joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001945
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x288
mov eax, dword [ebp + 0xc]
push ebx
push esi
sub eax, 0x82
push edi
je 0x10001b2c
sub eax, 0x7f7f
je 0x10001a51
dec eax
je 0x10001995
dec eax
je 0x10001987
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_DefWindowProcW]
jmp 0x10001b43
push dword [ecx + 4]
call dword [sym.imp.USER32.dll_DestroyWindow]
jmp 0x10001b41
xor esi, esi
push esi
push str.GADGET_56CE9459_562F_4420_AC1D_A31F261AA182
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x100019af
push 1
pop eax
jmp 0x10001b43
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x286]
mov word [ebp - 0x288], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x288]
push 0x103
push eax
push 0xa
call fcn.10005e88
add esp, 0xc
lea eax, [ebp - 0x288]
push str.Gadget.exe
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x288]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10001a4a
call fcn.10004f19
test eax, eax
je 0x10001a33
lea eax, [ebp + 0x10]
mov dword [ebp + 0x10], esi
push eax
call fcn.10005353
cmp dword [ebp + 0x10], 0x2000
pop ecx
jne 0x10001a33
push 0x1f4
lea eax, [ebp - 0x288]
push esi
push eax
call fcn.10005164
jmp 0x10001a45
push 0x1f4
lea eax, [ebp - 0x288]
push esi
push eax
call fcn.10005004
add esp, 0xc
mov esi, eax
mov eax, esi
jmp 0x10001b43
push dword [ebp + 0x10]
mov ebx, dword [sym.imp.USER32.dll_IsWindow]
call ebx
test eax, eax
je 0x10001b41
lea eax, [ebp + 0xc]
xor esi, esi
push eax
mov dword [ebp + 0xc], esi
push dword [ebp + 0x10]
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 0x1f
mov dword [ebp + 8], eax
pop ecx
xor eax, eax
push dword [ebp + 0xc]
lea edi, [ebp - 0x7e]
mov word [ebp - 0x80], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push str.PROXY_11318D5E_4368_48b9_AEB1_43123002F7BA__d
lea eax, [ebp - 0x80]
push 0x3c
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x10
lea eax, [ebp - 0x80]
push esi
push eax
call dword [sym.imp.USER32.dll_FindWindowW]
mov edi, eax
push edi
call ebx
test eax, eax
je 0x10001acd
push 0x7d0
push esi
push dword [ebp + 0x10]
push 0x8006
push edi
call fcn.10004e1d
add esp, 0x14
jmp 0x10001b41
mov eax, dword [section..toolbar]
mov edi, dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
cmp eax, esi
je 0x10001ae5
push eax
call edi
mov dword [section..toolbar], esi
push dword [ebp + 8]
push dword [0x100104f8]
push 0x10001b4a
push 4
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
cmp eax, esi
mov dword [section..toolbar], eax
je 0x10001b41
push 0x7d0
push esi
push esi
push dword [0x1001049c]
push dword [ebp + 0x10]
call fcn.10004e1d
add esp, 0x14
push dword [section..toolbar]
call edi
mov dword [section..toolbar], esi
jmp 0x10001b41
xor esi, esi
push esi
push 0xffffffffffffffeb
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetWindowLongW]
push esi
call dword [sym.imp.USER32.dll_PostQuitMessage]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x10001e53
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
je 0x10001e91
push dword [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x10001e77
push 0xffffffffffffffff
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0xc]
and dword [esi + 8], 0
test eax, eax
je 0x10001e91
mov ecx, dword [esi + 4]
mov dword [eax], ecx
pop esi
ret 8

Function at 0x10001f11
Capabilities:
Create thread

Disassembly:
push ecx
push esi
mov esi, ecx
cmp dword [esi + 8], 0
je 0x10001f1f
xor eax, eax
jmp 0x10001f42
lea eax, [esp + 4]
push eax
push 0
push esi
push 0x10001f60
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
mov dword [esi + 8], eax
test eax, eax
setne cl
mov eax, ecx
pop esi
pop ecx
ret

Function at 0x1000307f
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x53c
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ebx, ebx
je 0x10003202
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebx
call esi
test eax, eax
je 0x10003202
push str.javascript
push ebx
call dword [sym.imp.MSVCRT.dll__wcsicmp]
pop ecx
test eax, eax
pop ecx
je 0x100030cb
push 0
push ebx
push 0
call sub.urlmon.dll_IsValidURL
test eax, eax
je 0x100031e3
push str.localhost
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x100031e3
mov edi, str.localhost_
push edi
call esi
push eax
push edi
mov edi, dword [sym.imp.MSVCRT.dll__wcsnicmp]
push ebx
call edi
add esp, 0xc
test eax, eax
je 0x100031e3
mov ebx, 0x1000f700
push ebx
call esi
push eax
push ebx
mov ebx, dword [ebp + 8]
push ebx
call edi
add esp, 0xc
test eax, eax
je 0x100031e3
cmp dword [ebp + 0xc], 0
je 0x1000312d
push ebx
call fcn.1000332a
test eax, eax
pop ecx
jne 0x100031e3
push ebx
call fcn.10003358
test eax, eax
pop ecx
jne 0x100031e3
push ebx
call fcn.10003413
test eax, eax
pop ecx
jne 0x100031e3
and word [ebp - 0x53c], ax
mov ecx, 0xff
lea edi, [ebp - 0x53a]
push 0xe
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
pop ecx
xor eax, eax
lea edi, [ebp - 0x38]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x53c]
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x3c]
push eax
push 0x80000000
push ebx
mov dword [ebp - 0x34], 0x200
call esi
push eax
push ebx
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
jne 0x100031f7
and word [ebp - 0x13c], ax
push 0x3f
pop ecx
lea edi, [ebp - 0x13a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x13c]
push 0x80
push eax
push ebx
call fcn.10003209
add esp, 0xc
test eax, eax
je 0x100031d8
lea eax, [ebp - 0x13c]
push eax
call fcn.100032fb
test eax, eax
pop ecx
jne 0x100031e3
push ebx
call fcn.100036bc
test eax, eax
pop ecx
je 0x100031e8
push 1
pop eax
jmp 0x10003204
push ebx
call fcn.10003010
neg eax
sbb eax, eax
pop ecx
neg eax
jmp 0x10003204
xor eax, eax
cmp dword [ebp - 0x30], 0xffffffff
setne al
jmp 0x10003204
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000347a
Capabilities:
Get common file path

Disassembly:
mov eax, 0x10009654
call sub.MSVCRT.dll__EH_prolog
sub esp, 0x51c
push ebx
push esi
push edi
mov ecx, 0x10010530
mov dword [ebp - 0x10], esp
call fcn.10004080
xor ebx, ebx
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x326]
mov word [ebp - 0x328], bx
mov dword [ebp - 4], ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
call fcn.10004f09
cmp eax, ebx
lea eax, [ebp - 0x328]
push 0x104
push eax
je 0x100034e1
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x10003624
push str.driversetchosts
jmp 0x100034f4
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jbe 0x10003624
push 0x1000f770
lea eax, [ebp - 0x328]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x10003624
lea eax, [ebp - 0x328]
push 0x1000f76c
push eax
call dword [sym.imp.MSVCRT.dll__wfopen]
mov esi, eax
pop ecx
cmp esi, ebx
pop ecx
mov dword [ebp - 0x18], esi
je 0x10003619
test byte [esi + 0xc], 0x10
jne 0x10003611
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x11f]
mov byte [ebp - 0x120], bl
push esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x120]
push 0x104
push eax
call dword [sym.imp.MSVCRT.dll_fgets]
push 0x7f
xor eax, eax
pop ecx
lea edi, [ebp - 0x527]
mov byte [ebp - 0x528], bl
push 0x200
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x528]
push eax
lea eax, [ebp - 0x120]
push eax
call fcn.1000363b
add esp, 0x18
cmp eax, ebx
je 0x1000352a
lea eax, [ebp - 0x528]
test eax, eax
jne 0x100035a0
xor edi, edi
jmp 0x100035d8
lea eax, [ebp - 0x528]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
inc esi
lea eax, [esi + esi]
add eax, 3
and al, 0xfc
call fcn.10002ae0
mov edi, esp
push esi
push edi
lea eax, [ebp - 0x528]
push 0xffffffffffffffff
push eax
push ebx
push ebx
mov word [edi], bx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, dword [ebp - 0x18]
push edi
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], ebx
call fcn.1000417a
lea eax, [ebp - 0x14]
mov ecx, 0x10010530
push eax
lea eax, [ebp - 0x1c]
push dword [0x10010534]
mov byte [ebp - 4], 1
push eax
call fcn.100040a7
push dword [ebp - 0x14]
mov byte [ebp - 4], bl
call fcn.10002a99
pop ecx
jmp 0x1000352a
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
pop ecx
push 1
pop eax
jmp 0x10003626
xor eax, eax
mov ecx, dword [ebp - 0xc]
lea esp, [ebp - 0x534]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10003990
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
xor eax, eax
push esi
cmp dword [ebp + 8], eax
je 0x10003a3b
cmp dword [ebp + 0xc], eax
je 0x10003a3b
push edi
mov ecx, 0x81
lea edi, [ebp - 0x206]
mov word [ebp - 0x208], ax
rep stosd dword es:[edi], eax
push 0x104
push dword [ebp + 0xc]
stosw word es:[edi], ax
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push dword [ebp + 8]
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
pop edi
je 0x10003a3b
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp - 0x208]
push eax
call esi
test eax, eax
jne 0x10003a36
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
test eax, eax
jne 0x10003a3b
lea eax, [ebp - 0x208]
push str..url
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddExtensionW]
test eax, eax
je 0x10003a3b
lea eax, [ebp - 0x208]
push eax
call esi
test eax, eax
je 0x10003a3b
push 1
pop eax
jmp 0x10003a3d
xor eax, eax
pop esi
leave
ret

Function at 0x10003cae
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
cmp dword [0x10011984], 0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetVersion]
push esi
push edi
jne 0x10003cf6
call ebx
test eax, 0x80000000
je 0x10003cec
push str.___.___
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push str.Unicows.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x10011988], eax
mov dword [0x10011984], 1
mov eax, dword [0x10011988]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10003d12
push dword [ebp + 0x10]
push eax
call esi
test eax, eax
mov dword [ebp - 4], eax
jne 0x10003d43
mov edi, dword [ebp + 0xc]
mov eax, dword [edi]
test eax, eax
jne 0x10003d3a
call ebx
test eax, 0x80000000
mov eax, dword [ebp + 8]
je 0x10003d2e
push dword [eax + 8]
call dword [eax]
jmp 0x10003d34
push dword [eax + 0xc]
call dword [eax + 4]
test eax, eax
je 0x10003d43
mov dword [edi], eax
push dword [ebp + 0x10]
push eax
call esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x10004605
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push ebx
mov edx, 0x81
push edi
xor ebx, ebx
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x40e]
mov word [ebp - 0x410], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x206]
cmp dword [0x10010558], ebx
mov word [ebp - 0x208], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
jne 0x10004650
xor eax, eax
jmp 0x100046ea
push esi
mov esi, 0x104
lea eax, [ebp - 0x410]
push esi
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x100046e7
lea eax, [ebp - 0x208]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x208]
push str.dllcache
push eax
call esi
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
lea eax, [ebp - 0x208]
push eax
call esi
push 1
lea eax, [ebp - 0x208]
push ebx
push eax
call fcn.100046f0
mov esi, eax
cmp esi, ebx
je 0x100046e7
push dword [ebp + 0xc]
push esi
call fcn.10004573
cmp eax, ebx
je 0x100046e0
lea ecx, [ebp + 8]
push ecx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
pop esi
pop edi
pop ebx
leave
ret 0x10

Function at 0x10004f19
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
lea eax, [ebp - 0x114]
mov dword [ebp - 0x114], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x104], 2
jne 0x10004f50
cmp dword [ebp - 0x110], 6
jb 0x10004f50
push 1
pop eax
leave
ret
xor eax, eax
leave
ret

Function at 0x10005004
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x464
push esi
push edi
push 0x10
xor eax, eax
pop ecx
lea edi, [ebp - 0x50]
mov dword [ebp - 0x54], 0x44
xor esi, esi
rep stosd dword es:[edi], eax
push 0x10
lea eax, [ebp - 0x10]
push esi
push eax
call sub.MSVCRT.dll_memset
mov ecx, 0x103
xor eax, eax
lea edi, [ebp - 0x462]
mov word [ebp - 0x464], si
rep stosd dword es:[edi], eax
add esp, 0xc
cmp dword [ebp + 0xc], esi
stosw word es:[edi], ax
je 0x10005070
push dword [ebp + 0xc]
lea eax, [ebp - 0x464]
push dword [ebp + 8]
push str.__s___s
push 0x207
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x14
jmp 0x10005088
push 0x207
lea eax, [ebp - 0x464]
push dword [ebp + 8]
push eax
call dword [sym.imp.MSVCRT.dll_wcsncpy]
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x464]
push esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x100050cc
cmp dword [ebp + 0x10], esi
jbe 0x100050b9
push dword [ebp + 0x10]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0xc]
call esi
push 1
pop eax
pop edi
pop esi
leave
ret
Function at 0x100050d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
cmp dword [0x10010988], 0
jne 0x1000515d
and word [ebp - 0x20c], 0
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x20a]
mov dword [0x10010988], 1
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x208
push eax
lea eax, [ebp - 0x20c]
push eax
push 0
push str.Version
push 0x1000f978
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea eax, [ebp - 0x20c]
push 0x1000f974
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrW]
test eax, eax
pop edi
je 0x1000515d
and word [eax], 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.MSVCRT.dll__wtoi]
pop ecx
mov dword [0x1001098c], eax
mov eax, dword [0x1001098c]
leave
ret
Function at 0x1000519b
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x47c
push ebx
push esi
push edi
xor ebx, ebx
xor eax, eax
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], ebx
mov esi, 0x2000000
stosd dword es:[edi], eax
lea eax, [ebp - 0xc]
mov dword [ebp - 8], ebx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1000532c
lea eax, [ebp - 4]
push eax
push 1
push 2
push ebx
push esi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x10005327
push str.advapi32.dll
call fcn.10004f54
push str.ConvertStringSidToSidW
push eax
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x10005319
lea ecx, [ebp - 8]
push ecx
push dword [ebp + 8]
call eax
test eax, eax
je 0x10005319
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], 0x20
push eax
mov dword [ebp - 0x14], eax
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
add eax, 8
push eax
lea eax, [ebp - 0x14]
push eax
push 0x19
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
test eax, eax
je 0x10005310
push 0x10
xor eax, eax
pop ecx
lea edi, [ebp - 0x68]
mov dword [ebp - 0x6c], 0x44
mov dword [ebp - 0x28], ebx
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x24]
mov ecx, 0x103
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0x47a]
cmp dword [ebp + 0x10], ebx
mov word [ebp - 0x47c], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
je 0x100052af
push dword [ebp + 0x10]
lea eax, [ebp - 0x47c]
push dword [ebp + 0xc]
push str.__s___s
push 0x207
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x14
jmp 0x100052c7
push 0x207
lea eax, [ebp - 0x47c]
push dword [ebp + 0xc]
push eax
call dword [sym.imp.MSVCRT.dll_wcsncpy]
add esp, 0xc
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x6c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x47c]
push ebx
push eax
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x1000530a
cmp dword [ebp + 0x14], ebx
jbe 0x100052fb
push dword [ebp + 0x14]
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x28]
call esi
push dword [ebp - 0x24]
call esi
push 1
pop ebx
jmp 0x10005310
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push dword [ebp - 4]
call esi
push dword [ebp - 0xc]
call esi
pop edi
mov eax, ebx
pop esi
pop ebx
leave
ret
Function at 0x100054c9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x18]
call fcn.100054c3
cmp dword [ebp + 0x10], 0
pop ecx
je 0x10005524
cmp dword [ebp + 0x10], eax
jl 0x10005524
mov ecx, dword [ebp + 0xc]
push esi
xor esi, esi
and word [ecx], 0
cmp dword [ebp + 0x18], esi
jle 0x1000551e
push ebx
mov eax, esi
push 4
cdq
pop ebx
idiv ebx
mov al, byte [edx + 0x1000b8fc]
mov edx, dword [ebp + 0x14]
add al, byte [ebp + 8]
xor al, byte [esi + edx]
xor al, 0x80
movzx ax, al
mov word [ecx], ax
and word [ecx + 2], 0
inc esi
inc ecx
inc ecx
cmp esi, dword [ebp + 0x18]
jl 0x100054f0
pop ebx
push 1
pop eax
pop esi
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x10005a51
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push edi
push 0x44
pop ecx
xor eax, eax
lea edi, [ebp - 0x110]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x114], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
pop edi
je 0x10005ade
cmp dword [ebp - 0x104], 1
jne 0x10005a9a
cmp dword [ebp - 0x110], 4
jne 0x10005ade
mov al, 1
leave
ret
cmp dword [ebp - 0x104], 2
jne 0x10005ade
push 5
pop eax
cmp dword [ebp - 0x110], eax
jne 0x10005ad5
cmp dword [ebp - 0x10c], 0
jne 0x10005abb
mov al, 2
leave
ret
cmp dword [ebp - 0x10c], 1
jne 0x10005ac8
mov al, 3
leave
ret
cmp dword [ebp - 0x10c], 2
jne 0x10005ade
mov al, 4
leave
ret
cmp dword [ebp - 0x110], 6
je 0x10005ae0
xor al, al
leave
ret

Function at 0x10005cf7
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
and byte [ebp - 0x10], 0
push ebx
push esi
push edi
xor eax, eax
lea edi, [ebp - 0xf]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x10
pop esi
stosb byte es:[edi], al
push esi
lea eax, [ebp - 0x10]
push 0
push eax
call sub.MSVCRT.dll_memset
lea eax, [ebp - 0x10]
push esi
push eax
call fcn.10006724
mov ebx, eax
lea eax, [ebp - 0x10]
push esi
push eax
lea eax, [ebp - 0x20]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0x20
call fcn.10005333
test eax, eax
je 0x10005d60
lea eax, [ebp - 0x20]
push esi
push eax
push 3
push str.Custom_ID2
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov edi, dword [ebp + 8]
test edi, edi
je 0x10005d6e
lea esi, [ebp - 0x20]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
mov eax, ebx
pop esi
pop ebx
leave
ret 4

Function at 0x10005d77
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 8]
and dword [ebp - 4], 0
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push str.Owner_ID2
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push 0x80000002
mov dword [ebp - 8], 2
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov ax, word [ebp - 4]
leave
ret
Function at 0x10005e88
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 1
pop ebx
test byte [0x10011539], bl
jne 0x10005ea9
or byte [0x10011539], bl
call fcn.10006061
mov dword [0x10011520], eax
mov eax, dword [ebp + 8]
cmp eax, 0xc
ja case.0x10005eb5.8
jmp dword [eax*4 + 0x1000602d]
push dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
and word [esi], 0
push esi
call fcn.100066db
pop ecx
test eax, eax
pop ecx
je 0x10005ee1
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10006022
push dword [ebp + 0x10]
push esi
call fcn.1000609c
jmp 0x10005ef7
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.100094f3
pop ecx
pop ecx
jmp 0x10006022
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
jmp 0x10006022
push dword [ebp + 0xc]
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
jmp 0x10006022
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.100094f3
pop ecx
pop ecx
push str.downlo1
jmp 0x10006019
push ebx
push 0x1a
push dword [ebp + 0xc]
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je case.0x10005eb5.8
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push str.LocalVirtualStoreProgram_Files
push dword [ebp + 0xc]
call esi
push str.TENCENTQQToolbar
push dword [ebp + 0xc]
jmp 0x10005fa2
mov edi, dword [ebp + 0xc]
push ebx
push 0x1a
push edi
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je case.0x10005eb5.8
cmp dword [0x10011520], 0
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
je 0x10005f9c
push edi
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.LocalLow
push edi
call esi
push str.TENCENTQQToolbar
push edi
call esi
jmp 0x10006022
push ebx
push 0x1c
push dword [ebp + 0xc]
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je case.0x10005eb5.8
push str.TENCENTQQToolbar
jmp 0x10006019
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 6
call fcn.10005e88
add esp, 0xc
push str.btns
jmp 0x10006019
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 6
call fcn.10005e88
add esp, 0xc
push str.dlls
jmp 0x10006019
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 6
call fcn.10005e88
add esp, 0xc
push str.users
jmp 0x10006019
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 6
call fcn.10005e88
add esp, 0xc
push str.config
push dword [ebp + 0xc]
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov eax, ebx
jmp 0x10006028
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x10006061
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
lea eax, [ebp - 0x114]
mov dword [ebp - 0x114], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x104], 2
jne 0x10006098
cmp dword [ebp - 0x110], 6
jb 0x10006098
push 1
pop eax
leave
ret
xor eax, eax
leave
ret