi
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.00405dde
add esp, 0x24
lea eax, [ebp - 0x20c]
push eax
push ebx
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
inc dword [ebp - 4]
lea eax, [ebp - 0x20c]
push esi
push eax
push dword [ebp - 4]
jmp 0x401f4e
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4022b0
Capabilities:
Create process on windows

Disassembly:
cmp word [esp + 8], 0x439
jne 0x4022d4
push 5
push 0
push str.shell32_Control_RunDLL_Appwiz.cpl__0
push str.rundll32.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov eax, dword [esp + 0x10]
and dword [eax], 0
xor eax, eax
ret 0x10

Function at 0x402f34
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, dword [esp + 8]
push dword [esp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x402f4a
pop esi
ret
push esi
call dword [sym.imp.SHLWAPI.dll_PathRemoveBlanksW]
push esi
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
push esi
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 1
pop eax
pop esi
ret
Function at 0x403d9a
Capabilities:
Move file

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
test edi, edi
je 0x403dab
push edi
call fcn.00403482
pop ecx
mov esi, dword [esp + 0x10]
test esi, esi
je 0x403dba
push esi
call fcn.00403482
pop ecx
call fcn.00405351
test eax, eax
je 0x403dd8
xor eax, eax
test esi, esi
setne al
add eax, 4
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
jmp 0x403de1
push esi
push edi
call fcn.00403de4
pop ecx
pop ecx
pop edi
pop esi
ret
Function at 0x40438b
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x874
push ebx
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push edi
push dword [ebp + 0xc]
call esi
test eax, eax
jne 0x4043b8
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x4045b5
xor ebx, ebx
cmp dword [ebp + 0x10], ebx
je 0x4043c8
push dword [ebp + 0xc]
call fcn.00403482
pop ecx
push dword [ebp + 8]
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x872]
mov word [ebp - 0x874], bx
mov dword [ebp - 8], ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [ebp - 4], 1
call esi
test eax, eax
je 0x4045b5
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll_wcslen]
cmp eax, 4
pop ecx
jb 0x4045b5
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpynW]
push 0x104
push dword [ebp + 8]
lea eax, [ebp - 0x874]
push eax
call esi
mov ebx, dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x874]
push 0x41c904
push eax
call ebx
lea eax, [ebp - 0x66c]
push eax
lea eax, [ebp - 0x874]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0xc], eax
je 0x4045b5
cmp dword [ebp - 4], 0
je 0x4045a7
and word [ebp - 0x41c], 0
mov edx, 0x81
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x41a]
and word [ebp - 0x214], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x212]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, 0x104
lea eax, [ebp - 0x41c]
push edi
push dword [ebp + 8]
push eax
call esi
lea eax, [ebp - 0x640]
push eax
lea eax, [ebp - 0x41c]
push eax
call ebx
push edi
lea eax, [ebp - 0x214]
push dword [ebp + 0xc]
push eax
call esi
lea eax, [ebp - 0x640]
push eax
lea eax, [ebp - 0x214]
push eax
call ebx
test byte [ebp - 0x66c], 0x10
jne 0x404535
xor edi, edi
cmp dword [ebp + 0x14], edi
je 0x404503
lea eax, [ebp - 0x214]
push eax
call fcn.00403482
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x41c]
push eax
call fcn.00403d9a
add esp, 0xc
jmp 0x404582
lea eax, [ebp - 0x214]
push edi
push eax
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x404521
mov dword [ebp - 4], edi
jmp 0x404582
cmp dword [ebp + 0x10], edi
je 0x404582
lea eax, [ebp - 0x214]
push eax
call fcn.00403482
pop ecx
jmp 0x404582
mov edi, dword [sym.imp.MSVCRT.dll__wcsicmp]
lea eax, [ebp - 0x640]
push eax
push 0x41c6d0
call edi
pop ecx
test eax, eax
pop ecx
je 0x404582
lea eax, [ebp - 0x640]
push eax
push 0x41c6c8
call edi
pop ecx
test eax, eax
pop ecx
je 0x404582
push dword [ebp + 0x14]
lea eax, [ebp - 0x214]
push dword [ebp + 0x10]
push eax
lea eax, [ebp - 0x41c]
push eax
call fcn.0040438b
add esp, 0x10
mov dword [ebp - 4], eax
lea eax, [ebp - 0x66c]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x40459d
mov dword [ebp - 8], 1
cmp dword [ebp - 8], 0
je 0x404455
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 4]
jmp 0x4045b7
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x404b31
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
cmp dword [0x420a30], 0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetVersion]
push esi
push edi
jne 0x404b79
call ebx
test eax, 0x80000000
je 0x404b6f
push str.___.___
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push str.Unicows.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x420a34], eax
mov dword [0x420a30], 1
mov eax, dword [0x420a34]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x404b95
push dword [ebp + 0x10]
push eax
call esi
test eax, eax
mov dword [ebp - 4], eax
jne 0x404bc6
mov edi, dword [ebp + 0xc]
mov eax, dword [edi]
test eax, eax
jne 0x404bbd
call ebx
test eax, 0x80000000
mov eax, dword [ebp + 8]
je 0x404bb1
push dword [eax + 8]
call dword [eax]
jmp 0x404bb7
push dword [eax + 0xc]
call dword [eax + 4]
test eax, eax
je 0x404bc6
mov dword [edi], eax
push dword [ebp + 0x10]
push eax
call esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x4053e6
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
lea eax, [ebp - 0x114]
mov dword [ebp - 0x114], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x104], 2
jne 0x40541d
cmp dword [ebp - 0x110], 6
jb 0x40541d
push 1
pop eax
leave
ret
xor eax, eax
leave
ret

Function at 0x405ee6
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x464
push esi
push edi
push 0x10
xor eax, eax
pop ecx
lea edi, [ebp - 0x50]
mov dword [ebp - 0x54], 0x44
xor esi, esi
rep stosd dword es:[edi], eax
push 0x10
lea eax, [ebp - 0x10]
push esi
push eax
call sub.MSVCRT.dll_memset
mov ecx, 0x103
xor eax, eax
lea edi, [ebp - 0x462]
mov word [ebp - 0x464], si
rep stosd dword es:[edi], eax
add esp, 0xc
cmp dword [ebp + 0xc], esi
stosw word es:[edi], ax
je 0x405f52
push dword [ebp + 0xc]
lea eax, [ebp - 0x464]
push dword [ebp + 8]
push str.__s___s
push 0x207
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x14
jmp 0x405f6a
push 0x207
lea eax, [ebp - 0x464]
push dword [ebp + 8]
push eax
call dword [sym.imp.MSVCRT.dll_wcsncpy]
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x464]
push esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x405fae
cmp dword [ebp + 0x10], esi
jbe 0x405f9b
push dword [ebp + 0x10]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0xc]
call esi
push 1
pop eax
pop edi
pop esi
leave
ret
Function at 0x40635f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
cmp dword [0x41ebf8], 0
jne 0x4063ec
and word [ebp - 0x20c], 0
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x20a]
mov dword [0x41ebf8], 1
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x208
push eax
lea eax, [ebp - 0x20c]
push eax
push 0
push str.Version
push str.SOFTWAREMicrosoftInternet_Explorer
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea eax, [ebp - 0x20c]
push 0x41c6d0
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrW]
test eax, eax
pop edi
je 0x4063ec
and word [eax], 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.MSVCRT.dll__wtoi]
pop ecx
mov dword [0x41ebfc], eax
mov eax, dword [0x41ebfc]
leave
ret

Function at 0x406a0e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x18]
call fcn.004069b5
cmp dword [ebp + 0x10], 0
pop ecx
je 0x406a69
cmp dword [ebp + 0x10], eax
jl 0x406a69
mov ecx, dword [ebp + 0xc]
push esi
xor esi, esi
and word [ecx], 0
cmp dword [ebp + 0x18], esi
jle 0x406a63
push ebx
mov eax, esi
push 4
cdq
pop ebx
idiv ebx
mov al, byte [edx + 0x416834]
mov edx, dword [ebp + 0x14]
add al, byte [ebp + 8]
xor al, byte [esi + edx]
xor al, 0x80
movzx ax, al
mov word [ecx], ax
and word [ecx + 2], 0
inc esi
inc ecx
inc ecx
cmp esi, dword [ebp + 0x18]
jl 0x406a35
pop ebx
push 1
pop eax
pop esi
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x4073fa
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push ebx
mov edx, 0x81
push edi
xor ebx, ebx
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x40e]
mov word [ebp - 0x410], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x206]
cmp dword [0x41ec28], ebx
mov word [ebp - 0x208], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
jne 0x407445
xor eax, eax
jmp 0x4074df
push esi
mov esi, 0x104
lea eax, [ebp - 0x410]
push esi
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x4074dc
lea eax, [ebp - 0x208]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x208]
push 0x41cda8
push eax
call esi
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
lea eax, [ebp - 0x208]
push eax
call esi
push 1
lea eax, [ebp - 0x208]
push ebx
push eax
call fcn.004074e5
mov esi, eax
cmp esi, ebx
je 0x4074dc
push dword [ebp + 0xc]
push esi
call fcn.00407368
cmp eax, ebx
je 0x4074d5
lea ecx, [ebp + 8]
push ecx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
pop esi
pop edi
pop ebx
leave
ret 0x10
Function at 0x408526
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 1
pop ebx
test byte [0x41ee39], bl
jne 0x408547
or byte [0x41ee39], bl
call fcn.004086ff
mov dword [0x41ee20], eax
mov eax, dword [ebp + 8]
cmp eax, 0xc
ja case.0x408553.8
jmp dword [eax*4 + 0x4086cb]
push dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
and word [esi], 0
push esi
call fcn.0040ace5
pop ecx
test eax, eax
pop ecx
je 0x40857f
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4086c0
push dword [ebp + 0x10]
push esi
call fcn.0040873a
jmp 0x408595
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00402f34
pop ecx
pop ecx
jmp 0x4086c0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
jmp 0x4086c0
push dword [ebp + 0xc]
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
jmp 0x4086c0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00402f34
pop ecx
pop ecx
push str.downlo1
jmp 0x4086b7
push ebx
push 0x1a
push dword [ebp + 0xc]
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je case.0x408553.8
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push str.LocalVirtualStoreProgram_Files
push dword [ebp + 0xc]
call esi
push str.TENCENTQQToolbar
push dword [ebp + 0xc]
jmp 0x408640
mov edi, dword [ebp + 0xc]
push ebx
push 0x1a
push edi
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je case.0x408553.8
cmp dword [0x41ee20], 0
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
je 0x40863a
push edi
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.LocalLow
push edi
call esi
push str.TENCENTQQToolbar
push edi
call esi
jmp 0x4086c0
push ebx
push 0x1c
push dword [ebp + 0xc]
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je case.0x408553.8
push str.TENCENTQQToolbar
jmp 0x4086b7
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 6
call fcn.00408526
add esp, 0xc
push str.btns
jmp 0x4086b7
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 6
call fcn.00408526
add esp, 0xc
push str.dlls
jmp 0x4086b7
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 6
call fcn.00408526
add esp, 0xc
push str.users
jmp 0x4086b7
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 6
call fcn.00408526
add esp, 0xc
push str.config
push dword [ebp + 0xc]
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov eax, ebx
jmp 0x4086c6
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4086ff
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
lea eax, [ebp - 0x114]
mov dword [ebp - 0x114], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x104], 2
jne 0x408736
cmp dword [ebp - 0x110], 6
jb 0x408736
push 1
pop eax
leave
ret
xor eax, eax
leave
ret
Function at 0x4087a7
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
and word [ebp - 0x208], 0
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x206]
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x208]
push eax
push 6
call fcn.00408526
add esp, 0xc
test eax, eax
pop edi
je 0x40883c
lea eax, [ebp - 0x208]
push str.Update
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40881b
push eax
lea eax, [ebp - 0x208]
push eax
call fcn.00403b6e
pop ecx
test eax, eax
pop ecx
je 0x40883c
push dword [ebp + 0xc]
lea eax, [ebp - 0x208]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push dword [ebp + 8]
call fcn.00403482
pop ecx
push 1
pop eax
leave
ret
xor eax, eax
leave
ret

Function at 0x4091d2
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
and word [ebp - 0x208], 0
push esi
mov edx, ecx
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x206]
push 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 1
lea eax, [ebp - 0x208]
push 0x103
add edx, 4
push eax
push edx
call fcn.00413c6f
add esp, 0x14
mov esi, eax
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x409245
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x409245
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, esi
pop edi
pop esi
leave
ret

Function at 0x4094a8
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push edi
push 0x44
pop ecx
xor eax, eax
lea edi, [ebp - 0x110]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x114], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
pop edi
je 0x409535
cmp dword [ebp - 0x104], 1
jne 0x4094f1
cmp dword [ebp - 0x110], 4
jne 0x409535
mov al, 1
leave
ret
cmp dword [ebp - 0x104], 2
jne 0x409535
push 5
pop eax
cmp dword [ebp - 0x110], eax
jne 0x40952c
cmp dword [ebp - 0x10c], 0
jne 0x409512
mov al, 2
leave
ret
cmp dword [ebp - 0x10c], 1
jne 0x40951f
mov al, 3
leave
ret
cmp dword [ebp - 0x10c], 2
jne 0x409535
mov al, 4
leave
ret
cmp dword [ebp - 0x110], 6
je 0x409537
xor al, al
leave
ret