joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49d76b
Capabilities:
Get common file path

Disassembly:
push ecx
push ebx
xor ebx, ebx
cmp dword [esi], ebx
push edi
jne 0x49d811
cmp dword [esi + 4], 0xffffffff
jne 0x49d811
lea edi, [esi + 0x244]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push edi
call fcn.004c64fc
movzx eax, word [esi + eax*2 + 0x242]
cmp ax, 0x5c
pop ecx
je 0x49d7cc
cmp ax, 0x2f
je 0x49d7cc
push edi
call fcn.004c64fc
pop ecx
mov ecx, 0x103
sub ecx, eax
push ecx
push 0x4f09a4
push edi
call fcn.004bc835
add esp, 0xc
push 0x30
call fcn.004b9140
pop ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 0x1c], ecx
mov ecx, dword [esp + 0x14]
mov byte [eax], bl
mov byte [eax + 1], 1
mov byte [eax + 0x18], bl
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ebx
mov dword [eax + 0x28], ebx
mov dword [eax + 0x2c], ebx
mov dword [eax + 0x10], ebx
mov dword [eax + 0x14], ebx
call fcn.0049cd8a
mov dword [esi], eax
neg eax
sbb eax, eax
and eax, 0xfffffe00
add eax, 0x200
jmp 0x49d816
mov eax, 0x1000000
pop edi
pop ebx
pop ecx
ret 8

Function at 0x49ddd1
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x50f130]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
push esi
mov esi, dword [ebp + 0xc]
je 0x49de05
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x49de05
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
movzx ecx, word [esi]
test cx, cx
je 0x49dec7
mov eax, esi
mov edx, esi
movzx ecx, cx
cmp cx, 0x2f
je 0x49de24
cmp cx, 0x5c
jne 0x49de26
mov eax, edx
inc edx
inc edx
movzx ecx, word [edx]
test cx, cx
jne 0x49de18
cmp eax, esi
push edi
je 0x49de64
sub eax, esi
sar eax, 1
add eax, eax
mov edi, eax
push edi
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.004bf2a0
and word [ebp + edi - 0x414], 0
lea eax, [ebp - 0x414]
push eax
push ebx
call fcn.0049ddd1
add esp, 0x14
and word [ebp - 0x20c], 0
test ebx, ebx
mov edi, 0x103
je 0x49de86
push edi
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.004b848e
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
call fcn.004c64fc
sub edi, eax
push edi
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.004bc835
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
pop edi
jne 0x49dec7
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004b83ee
leave
ret
Function at 0x49e684
Capabilities:
Query environment variable

Disassembly:
push 0x22c
mov eax, 0x4deabe
call fcn.004be9c5
mov eax, dword [ebp + 8]
and word [ebp - 0x220], 0
mov dword [ebp - 0x230], eax
mov eax, dword [ebp + 0xc]
push 0x208
mov dword [ebp - 0x234], eax
lea eax, [ebp - 0x21e]
push 0
push eax
mov edi, ecx
mov ebx, edx
call fcn.004be240
add esp, 0xc
lea esi, [ebp - 0x228]
call fcn.004016f0
lea esi, [ebp - 0x224]
call fcn.004016f0
and dword [ebp - 4], 0
push 0x104
lea eax, [ebp - 0x220]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov eax, dword [edi]
lea edx, [ebp - 0x220]
lea edi, [ebp - 0x228]
mov dword [ebp - 0x22c], eax
call fcn.00404a50
mov eax, dword [ebp - 0x234]
mov ecx, dword [eax]
mov esi, dword [ebp - 0x224]
lea eax, [ecx - 0x10]
add esi, 0xfffffff0
cmp eax, esi
je 0x49e75a
cmp dword [esi + 0xc], 0
jl 0x49e74b
mov edx, dword [eax]
cmp edx, dword [esi]
jne 0x49e74b
call fcn.004012e0
mov edi, eax
mov eax, esi
call fcn.004010d0
add edi, 0x10
mov dword [ebp - 0x224], edi
jmp 0x49e75a
mov ebx, dword [ecx - 0xc]
push ecx
lea eax, [ebp - 0x224]
call fcn.00401470
mov edi, dword [ebp - 0x230]
lea eax, [ebp - 0x22c]
push eax
call fcn.0049e977
lea ecx, [ebp - 0x224]
call fcn.004016d0
lea ecx, [ebp - 0x228]
call fcn.004016d0
mov al, 1
call fcn.004bea48
ret 8

Function at 0x49e80a
Capabilities:
Create process on windows

Disassembly:
push 0x2a0
mov eax, 0x4dd524
call fcn.004be9c5
mov eax, dword [ebp + 8]
push 0x40
mov dword [ebp - 0x250], eax
xor ebx, ebx
lea eax, [ebp - 0x2a8]
push ebx
push eax
mov esi, ecx
call fcn.004be240
xor eax, eax
mov dword [ebp - 0x260], ebx
lea edi, [ebp - 0x25c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x208
stosd dword es:[edi], eax
lea eax, [ebp - 0x24a]
push ebx
push eax
mov dword [ebp - 0x2ac], 0x44
mov word [ebp - 0x24c], bx
call fcn.004be240
push 9
pop ecx
xor eax, eax
mov word [ebp - 0x3c], bx
lea edi, [ebp - 0x3a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [ebp - 0x250]
push dword [eax + 0xc]
lea eax, [ebp - 0x3c]
push 0x4f1bb4
push eax
call fcn.004b8974
mov eax, dword [esi + 8]
add esp, 0x24
sub eax, 0x10
call fcn.004012e0
add eax, 0x10
mov dword [ebp - 0x250], eax
lea eax, [ebp - 0x3c]
push eax
push str._Supplyid
lea eax, [ebp - 0x250]
push eax
mov dword [ebp - 4], ebx
call fcn.00407ee0
push dword [ebp - 0x250]
lea eax, [ebp - 0x24c]
push dword [esi + 4]
push str.__s___s
push eax
call fcn.004b8974
add esp, 0x10
lea eax, [ebp - 0x260]
push eax
lea eax, [ebp - 0x2ac]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x24c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x49e91a
push dword [ebp - 0x260]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x25c]
call esi
mov bl, 1
lea ecx, [ebp - 0x250]
call fcn.004016d0
mov al, bl
call fcn.004bea48
ret 4
Function at 0x49fc18
Capabilities:
Query environment variable

Disassembly:
push ebp
sub esp, 0x20c
lea ebp, [esp - 4]
mov eax, dword [0x50f130]
xor eax, ebp
mov dword [ebp + 0x20c], eax
push 0xc
mov eax, 0x4e0c73
call fcn.004be95c
mov dword [ebp - 0x18], ebx
mov edi, ecx
and dword [ebp - 4], 0
lea esi, [ebx + 4]
mov dword [ebx], vtable.QMDDetector::CFolderFile.0
call fcn.004016f0
push 0x208
lea eax, [ebp + 2]
push 0
mov byte [ebp - 4], 1
and word [ebp], 0
push eax
call fcn.004be240
add esp, 0xc
push 0x104
lea eax, [ebp]
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea edx, [ebp]
mov edi, esi
call fcn.00404a50
xor eax, eax
push esi
inc eax
lea ecx, [ebp - 0x14]
call fcn.00401030
mov edi, 0x4f09a4
push eax
mov ecx, edi
call fcn.00413b40
pop ecx
lea ecx, [ebp - 0x14]
mov byte [ebp - 0xd], al
call fcn.004016d0
cmp byte [ebp - 0xd], 0
je 0x49fcbe
mov edx, edi
mov edi, esi
call fcn.004139a0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x20c]
xor ecx, ebp
call fcn.004b83ee
add ebp, 0x210
leave
ret

Function at 0x4a393b
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x27c
mov eax, dword [0x50f130]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
push 0x40
lea eax, [ebp - 0x274]
push ebx
push eax
mov esi, ecx
mov dword [ebp - 0x21c], ebx
call fcn.004be240
xor eax, eax
mov dword [ebp - 0x22c], ebx
lea edi, [ebp - 0x228]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
push 0x208
stosd dword es:[edi], eax
lea eax, [ebp - 0x216]
push ebx
push eax
mov dword [ebp - 0x278], 0x44
mov word [ebp - 0x218], bx
call fcn.004be240
add esp, 0xc
push dword [esi + 8]
lea eax, [ebp - 0x218]
push dword [esi]
push str.__s___s
push eax
call fcn.004b8974
mov ecx, dword [esi]
mov edi, 0x4f7018
push edi
call fcn.0048fde1
mov ecx, dword [esi]
add esp, 0x14
push edi
call fcn.0048fb89
pop ecx
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x278]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x218]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4a3a11
push dword [ebp - 0x22c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x228]
call esi
jmp 0x4a3a1d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x21c], eax
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x21c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b83ee
leave
ret
Function at 0x4a4288
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4db977
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x50f130]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov ebx, ecx
lea eax, [ebx + 0x30]
push eax
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
and dword [esp + 0x30], 0
mov eax, dword [ebx + 0xc]
mov eax, dword [eax]
add ebx, 8
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
mov eax, dword [ebx + 4]
lea edi, [esp + 0x1c]
lea esi, [esp + 0x14]
mov dword [esp + 0x20], eax
call fcn.004b37a6
test al, al
jne 0x4a4336
mov edi, dword [esp + 0x14]
test edi, edi
jne 0x4a4302
call fcn.004b9ac9
mov esi, dword [esp + 0x18]
cmp esi, dword [edi + 4]
jne 0x4a4310
call fcn.004b9ac9
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x4a431d
mov eax, dword [ecx]
push 1
call dword [eax]
cmp esi, dword [edi + 4]
jne 0x4a4327
call fcn.004b9ac9
and dword [esi + 0x10], 0
lea esi, [esp + 0x14]
call fcn.004a4c86
jmp 0x4a42dd
mov edi, ebx
call fcn.004a8194
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4a5fc0
Capabilities:
Create thread

Disassembly:
push 0x14
mov eax, 0x4e597b
call fcn.004be95c
mov esi, ecx
push str.CDownload::Init__
push 3
call fcn.004afd14
xor edi, edi
cmp dword [esi + 0xc], edi
pop ecx
pop ecx
je 0x4a5feb
xor eax, eax
inc eax
jmp 0x4a6075
cmp dword [esi + 0x64], edi
mov dword [esi + 0xb8], 0x5dc
jne 0x4a6033
mov ebx, dword [sym.imp.KERNEL32.dll_CreateEventW]
push edi
push edi
push edi
push edi
call ebx
push edi
push edi
push edi
push edi
mov dword [esi + 0x68], eax
call ebx
push edi
push edi
push edi
push edi
mov dword [esi + 0x6c], eax
call ebx
mov dword [esi + 0x70], eax
lea eax, [esi + 0x74]
push eax
push edi
push esi
push 0x4a7763
push edi
push edi
call fcn.004b92a4
add esp, 0x18
mov dword [esi + 0x64], eax
lea eax, [esi + 0x8c]
mov dword [ebp - 0x14], eax
add eax, 4
push eax
mov dword [ebp - 0x18], vtable.QQDectector::fund::lock::scoped_lock_class_QQDectector::fund::lock::critical_section_.0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 4], edi
lea eax, [ebp - 0x20]
xor edi, edi
push eax
inc edi
lea eax, [esi + 0x78]
mov dword [ebp - 0x20], edi
call fcn.004a7b65
push dword [esi + 0x70]
call dword [sym.imp.KERNEL32.dll_SetEvent]
lea esi, [ebp - 0x18]
call fcn.004a7d8a
mov eax, edi
call fcn.004bea34
ret
Function at 0x4a60f6
Capabilities:
Print debug messages
Terminate thread

Disassembly:
push 0x10
mov eax, 0x4de867
call fcn.004be95c
push str.CDownload::Uninit__
push 3
call fcn.004afd14
pop ecx
lea eax, [edi + 0x8c]
mov dword [ebp - 0x10], eax
pop ecx
add eax, 4
push eax
mov dword [ebp - 0x14], vtable.QQDectector::fund::lock::scoped_lock_class_QQDectector::fund::lock::critical_section_.0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
and dword [ebp - 4], 0
lea eax, [ebp - 0x1c]
push eax
lea eax, [edi + 0x78]
mov dword [ebp - 0x1c], 2
call fcn.004a7b65
push dword [edi + 0x70]
mov ebx, dword [sym.imp.KERNEL32.dll_SetEvent]
call ebx
lea esi, [ebp - 0x14]
call fcn.004a7d8a
push dword [edi + 0x68]
call ebx
push dword [edi + 0x70]
call ebx
cmp dword [edi + 0x64], 0
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x4a619e
push 0x1388
push dword [edi + 0x6c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4a6195
push 0x3ff
push dword [edi + 0x64]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push str.Uninit::TerminateThread
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push dword [edi + 0x64]
call esi
and dword [edi + 0x64], 0
push dword [edi + 0x70]
call esi
push dword [edi + 0x68]
call esi
push dword [edi + 0x6c]
call esi
call fcn.004bea34
ret

Function at 0x4a8215
Capabilities:
Hash data with md5

Disassembly:
push 0x5c
push 0
push esi
call fcn.004be240
and dword [esi + 0x10], 0
and dword [esi + 0x14], 0
and dword [esi + 0x58], 0
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
ret
Function at 0x4a8c7f
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [sym.imp.WS2_32.dll_ntohl]
push edi
mov ebx, eax
push dword [ebx]
call esi
push dword [ebx + 4]
mov edi, eax
call esi
and dword [ebp - 4], 0
mov ebx, eax
mov eax, dword [ebp - 4]
push dword [eax + str.37k_IF__y_d]
call esi
mov ecx, dword [ebp - 4]
add dword [ebp - 4], 4
cmp dword [ebp - 4], 0x10
mov dword [ebp + ecx - 0x14], eax
jl 0x4a8ca1
push 0x10
xor eax, eax
pop ecx
mov edx, ebx
shr edx, 5
add edx, dword [ebp - 0x10]
mov esi, ebx
shl esi, 4
add esi, dword [ebp - 0x14]
sub eax, 0x61c88647
xor edx, esi
lea esi, [eax + ebx]
xor edx, esi
add edi, edx
mov edx, edi
shr edx, 5
add edx, dword [ebp - 8]
mov esi, edi
shl esi, 4
add esi, dword [ebp - 0xc]
xor edx, esi
lea esi, [eax + edi]
xor edx, esi
add ebx, edx
dec ecx
jne 0x4a8cc2
mov esi, dword [sym.imp.WS2_32.dll_htonl]
push edi
call esi
mov edi, dword [ebp + 8]
push ebx
mov dword [edi], eax
call esi
mov dword [edi + 4], eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4a8d15
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [sym.imp.WS2_32.dll_ntohl]
push edi
mov edi, eax
push dword [edi]
call esi
push dword [edi + 4]
mov ebx, eax
call esi
and dword [ebp - 4], 0
mov edi, eax
mov eax, dword [ebp - 4]
push dword [eax + str.37k_IF__y_d]
call esi
mov ecx, dword [ebp - 4]
add dword [ebp - 4], 4
cmp dword [ebp - 4], 0x10
mov dword [ebp + ecx - 0x14], eax
jl 0x4a8d37
push 0x10
mov eax, 0xe3779b90
pop ecx
mov edx, ebx
shr edx, 5
add edx, dword [ebp - 8]
mov esi, ebx
shl esi, 4
add esi, dword [ebp - 0xc]
xor edx, esi
lea esi, [eax + ebx]
xor edx, esi
sub edi, edx
mov edx, edi
shr edx, 5
add edx, dword [ebp - 0x10]
mov esi, edi
shl esi, 4
add esi, dword [ebp - 0x14]
xor edx, esi
lea esi, [eax + edi]
xor edx, esi
sub ebx, edx
add eax, 0x61c88647
dec ecx
jne 0x4a8d5b
mov esi, dword [sym.imp.WS2_32.dll_htonl]
push ebx
call esi
mov ebx, dword [ebp + 8]
push edi
mov dword [ebx], eax
call esi
pop edi
pop esi
mov dword [ebx + 4], eax
pop ebx
leave
ret
Function at 0x4a91ca
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x50f130]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
xor ecx, ecx
cmp eax, ecx
push edi
je 0x4a922b
cmp dword [ebp + 0xc], ecx
jle 0x4a922b
cmp ebx, ecx
je 0x4a922b
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x50], ecx
push eax
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x60]
mov dword [ebp - 0x60], 0x67452301
mov dword [ebp - 0x5c], 0xefcdab89
mov dword [ebp - 0x58], 0x98badcfe
mov dword [ebp - 0x54], 0x10325476
call fcn.004b488c
pop ecx
lea edi, [ebp - 0x60]
call fcn.004b4933
mov al, 1
jmp 0x4a922d
xor al, al
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.004b83ee
leave
ret

Function at 0x4a9aa4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
lea ecx, [ebp + 8]
push ecx
xor ebx, ebx
inc ebx
push ebx
mov esi, eax
mov eax, dword [edi]
push 0
push eax
push dword [ebp + 8]
mov dword [ebp - 4], 0x100
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a9afc
mov eax, dword [esi]
lea ecx, [ebp - 4]
push ecx
push dword [ebp + 0xc]
lea ecx, [ebp - 8]
push ecx
push 0
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4a9afc
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov al, bl
pop ebx
leave
ret 8
or eax, 0xffffffff
call fcn.00409a20
or eax, 0xffffffff
mov esi, edi
call fcn.00409a20
xor bl, bl
jmp 0x4a9aeb
Function at 0x4a9b12
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x40
mov eax, 0x4de7d3
call fcn.004be95c
mov edi, dword [ebp + 0x10]
call fcn.004aacc4
mov eax, dword [ebp + 0xc]
xor esi, esi
mov dword [ebp - 0x10], esi
mov dword [ebp + 0xc], eax
mov ebx, 0x208
mov ecx, dword [eax]
mov dword [ebp - 0x18], ecx
mov ecx, dword [eax + 4]
xor eax, eax
dec ecx
mov dword [ebp - 0x2c], esi
lea edi, [ebp - 0x28]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
je 0x4a9b78
dec ecx
je 0x4a9b69
dec ecx
dec ecx
jne 0x4a9c31
push 4
pop edi
push edi
call fcn.004b73e1
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x2c], edi
jmp 0x4a9b88
push ebx
call fcn.004b73e1
mov dword [ebp - 0x2c], 2
jmp 0x4a9b85
push ebx
call fcn.004b73e1
mov dword [ebp - 0x2c], 1
mov dword [ebp - 0x24], ebx
cmp eax, esi
pop ecx
mov dword [ebp - 0x28], eax
je 0x4a9c31
push dword [ebp - 0x24]
push esi
push eax
call fcn.004be240
mov eax, dword [ebp - 0x24]
add esp, 0xc
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x28]
lea eax, [ebp - 0x2c]
push eax
push esi
push dword [ebp - 0x18]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, esi
je 0x4a9bd7
cmp dword [ebp - 0x28], esi
mov dword [ebp - 0x1c], eax
je 0x4a9bd7
push dword [ebp - 0x28]
call fcn.004b8802
pop ecx
mov dword [ebp - 0x28], esi
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x48]
call fcn.00403710
mov ecx, dword [ebp + 0x10]
lea eax, [ebp - 0x48]
push eax
mov dword [ebp - 4], esi
call fcn.004aabc7
mov ecx, dword [ebp - 0x1c]
mov dword [eax + 0x10], ecx
mov ecx, dword [ebp - 0x20]
mov dword [eax + 0xc], ecx
mov ecx, dword [ebp - 0x24]
mov dword [eax + 8], ecx
mov ecx, dword [ebp - 0x28]
mov dword [eax + 4], ecx
mov ecx, dword [ebp - 0x2c]
or dword [ebp - 4], 0xffffffff
lea esi, [ebp - 0x48]
mov dword [eax], ecx
call fcn.0040c0b0
inc dword [ebp - 0x10]
add dword [ebp + 0xc], 8
cmp dword [ebp - 0x10], 4
jge 0x4a9c35
mov eax, dword [ebp + 0xc]
xor esi, esi
jmp 0x4a9b36
xor eax, eax
jmp 0x4a9c38
xor eax, eax
inc eax
call fcn.004bea34
ret 0xc

Function at 0x4a9dbd
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x50f130]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
xor edi, edi
push 0x206
lea eax, [ebp - 0x20a]
push edi
push eax
mov word [ebp - 0x20c], di
call fcn.004be240
add esp, 0xc
cmp dword [esi + 4], edi
jne 0x4a9e70
call dword [sym.imp.KERNEL32.dll_GetVersion]
and eax, 0xff
cmp eax, 5
push str.TSKSP
lea eax, [ebp - 0x20c]
jb 0x4a9e16
push str..Global_s
jmp 0x4a9e1b
push str.._s
push 0x104
push eax
call fcn.004b937c
add esp, 0x10
push edi
push 0x80
push 3
push edi
xor edi, edi
inc edi
push edi
push 0xc0000000
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x4a9e58
push eax
mov dword [esi], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4a9e70
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
cmp eax, 5
je 0x4a9e6d
call ebx
cmp eax, 0x1f
jne 0x4a9e6f
mov dword [esi], edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.004b83ee
leave
ret
Function at 0x4aa985
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.SOFTWARETencentQQPCMgr
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4aa9ec
push edi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push esi
push esi
push 0x4f8694
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
pop edi
jne 0x4aa9ec
xor eax, eax
cmp dword [ebp - 8], esi
sete al
jmp 0x4aa9ee
xor al, al
pop esi
leave
ret

Function at 0x4ad08d
Capabilities:
Read file on windows

Disassembly:
push 8
mov eax, 0x4dd22a
call fcn.004be95c
mov edi, dword [ebp + 8]
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
jne 0x4ad0b6
push ebx
push ebx
push 2
xor ecx, ecx
pop eax
call fcn.004ae1f0
xor al, al
jmp 0x4ad214
call fcn.004acad5
or dword [edi + 8], 0xffffffff
or dword [edi + 4], 0xffffffff
push 2
push ebx
push dword [ebp + 0xc]
call fcn.004bd709
push dword [ebp + 0xc]
call fcn.004bd0e5
push ebx
push ebx
push dword [ebp + 0xc]
mov esi, eax
call fcn.004bd709
add esp, 0x1c
cmp esi, ebx
jg 0x4ad0ef
push ebx
push ebx
push 0xd
jmp 0x4ad0a7
mov ebx, 0x51561c
mov dword [ebp - 0x10], ebx
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
mov ecx, esi
call fcn.004ac4eb
lea eax, [esi + 1]
push eax
call fcn.004b9140
push dword [ebp + 0xc]
mov edi, eax
push 1
push esi
push edi
mov dword [ebp - 0x14], edi
mov byte [edi], 0
call fcn.004bd462
add esp, 0x14
cmp eax, 1
je 0x4ad15a
push edi
call fcn.004b83e9
mov edi, dword [ebp + 8]
pop ecx
push 0
push 0
push 2
xor ecx, ecx
pop eax
call fcn.004ae1f0
cmp dword [ebp - 0x10], ebx
je 0x4ad0af
push dword [ebp - 0x10]
call fcn.004b8802
pop ecx
jmp 0x4ad0af
mov ebx, edi
mov eax, ebx
mov byte [eax + esi], 0
cmp byte [eax], 0
je 0x4ad1bf
mov al, byte [ebx]
cmp al, 0xa
jne 0x4ad17f
mov eax, ebx
sub eax, edi
inc eax
push eax
push edi
lea edi, [ebp - 0x10]
call fcn.004ac5db
inc ebx
jmp 0x4ad1b5
cmp al, 0xd
jne 0x4ad1b9
mov eax, ebx
sub eax, edi
test eax, eax
jle 0x4ad195
push eax
push edi
lea edi, [ebp - 0x10]
call fcn.004ac5db
push 1
lea eax, [ebp + 0xc]
push eax
lea edi, [ebp - 0x10]
mov byte [ebp + 0xc], 0xa
call fcn.004ac5db
lea eax, [ebx + 1]
cmp byte [eax], 0xa
jne 0x4ad1b3
inc ebx
inc ebx
jmp 0x4ad1b5
mov ebx, eax
mov edi, ebx
jmp 0x4ad1ba
inc ebx
cmp byte [ebx], 0
jne 0x4ad167
sub ebx, edi
je 0x4ad1cd
push ebx
push edi
lea edi, [ebp - 0x10]
call fcn.004ac5db
push dword [ebp - 0x14]
call fcn.004b83e9
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp + 8]
mov eax, dword [esi]
pop ecx
push 0
push 0
lea ecx, [edi + 8]
push ecx
mov ecx, esi
call dword [eax + 8]
cmp byte [esi + 0x2c], 0
je 0x4ad203
cmp edi, 0x51561c
je 0x4ad0af
push edi
jmp 0x4ad14f
cmp edi, 0x51561c
je 0x4ad212
push edi
call fcn.004b8802
pop ecx
mov al, 1
call fcn.004bea34
ret 8