joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4319a0
Capabilities:
Access the windows event log
Write file on windows

Disassembly:
mov eax, 0x108
call fcn.0047f270
mov eax, dword [0x4d4664]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
test esi, esi
je 0x431a3c
push esi
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x431a3c
lea eax, [esp + 0x114]
push eax
push 0
push dword [esp + 0xc]
lea eax, [esp + 0x14]
push 0x100
push eax
call fcn.00401871
mov ecx, dword [eax]
push dword [eax + 4]
or ecx, 1
push ecx
call fcn.004886e6
add esp, 0x1c
or ecx, 0xffffffff
test eax, eax
cmovs eax, ecx
lea ecx, [esp + 4]
push 0
push ecx
test eax, eax
mov ecx, 0x100
cmovs eax, ecx
push eax
lea eax, [esp + 0x14]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0047f259
add esp, 0x108
ret
lea eax, [esp + 0x114]
push eax
push 0
push dword [esp + 0x118]
lea eax, [esp + 0x14]
push 0xff
push eax
call fcn.00401871
mov ecx, dword [eax]
push dword [eax + 4]
or ecx, 1
push ecx
call fcn.004886e6
add esp, 0x1c
mov byte [esp + 0x107], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x431ad9
call fcn.00431b40
test eax, eax
jle 0x431ad9
push str.OPENSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
push 0
mov esi, eax
lea eax, [esp + 0xc]
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
push 0
push 1
push 0
push 0
push 0
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0047f259
add esp, 0x108
ret
push 0x10
push str.OpenSSL:_FATAL
lea eax, [esp + 0x10]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x108]
pop esi
xor ecx, esp
call fcn.0047f259
add esp, 0x108
ret
Function at 0x43b5c0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 0x14]
cmp dword [esp + 0x18], esi
jne 0x43b68c
mov ecx, dword [esp + 0x10]
mov al, byte [ecx]
cmp al, 0x6a
je 0x43b5e1
cmp al, 0x6b
jne 0x43b68c
inc ecx
cmp al, 0x6b
jne 0x43b64e
add esi, 0xfffffffd
xor eax, eax
test esi, esi
jle 0x43b602
nop
mov dl, byte [ecx]
inc ecx
cmp dl, 0xba
je 0x43b602
cmp dl, 0xbb
jne 0x43b62b
inc eax
cmp eax, esi
jl 0x43b5f0
sub esi, eax
test eax, eax
jne 0x43b651
push 0x8a
push str..crypto_rsa_rsa_x931.c
push 0x8a
push 0x80
push 4
call fcn.00412cb0
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
push 0x81
push str..crypto_rsa_rsa_x931.c
push 0x8a
push 0x80
push 4
call fcn.00412cb0
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
add esi, 0xfffffffe
cmp byte [esi + ecx], 0xcc
je 0x43b67a
push 0x93
push str..crypto_rsa_rsa_x931.c
push 0x8b
push 0x80
push 4
call fcn.00412cb0
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
push esi
push ecx
push dword [esp + 0x10]
call fcn.00480c10
add esp, 0xc
mov eax, esi
pop esi
ret
push 0x72
push str..crypto_rsa_rsa_x931.c
push 0x89
push 0x80
push 4
call fcn.00412cb0
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
Function at 0x440530
Capabilities:
Encode data using xor

Disassembly:
push esi
call fcn.0042f5e0
mov esi, dword [esp + 8]
test eax, eax
je 0x440557
cmp dword [esi + 4], 0
jne 0x440557
push dword [esp + 0x10]
push dword [esp + 0x10]
push esi
call fcn.00444110
add esp, 0xc
pop esi
ret
cmp dword [esi + 0x10c], 0xffffffff
jne 0x440564
xor eax, eax
pop esi
ret
push ebp
push edi
push esi
call fcn.00455c60
mov ecx, dword [esp + 0x1c]
add esp, 4
mov ebp, dword [esp + 0x14]
mov edi, eax
mov dword [ecx], edi
test ebp, ebp
je 0x440625
mov ecx, dword [esi + 0x10c]
push ebx
cmp ecx, edi
jne 0x4405b6
test edi, edi
jle 0x440604
mov edx, ebp
lea ecx, [esi + 0x8c]
mov ebx, edi
nop dword [eax]
mov al, byte [ecx + 0x60]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
lea edx, [edx + 1]
mov byte [edx - 1], al
sub ebx, 1
jne 0x4405a0
jmp 0x440604
sub eax, ecx
mov byte [ecx + esi + 0xec], 0x80
cmp eax, 1
jle 0x4405da
dec eax
push eax
lea eax, [esi + 0xed]
add eax, ecx
push 0
push eax
call fcn.00481190
add esp, 0xc
test edi, edi
jle 0x440604
mov edx, ebp
lea ecx, [esi + 0xac]
mov ebx, edi
nop dword [eax + eax]
mov al, byte [ecx + 0x40]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
lea edx, [edx + 1]
mov byte [edx - 1], al
sub ebx, 1
jne 0x4405f0
push edi
push ebp
push ebp
push esi
call fcn.00417ce0
add esp, 0x10
pop ebx
test eax, eax
jne 0x440625
push edi
push ebp
call fcn.00412160
add esp, 8
xor eax, eax
pop edi
pop ebp
pop esi
ret
pop edi
pop ebp
mov eax, 1
pop esi
ret

Function at 0x444110
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 8]
cmp dword [edi + 0x10c], 0xffffffff
jne 0x444122
xor eax, eax
pop edi
ret
mov eax, dword [edi]
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [eax + 4]
mov eax, dword [esp + 0x18]
mov dword [eax], esi
test ebp, ebp
je 0x4441d5
mov ecx, dword [edi + 0x10c]
push ebx
cmp ecx, esi
jne 0x44416a
test esi, esi
jle 0x4441b4
mov edx, ebp
lea ecx, [edi + 0x8c]
mov ebx, esi
mov al, byte [ecx + 0x60]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
lea edx, [edx + 1]
mov byte [edx - 1], al
sub ebx, 1
jne 0x444154
jmp 0x4441b4
mov eax, esi
mov byte [ecx + edi + 0xec], 0x80
sub eax, ecx
cmp eax, 1
jle 0x444190
dec eax
push eax
lea eax, [edi + 0xed]
add eax, ecx
push 0
push eax
call fcn.00481190
add esp, 0xc
test esi, esi
jle 0x4441b4
mov edx, ebp
lea ecx, [edi + 0xac]
mov ebx, esi
nop
mov al, byte [ecx + 0x40]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
lea edx, [edx + 1]
mov byte [edx - 1], al
sub ebx, 1
jne 0x4441a0
push esi
push ebp
push ebp
push edi
call fcn.00420000
add esp, 0x10
pop ebx
test eax, eax
jne 0x4441d5
push esi
push ebp
call fcn.0041c050
add esp, 8
xor eax, eax
pop esi
pop ebp
pop edi
ret
pop esi
pop ebp
mov eax, 1
pop edi
ret
Function at 0x444470
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 0x14]
cmp dword [esp + 0x18], esi
jne 0x44453c
mov ecx, dword [esp + 0x10]
mov al, byte [ecx]
cmp al, 0x6a
je 0x444491
cmp al, 0x6b
jne 0x44453c
inc ecx
cmp al, 0x6b
jne 0x4444fe
add esi, 0xfffffffd
xor eax, eax
test esi, esi
jle 0x4444b2
nop
mov dl, byte [ecx]
inc ecx
cmp dl, 0xba
je 0x4444b2
cmp dl, 0xbb
jne 0x4444db
inc eax
cmp eax, esi
jl 0x4444a0
sub esi, eax
test eax, eax
jne 0x444501
push 0x8c
push str..crypto_rsa_rsa_x931.c
push 0x8a
push 0x80
push 4
call fcn.0041d280
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
push 0x83
push str..crypto_rsa_rsa_x931.c
push 0x8a
push 0x80
push 4
call fcn.0041d280
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
add esi, 0xfffffffe
cmp byte [esi + ecx], 0xcc
je 0x44452a
push 0x95
push str..crypto_rsa_rsa_x931.c
push 0x8b
push 0x80
push 4
call fcn.0041d280
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
push esi
push ecx
push dword [esp + 0x10]
call fcn.00480c10
add esp, 0xc
mov eax, esi
pop esi
ret
push 0x74
push str..crypto_rsa_rsa_x931.c
push 0x89
push 0x80
push 4
call fcn.0041d280
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
Function at 0x461390
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 0xc]
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push edi
mov eax, dword [ebp + 4]
cmp eax, dword [ecx + 4]
jge 0x4613a7
mov edi, ecx
jmp 0x4613ab
mov edi, ebp
mov ebp, ecx
mov ebx, dword [esp + 0x10]
mov eax, dword [edi + 4]
cmp eax, dword [ebx + 8]
jg 0x4613bb
mov eax, ebx
jmp 0x4613c5
push eax
push ebx
call fcn.00432650
add esp, 8
test eax, eax
jne 0x4613cd
pop edi
pop ebp
pop ebx
ret
push esi
xor esi, esi
cmp dword [ebp + 4], esi
jle 0x4613eb
mov eax, dword [edi]
mov ecx, dword [ebp]
mov edx, dword [eax + esi*4]
mov eax, dword [ebx]
xor edx, dword [ecx + esi*4]
mov dword [eax + esi*4], edx
inc esi
cmp esi, dword [ebp + 4]
jl 0x4613d5
cmp esi, dword [edi + 4]
jge 0x461400
mov eax, dword [edi]
mov ecx, dword [ebx]
mov eax, dword [eax + esi*4]
mov dword [ecx + esi*4], eax
inc esi
cmp esi, dword [edi + 4]
jl 0x4613f0
mov ecx, dword [edi + 4]
mov dword [ebx + 4], ecx
pop esi
test ecx, ecx
jle 0x461424
mov edx, dword [ebx]
add edx, 0xfffffffc
lea edx, [edx + ecx*4]
mov eax, dword [edx]
lea edx, [edx - 4]
test eax, eax
jne 0x461421
dec ecx
test ecx, ecx
jg 0x461413
mov dword [ebx + 4], ecx
pop edi
pop ebp
mov eax, 1
pop ebx
ret
Function at 0x46deb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x6c
call fcn.0047f270
mov eax, dword [0x4d4664]
xor eax, esp
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0x74]
push ebx
mov dword [esp + 0xc], eax
xor ebx, ebx
mov eax, dword [esp + 0x7c]
push ebp
mov ebp, dword [esp + 0x78]
push esi
mov dword [esp + 0x10], eax
xor esi, esi
mov dword [eax], ebx
lea eax, [esp + 0x1c]
push edi
mov edi, dword [esp + 0x8c]
push eax
call fcn.00430910
lea eax, [esp + 0x24]
push ebp
push eax
call fcn.0041ba90
add esp, 0xc
test eax, eax
je 0x46dfb2
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x28]
push eax
call fcn.0041b840
add esp, 0xc
test eax, eax
je 0x46dfb2
lea eax, [esp + 0x20]
push eax
call fcn.0041ba30
mov esi, dword [ebp]
add esp, 4
test byte [esi + 0xc], 4
je 0x46dfd0
push edi
call fcn.00437ae0
push ebx
push edi
mov dword [esp + 0x1c], eax
call fcn.004301c0
mov esi, eax
add esp, 0xc
test esi, esi
je 0x46dfb2
push esi
call fcn.0046c080
add esp, 4
test eax, eax
jle 0x46dfb2
push dword [ebp]
push ebx
push 1
push 0xf8
push 0xffffffffffffffff
push esi
call fcn.0042ff70
add esp, 0x18
test eax, eax
jle 0x46dfb2
push dword [esp + 0x1c]
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x24]
push esi
call fcn.0046bfa0
add esp, 0x14
test eax, eax
jle 0x46dfb2
mov ecx, dword [esp + 0x14]
mov ebx, 1
mov eax, dword [esp + 0x10]
mov dword [ecx], eax
push esi
call fcn.00430160
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x68]
xor ecx, esp
call fcn.0047f259
add esp, 0x6c
ret
xor eax, eax
lea ecx, [esi + 0x2c]
mov edx, dword [ecx]
test edx, edx
je 0x46dfe8
cmp dword [edi], edx
je 0x46e012
inc eax
add ecx, 4
cmp eax, 4
jl 0x46dfd5
push 0x7f
push str..cryptoevpp_sign.c
push 0x6e
push 0x6b
push 6
call fcn.00412cb0
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x68]
xor ecx, esp
call fcn.0047f259
add esp, 0x6c
ret
mov eax, dword [esi + 0x24]
test eax, eax
jne 0x46e046
push 0x85
push str..cryptoevpp_sign.c
push 0x68
push 0x6b
push 6
call fcn.00412cb0
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x68]
xor ecx, esp
call fcn.0047f259
add esp, 0x6c
ret
push dword [edi + 0x14]
mov ecx, dword [esp + 0x18]
push ecx
push dword [esp + 0x20]
lea ecx, [esp + 0x44]
push dword [esp + 0x28]
push ecx
push dword [esi]
call eax
mov ecx, dword [esp + 0x90]
add esp, 0x18
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0047f259
add esp, 0x6c
ret
Function at 0x46ff90
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 0xc]
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push edi
mov eax, dword [ebp + 4]
cmp eax, dword [ecx + 4]
jge 0x46ffa7
mov edi, ecx
jmp 0x46ffab
mov edi, ebp
mov ebp, ecx
mov ebx, dword [esp + 0x10]
mov eax, dword [edi + 4]
cmp eax, dword [ebx + 8]
jg 0x46ffbb
mov eax, ebx
jmp 0x46ffc5
push eax
push ebx
call fcn.00429770
add esp, 8
test eax, eax
jne 0x46ffcd
pop edi
pop ebp
pop ebx
ret
push esi
xor esi, esi
cmp dword [ebp + 4], esi
jle 0x46ffeb
mov eax, dword [edi]
mov ecx, dword [ebp]
mov edx, dword [eax + esi*4]
mov eax, dword [ebx]
xor edx, dword [ecx + esi*4]
mov dword [eax + esi*4], edx
inc esi
cmp esi, dword [ebp + 4]
jl 0x46ffd5
cmp esi, dword [edi + 4]
jge 0x470000
mov eax, dword [edi]
mov ecx, dword [ebx]
mov eax, dword [eax + esi*4]
mov dword [ecx + esi*4], eax
inc esi
cmp esi, dword [edi + 4]
jl 0x46fff0
mov ecx, dword [edi + 4]
mov dword [ebx + 4], ecx
pop esi
test ecx, ecx
jle 0x470024
mov edx, dword [ebx]
add edx, 0xfffffffc
lea edx, [edx + ecx*4]
mov eax, dword [edx]
lea edx, [edx - 4]
test eax, eax
jne 0x470021
dec ecx
test ecx, ecx
jg 0x470013
mov dword [ebx + 4], ecx
pop edi
pop ebp
mov eax, 1
pop ebx
ret
Function at 0x47a7f0
Capabilities:
Encode data using base64

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
xor ebx, ebx
test esi, esi
jle 0x47a8dc
push edi
mov edi, dword [esp + 0x14]
inc edi
nop word [eax + eax]
movzx edx, byte [edi - 1]
cmp esi, 3
jl 0x47a86e
movzx ecx, byte [edi]
shl edx, 8
or edx, ecx
movzx ecx, byte [edi + 1]
shl edx, 8
or edx, ecx
mov ecx, edx
shr ecx, 0x12
and ecx, 0x3f
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax], cl
mov ecx, edx
shr ecx, 0xc
and ecx, 0x3f
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + 1], cl
mov ecx, edx
shr ecx, 6
and ecx, 0x3f
and edx, 0x3f
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + 2], cl
movzx ecx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + 3], cl
jmp 0x47a8bf
shl edx, 0x10
cmp esi, 2
jne 0x47a87e
movzx ecx, byte [edi]
shl ecx, 8
or edx, ecx
mov ecx, edx
shr ecx, 0x12
and ecx, 0x3f
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax], cl
mov ecx, edx
shr ecx, 0xc
and ecx, 0x3f
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + 1], cl
cmp esi, 1
jne 0x47a8ab
lea ecx, [esi + 0x3c]
jmp 0x47a8b8
shr edx, 6
and edx, 0x3f
movzx ecx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + 2], cl
mov byte [eax + 3], 0x3d
sub esi, 3
add eax, 4
add ebx, 4
add edi, 3
test esi, esi
jg 0x47a810
pop edi
mov byte [eax], 0
mov eax, ebx
pop esi
pop ebx
ret
mov byte [eax], bl
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x499c12
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00499a91

Function at 0x49b448
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0049b108

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
add eax, 0x403d6f
nop
nop
sub eax, 0x403d15
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x405ab0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x46e018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push pe_nt_image_headers32
lea eax, [ebp - 0x124]
mov dword [ebp - 0x128], 0x11c
push 0
push eax
call fcn.0042ff40
add esp, 0xc
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x124], 0xa
setae bl
movzx ecx, bl
push ecx
push str.NeedPatch__d
push 0xdd
push str.D:qci_workspace_root_workspaces__qci_pipeline_10991585_1QQPCMgrPacket_srcMainUpdateTrayIconTrayIconTrayIcon.cpp
push 2
push 0x470efc
call fcn.00404f70
mov ecx, dword [ebp - 4]
add esp, 0x18
mov al, bl
xor ecx, ebp
pop ebx
call fcn.0042dc42
mov esp, ebp
pop ebp
ret
Function at 0x40dac0
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x46e018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, dword [sym.imp.USER32.dll_FindWindowExW]
push 0
push str.TrayNotifyWnd
push 0
push eax
call esi
push 0
push str.SysPager
mov ebx, eax
push 0
push ebx
mov dword [ebp - 0x1c], ebx
call esi
push 0
push str.ToolbarWindow32
push 0
test eax, eax
jne 0x40db13
push ebx
jmp 0x40db14
push eax
call esi
mov ebx, eax
lea eax, [ebp - 0x14]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetClientRect]
mov edi, dword [ebp - 0xc]
mov edx, 1
mov dword [ebp - 0x18], edx
lea eax, [edi - 1]
cmp eax, edx
jle 0x40db8a
mov ecx, dword [ebp - 8]
nop dword [eax + eax]
mov esi, 1
cmp ecx, esi
jle 0x40db77
movzx edi, dx
nop dword [eax]
movzx eax, si
shl eax, 0x10
or eax, edi
push eax
push 0
push 0x200
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 8]
add esi, 4
cmp esi, ecx
jl 0x40db50
mov edi, dword [ebp - 0xc]
mov edx, dword [ebp - 0x18]
add edx, 4
lea eax, [edi - 1]
mov dword [ebp - 0x18], edx
cmp edx, eax
jl 0x40db40
mov esi, dword [sym.imp.USER32.dll_FindWindowExW]
push 1
lea eax, [ebp - 0x14]
push eax
push ebx
call dword [sym.imp.USER32.dll_InvalidateRect]
push 0
push str.NotifyIconOverflowWindow
call dword [sym.imp.USER32.dll_FindWindowW]
mov ebx, eax
test ebx, ebx
je 0x40dbb8
push 0
push str.ToolbarWindow32
push 0
push ebx
call esi
mov ebx, eax
push 0
push str.Button
push 0
push dword [ebp - 0x1c]
call esi
mov edi, eax
test edi, edi
je 0x40dc33
mov esi, dword [sym.imp.USER32.dll_SendMessageTimeoutW]
push 0
push 0x64
push 0
push 0x13000a
push 1
push 0x201
push edi
call esi
push 0
push 0x64
push 0
push 0x13000a
push 0
push 0x202
push edi
call esi
push 0
push 0x64
push 0
push 0x13000a
push 1
push 0x201
push edi
call esi
push 0
push 0x64
push 0
push 0x13000a
push 0
push 0x202
push edi
call esi
push 1
lea eax, [ebp - 0x14]
push eax
push ebx
call dword [sym.imp.USER32.dll_InvalidateRect]
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042dc42
mov esp, ebp
pop ebp
ret
Function at 0x410200
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x410259
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x410259
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x410248
cmp esi, edx
jae 0x410259
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x410236
cmp esi, edx
jae 0x410259
cmp word [esi], 0
je 0x410259
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret

Function at 0x410530
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, ecx
push ebx
mov dword [ebp - 0xc], eax
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword [eax]
test eax, eax
je 0x4105fd
lea ecx, [ebp - 4]
push ecx
push ebx
lea ecx, [ebp - 8]
push ecx
push ebx
push str.ExeString
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 8], 1
jne 0x4105fd
push esi
mov esi, dword [ebp + 0xc]
mov ecx, esi
push edi
call fcn.00410260
mov edx, dword [ebp - 4]
shr edx, 1
add edx, 1
js 0x410606
mov edi, dword [esi]
mov ecx, 1
mov eax, dword [edi - 8]
sub ecx, dword [edi - 4]
sub eax, edx
or ecx, eax
jge 0x4105a2
push edx
mov ecx, esi
call fcn.004104b0
mov edi, dword [esi]
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push 0
push str.ExeString
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4105fb
mov eax, dword [ebp - 4]
xor ecx, ecx
shr eax, 1
mov word [edi + eax*2], cx
mov eax, dword [esi]
test eax, eax
je 0x4105e4
push dword [eax - 8]
push eax
call fcn.0043b8cb
mov ecx, eax
add esp, 8
test ecx, ecx
js 0x410606
mov eax, dword [esi]
cmp ecx, dword [eax - 8]
jg 0x410606
mov dword [eax - 0xc], ecx
xor edx, edx
mov eax, dword [esi]
mov ebx, 1
mov word [eax + ecx*2], dx
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0x80070057
call fcn.00410440
int3
Function at 0x410970
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x46e018]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4109ed
lea eax, [ebp - 0x10]
push eax
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x4109ed
push 0
push 0
push 0
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 1
push eax
push 0
push dword [ebp - 0x18]
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4109ed
push 0x40000
push 6
call dword [sym.imp.USER32.dll_ExitWindowsEx]
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x4109fb
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.0042dc42
mov esp, ebp
pop ebp
ret
Function at 0x411f00
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x455987
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x46e018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x220], esi
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 0x224], esi
push 0
push eax
mov dword [ebp - 0x21c], 0
call fcn.0042ff40
add esp, 0xc
mov dword [ebp - 4], 1
call fcn.00402ca0
mov ecx, eax
test ecx, ecx
je 0x41200a
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
push 0
push 0x23
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push eax
push 0
mov dword [ebp - 0x21c], 1
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x411fee
push str.TencentQQPCMgr_
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x218]
call fcn.004106d0
test eax, eax
je 0x411fee
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x411fd0
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.0040f7b0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042dc42
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00410440
int3

Function at 0x4120e0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x46e018]
xor eax, ebp
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 5
ja 0x4121a8
jb 0x412198
shr eax, 8
test al, al
je 0x412198
push pe_nt_image_headers32
lea eax, [ebp - 0x11c]
push 0
push eax
call fcn.0042ff40
add esp, 0xc
mov dword [ebp - 0x120], 0x11c
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x41215e
lea eax, [ebp - 0x120]
mov dword [ebp - 0x120], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4121a8
push 0x80
lea eax, [ebp - 0x10c]
push str.Service_Pack_1
push eax
call fcn.0043c197
add esp, 0xc
test eax, eax
je 0x412198
push 0x80
lea eax, [ebp - 0x10c]
push str.Service_Pack_2
push eax
call fcn.0043c197
add esp, 0xc
test eax, eax
jne 0x4121a8
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042dc42
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
call fcn.0042dc42
mov esp, ebp
pop ebp
ret