joyce8/EMBER2024-capa huggingface dataset:
Function at 0x421eb0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x43d150]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x210]
push eax
call fcn.00421e60
add esp, 4
lea ecx, [ebp - 0x210]
push ecx
push str._sWhatsnew.txt
push 0x104
lea edx, [ebp - 0x418]
push edx
call fcn.0040d685
add esp, 0x10
push 5
push 0
lea eax, [ebp - 0x418]
push eax
push str.notepad.exe
push 0x437c54
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040cf89
mov esp, ebp
pop ebp
ret

Function at 0x421ff0
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa30
mov eax, dword [0x43d150]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0xa30]
push eax
call fcn.00421e60
add esp, 4
lea ecx, [ebp - 0xa30]
push ecx
push 0x437384
push 0x104
lea edx, [ebp - 0x210]
push edx
call fcn.0040d685
add esp, 0x10
lea eax, [ebp - 0xa30]
push eax
push 0x4373a4
push 0x104
lea ecx, [ebp - 0x620]
push ecx
call fcn.0040d685
add esp, 0x10
lea edx, [ebp - 0x418]
push edx
call fcn.00421530
add esp, 4
test eax, eax
jne 0x4220d1
lea eax, [ebp - 0x418]
push eax
push str._s_npqqedit.dll
push 0x104
lea ecx, [ebp - 0x828]
push ecx
call fcn.0040d685
add esp, 0x10
push 0
lea edx, [ebp - 0x828]
push edx
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea ecx, [ebp - 0x418]
push ecx
push str._s_npqqcert.dll
push 0x104
lea edx, [ebp - 0x828]
push edx
call fcn.0040d685
add esp, 0x10
push 0
lea eax, [ebp - 0x828]
push eax
lea ecx, [ebp - 0x620]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040cf89
mov esp, ebp
pop ebp
ret

Function at 0x4221a0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x43d150]
xor eax, ebp
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x210]
push eax
call fcn.00421cd0
add esp, 4
test eax, eax
je 0x4221ce
or eax, 0xffffffff
jmp 0x42226a
push 0x436d54
lea ecx, [ebp - 0x210]
push ecx
call fcn.00401000
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4221f2
mov eax, 0xfffffffe
jmp 0x42226a
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x210]
sub edx, eax
sar edx, 1
mov dword [ebp - 8], edx
xor ecx, ecx
mov edx, dword [ebp - 8]
mov word [ebp + edx*2 - 0x210], cx
push 0
lea eax, [ebp - 0x210]
push eax
call fcn.0040e937
add esp, 8
cmp eax, 0xffffffff
jne 0x42222c
mov eax, 0xfffffffd
jmp 0x42226a
lea ecx, [ebp - 0x210]
push ecx
push 0x436c84
push 0x104
mov edx, dword [ebp + 8]
push edx
call fcn.0040d685
add esp, 0x10
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.0040e937
add esp, 8
cmp eax, 0xffffffff
jne 0x422268
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor eax, eax
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0040cf89
mov esp, ebp
pop ebp
ret
Function at 0x422280
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x43d150]
xor eax, ebp
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x210]
push eax
call fcn.00421cd0
add esp, 4
test eax, eax
je 0x4222ae
or eax, 0xffffffff
jmp 0x42234a
push 0x436bd4
lea ecx, [ebp - 0x210]
push ecx
call fcn.00401000
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4222d2
mov eax, 0xfffffffe
jmp 0x42234a
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x210]
sub edx, eax
sar edx, 1
mov dword [ebp - 8], edx
xor ecx, ecx
mov edx, dword [ebp - 8]
mov word [ebp + edx*2 - 0x210], cx
push 0
lea eax, [ebp - 0x210]
push eax
call fcn.0040e937
add esp, 8
cmp eax, 0xffffffff
jne 0x42230c
mov eax, 0xfffffffd
jmp 0x42234a
lea ecx, [ebp - 0x210]
push ecx
push 0x436bec
push 0x104
mov edx, dword [ebp + 8]
push edx
call fcn.0040d685
add esp, 0x10
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.0040e937
add esp, 8
cmp eax, 0xffffffff
jne 0x422348
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor eax, eax
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0040cf89
mov esp, ebp
pop ebp
ret

Function at 0x422360
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x43d150]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.0042c9c0
push eax
push str.https:__www.tenpay.com__ADTAGTENPAY.CLIENT.SETUP._s
push 0x104
lea eax, [ebp - 0x210]
push eax
call fcn.0040d685
add esp, 0x10
push 1
push 0
push 0
lea ecx, [ebp - 0x210]
push ecx
push 0x437ba4
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040cf89
mov esp, ebp
pop ebp
ret
Function at 0x4223c0
Capabilities:
Delete registry key
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x43d150]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x214]
push eax
push str.SYSTEMCurrentControlSetServicesTenpayKeyboard
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x42241c
mov ecx, dword [ebp - 0x214]
push ecx
call fcn.004213f0
add esp, 4
push 0x43776c
mov edx, dword [ebp - 0x214]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x214]
push ecx
push str.SYSTEMCurrentControlSetControlClass4D36E96B_E325_11CE_BFC1_08002BE10318
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x422545
mov dword [ebp - 0x21c], 0x208
lea edx, [ebp - 0x21c]
push edx
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x218]
push ecx
push 0
push 0x43780c
mov edx, dword [ebp - 0x214]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x422538
mov eax, dword [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x210]
push ecx
call fcn.00421f20
add esp, 8
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0xffffffff
je 0x422538
push str.TenpayKeyboard
call fcn.0040dc46
add esp, 4
add eax, 1
mov dword [ebp - 0x224], eax
mov edx, dword [ebp - 0x220]
add edx, dword [ebp - 0x224]
shl edx, 1
mov eax, dword [ebp - 0x21c]
sub eax, edx
push eax
mov ecx, dword [ebp - 0x220]
lea edx, [ebp + ecx*2 - 0x210]
mov eax, dword [ebp - 0x224]
lea ecx, [edx + eax*2]
push ecx
mov edx, dword [ebp - 0x220]
lea eax, [ebp + edx*2 - 0x210]
push eax
call fcn.0040d320
add esp, 0xc
mov ecx, dword [ebp - 0x224]
shl ecx, 1
mov edx, dword [ebp - 0x21c]
sub edx, ecx
mov dword [ebp - 0x21c], edx
mov eax, dword [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x210]
push ecx
mov edx, dword [ebp - 0x218]
push edx
push 0
push str.UpperFilters
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 0x214]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040cf89
mov esp, ebp
pop ebp
ret
Function at 0x422c30
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x298
mov eax, dword [0x43d150]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push eax
push 0x436998
push 0x104
lea ecx, [ebp - 0x210]
push ecx
call fcn.0040d685
add esp, 0x10
mov dword [ebp - 0x214], 0
push 0
lea edx, [ebp - 0x218]
push edx
push 0
push 0xf003f
push 0
push 0
push 0
lea eax, [ebp - 0x210]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x422dbc
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0040dc46
add esp, 4
shl eax, 1
mov dword [ebp - 0x214], eax
mov edx, dword [ebp - 0x214]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 1
push 0
push str.Description
mov ecx, dword [ebp - 0x218]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [ebp - 0x214]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 1
push 0
push str.ProductName
mov ecx, dword [ebp - 0x218]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push str.tenpay
push 0x40
lea edx, [ebp - 0x298]
push edx
call fcn.0040eced
add esp, 0xc
lea eax, [ebp - 0x298]
push eax
call fcn.0040dc46
add esp, 4
shl eax, 1
mov dword [ebp - 0x214], eax
mov ecx, dword [ebp - 0x214]
push ecx
lea edx, [ebp - 0x298]
push edx
push 1
push 0
push str.Vendor
mov eax, dword [ebp - 0x218]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp + 8]
push ecx
call fcn.0040dc46
add esp, 4
shl eax, 1
mov dword [ebp - 0x214], eax
mov edx, dword [ebp - 0x214]
push edx
mov eax, dword [ebp + 8]
push eax
push 1
push 0
push str.Path
mov ecx, dword [ebp - 0x218]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
call fcn.0042ca30
push eax
call fcn.0040dc46
add esp, 4
shl eax, 1
mov dword [ebp - 0x214], eax
mov edx, dword [ebp - 0x214]
push edx
call fcn.0042ca30
push eax
push 1
push 0
push str.Version
mov eax, dword [ebp - 0x218]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 0x218]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040cf89
mov esp, ebp
pop ebp
ret
Function at 0x422dd0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x490
mov eax, dword [0x43d150]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0x100
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallTenpay_Security_Control
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
je 0x422e0a
or eax, 0xffffffff
jmp 0x422f34
call fcn.0042ca30
push eax
push 0x437980
push 0x437990
push 0x78
lea ecx, [ebp - 0x88]
push ecx
call fcn.0040d8b0
add esp, 0x14
lea edx, [ebp - 0x88]
push edx
mov eax, dword [ebp - 8]
push eax
lea ecx, [ebp - 0x490]
push ecx
call fcn.0040d685
add esp, 0xc
mov edx, dword [ebp - 8]
push edx
lea eax, [ebp - 0x490]
push eax
push 1
push 0
push str.DisplayName
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
call fcn.0042ca30
push eax
mov edx, dword [ebp - 8]
push edx
lea eax, [ebp - 0x490]
push eax
call fcn.0040d685
add esp, 0xc
mov ecx, dword [ebp - 8]
push ecx
lea edx, [ebp - 0x490]
push edx
push 1
push 0
push str.DisplayVersion
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x4379d4
mov ecx, dword [ebp - 8]
push ecx
lea edx, [ebp - 0x490]
push edx
call fcn.0040d685
add esp, 0xc
mov eax, dword [ebp - 8]
push eax
lea ecx, [ebp - 0x490]
push ecx
push 1
push 0
push str.Publisher
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea eax, [ebp - 0x290]
push eax
call fcn.00421e60
add esp, 4
lea ecx, [ebp - 0x290]
push ecx
push str._suninstall.exe
mov edx, dword [ebp - 8]
push edx
lea eax, [ebp - 0x490]
push eax
call fcn.0040d685
add esp, 0x10
mov ecx, dword [ebp - 8]
push ecx
lea edx, [ebp - 0x490]
push edx
push 1
push 0
push str.UninstallString
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
call fcn.004213d0
call fcn.00422560
movzx ecx, ax
test ecx, ecx
je 0x422f32
call fcn.004223c0
xor eax, eax
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0040cf89
mov esp, ebp
pop ebp
ret
Function at 0x423450
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x432f8c
mov eax, dword fs:[0]
push eax
sub esp, 0x4b0
mov eax, dword [0x43d150]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2a8], 0
lea eax, [ebp - 0x2a8]
push eax
push 0x10
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
cmp dword [ebp - 0x2a8], 0
jne 0x4234a7
or eax, 0xffffffff
jmp 0x4235f5
lea ecx, [ebp - 0x21c]
push ecx
mov edx, dword [ebp - 0x2a8]
push edx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
lea eax, [ebp - 0x21c]
push eax
push 0x437aec
push 0x104
lea ecx, [ebp - 0x4b4]
push ecx
call fcn.0040d685
add esp, 0x10
push 1
lea ecx, [ebp - 0x2a4]
call fcn.00406790
mov dword [ebp - 4], 0
push 0x40
push 2
lea edx, [ebp - 0x4b4]
push edx
lea ecx, [ebp - 0x2a4]
call fcn.004068b0
mov eax, dword [ebp - 0x2a4]
mov ecx, dword [eax + 4]
lea ecx, [ebp + ecx - 0x2a4]
call fcn.004059a0
movzx edx, al
test edx, edx
je 0x423548
mov dword [ebp - 0x4b8], 0xfffffffe
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2a4]
call fcn.00405e70
mov eax, dword [ebp - 0x4b8]
jmp 0x4235f5
push 0x405db0
push str._InternetShortcut_
lea eax, [ebp - 0x2a4]
push eax
call fcn.0040b080
add esp, 8
mov ecx, eax
call fcn.00405ef0
push 0x405db0
push str.IconFileC:Program_FilesCommon_FilesTencentPaycenter_tenpay.ico
lea ecx, [ebp - 0x2a4]
push ecx
call fcn.0040b080
add esp, 8
mov ecx, eax
call fcn.00405ef0
push 0x405db0
push str.URLhttps:__www.tenpay.com__ADTAGTENPAY.CLIENT.ICO.DESKTOP
lea edx, [ebp - 0x2a4]
push edx
call fcn.0040b080
add esp, 8
mov ecx, eax
call fcn.00405ef0
push 0x405db0
push str.IconIndex0
lea eax, [ebp - 0x2a4]
push eax
call fcn.0040b080
add esp, 8
mov ecx, eax
call fcn.00405ef0
lea ecx, [ebp - 0x2a4]
call fcn.00406900
mov dword [ebp - 0x4bc], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2a4]
call fcn.00405e70
mov eax, dword [ebp - 0x4bc]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040cf89
mov esp, ebp
pop ebp
ret
Function at 0x423610
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x432fbf
mov eax, dword fs:[0]
push eax
sub esp, 0x4b0
mov eax, dword [0x43d150]
xor eax, ebp
mov dword [ebp - 0x98], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2a8], 0
lea eax, [ebp - 0x2a8]
push eax
push 6
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
cmp dword [ebp - 0x2a8], 0
jne 0x42366a
or eax, 0xffffffff
jmp 0x4237d8
lea ecx, [ebp - 0x2a4]
push ecx
mov edx, dword [ebp - 0x2a8]
push edx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
lea eax, [ebp - 0x2a4]
push eax
push 0x437a38
push 0x104
lea ecx, [ebp - 0x4b4]
push ecx
call fcn.0040d685
add esp, 0x10
push 1
lea ecx, [ebp - 0x94]
call fcn.00406790
mov dword [ebp - 4], 0
push 0x40
push 2
lea edx, [ebp - 0x4b4]
push edx
lea ecx, [ebp - 0x94]
call fcn.004068b0
mov eax, dword [ebp - 0x94]
mov ecx, dword [eax + 4]
lea ecx, [ebp + ecx - 0x94]
call fcn.004059a0
movzx edx, al
test edx, edx
je 0x42370b
mov dword [ebp - 0x4b8], 0xfffffffe
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.00405e70
mov eax, dword [ebp - 0x4b8]
jmp 0x4237d8
push 0x405db0
push str._DEFAULT_
lea eax, [ebp - 0x94]
push eax
call fcn.0040b080
add esp, 8
mov ecx, eax
call fcn.00405ef0
push 0x405db0
push str.BASEURLhttps:__www.tenpay.com_
lea ecx, [ebp - 0x94]
push ecx
call fcn.0040b080
add esp, 8
mov ecx, eax
call fcn.00405ef0
push 0x405db0
push 0x437a90
lea edx, [ebp - 0x94]
push edx
call fcn.0040b080
add esp, 8
mov ecx, eax
call fcn.00405ef0
push 0x405db0
push str.URLhttps:__www.tenpay.com_
lea eax, [ebp - 0x94]
push eax
call fcn.0040b080
add esp, 8
mov ecx, eax
call fcn.00405ef0
push 0x405db0
push str.IconFilehttps:__www.tenpay.com_favicon.ico
lea ecx, [ebp - 0x94]
push ecx
call fcn.0040b080
add esp, 8
mov ecx, eax
call fcn.00405ef0
lea ecx, [ebp - 0x94]
call fcn.00406900
mov dword [ebp - 0x4bc], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.00405e70
mov eax, dword [ebp - 0x4bc]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x98]
xor ecx, ebp
call fcn.0040cf89
mov esp, ebp
pop ebp
ret

Function at 0x423800
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x43d150]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x210]
push eax
call fcn.00421e60
add esp, 4
cmp dword [ebp + 8], 0
je 0x42383b
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x210]
push edx
call fcn.0040dfd7
add esp, 8
push 0
lea eax, [ebp - 0x210]
push eax
call fcn.0040e937
add esp, 8
cmp eax, 0xffffffff
jne 0x423860
push 0
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea edx, [ebp - 0x210]
push edx
push 0
mov eax, dword [0x43f550]
push eax
call fcn.004284a0
add esp, 0xc
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040cf89
mov esp, ebp
pop ebp
ret
Function at 0x423890
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 1
mov eax, dword [0x44126c]
push eax
push 0x30
push 0x7f1
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x440400
push 0x7f1
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
cmp dword [0x43fbc4], 0
je 0x4238ea
push 5
push 0x7f1
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x423902
push 0
push 0x7f1
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebp
ret

Function at 0x423970
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 5
push 0
push 0
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
push 5
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebp
ret
Function at 0x424e40
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
je 0x424e56
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00424c80
add esp, 0x10
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
je 0x424e8c
cmp dword [0x43f5a4], 0
je 0x424e8c
push 5
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [0x43f5a4], 1
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x4251f0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp dword [ebp + 8], 0
jl 0x425207
mov eax, dword [ebp + 8]
cmp eax, dword [0x43f5a0]
jl 0x42520c
jmp 0x4252d8
mov dword [ebp - 4], 0
cmp dword [0x43f554], 0
jl 0x42523c
mov ecx, dword [0x43f554]
cmp ecx, dword [0x43f5a0]
jge 0x42523c
mov edx, dword [0x43f554]
imul edx, edx, 0xc
mov eax, dword [edx + 0x43f560]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
mov dword [0x43f554], ecx
cmp dword [ebp - 4], 0
je 0x42528c
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push 0x41
push 0
push 0
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x14]
push edx
push 0
mov eax, dword [0x43f554]
imul eax, eax, 0xc
mov ecx, dword [eax + 0x43f560]
push ecx
call dword [sym.imp.USER32.dll_SetWindowPos]
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x4252d8
push 0
call dword [sym.imp.USER32.dll_GetSystemMetrics]
cdq
mov ecx, 3
idiv ecx
mov dword [ebp - 0x18], eax
push 1
call dword [sym.imp.USER32.dll_GetSystemMetrics]
cdq
mov ecx, 3
idiv ecx
mov dword [ebp - 0x1c], eax
push 0x41
push 0
push 0
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x18]
push eax
push 0
mov ecx, dword [0x43f554]
imul ecx, ecx, 0xc
mov edx, dword [ecx + 0x43f560]
push edx
call dword [sym.imp.USER32.dll_SetWindowPos]
mov esp, ebp
pop ebp
ret
Function at 0x425510
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x640
mov eax, dword [0x43d150]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
push eax
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x425545
xor eax, eax
jmp 0x42567c
mov dword [ebp - 0x438], 0x428
lea ecx, [ebp - 0x438]
push ecx
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.dll_Module32FirstW
test eax, eax
jne 0x425574
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x42567c
push 0x208
push 0
lea ecx, [ebp - 0x640]
push ecx
call fcn.0040dc60
add esp, 0xc
lea edx, [ebp - 0x640]
push edx
call fcn.00421e60
add esp, 4
lea eax, [ebp - 0x640]
push eax
call fcn.0040dc46
add esp, 4
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
push ecx
lea edx, [ebp - 0x640]
push edx
lea eax, [ebp - 0x218]
push eax
call fcn.0040e024
add esp, 0xc
test eax, eax
jne 0x4255d3
mov eax, 1
jmp 0x42567c
push 0x4384d4
lea ecx, [ebp - 0x418]
push ecx
call fcn.0040dd62
add esp, 8
test eax, eax
jne 0x4255f7
mov eax, 1
jmp 0x42567c
push str.qqcert.dll
lea edx, [ebp - 0x418]
push edx
call fcn.0040dd62
add esp, 8
test eax, eax
jne 0x425618
mov eax, 1
jmp 0x42567c
push 0x438504
lea eax, [ebp - 0x418]
push eax
call fcn.0040dd62
add esp, 8
test eax, eax
jne 0x425639
mov eax, 1
jmp 0x42567c
push str.npqqedit.dll
lea ecx, [ebp - 0x418]
push ecx
call fcn.0040dd62
add esp, 8
test eax, eax
jne 0x425658
mov eax, 1
jmp 0x42567c
lea edx, [ebp - 0x438]
push edx
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x4255ab
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0040cf89
mov esp, ebp
pop ebp
ret
Function at 0x425690
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x640
mov eax, dword [0x43d150]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
push eax
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x4256c5
xor eax, eax
jmp 0x42578b
mov dword [ebp - 0x438], 0x428
lea ecx, [ebp - 0x438]
push ecx
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.dll_Module32FirstW
test eax, eax
jne 0x4256f4
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x42578b
push 0x208
push 0
lea ecx, [ebp - 0x640]
push ecx
call fcn.0040dc60
add esp, 0xc
lea edx, [ebp - 0x640]
push edx
call fcn.00421e60
add esp, 4
lea eax, [ebp - 0x640]
push eax
call fcn.0040dc46
add esp, 4
mov dword [ebp - 8], eax
push 0x438330
lea ecx, [ebp - 0x418]
push ecx
call fcn.0040dd62
add esp, 8
test eax, eax
jne 0x42574c
mov eax, 1
jmp 0x42578b
push str.npqqcert.dll
lea edx, [ebp - 0x418]
push edx
call fcn.0040dd62
add esp, 8
test eax, eax
jne 0x42576b
mov eax, 1
jmp 0x42578b
lea eax, [ebp - 0x438]
push eax
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x42572b
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0040cf89
mov esp, ebp
pop ebp
ret

Function at 0x4257a0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x43d150]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x23c], 0
mov dword [ebp - 0x238], 0
push 0x228
push 0
lea eax, [ebp - 0x234]
push eax
call fcn.0040dc60
add esp, 0xc
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0xffffffff
jne 0x425802
lea ecx, [ebp + 8]
call fcn.004012a0
jmp 0x42589d
mov dword [ebp - 0x238], 0x22c
lea ecx, [ebp - 0x238]
push ecx
mov edx, dword [ebp - 0x23c]
push edx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x425888
lea ecx, [ebp + 8]
call fcn.00402360
push eax
lea eax, [ebp - 0x214]
push eax
call fcn.0040dd62
add esp, 8
test eax, eax
jne 0x425871
mov ecx, dword [ebp - 0x230]
push ecx
push 0
push 0x100001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 0
je 0x425871
push 0
mov edx, dword [ebp - 0x240]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea eax, [ebp - 0x238]
push eax
mov ecx, dword [ebp - 0x23c]
push ecx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x425823
mov edx, dword [ebp - 0x23c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp + 8]
call fcn.004012a0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040cf89
mov esp, ebp
pop ebp
ret