joyce8/EMBER2024-capa huggingface dataset:
Function at 0x486b80
Capabilities:
Check if file exists
Get file attributes
Move file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov edi, edx
test esi, esi
je 0x486bf3
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x486bf3
test al, 0x10
jne 0x486bf3
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x486bc6
test al, 0x10
jne 0x486bc6
push 1
push edi
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x486bd2
push 5
jmp 0x486bc8
push 1
push edi
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ebx, eax
push ebx
push edi
push esi
push str.MoveFileEx_lpszSourceFile:_s__lpszDestFile:_s__bRet:_d
push 0x54bba8
call fcn.0048d420
add esp, 0x14
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push str.lpszSourceFile:_s_not_exist
push 0x54bba8
call fcn.0048d420
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x486f70
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x54b144]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x20a
xor esi, esi
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.004dcc10
add esp, 0xc
push str.TSKSP
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 5
mov edx, str..Global_s
mov ecx, str.._s
lea eax, [ebp - 0x210]
cmovae ecx, edx
push ecx
push 0x104
push eax
call fcn.0048cbf0
add esp, 0x10
lea eax, [ebp - 0x210]
push esi
push 0x80
push 3
push esi
push 1
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x48701a
push esi
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], esi
push eax
push esi
push esi
push 4
lea eax, [ebp + 8]
push eax
push 0x22e05c
push edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push dword [ebp + 8]
push str.UpdateSelfProtect__Leave__bEnable_d__bResult_d
push 0x54bba8
call fcn.0048d420
mov ecx, dword [ebp - 4]
add esp, 0x10
mov eax, esi
xor ecx, ebp
pop edi
pop esi
call fcn.004dafe6
mov esp, ebp
pop ebp
ret

Function at 0x487050
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x54b144]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x54f5fc], 0
jne 0x48714d
push esi
push edi
push 0x228
lea eax, [ebp - 0x22c]
mov dword [0x54f5fc], 1
push 0
push eax
call fcn.004dcc10
add esp, 0xc
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x487108
lea eax, [ebp - 0x230]
mov dword [ebp - 0x230], 0x22c
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x487101
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, eax
mov ecx, dword [ebp - 0x228]
cmp ecx, edi
je 0x4870f0
test ecx, ecx
je 0x4870f0
cmp ecx, 4
je 0x4870f0
lea eax, [ebp - 0x20c]
push str.360tray.exe
push eax
call fcn.004e0469
add esp, 8
test eax, eax
je 0x487127
lea eax, [ebp - 0x230]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4870c5
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov dword [0x54bc00], 2
mov eax, 2
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004dafe6
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov dword [0x54bc00], 1
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004dafe6
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, dword [0x54bc00]
xor ecx, ebp
call fcn.004dafe6
mov esp, ebp
pop ebp
ret
Function at 0x4873e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50c2d0
mov eax, dword fs:[0]
push eax
sub esp, 0x110
mov eax, dword [0x54b144]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x114], 0
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftInternet_Explorer
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x487503
push 0x80
push eax
lea eax, [ebp - 0x90]
push eax
call fcn.004dcc10
push 0x80
lea eax, [ebp - 0x110]
push 0
push eax
call fcn.004dcc10
mov eax, dword [ebp - 0x114]
add esp, 0x18
mov dword [ebp - 0x118], 0x40
test eax, eax
je 0x487509
lea ecx, [ebp - 0x118]
push ecx
lea ecx, [ebp - 0x90]
push ecx
lea ecx, [ebp - 0x11c]
push ecx
push 0
push str.Version
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x487503
lea eax, [ebp - 0x90]
push eax
call fcn.004e5c65
mov esi, eax
add esp, 4
cmp esi, 9
jne 0x4874fb
mov eax, dword [ebp - 0x114]
test eax, eax
je 0x487516
lea ecx, [ebp - 0x118]
push ecx
lea ecx, [ebp - 0x110]
push ecx
lea ecx, [ebp - 0x11c]
push ecx
push 0
push str.svcVersion
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4874fb
lea eax, [ebp - 0x110]
push eax
call fcn.004e5c65
add esp, 4
mov esi, eax
mov eax, dword [ebp - 0x114]
jmp 0x48750b
mov eax, dword [ebp - 0x114]
xor esi, esi
test eax, eax
je 0x487516
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004dafe6
mov esp, ebp
pop ebp
ret
Function at 0x487540
Capabilities:
Check if file exists
Create directory
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50c30d
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x54b144]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov ecx, esi
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x487590
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x28]
call fcn.0044a750
push esi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x48763b
test al, 0x10
je 0x487628
test al, 2
je 0x4875e6
push 0x90
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x4875e6
push str.CreateDeepDirectory__failed_to_SetFileAttributes.
push 0x54bba8
call fcn.0048d0e0
add esp, 8
mov esi, 1
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x4876bd
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4876b3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4876d9
jmp 0x4876b3
push 1
push esi
call fcn.00487730
add esp, 8
test eax, eax
jne 0x48763b
xor esi, esi
jmp 0x4875eb
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4875e6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4875e6
lea eax, [ebp - 0x28]
push eax
call fcn.00487230
add esp, 4
cmp dword [ebp - 0x18], 0
jne 0x48766b
xor esi, esi
jmp 0x4875eb
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.00487540
add esp, 4
test eax, eax
jne 0x48768a
xor esi, esi
jmp 0x4875eb
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4875e6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4875e6
xor esi, esi
jmp 0x4875eb
push edx
push ecx
call fcn.004dafca
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004dafe6
mov esp, ebp
pop ebp
ret
call fcn.004e002c
int3
Function at 0x488f90
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50c58b
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x54b144]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x218]
push 0x208
push 0
push eax
mov dword [ebp - 0x220], edi
call fcn.004dcc10
add esp, 0xc
call fcn.004501e0
mov ecx, eax
test ecx, ecx
je 0x489114
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x21c], esi
push 0
push 0x23
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x489088
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x489030
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x21c]
call fcn.0044f440
push 0x21
push str.Application_DataTencentQQPCMgr_
lea ecx, [ebp - 0x21c]
call fcn.0048c350
mov esi, dword [ebp - 0x21c]
push esi
call fcn.00487540
add esp, 4
test eax, eax
jne 0x489088
lea ecx, [ebp - 0x21c]
call fcn.0044f630
mov esi, dword [ebp - 0x21c]
call fcn.004501e0
mov ecx, eax
test ecx, ecx
je 0x48911e
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
push esi
mov ecx, edi
mov byte [ebp - 4], 1
call fcn.0044f2b0
test al, al
jne 0x4890d8
test esi, esi
jne 0x4890b9
xor ecx, ecx
jmp 0x4890cf
mov ecx, esi
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4890c0
sub ecx, edx
sar ecx, 1
push ecx
push esi
mov ecx, edi
call fcn.0044f440
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4890f7
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004dafe6
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00450130
push 0x80004005
call fcn.00450130
int3
Function at 0x489130
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50c5e7
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x54b144]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x218]
push 0x208
mov dword [ebp - 4], 0
push 0
mov dword [ebp - 0x220], esi
push eax
mov dword [ebp - 0x21c], 0
call fcn.004dcc10
add esp, 0xc
call fcn.004501e0
mov ecx, eax
test ecx, ecx
je 0x48923a
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
push 0
push 0x23
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push eax
push 0
mov dword [ebp - 0x21c], 1
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x48921e
push str.TencentQQPCMgr_
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push eax
call fcn.00487540
add esp, 4
test eax, eax
je 0x48921e
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x489200
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.0044f440
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004dafe6
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00450130
int3
Function at 0x489f40
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x54b144]
xor eax, ebp
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 5
ja 0x48a008
jb 0x489ff8
shr eax, 8
test al, al
je 0x489ff8
push 0x118
lea eax, [ebp - 0x11c]
push 0
push eax
call fcn.004dcc10
add esp, 0xc
mov dword [ebp - 0x120], 0x11c
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x489fbe
lea eax, [ebp - 0x120]
mov dword [ebp - 0x120], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x48a008
push 0x80
lea eax, [ebp - 0x10c]
push str.Service_Pack_1
push eax
call fcn.004f18c6
add esp, 0xc
test eax, eax
je 0x489ff8
push 0x80
lea eax, [ebp - 0x10c]
push str.Service_Pack_2
push eax
call fcn.004f18c6
add esp, 0xc
test eax, eax
jne 0x48a008
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004dafe6
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
call fcn.004dafe6
mov esp, ebp
pop ebp
ret
Function at 0x48a030
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x424
mov eax, dword [0x54b144]
xor eax, esp
mov dword [esp + 0x420], eax
push ebx
push esi
push edi
push 0x400
lea eax, [esp + 0x2c]
mov dword [esp + 0x1c], edx
mov edi, ecx
mov dword [esp + 0x14], 0
push 0
push eax
mov dword [esp + 0x28], edi
call fcn.004dcc10
mov ebx, dword [ebp + 8]
add esp, 0xc
xorps xmm0, xmm0
movlpd qword [esp + 0x20], xmm0
test ebx, ebx
je 0x48a0c5
cmp dword [0x54bbfc], 0xffffffff
jne 0x48a0c5
push str.IsWow64Process
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x48a0bb
push 0x54bbfc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
test eax, eax
jne 0x48a0c5
mov dword [0x54bbfc], 0
lea eax, [esp + 0x10]
push eax
push 0xf003f
push 0
push dword [esp + 0x24]
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x48a167
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea eax, [esp + 0x20]
push eax
push 0
push 0
push 0
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 0x200
push eax
lea eax, [esp + 0x3c]
push eax
push 0
push dword [esp + 0x2c]
call edi
test eax, eax
jne 0x48a14f
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x28]
push ebx
call fcn.0048a030
mov esi, eax
add esp, 4
test esi, esi
jne 0x48a17c
lea eax, [esp + 0x20]
mov dword [esp + 0x14], 0x200
push eax
push esi
push esi
push esi
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x3c]
push eax
push esi
push dword [esp + 0x2c]
call edi
test eax, eax
je 0x48a113
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [esp + 0x18]
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x420]
xor ecx, esp
call fcn.004dafe6
mov esp, ebp
pop ebp
ret
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x42c]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004dafe6
mov esp, ebp
pop ebp
ret
Function at 0x48a540
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x54b144]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x210]
push 0x20a
push 0
push eax
mov dword [ebp - 0x214], esi
call fcn.004dcc10
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
xor eax, eax
mov dword [esi], 0
lea ecx, [ebp - 0x210]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
lea edx, [ecx + 2]
mov word [esi], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x48a5a7
sub ecx, edx
lea eax, [ebp - 0x210]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.0044a750
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004dafe6
mov esp, ebp
pop ebp
ret
Function at 0x48b860
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x54b144]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
xor ebx, ebx
lea eax, [ebp - 0x414]
push 0x208
push ebx
push eax
mov edi, ecx
mov dword [ebp - 0x418], ebx
call fcn.004dcc10
push 0x208
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.004dcc10
add esp, 0x18
mov dword [ebp - 0x41c], 0x208
test edi, edi
je 0x48ba88
push esi
push 0x208
push ebx
push edi
call fcn.004dcc10
add esp, 0xc
mov esi, 1
nop dword [eax]
push esi
lea eax, [ebp - 0x414]
push str.SOFTWARETencentPlatForm_Type_List_d
push eax
call fcn.00471470
add esp, 0xc
lea eax, [ebp - 0x418]
push eax
push 1
push 0
lea eax, [ebp - 0x414]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x48b9b1
mov eax, dword [ebp - 0x418]
test eax, eax
je 0x48b9b1
lea ecx, [ebp - 0x41c]
mov dword [ebp - 0x41c], 0x208
push ecx
lea ecx, [ebp - 0x20c]
push ecx
push 0
push 0
push str.TypePath
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x48b9a0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x48b967
push str.BinQQ.exe
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x48b9a0
lea ecx, [ebp - 0x20c]
mov edx, edi
mov eax, ecx
mov ebx, 1
sub edx, eax
nop dword [eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x48b990
mov eax, dword [ebp - 0x418]
test eax, eax
je 0x48b9bb
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x418], 0
inc esi
cmp esi, 5
jle 0x48b8d0
pop esi
test ebx, ebx
jne 0x48ba76
lea eax, [ebp - 0x418]
push eax
push 1
push 0
push str.SOFTWARETencentQQ2009
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x48ba65
mov eax, dword [ebp - 0x418]
test eax, eax
je 0x48ba23
lea ecx, [ebp - 0x41c]
mov dword [ebp - 0x41c], 0x208
push ecx
lea ecx, [ebp - 0x20c]
push ecx
push 0
push 0
push str.Install
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x48ba65
push str.BinQQ.exe
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x48ba65
lea ecx, [ebp - 0x20c]
mov ebx, 1
mov eax, ecx
sub edi, eax
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edi + ecx - 2], ax
test ax, ax
jne 0x48ba55
mov ecx, dword [ebp - 0x418]
test ecx, ecx
je 0x48ba76
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004dafe6
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop ebx
call fcn.004dafe6
mov esp, ebp
pop ebp
ret
Function at 0x48cf30
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xec
mov eax, dword [0x54b144]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x54bbdc], 0
push esi
mov esi, dword [ebp + 8]
je 0x48cf66
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004dafe6
mov esp, ebp
pop ebp
ret 4
call fcn.0048d9b0
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x48cf70
push ebx
sub eax, edx
mov ecx, 0x54bbb8
push edi
sar eax, 1
push eax
push esi
call fcn.0044a750
push 0xc8
lea eax, [ebp - 0xcc]
mov dword [0x54bbdc], 1
xorps xmm0, xmm0
mov dword [ebp - 0xdc], 0
push 0
push eax
movups xmmword [ebp - 0xec], xmm0
mov dword [ebp - 0xd0], 0
call fcn.004dcc10
add esp, 0xc
lea eax, [ebp - 0xec]
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 0
push 0
push 1
lea eax, [ebp - 0xec]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
lea eax, [ebp - 0xec]
mov dword [ebp - 0xd8], 0xc
mov dword [ebp - 0xd4], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.GlobalBFD88F2D_0990_4de4_AD0F_764F5894389A__d
lea eax, [ebp - 0xcc]
push 0x63
push eax
call fcn.0048de10
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventW]
lea eax, [ebp - 0xcc]
add esp, 0x10
push eax
push 1
push 1
lea eax, [ebp - 0xd8]
push eax
call esi
mov ecx, dword [0x54bbac]
mov ebx, eax
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test ecx, ecx
je 0x48d04f
push ecx
call edi
push 0
push 0
push 0
push 0
mov dword [0x54bbac], ebx
call esi
mov esi, eax
mov eax, dword [0x54bbb0]
test eax, eax
je 0x48d06d
push eax
call edi
cmp dword [0x54bbac], 0
mov dword [0x54bbb0], esi
je 0x48d0ca
test esi, esi
je 0x48d0ca
push 0
push 0
push 0x54bba8
push 0x48d6d0
push 0
push 0
call fcn.004e5eef
mov esi, eax
add esp, 0x18
mov eax, dword [0x54bbb4]
test eax, eax
je 0x48d0a8
push eax
call edi
mov dword [0x54bbb4], esi
test esi, esi
je 0x48d0ca
pop edi
pop ebx
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004dafe6
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop ebx
xor ecx, ebp
pop esi
call fcn.004dafe6
mov esp, ebp
pop ebp
ret 4
Function at 0x48d9b0
Capabilities:
Get file size
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50ccd5
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x54b144]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x54bbcc], 8
mov eax, 0x54bbb8
push 0
cmovae eax, dword [0x54bbb8]
push 0x80
push 3
push 0
push 3
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x48db83
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, 0xffffffff
je 0x48db83
cmp edi, 0x80000
jb 0x48db83
cmp dword [0x54bbcc], 8
mov esi, 0x54bbb8
cmovae esi, dword [0x54bbb8]
call fcn.004501e0
mov ecx, eax
test ecx, ecx
je 0x48db9a
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
push esi
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 0
call fcn.0044f2b0
test al, al
jne 0x48da9d
test esi, esi
jne 0x48da7f
xor ecx, ecx
jmp 0x48da93
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x48da84
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x10]
call fcn.0044f440
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax - 0x10]
test ecx, ecx
je 0x48dab9
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
test ecx, ecx
jne 0x48dacf
call fcn.004501e0
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
mov ecx, eax
test ecx, ecx
je 0x48dba4
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
push 0x532df4
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.0044f2b0
test al, al
jne 0x48dafc
push 0x532df4
lea ecx, [ebp - 0x14]
call fcn.0048dd00
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x10]
mov esi, dword [ebp - 0x14]
push dword [esi - 0xc]
push esi
call fcn.0048c350
mov byte [ebp - 4], 1
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x48db2b
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [0x54bbcc], 8
mov ebx, 0x54bbb8
mov esi, dword [ebp - 0x10]
cmovae ebx, dword [0x54bbb8]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0
push esi
call edi
push 1
push esi
call fcn.00487730
add esp, 8
push 0
push ebx
call edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x48db83
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00450130
push 0x80004005
call fcn.00450130
int3