joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43e860
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1048
call fcn.0042a4c0
mov eax, dword [0x481288]
xor eax, ebp
mov dword [ebp - 4], eax
mov word [ebp - 0x1048], 0
push 0x40e
push 0
lea eax, [ebp - 0x1046]
push eax
call fcn.00415680
add esp, 0xc
mov word [ebp - 0x828], 0
push 0x40e
push 0
lea ecx, [ebp - 0x826]
push ecx
call fcn.00415680
add esp, 0xc
mov word [ebp - 0xc38], 0
push 0x40e
push 0
lea edx, [ebp - 0xc36]
push edx
call fcn.00415680
add esp, 0xc
mov word [ebp - 0x418], 0
push 0x40e
push 0
lea eax, [ebp - 0x416]
push eax
call fcn.00415680
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
push str._suninst.exe
push 0x410
push 0x208
lea edx, [ebp - 0x1048]
push edx
call fcn.004157ac
add esp, 0x14
lea eax, [ebp - 0x1048]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp + 0xc]
push ecx
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall
push 0x471820
push 0x410
push 0x208
lea edx, [ebp - 0x828]
push edx
call fcn.004157ac
add esp, 0x18
lea eax, [ebp - 0x828]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00439800
add esp, 8
push 0
push 0x47182c
push 0x471840
push 0x471858
push 0x471864
call fcn.00439ec0
add esp, 0x14
push 0
push 0x471870
push 0x471884
push 0x47189c
push str.CN_vAx
call fcn.00439ec0
add esp, 0x14
lea ecx, [ebp - 0xc38]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00433ed0
add esp, 8
push 0x4718b4
lea eax, [ebp - 0xc38]
push eax
call fcn.004159fc
add esp, 8
test eax, eax
je 0x43ea0d
lea ecx, [ebp - 0xc38]
push ecx
call fcn.00438d00
add esp, 4
lea edx, [ebp - 0x418]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00433d20
add esp, 8
push 0x4718b8
lea ecx, [ebp - 0x418]
push ecx
call fcn.004159fc
add esp, 8
test eax, eax
je 0x43ea0d
lea edx, [ebp - 0x418]
push edx
call fcn.00438d00
add esp, 4
push str..tmp
mov eax, dword [ebp + 8]
push eax
call fcn.004392b0
add esp, 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004151d0
mov esp, ebp
pop ebp
ret
Function at 0x441b70
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [0x48aca0], 1
push 0
push 0
mov eax, dword [ebp + 8]
push eax
push 0x4413d0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov dword [0x48aca8], ecx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x442070
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [0x48ac98], 1
push 0
push 0
push 0
push 0x441ef0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [0x48ac9c], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x4420b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x481288]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x21c], 0
lea eax, [ebp - 0x21c]
push eax
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov dword [ebp - 0x214], eax
lea ecx, [ebp - 0x210]
push ecx
mov edx, dword [ebp - 0x21c]
push edx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov dword [ebp - 0x218], eax
push str.TencentQQMisc
lea eax, [ebp - 0x210]
push eax
push 0x47449c
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.004157ac
add esp, 0x18
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004151d0
mov esp, ebp
pop ebp
ret
Function at 0x442760
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x694
mov eax, dword [0x481288]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 1
push 0x208
push 0x104
lea eax, [ebp - 0x420]
push eax
call fcn.004420b0
add esp, 0xc
push str.EnvirConf.ini
lea ecx, [ebp - 0x420]
push ecx
push 0x4744bc
push 0x208
push 0x104
lea edx, [ebp - 0x218]
push edx
call fcn.004157ac
add esp, 0x18
mov word [ebp - 0x620], 0
push 0x1fe
push 0
lea eax, [ebp - 0x61e]
push eax
call fcn.00415680
add esp, 0xc
lea ecx, [ebp - 0x218]
push ecx
push 0x100
lea edx, [ebp - 0x620]
push edx
push 0x4744c8
push str.ScanOpt
push str.Option
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov dword [ebp - 0x624], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 0x624], 0
jne 0x442824
mov eax, 1
jmp 0x4429c1
cmp dword [ebp - 0x624], 0x80
jne 0x4429b7
mov byte [ebp - 0x668], 0
push 0x3f
push 0
lea eax, [ebp - 0x667]
push eax
call fcn.00415680
add esp, 0xc
lea ecx, [ebp - 0x668]
push ecx
mov edx, dword [ebp - 0x624]
push edx
lea eax, [ebp - 0x620]
push eax
call fcn.00442530
add esp, 0xc
test eax, eax
je 0x4429b7
mov byte [ebp - 0x68c], 0
xor ecx, ecx
mov dword [ebp - 0x68b], ecx
mov dword [ebp - 0x687], ecx
mov dword [ebp - 0x683], ecx
mov dword [ebp - 0x67f], ecx
mov dword [ebp - 0x67b], ecx
mov dword [ebp - 0x677], ecx
mov dword [ebp - 0x673], ecx
mov dword [ebp - 0x66f], ecx
push 0x25
push 0x40
lea edx, [ebp - 0x668]
push edx
push 0x20
lea eax, [ebp - 0x68c]
push eax
call fcn.004424b0
add esp, 0x14
test eax, eax
je 0x4429b7
push 1
lea ecx, [ebp - 0x68c]
push ecx
push 1
push 4
lea edx, [ebp - 8]
push edx
call fcn.00442140
add esp, 0x14
test eax, eax
je 0x4429b7
mov eax, dword [ebp - 8]
mov dword [ebp - 0x690], eax
cmp dword [ebp - 0x690], 0x541a
je 0x442932
cmp dword [ebp - 0x690], 0x5f52
je 0x442920
cmp dword [ebp - 0x690], 0x5fd8
je 0x442929
jmp 0x44293b
mov dword [ebp - 8], 3
jmp 0x442942
mov dword [ebp - 8], 2
jmp 0x442942
mov dword [ebp - 8], 0
jmp 0x442942
mov dword [ebp - 8], 1
lea ecx, [ebp - 0x218]
push ecx
push 0
push str.EnvirType
push str.Option
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
mov dword [ebp - 0x694], edx
cmp dword [ebp - 0x694], 0x708b
je 0x44298d
cmp dword [ebp - 0x694], 0x70f0
je 0x442998
cmp dword [ebp - 0x694], 0x711a
je 0x4429a3
jmp 0x4429ae
mov eax, dword [ebp + 0xc]
mov dword [eax], 1
jmp 0x4429b7
mov ecx, dword [ebp + 0xc]
mov dword [ecx], 0
jmp 0x4429b7
mov edx, dword [ebp + 0xc]
mov dword [edx], 2
jmp 0x4429b7
mov eax, dword [ebp + 0xc]
mov dword [eax], 0
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 8]
mov dword [ecx], edx
xor eax, eax
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004151d0
mov esp, ebp
pop ebp
ret
Function at 0x442b80
Capabilities:
Copy file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa34
mov eax, dword [0x481288]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0xa34], 0
mov word [ebp - 0x620], 0
push 0x206
push 0
lea eax, [ebp - 0x61e]
push eax
call fcn.00415680
add esp, 0xc
lea ecx, [ebp - 0xa34]
push ecx
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
lea edx, [ebp - 0x620]
push edx
mov eax, dword [ebp - 0xa34]
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov word [ebp - 0x828], 0
push 0x206
push 0
lea ecx, [ebp - 0x826]
push ecx
call fcn.00415680
add esp, 0xc
push 0x474d78
push 0x474d88
lea edx, [ebp - 0x620]
push edx
push str._sTencentQQSTempUninstall_s_s
push 0x208
push 0x104
lea eax, [ebp - 0x828]
push eax
call fcn.004157ac
add esp, 0x1c
mov word [ebp - 0x210], 0
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.00415680
add esp, 0xc
push 0x474df0
lea edx, [ebp - 0x620]
push edx
push str._sTencentQQSTempUninstall_s
push 0x208
push 0x104
lea eax, [ebp - 0x210]
push eax
call fcn.004157ac
add esp, 0x18
lea ecx, [ebp - 0x418]
push ecx
push 0x474e54
call fcn.00438b10
add esp, 8
mov dword [ebp - 4], 0x104
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 0xa30]
push eax
push str.LocalPackage
lea ecx, [ebp - 0x418]
push ecx
call sub.Msi.dll_MsiGetPropertyW
test eax, eax
jne 0x442cda
lea edx, [ebp - 0x210]
push edx
call fcn.00437cb0
add esp, 4
push 0
lea eax, [ebp - 0x828]
push eax
lea ecx, [ebp - 0xa30]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
jmp 0x442cdc
xor eax, eax
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004151d0
mov esp, ebp
pop ebp
ret
Function at 0x442cf0
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x844
mov eax, dword [0x481288]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x210]
push eax
push 0x474cdc
call fcn.00438b10
add esp, 8
lea ecx, [ebp - 0x214]
push ecx
push 0x20019
push 0
lea edx, [ebp - 0x210]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
jne 0x442e91
mov dword [ebp - 0x21c], 4
mov dword [ebp - 0x430], 0x104
mov dword [ebp - 0x42c], 0
lea eax, [ebp - 0x430]
push eax
lea ecx, [ebp - 0x428]
push ecx
lea edx, [ebp - 0x21c]
push edx
push 0
push 0x474d04
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x442e84
cmp dword [ebp - 0x21c], 1
jne 0x442e84
lea ecx, [ebp - 0x428]
push ecx
call fcn.00414d31
add esp, 4
test eax, eax
jbe 0x442e84
mov dword [ebp - 0x844], 0
mov word [ebp - 0x638], 0
push 0x206
push 0
lea edx, [ebp - 0x636]
push edx
call fcn.00415680
add esp, 0xc
lea eax, [ebp - 0x844]
push eax
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
lea ecx, [ebp - 0x638]
push ecx
mov edx, dword [ebp - 0x844]
push edx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov word [ebp - 0x840], 0
push 0x206
push 0
lea eax, [ebp - 0x83e]
push eax
call fcn.00415680
add esp, 0xc
push 0x474d14
lea ecx, [ebp - 0x428]
push ecx
lea edx, [ebp - 0x638]
push edx
push 0x474d28
push 0x208
push 0x104
lea eax, [ebp - 0x840]
push eax
call fcn.004157ac
add esp, 0x1c
lea ecx, [ebp - 0x840]
push ecx
push 0x474d70
push 0x104
push 0x104
mov edx, dword [ebp + 8]
push edx
call fcn.004157ac
add esp, 0x14
mov eax, 1
jmp 0x442e93
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004151d0
mov esp, ebp
pop ebp
ret

Function at 0x442fe0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x481288]
xor eax, ebp
mov dword [ebp - 4], eax
mov word [ebp - 0x210], 0
push 0x206
push 0
lea eax, [ebp - 0x20e]
push eax
call fcn.00415680
add esp, 0xc
push 1
push 0xb
lea ecx, [ebp - 0x210]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x44304a
push 0x474a14
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x210]
push eax
call fcn.00438d00
add esp, 4
push 1
push 0x16
lea ecx, [ebp - 0x210]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x443082
push 0x474a34
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x210]
push eax
call fcn.00438d00
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004151d0
mov esp, ebp
pop ebp
ret
Function at 0x443090
Capabilities:
Check if file exists
Copy file
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x830
mov eax, dword [0x481288]
xor eax, ebp
mov dword [ebp - 4], eax
mov word [ebp - 0x210], 0
push 0x206
push 0
lea eax, [ebp - 0x20e]
push eax
call fcn.00415680
add esp, 0xc
push 0x4746a4
mov ecx, dword [ebp + 8]
push ecx
push str._sSysDirTXSSO_s
push 0x208
push 0x104
lea edx, [ebp - 0x210]
push edx
call fcn.004157ac
add esp, 0x18
mov dword [0x48a854], 1
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x443231
push 0
push 0
push 0
lea ecx, [ebp - 0x210]
push ecx
push 0x4746ec
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x41c], 0
mov word [ebp - 0x418], 0
push 0x206
push 0
lea edx, [ebp - 0x416]
push edx
call fcn.00415680
add esp, 0xc
mov word [ebp - 0x830], 0
push 0x206
push 0
lea eax, [ebp - 0x82e]
push eax
call fcn.00415680
add esp, 0xc
mov word [ebp - 0x628], 0
push 0x206
push 0
lea ecx, [ebp - 0x626]
push ecx
call fcn.00415680
add esp, 0xc
lea edx, [ebp - 0x41c]
push edx
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
lea eax, [ebp - 0x418]
push eax
mov ecx, dword [ebp - 0x41c]
push ecx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
lea edx, [ebp - 0x418]
push edx
push str._sTencentQQcommonf_inst
push 0x208
push 0x104
lea eax, [ebp - 0x830]
push eax
call fcn.004157ac
add esp, 0x14
push str.TXSSOSetup.exe
lea ecx, [ebp - 0x830]
push ecx
push 0x474750
push 0x208
push 0x104
lea edx, [ebp - 0x628]
push edx
call fcn.004157ac
add esp, 0x18
lea eax, [ebp - 0x830]
push eax
call fcn.00437cb0
add esp, 4
push 0
lea ecx, [ebp - 0x628]
push ecx
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov eax, 1
jmp 0x44323d
mov dword [0x48a854], 0
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004151d0
mov esp, ebp
pop ebp
ret

Function at 0x443250
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x481288]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
mov word [ebp - 0x418], 0
push 0x206
push 0
lea eax, [ebp - 0x416]
push eax
call fcn.00415680
add esp, 0xc
mov word [ebp - 0x210], 0
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.00415680
add esp, 0xc
lea edx, [ebp - 4]
push edx
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
lea eax, [ebp - 0x418]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
push 0x47462c
lea edx, [ebp - 0x418]
push edx
push str._sTencentLogsQQ2010Setup__s.tlg
push 0x208
push 0x104
lea eax, [ebp - 0x210]
push eax
call fcn.004157ac
add esp, 0x18
push 1
lea ecx, [ebp - 0x210]
push ecx
push 0x3cff
call sub.Msi.dll_MsiGetComponentPathW
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004151d0
mov esp, ebp
pop ebp
ret
Function at 0x443a90
Capabilities:
Check if file exists
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x481288]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [0x485bf4], eax
mov ecx, dword [ebp + 0x10]
mov dword [0x485bf8], ecx
push 0
push 0x102
call sub.Msi.dll_MsiSetPropertyW
push str.TEST
push 0x7fff
push 0x4434c0
call sub.Msi.dll_MsiSetInternalUI
call fcn.004434a0
mov dword [0x485bf0], 0
mov dword [ebp - 4], 0x104
call fcn.00442fe0
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 0x210]
push eax
push 0x474a60
mov ecx, dword [ebp + 8]
push ecx
call sub.Msi.dll_MsiGetPropertyW
test eax, eax
jne 0x443bde
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x443b87
mov word [ebp - 0x420], 0
push 0x206
push 0
lea eax, [ebp - 0x41e]
push eax
call fcn.00415680
add esp, 0xc
lea ecx, [ebp - 0x420]
push ecx
call fcn.00442cf0
add esp, 4
mov dword [ebp - 0x218], eax
lea edx, [ebp - 0x420]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
je 0x443b87
push 0
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x420]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov dword [0x4880a4], 0
mov dword [ebp - 0x214], 0
cmp dword [0x4880a0], 0
je 0x443bbd
push str.REMOVE_ALL__YP_SHOW_MSGBOX_No__YP_CHECK_QQTM_RUN_Yes__YP_DELETE_AUTO_RUN_No__YP_UNINSTALL_FROM_upgrade_
lea edx, [ebp - 0x210]
push edx
call sub.Msi.dll_MsiOpenDatabaseW
mov dword [ebp - 0x214], eax
jmp 0x443bd4
push str.REMOVE_ALL__YP_SHOW_MSGBOX_No__YP_CHECK_QQTM_RUN_Yes__YP_DELETE_AUTO_RUN_No__YP_UNINSTALL_FROM_setupexe_
lea eax, [ebp - 0x210]
push eax
call sub.Msi.dll_MsiOpenDatabaseW
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
jmp 0x443be0
xor eax, eax
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004151d0
mov esp, ebp
pop ebp
ret
Function at 0x444380
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 4]
push eax
push 0x20006
push 0
push 0x4770f0
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4443c9
lea ecx, [ebp - 4]
push ecx
push str.SOFTWARETencentQQ2009
push connect
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4443c9
jmp 0x4443e9
mov dword [ebp - 0xc], 1
push 4
lea edx, [ebp - 0xc]
push edx
push 4
push 0
push str.nVirginStart
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esp, ebp
pop ebp
ret

Function at 0x4443f0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x20006
push 0
push str.SOFTWAREMicrosoftInternet_ExplorerLow_RightsElevationPolicy
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4444bf
mov dword [ebp - 8], 0
push 0
lea ecx, [ebp - 8]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4444b5
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00414d31
add esp, 4
lea edx, [eax + eax + 2]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 1
push 0
push str.AppName
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [ebp + 0x10]
push edx
call fcn.00414d31
add esp, 4
lea eax, [eax + eax + 2]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
push 2
push 0
push str.AppPath
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 4
lea eax, [ebp + 0x14]
push eax
push 4
push 0
push str.Policy
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret
Function at 0x444840
Capabilities:
Check if file exists
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x481288]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 4], 1
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
push str._s_d
push 0x208
push 0x104
lea edx, [ebp - 0x210]
push edx
call fcn.004157ac
add esp, 0x18
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4448b3
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4448b3
push 4
push 0
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 5
jl 0x44485a
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004151d0
mov esp, ebp
pop ebp
ret

Function at 0x4448d0
Capabilities:
Check if file exists
Delete directory
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x620
mov eax, dword [0x481288]
xor eax, ebp
mov dword [ebp - 8], eax
push 0x486708
call fcn.00414d31
add esp, 4
test eax, eax
jbe 0x444a78
push 0x486708
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x444a78
push 0x4880d0
push 0x486708
call fcn.004159fc
add esp, 8
test eax, eax
je 0x444a78
mov word [ebp - 0x418], 0
push 0x206
push 0
lea eax, [ebp - 0x416]
push eax
call fcn.00415680
add esp, 0xc
mov word [ebp - 0x210], 0
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.00415680
add esp, 0xc
mov word [ebp - 0x620], 0
push 0x206
push 0
lea edx, [ebp - 0x61e]
push edx
call fcn.00415680
add esp, 0xc
mov dword [ebp - 4], 0
push 0x486708
push str._sPlugin
push 0x208
push 0x104
lea eax, [ebp - 0x418]
push eax
call fcn.004157ac
add esp, 0x14
lea ecx, [ebp - 0x418]
push ecx
call fcn.00438d00
add esp, 4
push 0x486708
push 0x4756e4
push 0x208
push 0x104
lea edx, [ebp - 0x210]
push edx
call fcn.004157ac
add esp, 0x14
lea eax, [ebp - 0x210]
push eax
call fcn.00438d00
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x444a18
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x444a18
push 4
push 0
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 0x486708
push str._sUsers
push 0x208
push 0x104
lea eax, [ebp - 0x620]
push eax
call fcn.004157ac
add esp, 0x14
lea ecx, [ebp - 0x620]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x444a5a
push 0x486708
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov dword [ebp - 4], eax
push 0x486708
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x444a78
push 4
push 0
push 0x486708
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004151d0
mov esp, ebp
pop ebp
ret
Function at 0x444a90
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x481288]
xor eax, ebp
mov dword [ebp - 4], eax
mov word [ebp - 0x418], 0
push 0x206
push 0
lea eax, [ebp - 0x416]
push eax
call fcn.00415680
add esp, 0xc
mov word [ebp - 0x210], 0
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.00415680
add esp, 0xc
push str.http:__ptlogin2.qq.com_2012beta2
push 0x4756bc
push 0x208
push 0x104
lea edx, [ebp - 0x418]
push edx
call fcn.004157ac
add esp, 0x14
push 5
push 0x4880d0
push 0
lea eax, [ebp - 0x418]
push eax
push 0x4756c4
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004151d0
mov esp, ebp
pop ebp
ret

Function at 0x444b40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x444c3d
mov dword [ebp - 0xc], 0
cmp dword [ebp + 0x14], 0
je 0x444baa
mov byte [ebp - 0x18], 0xff
mov byte [ebp - 0x17], 0xfe
mov dword [ebp - 0xc], 2
mov dword [ebp - 0x1c], 0
push 0
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0xc]
push edx
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0xc]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 0
cmp dword [ebp - 8], 0x1000000
jle 0x444bd5
mov dword [ebp - 0x2c], 0x1000000
jmp 0x444bdb
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], 0
push 0
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x10]
add ecx, dword [ebp - 0x24]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 0x24]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x24]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x20], 0
jne 0x444c26
jmp 0x444c2c
cmp dword [ebp - 8], 0
jg 0x444bc3
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x444c3f
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x444c50
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x481288]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x487ae8], 0
je 0x444c73
xor eax, eax
jmp 0x444d1f
mov word [ebp - 0x210], 0
push 0x206
push 0
lea eax, [ebp - 0x20e]
push eax
call fcn.00415680
add esp, 0xc
mov word [ebp - 0x418], 0
push 0x206
push 0
lea ecx, [ebp - 0x416]
push ecx
call fcn.00415680
add esp, 0xc
push 0x4880d0
push 0x4755d8
push 0x208
push 0x104
lea edx, [ebp - 0x210]
push edx
call fcn.004157ac
add esp, 0x14
push 0x4755e8
lea eax, [ebp - 0x210]
push eax
push 0x4755f8
push 0x208
push 0x104
lea ecx, [ebp - 0x418]
push ecx
call fcn.004157ac
add esp, 0x18
push 5
lea edx, [ebp - 0x210]
push edx
push 0
lea eax, [ebp - 0x418]
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004151d0
mov esp, ebp
pop ebp
ret