joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100bc858
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x45c
mov eax, dword [0x100f93e0]
xor eax, ebp
mov dword [ebp - 0x1c], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x18], 0x124f80
and dword [ebp - 8], 0
lea ecx, [ebp - 0x10]
call fcn.100223dd
push 0x2001f
push 0x100dfd88
push SysReAllocStringLen
lea ecx, [ebp - 0x10]
call fcn.1000e13e
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x100bc8cc
lea eax, [ebp - 0x18]
push eax
push str.kSeWT
lea ecx, [ebp - 0x10]
call fcn.10024dc5
lea eax, [ebp - 8]
push eax
push str.kSeDbg
lea ecx, [ebp - 0x10]
call fcn.10024dc5
cmp dword [ebp - 8], 0
je 0x100bc8e0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x18]
jae 0x100bc91e
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0xc]
push eax
mov ecx, 0x10115834
call fcn.10005b69
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x100bc91e
or dword [ebp - 0x450], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.1000e1b0
mov eax, dword [ebp - 0x450]
jmp 0x100bca86
lea ecx, [ebp - 4]
call fcn.100223dd
push 0x2001f
push 0x100dfdd8
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 4]
call fcn.1000e13e
mov dword [ebp - 0x14], eax
and word [ebp - 0x230], 0
push 0x208
push 0
lea eax, [ebp - 0x22e]
push eax
call fcn.100771d0
add esp, 0xc
mov dword [ebp - 0x234], 0x104
cmp dword [ebp - 0x14], 0
jne 0x100bc989
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x230]
push eax
push str.ExeString
lea ecx, [ebp - 4]
call fcn.1000e2d4
lea eax, [ebp - 0x230]
push eax
call fcn.10077b0b
pop ecx
test eax, eax
jbe 0x100bc9cd
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100bc9cd
or dword [ebp - 0x454], 0xffffffff
lea ecx, [ebp - 4]
call fcn.1000e1b0
lea ecx, [ebp - 0x10]
call fcn.1000e1b0
mov eax, dword [ebp - 0x454]
jmp 0x100bca86
and word [ebp - 0x448], 0
push 0x208
push 0
lea eax, [ebp - 0x446]
push eax
call fcn.100771d0
add esp, 0xc
mov dword [ebp - 0x44c], 0x104
cmp dword [ebp - 0x14], 0
jne 0x100bca16
lea eax, [ebp - 0x44c]
push eax
lea eax, [ebp - 0x448]
push eax
push 0x100dfe20
lea ecx, [ebp - 4]
call fcn.1000e2d4
lea eax, [ebp - 0x448]
push eax
call fcn.10077b0b
pop ecx
test eax, eax
jbe 0x100bca69
push str.QQPCTray.dat
lea eax, [ebp - 0x448]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x448]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100bca69
or dword [ebp - 0x458], 0xffffffff
lea ecx, [ebp - 4]
call fcn.1000e1b0
lea ecx, [ebp - 0x10]
call fcn.1000e1b0
mov eax, dword [ebp - 0x458]
jmp 0x100bca86
and dword [ebp - 0x45c], 0
lea ecx, [ebp - 4]
call fcn.1000e1b0
lea ecx, [ebp - 0x10]
call fcn.1000e1b0
mov eax, dword [ebp - 0x45c]
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.100771ba
leave
ret
Function at 0x100bca92
Capabilities:
Delete file
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c7503
mov eax, dword fs:[0]
push eax
mov eax, 0x822c
call fcn.10091bf0
mov eax, dword [0x100f93e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
and word [ebp - 0x4224], 0
push 0x206
push 0
lea eax, [ebp - 0x4222]
push eax
call fcn.100771d0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x4224]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x4224]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
push 0x100dfce8
lea eax, [ebp - 0x4224]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddExtensionW]
and word [ebp - 0x401c], 0
push 0x4002
push 0
lea eax, [ebp - 0x401a]
push eax
call fcn.100771d0
add esp, 0xc
and word [ebp - 0x822c], 0
push 0x4002
push 0
lea eax, [ebp - 0x822a]
push eax
call fcn.100771d0
add esp, 0xc
lea eax, [ebp - 0x4224]
push eax
push 0x2002
lea eax, [ebp - 0x822c]
push eax
push 0x100dfcf4
push str.RTData
push 0x100dfd08
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
jbe 0x100bcc82
lea eax, [ebp - 0x4224]
push eax
push 0x2002
lea eax, [ebp - 0x401c]
push eax
push 0x100dfd1c
push str.ConfData
push 0x100dfd34
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
jbe 0x100bcc82
lea eax, [ebp - 0x401c]
push eax
call fcn.10077b0b
pop ecx
push eax
lea eax, [ebp - 0x401c]
push eax
lea eax, [ebp - 0x8234]
push eax
call fcn.100ab638
add esp, 0xc
and dword [ebp - 4], 0
lea eax, [ebp - 0x822c]
push eax
call fcn.10077b0b
pop ecx
push eax
lea eax, [ebp - 0x822c]
push eax
lea eax, [ebp - 0x8238]
push eax
call fcn.100ab638
add esp, 0xc
lea ecx, [ebp - 0x8234]
call fcn.10003bb7
cmp eax, 0x1000
jge 0x100bcc31
lea ecx, [ebp - 0x8234]
call fcn.10003bb7
push eax
lea ecx, [ebp - 0x8234]
call fcn.10005b69
push eax
push section.Downlaod
call fcn.1007b1b2
add esp, 0xc
lea ecx, [ebp - 0x8238]
call fcn.10003bb7
cmp eax, 0x1000
jge 0x100bcc68
lea ecx, [ebp - 0x8238]
call fcn.10003bb7
push eax
lea ecx, [ebp - 0x8238]
call fcn.10005b69
push eax
push 0x1011b008
call fcn.1007b1b2
add esp, 0xc
lea ecx, [ebp - 0x8238]
call fcn.10014be9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8234]
call fcn.10014be9
lea eax, [ebp - 0x4224]
push eax
push 0xffff
push str.index
push 0x100dfd54
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 0x8230], eax
cmp dword [ebp - 0x8230], 0xffff
je 0x100bccbb
mov eax, dword [ebp - 0x8230]
mov dword [0x1011f014], eax
lea eax, [ebp - 0x4224]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100771ba
leave
ret
Function at 0x100bce68
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c7859
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x100f93e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], ecx
push str.QQPC02FB3C82_DC18_475c_A75E_B44B90975300MGR
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 0x70], eax
lea ecx, [ebp - 0x10]
call fcn.10014b4b
and dword [ebp - 4], 0
push dword [ebp + 8]
push str.Global97ED6B7B_FABA_4282_B5E8_E5150894AB99
push 0x100dfb9c
lea eax, [ebp - 0x10]
push eax
call fcn.10008825
add esp, 0x10
lea ecx, [ebp - 0x10]
call fcn.10005b69
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 0x6c], eax
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0x6c], 0
je 0x100bcf11
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x100bcf11
mov dword [ebp - 0x14], 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.10014be9
mov eax, dword [ebp - 0x14]
jmp 0x100bcf24
and dword [ebp - 0x18], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.10014be9
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
leave
ret 4
Function at 0x100bdbaa
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 0x1c
call fcn.1007786b
pop ecx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x100bdbd1
push dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
call fcn.1000173d
mov dword [ebp - 0x10], eax
jmp 0x100bdbd5
and dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
push 0x10115730
push 0
push dword [ebp - 4]
push 0x100bdb2c
push 0
push 0
call fcn.1007b853
add esp, 0x18
mov dword [0x1011572c], eax
xor eax, eax
cmp dword [0x1011572c], 0
setne al
mov dword [0x10115738], eax
mov eax, dword [0x10115738]
leave
ret 4

Function at 0x100bdc37
Capabilities:
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push edi
and dword [ebp - 4], 0
push 0x20a
push 0
push str.InstallerSvcEx2014
call fcn.100771d0
add esp, 0xc
push 0x104
push dword [ebp + 8]
push str.InstallerSvcEx2014
call fcn.1007b1b2
add esp, 0xc
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x100bdc91
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x100bdd38
push 0xf01ff
push dword [ebp + 8]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x100bdcb6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x100bdd2f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x100bdcd4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x100bdd26
mov dword [ebp - 0x10], 7
cmp dword [ebp - 0x10], 0
jle 0x100bdd26
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
and dword [ebp - 0x2c], 0
push 6
pop ecx
xor eax, eax
lea edi, [ebp - 0x28]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x100bdd12
cmp dword [ebp - 0x28], 4
jne 0x100bdd10
jmp 0x100bdd26
jmp 0x100bdd1d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x100bdd26
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
jmp 0x100bdcdb
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 4]
pop edi
leave
ret
Function at 0x100bdd3e
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 4], 0
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x100bdd68
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x100bddb8
push 0xf01ff
push dword [ebp + 8]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x100bdd8d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x100bddac
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x100bdda3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 4]
leave
ret

Function at 0x100bddba
Capabilities:
Create service
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 8], 0
push 2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x100bdde7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x100bde53
push 0
push 0
push 0
push 0
push 0x100e0170
push dword [ebp + 8]
push 1
push dword [ebp + 0x18]
push 0x110
push 0xf01ff
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x100bde29
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
jmp 0x100bde47
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 8]
leave
ret
Function at 0x100be4d1
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x100ed000
push 0x1007efd0
mov eax, dword fs:[0]
push eax
push ecx
push ecx
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x100f93e0]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
and dword [ebp - 0x24], 0
mov eax, dword [ebp + 0x14]
add eax, 5
mov dword [ebp - 0x1c], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.100be064
pop ecx
pop ecx
mov dword [ebp - 0x20], eax
push dword [ebp + 0x10]
mov eax, dword [ebp + 8]
push dword [eax + 0x210]
call fcn.100be064
pop ecx
pop ecx
mov dword [ebp - 0x28], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0
je 0x100be5fd
cmp dword [ebp - 0x28], 0
je 0x100be5fd
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
cmp eax, 0xe9
jne 0x100be5fd
push dword [ebp + 0x18]
mov eax, dword [ebp - 0x28]
add eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x1c]
push eax
call fcn.10078d38
add esp, 0xc
test eax, eax
jne 0x100be5fd
push dword [ebp - 0x1c]
push dword [ebp - 0x28]
push dword [ebp - 0x20]
call fcn.10078d38
add esp, 0xc
test eax, eax
je 0x100be5fd
and dword [ebp - 0x2c], 0
lea eax, [ebp - 0x2c]
push eax
push 0x40
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x100be5fd
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
test eax, eax
jne 0x100be5ea
and dword [ebp - 0x34], 0
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 0x1c]
push dword [ebp - 0x28]
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0x34]
sub eax, dword [ebp - 0x1c]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x2c]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 4], 0xfffffffe
jmp 0x100be618
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100beac7
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x100f93e0]
xor eax, ebp
mov dword [ebp - 8], eax
mov byte [ebp - 0x108], 0
push 0xff
push 0
lea eax, [ebp - 0x107]
push eax
call fcn.100771d0
add esp, 0xc
push 0x11c
push 0
lea eax, [ebp - 0x228]
push eax
call fcn.100771d0
add esp, 0xc
mov dword [ebp - 0x228], 0x11c
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x100beb4c
mov dword [ebp - 0x228], 0x114
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x100beb4c
xor eax, eax
jmp 0x100beb67
cmp dword [ebp - 0x224], 6
jne 0x100beb65
cmp dword [ebp - 0x220], 1
jb 0x100beb65
xor eax, eax
inc eax
jmp 0x100beb67
xor eax, eax
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.100771ba
leave
ret

Function at 0x100beb73
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x100f93e0]
xor eax, ebp
mov dword [ebp - 8], eax
mov byte [ebp - 0x108], 0
push 0xff
push 0
lea eax, [ebp - 0x107]
push eax
call fcn.100771d0
add esp, 0xc
push 0x11c
push 0
lea eax, [ebp - 0x228]
push eax
call fcn.100771d0
add esp, 0xc
mov dword [ebp - 0x228], 0x11c
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x100bebf8
mov dword [ebp - 0x228], 0x114
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x100bebf8
xor eax, eax
jmp 0x100bec13
cmp dword [ebp - 0x224], 6
jne 0x100bec11
cmp dword [ebp - 0x220], 0
jne 0x100bec11
xor eax, eax
inc eax
jmp 0x100bec13
xor eax, eax
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.100771ba
leave
ret

Function at 0x100bec1f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x100f93e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp dword [ebp + 0x10], 0
jne 0x100bec3f
xor eax, eax
jmp 0x100becf4
and dword [ebp - 8], 0
call fcn.100beac0
neg eax
sbb eax, eax
and eax, 0x200
add eax, 0x20019
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push 0
push dword [ebp + 8]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100becf2
cmp dword [ebp - 8], 0
je 0x100becf2
and word [ebp - 0x220], 0
push 0x20a
push 0
lea eax, [ebp - 0x21e]
push eax
call fcn.100771d0
add esp, 0xc
mov dword [ebp - 0xc], 0x20b
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x220]
push eax
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100bece5
push 0x103
lea eax, [ebp - 0x220]
push eax
push dword [ebp + 0x10]
call fcn.1007b1b2
add esp, 0xc
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
jmp 0x100becf4
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x100becf4
xor eax, eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100771ba
leave
ret
Function at 0x100bed38
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c787f
mov eax, dword fs:[0]
push eax
sub esp, 0x220
mov eax, dword [0x100f93e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
and dword [ebp - 0x22c], 0
lea ecx, [ebp - 0x228]
call fcn.10014b4b
and dword [ebp - 4], 0
lea ecx, [ebp - 0x228]
call fcn.10004816
and word [ebp - 0x224], 0
push 0x20a
push 0
lea eax, [ebp - 0x222]
push eax
call fcn.100771d0
add esp, 0xc
push 1
push 0x23
lea eax, [ebp - 0x224]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x224]
push eax
lea ecx, [ebp - 0x228]
call fcn.10003c7e
lea ecx, [ebp - 0x228]
call fcn.10003bb7
test eax, eax
jle 0x100bee1f
lea eax, [ebp - 0x228]
push eax
call fcn.100bed00
pop ecx
push str.TencentQMDownload_
lea ecx, [ebp - 0x228]
call fcn.1000e4d2
lea ecx, [ebp - 0x228]
call fcn.10005b69
push eax
call fcn.1000e4a8
pop ecx
test eax, eax
jne 0x100bee1f
push 0
lea ecx, [ebp - 0x228]
call fcn.10005b69
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
lea eax, [ebp - 0x228]
push eax
mov ecx, dword [ebp + 8]
call fcn.10003be1
mov eax, dword [ebp - 0x22c]
or eax, 1
mov dword [ebp - 0x22c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x228]
call fcn.10014be9
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100771ba
leave
ret
Function at 0x100bee66
Capabilities:
Check if file exists
Create directory
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x100f93e0]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x21c], 0
mov eax, dword [0x10115e68]
and eax, 1
jne 0x100beeac
mov eax, dword [0x10115e68]
or eax, 1
mov dword [0x10115e68], eax
mov ecx, 0x10115e64
call fcn.10014b4b
push 0x100cf0cb
call fcn.10077c75
pop ecx
mov ecx, 0x10115e64
call fcn.10003bcb
movzx eax, al
test eax, eax
je 0x100bef7d
and word [ebp - 0x218], 0
push 0x20a
push 0
lea eax, [ebp - 0x216]
push eax
call fcn.100771d0
add esp, 0xc
push 0x208
lea eax, [ebp - 0x218]
push eax
push 0x100e05e4
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x100bef6c
push 0
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x100bef6c
push 1
push 0x23
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.TencentQMDownload
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
lea eax, [ebp - 0x218]
push eax
mov ecx, 0x10115e64
call fcn.10003c7e
push 0x10115e64
mov ecx, dword [ebp + 8]
call fcn.10003be1
mov eax, dword [ebp - 0x21c]
or eax, 1
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100771ba
leave
ret
Function at 0x100bf039
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [0x100f93e0]
xor eax, ebp
mov dword [ebp - 0x1c], eax
mov dword [ebp - 8], 3
mov dword [ebp - 0xc], 0x104
mov dword [ebp - 0x18], 1
and dword [ebp - 0x14], 0
and dword [ebp - 4], 0
and dword [ebp - 0x10], 0
lea eax, [ebp - 0x14]
push eax
push 0x20019
push 0
push 0x100e0928
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x100bf096
jmp 0x100bf1e9
push dword [ebp + 8]
push 0x100e0978
push 0x103
lea eax, [ebp - 0x128]
push eax
call fcn.1000c548
add esp, 0x10
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x128]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x100bf0db
jmp 0x100bf1e0
mov dword [ebp - 0x18], 4
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0x100e0988
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x100bf113
jmp 0x100bf1d7
mov dword [ebp - 0x18], 1
mov dword [ebp - 0xc], 0x103
push 0x104
push 0
lea eax, [ebp - 0x128]
push eax
call fcn.100771d0
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0x100e0998
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x100bf15e
jmp 0x100bf1d7
cmp dword [ebp - 0x10], 1
jne 0x100bf18e
push 0x100e0924
call fcn.10077a80
pop ecx
push eax
push 0x100e09a8
lea eax, [ebp - 0x128]
push eax
call fcn.1007a3bd
add esp, 0xc
test eax, eax
jne 0x100bf18e
and dword [ebp - 8], 0
jmp 0x100bf1d7
cmp dword [ebp - 0x10], 1
jne 0x100bf1c1
push 0x100e09ac
call fcn.10077a80
pop ecx
push eax
push 0x100e09b0
lea eax, [ebp - 0x128]
push eax
call fcn.1007a3bd
add esp, 0xc
test eax, eax
je 0x100bf1c1
mov dword [ebp - 8], 2
jmp 0x100bf1d7
cmp dword [ebp - 0x10], 2
jne 0x100bf1d0
mov dword [ebp - 8], 1
jmp 0x100bf1d7
mov dword [ebp - 8], 3
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.100771ba
leave
ret
Function at 0x100bf5b7
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 8]
push dword [eax]
call dword [sym.imp.WS2_32.dll_ntohl]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push dword [eax + 4]
call dword [sym.imp.WS2_32.dll_ntohl]
mov dword [ebp - 0x20], eax
and dword [ebp - 8], 0
jmp 0x100bf5e7
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 4
jge 0x100bf605
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
push dword [ecx + eax*4]
call dword [sym.imp.WS2_32.dll_ntohl]
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x18], eax
jmp 0x100bf5e0
mov dword [ebp - 0x1c], 0xe3779b90
and dword [ebp - 8], 0
jmp 0x100bf619
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x10
jge 0x100bf674
mov eax, dword [ebp - 4]
shl eax, 4
add eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0x1c]
xor eax, ecx
mov ecx, dword [ebp - 4]
shr ecx, 5
add ecx, dword [ebp - 0xc]
xor eax, ecx
mov ecx, dword [ebp - 0x20]
sub ecx, eax
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
shl eax, 4
add eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0x1c]
xor eax, ecx
mov ecx, dword [ebp - 0x20]
shr ecx, 5
add ecx, dword [ebp - 0x14]
xor eax, ecx
mov ecx, dword [ebp - 4]
sub ecx, eax
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 0x1c]
add eax, 0x61c88647
mov dword [ebp - 0x1c], eax
jmp 0x100bf612
push dword [ebp - 4]
call dword [sym.imp.WS2_32.dll_htonl]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
push dword [ebp - 0x20]
call dword [sym.imp.WS2_32.dll_htonl]
mov ecx, dword [ebp + 0x10]
mov dword [ecx + 4], eax
leave
ret