joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10015f8f
Capabilities:
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x2114]
mov eax, 0x2114
call fcn.1006b5e0
push 0xffffffffffffffff
push 0x10074ef8
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x10098428]
xor eax, ebp
mov dword [ebp + 0x2110], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x211c]
xor ebx, ebx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ebx
push SysReAllocString
push eax
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 4], ebx
call fcn.10015dc3
test eax, eax
jge 0x10016005
cmp dword [ebp - 0x10], ebx
je 0x10015ffe
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x100160e0
xor eax, eax
mov byte [ebp + 0x2100], bl
lea edi, [ebp + 0x2101]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea esi, [ebp - 0x74]
stosb byte es:[edi], al
call fcn.100034da
push ebx
lea eax, [ebp - 0x14]
push eax
push 0x2000
lea eax, [ebp]
push eax
push dword [ebp - 0x10]
mov dword [ebp - 0x14], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10016044
call fcn.10014bd7
mov eax, dword [ebp - 0x14]
cmp eax, ebx
je 0x10016058
lea ecx, [ebp]
lea edx, [ebp - 0x74]
call fcn.10003c24
jmp 0x10016021
cmp dword [ebp - 0x10], ebx
je 0x10016069
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x10], ebx
lea eax, [ebp + 0x2100]
push eax
lea esi, [ebp - 0x74]
call fcn.10003e2f
push 0xfe
lea eax, [ebp + 0x2002]
push ebx
push eax
mov word [ebp + 0x2000], bx
call fcn.10053710
add esp, 0x10
lea esi, [ebp + 0x2000]
xor edi, edi
movzx eax, byte [ebp + edi + 0x2100]
push eax
push 0x100846e8
push 0xffffffffffffffff
push 3
push esi
call fcn.100574e7
add esp, 0x14
add esi, 4
inc edi
cmp edi, 0x10
jb 0x1001609c
lea eax, [ebp + 0x2000]
push eax
push dword [ebp - 0x18]
call fcn.10002fc7
cmp dword [ebp - 0x10], ebx
je 0x100160dd
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x2110]
xor ecx, ebp
call fcn.10053191
add ebp, 0x2114
leave
ret

Function at 0x10016103
Capabilities:
Check if file exists

Disassembly:
push ebp
lea ebp, [esp - 0x194]
sub esp, 0x214
mov eax, dword [0x10098428]
xor eax, ebp
mov dword [ebp + 0x190], eax
push ebx
push edi
xor eax, eax
push 0x208
push eax
mov dword [ebp - 0x80], eax
mov word [ebp - 0x7c], ax
lea eax, [ebp - 0x7a]
push eax
call fcn.10053710
push str.SOFTWARETencentQQPCMgr
lea edi, [ebp - 0x7c]
mov ebx, str.InstallDir
call fcn.10008fc2
add esp, 0x10
test eax, eax
pop edi
pop ebx
je 0x10016175
lea eax, [ebp - 0x7c]
push eax
call fcn.1005317b
test eax, eax
pop ecx
jbe 0x10016175
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10016175
lea eax, [ebp - 0x7c]
push eax
jmp 0x1001617a
push 0x1007dca8
mov eax, esi
call fcn.1000189d
mov ecx, dword [ebp + 0x190]
xor ecx, ebp
mov eax, esi
call fcn.10053191
add ebp, 0x194
leave
ret
Function at 0x100191ac
Capabilities:
Hide graphical window

Disassembly:
push 0
mov eax, 0x10079af5
call fcn.1005a2eb
mov esi, ecx
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x18]
xor edi, edi
inc edi
cmp eax, 0xf
jne 0x100191f4
mov dword [esi + 0xd0], edi
push dword [ebp + 0x10]
and dword [ebp - 4], 0
call fcn.100171e7
or dword [ebp - 4], 0xffffffff
and dword [ebx], 0
cmp dword [esi + 0xd0], 0
je 0x10019259
mov eax, edi
call fcn.1005a3c3
ret 0x14
cmp eax, 2
jne 0x1001922d
push dword [esi + 0xd4]
mov dword [esi + 0xd0], edi
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_GetDlgItem]
test eax, eax
mov dword [ebp + 0x18], eax
je 0x100191de
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x100191de
push 0
push dword [ebp + 0x18]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x100191de
cmp eax, 0x47
jne 0x10019244
push dword [ebp + 0x14]
mov eax, esi
mov dword [esi + 0xd0], edi
call fcn.10018fbb
jmp 0x100191de
cmp eax, 0x18
jne 0x100191e1
mov eax, dword [ebp + 0x10]
mov dword [esi + 0xd0], edi
call fcn.10019095
jmp 0x100191de
push ebx
push dword [ebp + 0x14]
mov ecx, esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.10017665
jmp 0x100191ec
Function at 0x1001da7a
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x3f4]
xor ecx, ecx
inc ecx
cmp eax, 2
mov dword [esi + 0x40c], ecx
je 0x1001da9e
cmp eax, 3
je 0x1001da9e
mov eax, esi
pop esi
jmp fcn.1001f60a
push ecx
call fcn.1001e481
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
ret

Function at 0x1001db87
Capabilities:
Hide graphical window

Disassembly:
push 0
mov eax, 0x100787f8
call fcn.1005a2eb
mov esi, ecx
cmp dword [ebp + 8], 1
jne 0x1001dbd3
mov eax, dword [esi + 0x404]
mov ecx, dword [esi + 0x3e4]
cmp ecx, dword [eax + 0x30]
jb 0x1001dbb3
and dword [esi + 0x3e4], 0
mov ecx, dword [esi + 0x3e4]
mov eax, dword [eax + ecx*4 + 8]
test eax, eax
je 0x1001dbc8
push eax
push esi
call fcn.1001f4ae
inc dword [esi + 0x3e4]
jmp 0x1001dc6c
cmp dword [ebp + 8], 2
je 0x1001dc6c
cmp dword [ebp + 8], 3
jne 0x1001dc6c
mov eax, dword [esi + 0x41c]
inc dword [esi + 0x410]
mov ecx, dword [eax]
push 0
push str.hidetotraytime
push eax
call dword [ecx + 0x18]
mov edi, eax
sub edi, dword [esi + 0x410]
test edi, edi
jle 0x1001dc4c
mov eax, dword [0x1009d334]
mov ecx, 0x1009d334
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp + 8], eax
and dword [ebp - 4], 0
push edi
lea eax, [ebp + 8]
push 0x10084d7c
push eax
call fcn.1000f214
mov edi, dword [ebp + 8]
add esp, 0xc
push edi
push 0x64
mov eax, esi
call fcn.1001f464
lea eax, [edi - 0x10]
call fcn.10003389
jmp 0x1001dc6c
and dword [esi + 0x410], 0
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
call fcn.1001e481
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x2c]
call fcn.1005a3c3
ret 4

Function at 0x1001dc84
Capabilities:
Hide graphical window

Disassembly:
xor eax, eax
push esi
inc eax
mov esi, ecx
push eax
mov dword [esi + 0x40c], eax
call fcn.1001e481
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
ret
Function at 0x1001e938
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10074df6
mov eax, dword fs:[0]
push eax
sub esp, 0x45c
mov eax, dword [0x10098428]
xor eax, esp
mov dword [esp + 0x454], eax
push esi
push edi
mov eax, dword [0x10098428]
xor eax, esp
push eax
lea eax, [esp + 0x468]
mov dword fs:[0], eax
mov edi, 0x208
xor esi, esi
push edi
lea eax, [esp + 0x252]
push esi
push eax
mov word [esp + 0x258], si
call fcn.10053710
add esp, 0xc
push edi
lea eax, [esp + 0x42]
push esi
push eax
mov word [esp + 0x48], si
call fcn.10053710
add esp, 0xc
jmp 0x1001ea58
lea ecx, [esp + 0x3c]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x1001eb42
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x10]
push eax
call fcn.10002d62
mov dword [esp + 0x470], esi
mov eax, dword [esp + 0xc]
push 2
pop ecx
cmp dword [eax - 0xc], ecx
jl 0x1001ea2f
lea edx, [esp + 0x10]
lea eax, [esp + 0xc]
call fcn.10002e30
xor eax, eax
push esi
mov dword [esp + 0x18], esi
lea edi, [esp + 0x1c]
stosd dword es:[edi], eax
mov edi, dword [esp + 0x14]
push esi
lea eax, [esp + 0x1c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
cmp dword [esp + 0x18], esi
ja 0x1001eaa1
jb 0x1001ea27
cmp dword [esp + 0x14], 0x6400000
jae 0x1001eaa1
lea eax, [edi - 0x10]
call fcn.10003389
push 0x40
push 0x10084f4c
push 0x10085110
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
or dword [esp + 0x470], 0xffffffff
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
call fcn.10003389
push 7
xor eax, eax
pop ecx
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
mov eax, dword [ebx + 4]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x24c]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x24], esi
mov dword [esp + 0x2c], 0x10085100
mov dword [esp + 0x30], 0x43
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderW]
cmp eax, esi
jne 0x1001e9b1
jmp 0x1001eb42
lea eax, [edi - 0x10]
call fcn.10003389
mov dword [esp + 0x10], esi
lea eax, [esp + 0xc]
mov byte [esp + 0x470], 1
call fcn.100163dd
lea edi, [esp + 0xc]
call fcn.10002da9
push str.qqpcmgr
xor ecx, ecx
mov esi, edi
call fcn.100163ac
cmp eax, 0xffffffff
lea eax, [esp + 0x3c]
push eax
jne 0x1001eb03
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea eax, [esp + 0x3c]
push eax
mov eax, edi
push eax
call fcn.10002fc7
push str.QQPCMgr
mov eax, edi
push eax
call fcn.1000923c
push dword [esp + 0xc]
lea esi, [esp + 0x14]
call fcn.1002109f
mov eax, dword [ebx + 0x418]
push dword [esp + 0x10]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x3c]
push dword [esp + 0x10]
push dword [ebx + 0x424]
call dword [sym.imp.USER32.dll_SetWindowTextW]
push dword [esp + 0x10]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
call fcn.10003389
mov ecx, dword [esp + 0x468]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x454]
xor ecx, esp
call fcn.10053191
mov esp, ebp
pop ebp
ret
Function at 0x1001ee2c
Capabilities:
Create process on windows

Disassembly:
push ebp
sub esp, 0x20c
lea ebp, [esp - 4]
mov eax, dword [0x10098428]
xor eax, ebp
mov dword [ebp + 0x20c], eax
push 0x10
mov eax, 0x100747b0
call fcn.1005a2eb
xor edi, edi
mov esi, ecx
mov eax, dword [esi + 0x41c]
push edi
push str.bShowPacketInstallProgross
mov dword [ebp - 0x14], edi
mov ecx, dword [eax]
push eax
call dword [ecx + 0x20]
lea edx, [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi + 0x418]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x58]
cmp dword [ebp - 0x14], 1
jne 0x1001ef45
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x18], edi
push 0x208
lea eax, [ebp + 2]
push edi
mov byte [ebp - 4], 1
push eax
mov word [ebp], di
call fcn.10053710
push str.SOFTWARETencentQQPCMgr
lea edi, [ebp]
mov ebx, str.InstallDir
call fcn.10008fc2
add esp, 0x10
test eax, eax
je 0x1001ef33
mov eax, dword [esi + 0x41c]
mov ecx, dword [eax]
mov edi, 0x1007e388
push edi
lea edx, [ebp - 0x10]
push edx
push str.NewVersionRunExe
push eax
call dword [ecx + 0x14]
mov eax, dword [esi + 0x41c]
mov ecx, dword [eax]
push edi
lea edx, [ebp - 0x18]
push edx
push str.NewVersionRunExeParam
push eax
call dword [ecx + 0x14]
lea eax, [ebp - 0x10]
push eax
call fcn.10021059
test al, al
je 0x1001ef33
lea eax, [ebp]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
push dword [ebp - 0x10]
lea eax, [ebp]
push 0x104
push eax
call fcn.10057b8d
add esp, 0xc
push 1
push 0
push dword [ebp - 0x18]
lea eax, [ebp]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push dword [ebp - 0x18]
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
call edi
push dword [ebp - 0x10]
call edi
xor edi, edi
cmp dword [esi + 0x40c], edi
jne 0x1001ef63
cmp dword [ebp - 0x1c], edi
je 0x1001ef58
cmp dword [ebp - 0x14], 1
jne 0x1001ef63
push 1
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x20c]
xor ecx, ebp
call fcn.10053191
add ebp, 0x210
leave
ret

Function at 0x1001ef9a
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 8]
push dword [ebp + 0xc]
push edi
call fcn.1001e337
mov dword [ebp + 0x10], eax
mov eax, dword [edi + 0x54]
test eax, eax
je 0x1001efe5
mov ecx, dword [eax]
push 0
push str.bShowPacketInstallProgross
push eax
call dword [ecx + 0x20]
test eax, eax
je 0x1001efe5
push esi
push 0
lea esi, [edi - 0x3c8]
call fcn.1001e481
push 0
push dword [edi - 0x3c4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
mov eax, dword [ebp + 0x10]
pop edi
pop ebp
ret 0xc
Function at 0x10020418
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
xor ebx, ebx
push esi
lea esi, [edi + 0x334]
cmp dword [esi], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
je 0x1002043a
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov dword [esi], ebx
mov eax, dword [edi + 0x324]
cmp eax, ebx
je 0x10020508
push eax
call fcn.1000c49c
mov esi, eax
cmp esi, ebx
pop ecx
je 0x100204bd
push ebx
push edi
push 2
pop eax
call fcn.1001fc9d
mov eax, dword [edi + 0x324]
cmp eax, dword [edi + 0x320]
jne 0x100204bd
movzx eax, word [ebp + 0x10]
movzx ecx, word [ebp + 0xc]
shl eax, 0x10
or eax, ecx
push eax
push dword [ebp + 8]
mov ecx, esi
push 0x202
call fcn.1000c50b
mov eax, dword [esi + 0x88]
cmp eax, ebx
je 0x100204ac
cmp word [eax], bx
je 0x100204ac
push 1
push ebx
push ebx
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x100204bd
mov eax, dword [esi + 0x10]
cmp eax, ebx
je 0x100204bd
mov dword [ebp - 4], 1
mov dword [ebp - 8], eax
cmp dword [ebp - 4], ebx
mov dword [edi + 0x324], ebx
je 0x10020508
mov eax, dword [edi + 4]
push eax
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x1c], eax
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
push dword [edi + 4]
mov dword [ebp - 0xc], eax
call dword [sym.imp.USER32.dll_GetParent]
lea ecx, [ebp - 0x1c]
push ecx
push dword [ebp - 0x18]
push 0x4e
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
pop esi
pop ebx
leave
ret 0xc

Function at 0x100219ae
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
push edi
je 0x10021a4b
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
mov dword [ebp + 8], ebx
jmp 0x10021a40
lea eax, [esi + 0xc]
cmp dword [eax], ebx
je 0x10021a66
push 0x4ff
push 0x64
push ebx
push eax
push 1
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
cmp eax, ebx
je 0x10021a47
cmp eax, 0xffffffff
je 0x10021a66
push 6
pop ecx
push 1
push ebx
xor eax, eax
push ebx
mov dword [ebp - 0x20], ebx
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
push ebx
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x10021a2b
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp dword [ebp - 0x1c], 0x12
jne 0x10021a2b
mov dword [ebp + 8], 1
cmp dword [ebp + 8], ebx
je 0x10021a40
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 4]
cmp eax, 0x2710
ja 0x10021a66
cmp dword [esi + 4], ebx
jne 0x100219cf
jmp 0x10021a66
mov bl, 1
jmp 0x10021a66
mov eax, dword [esi + 0xc]
cmp eax, ebx
je 0x10021a66
push 0xbb8
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebx, eax
neg ebx
sbb bl, bl
inc bl
pop edi
mov al, bl
pop ebx
leave
ret 4
Function at 0x100226a6
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
cmp eax, 3
jne 0x100226b0
jmp fcn.1002271d
cmp eax, 0xe
jne 0x100226ba
jmp fcn.10022943
cmp eax, 1
jne 0x100226c4
jmp fcn.100226c7
xor eax, eax
ret

Function at 0x1002271d
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
sub esp, 0x20c
lea ebp, [esp - 4]
mov eax, dword [0x10098428]
xor eax, ebp
mov dword [ebp + 0x20c], eax
push 0x14
mov eax, 0x100758d0
call fcn.1005a2eb
lea eax, [ebp - 0x14]
push eax
push 0x20019
xor ebx, ebx
push ebx
push str.SOFTWAREkingsoftAntivirus
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x14], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10022820
push 0x208
lea eax, [ebp + 2]
push ebx
push eax
mov dword [ebp - 0x20], ebx
mov word [ebp], bx
call fcn.10053710
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp]
push eax
lea eax, [ebp - 0x20]
push eax
push ebx
push str.ProgramPath
push dword [ebp - 0x14]
mov dword [ebp - 0x18], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10022820
lea eax, [ebp]
push eax
call fcn.1005317b
add eax, eax
cmp word [ebp + eax - 2], 0x5c
pop ecx
je 0x100227c7
mov word [ebp + eax], 0x5c
mov word [ebp + eax + 2], bx
lea eax, [ebp]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.10002d62
lea eax, [ebp - 0x1c]
push str.kxetray.exe
push eax
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], ebx
call fcn.1000d4ab
pop ecx
pop ecx
lea edi, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.10002da9
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
call fcn.10003389
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10022811
xor ebx, ebx
inc ebx
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.10003389
mov eax, ebx
jmp 0x10022822
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x20c]
xor ecx, ebp
call fcn.10053191
add ebp, 0x210
leave
ret
Function at 0x10022c4f
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x90]
sub esp, 0x110
mov eax, dword [0x10098428]
xor eax, ebp
mov dword [ebp + 0x8c], eax
push ebx
push edi
lea eax, [ebp - 0x78]
push eax
push 0x20019
xor ebx, ebx
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
push reloc.OLEAUT32.dll_SysReAllocString
xor edi, edi
mov dword [ebp - 0x78], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10022cfa
push esi
push 0xff
lea eax, [ebp - 0x73]
push ebx
push eax
mov dword [ebp - 0x80], ebx
mov byte [ebp - 0x74], bl
call fcn.10053710
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
add esp, 0xc
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x80]
push eax
push ebx
push str.KAVINSTALLNEEDREBOOT
push dword [ebp - 0x78]
mov dword [ebp - 0x7c], pe_nt_image_headers32
call esi
test eax, eax
je 0x10022ced
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x80]
push eax
push ebx
push str.KAV7NEEDREBOOT
push dword [ebp - 0x78]
call esi
test eax, eax
jne 0x10022cf0
xor edi, edi
inc edi
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov ecx, dword [ebp + 0x8c]
mov eax, edi
pop edi
xor ecx, ebp
pop ebx
call fcn.10053191
add ebp, 0x90
leave
ret

Function at 0x10022f86
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10098428]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [0x1009d49c]
push edi
push str.RT_RCDATA
push 0x6f
xor ebx, ebx
push esi
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
cmp edi, ebx
jne 0x10022fcf
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10053191
leave
ret
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
cmp eax, ebx
mov dword [ebp - 0xc], eax
je 0x10022fbe
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
cmp edi, ebx
je 0x10022fbe
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp eax, ebx
mov dword [ebp - 0x14], eax
je 0x10022fbe
push ebx
push 0x80
push 2
push ebx
push 1
push 0x10000000
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10023023
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
jmp 0x10022fbe
push ebx
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push dword [ebp - 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1002304e
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
jmp 0x10022fc0
xor ebx, ebx
inc ebx
jmp 0x10023040
Function at 0x10023650
Capabilities:
Create thread

Disassembly:
push 0x30
mov eax, 0x10077b28
call fcn.1005a354
xor edi, edi
mov ebx, ecx
mov esi, edx
mov dword [ebp - 0x20], 7
mov dword [ebp - 0x24], edi
mov word [ebp - 0x34], di
push esi
mov dword [ebp - 4], edi
call fcn.1005317b
pop ecx
mov ecx, esi
lea esi, [ebp - 0x38]
call fcn.100022ac
push edi
push edi
push 1
push edi
mov dword [ebp - 0x18], edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
cmp eax, edi
mov ecx, dword [ebx + 0x3c]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], ecx
je 0x10023700
push edi
push edi
mov eax, esi
push eax
push 0x100235a7
push edi
push edi
call fcn.1005671f
add esp, 0x18
cmp eax, edi
mov dword [ebp - 0x3c], eax
je 0x100236f7
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x100236e3
cmp dword [ebx + 0x3c], 1
jne 0x100236e3
cmp dword [0x1009d498], edi
jne 0x100236e3
call fcn.10023716
test eax, eax
je 0x100236e3
mov dword [0x1009d498], 1
push 0x64
push dword [ebp - 0x1c]
call esi
test eax, eax
jne 0x100236c2
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [ebp - 0x18]
push edi
push 1
lea esi, [ebp - 0x38]
call fcn.10001efb
mov eax, ebx
call fcn.1005a3d7
ret

Function at 0x10023859
Capabilities:
Check if file exists
Delete file
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x194]
sub esp, 0x214
mov eax, dword [0x10098428]
xor eax, ebp
mov dword [ebp + 0x190], eax
push ebx
push esi
mov esi, ecx
test esi, esi
push edi
je 0x10023940
call dword [0x1009960c]
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jg 0x10023940
lea edi, [eax + eax]
mov eax, edi
call fcn.10064570
mov eax, esp
push ebx
push edi
push esi
mov esi, eax
call fcn.10015d90
mov edi, eax
xor ebx, ebx
cmp edi, ebx
je 0x10023940
push 0x208
lea eax, [ebp - 0x7a]
push ebx
push eax
mov word [ebp - 0x7c], bx
call fcn.10053710
add esp, 0xc
lea esi, [ebp - 0x7c]
call fcn.10023a42
push str.Txdlproxy.dat
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10023900
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x10085c40
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x80], ebx
call fcn.10058198
add esp, 0xc
cmp dword [ebp - 0x80], ebx
je 0x10023940
push edi
call fcn.100530f0
push dword [ebp - 0x80]
inc eax
push eax
push 1
push edi
call fcn.10058347
push dword [ebp - 0x80]
call fcn.1005843b
xor eax, eax
add esp, 0x18
inc eax
jmp 0x10023942
xor eax, eax
lea esp, [ebp - 0x8c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x190]
xor ecx, ebp
call fcn.10053191
add ebp, 0x194
leave
ret