joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001b83f
Capabilities:
Check if file exists
Copy file

Disassembly:
push 0x94
mov eax, 0x1006dcb4
call fcn.100521f6
mov edi, ecx
mov ebx, dword [edi + 0xc]
lea esi, [ebp - 0x74]
mov dword [ebp - 0x78], edi
call fcn.1001d36a
mov edi, dword [ebp - 0x78]
mov ebx, dword [edi + 0x10]
lea esi, [ebp - 0x84]
call fcn.1001d36a
mov edi, dword [ebp - 0x74]
test edi, edi
je 0x1001b87e
cmp edi, dword [ebp - 0x84]
je 0x1001b883
call fcn.1004cee2
mov eax, dword [ebp - 0x70]
cmp eax, dword [ebp - 0x80]
je 0x1001ba15
lea esi, [ebp - 0x74]
call fcn.1001ce5e
push dword [ebp - 0x78]
mov ebx, eax
lea ecx, [ebp - 0x30]
call fcn.1001bd0c
xor ebx, ebx
mov dword [ebp - 4], ebx
call fcn.1001ce5e
cmp dword [eax + 4], ebx
jne 0x1001b8de
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x1001b8bf
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1001b8de
or dword [ebp - 4], 0xffffffff
push ebx
push 1
lea esi, [ebp - 0x30]
call fcn.1000457f
jmp 0x1001b9f0
lea esi, [ebp - 0x74]
call fcn.1001ce5e
push dword [ebp - 0x78]
mov edi, eax
lea ecx, [ebp - 0x4c]
call fcn.1001bd87
lea eax, [ebp - 0x4c]
push eax
lea esi, [ebp - 0x69]
mov byte [ebp - 4], 1
call fcn.10027584
neg al
sbb al, al
and al, byte [ebp - 0x69]
pop ecx
cmp al, bl
je 0x1001b935
cmp dword [ebp - 0x18], 8
mov ecx, dword [ebp - 0x2c]
jae 0x1001b91b
lea ecx, [ebp - 0x2c]
cmp dword [ebp - 0x34], 8
mov eax, dword [ebp - 0x48]
jae 0x1001b927
lea eax, [ebp - 0x48]
push ecx
push eax
call fcn.1001955e
pop ecx
pop ecx
jmp 0x1001b9d3
xor edi, edi
inc edi
push edi
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x30]
mov dword [ebp - 0x7c], 0x5c
call fcn.1000441c
cmp eax, 0xffffffff
je 0x1001b9b2
push eax
push ebx
lea eax, [ebp - 0x30]
push eax
lea esi, [ebp - 0x68]
call fcn.10004135
mov byte [ebp - 4], 2
cmp dword [ebp - 0x50], 8
mov eax, dword [ebp - 0x64]
jae 0x1001b96f
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1001b9a8
cmp dword [ebp - 0x50], 8
mov eax, dword [ebp - 0x64]
jae 0x1001b986
lea eax, [ebp - 0x64]
push eax
lea esi, [ebp - 0xa0]
call fcn.100040e3
mov eax, esi
push edi
push eax
mov byte [ebp - 4], 3
call fcn.100277c7
pop ecx
pop ecx
push ebx
push edi
call fcn.1000457f
push ebx
push edi
lea esi, [ebp - 0x68]
call fcn.1000457f
cmp dword [ebp - 0x18], 8
mov ecx, dword [ebp - 0x2c]
jae 0x1001b9be
lea ecx, [ebp - 0x2c]
cmp dword [ebp - 0x34], 8
mov eax, dword [ebp - 0x48]
jae 0x1001b9ca
lea eax, [ebp - 0x48]
push ebx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push ebx
push 1
lea esi, [ebp - 0x4c]
call fcn.1000457f
or dword [ebp - 4], 0xffffffff
push ebx
push 1
lea esi, [ebp - 0x30]
call fcn.1000457f
mov edi, dword [ebp - 0x74]
cmp edi, ebx
jne 0x1001ba11
call fcn.1004cee2
xor eax, eax
mov ecx, dword [ebp - 0x70]
cmp ecx, dword [eax + 0x10]
jb 0x1001ba08
call fcn.1004cee2
add dword [ebp - 0x70], 0x40
jmp 0x1001b85e
mov eax, dword [edi]
jmp 0x1001b9fb
mov eax, dword [ebp - 0x78]
call fcn.1001cc66
call fcn.10052279
ret
Function at 0x1001bdd5
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x1008f210]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
mov ebx, dword [edi + 0xc]
lea esi, [ebp - 0x28]
mov dword [ebp - 0x2c], edi
call fcn.1001d36a
mov edi, dword [ebp - 0x2c]
mov ebx, dword [edi + 0x10]
lea esi, [ebp - 0x34]
call fcn.1001d36a
mov eax, dword [ebp - 0x28]
xor edi, edi
cmp eax, edi
je 0x1001be14
cmp eax, dword [ebp - 0x34]
je 0x1001be19
call fcn.1004cee2
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x30]
je 0x1001bec7
lea esi, [ebp - 0x28]
call fcn.1001ce5e
mov ecx, eax
lea ebx, [ebp - 0x20]
call fcn.1001bede
cmp dword [ebp - 0xc], edi
je 0x1001be94
cmp dword [ebp - 8], 8
mov eax, dword [ebp - 0x1c]
jae 0x1001be48
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1001be94
lea esi, [ebp - 0x28]
call fcn.1001ce5e
cmp dword [ebp - 8], 8
mov ecx, dword [ebp - 0x1c]
jae 0x1001be67
lea ecx, [ebp - 0x1c]
push edi
push dword [eax + 0x38]
push ecx
call fcn.1002047b
add esp, 0xc
lea esi, [ebp - 0x28]
call fcn.1001ce5e
cmp dword [eax + 0x38], edi
je 0x1001be94
cmp dword [ebp - 8], 8
mov eax, dword [ebp - 0x1c]
jae 0x1001be8d
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
push 1
lea esi, [ebp - 0x20]
call fcn.1000457f
mov eax, dword [ebp - 0x28]
cmp eax, edi
jne 0x1001bec3
call fcn.1004cee2
xor eax, eax
mov ecx, dword [ebp - 0x24]
cmp ecx, dword [eax + 0x10]
jb 0x1001beba
call fcn.1004cee2
add dword [ebp - 0x24], 0x3c
jmp 0x1001bdf8
mov eax, dword [eax]
jmp 0x1001bead
mov eax, dword [ebp - 0x2c]
call fcn.1001cd80
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004c55d
leave
ret
Function at 0x1001ebb6
Capabilities:
Delete registry key

Disassembly:
push 0x664
mov eax, 0x1006c265
call fcn.100521f6
xor eax, eax
mov ebx, 0x206
push ebx
push eax
mov word [ebp - 0x424], ax
lea eax, [ebp - 0x422]
push eax
call fcn.10051a60
mov esi, 0x100768a4
push esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
push 0x10078b88
mov edi, 0x104
lea eax, [ebp - 0x424]
push edi
push eax
call fcn.1004c98d
add esp, 0x20
lea eax, [ebp - 0x424]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
and dword [ebp - 0x650], 0
and dword [ebp - 0x64c], 0
push 0x20006
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallQQBrowser
push reloc.OLEAUT32.dll_SysReAllocString
lea eax, [ebp - 0x654]
mov dword [ebp - method.Util::RegKey.virtual_0], vtable.Util::RegKey.0
call fcn.1002733f
xor eax, eax
mov dword [ebp - 4], eax
cmp dword [ebp - 0x650], eax
je 0x1001edff
push ebx
push eax
lea eax, [ebp - 0x21a]
xor ecx, ecx
push eax
mov word [ebp - 0x21c], cx
call fcn.10051a60
push 2
push 8
push esi
push str._s_d._d
lea eax, [ebp - 0x21c]
push edi
push eax
call fcn.1004c98d
add esp, 0x24
lea eax, [ebp - 0x21c]
push eax
push str.DisplayName
lea eax, [ebp - 0x654]
push eax
call fcn.1002753a
push 0x10094c38
lea esi, [ebp - 0x648]
call fcn.100040e3
push str.uninst.exe
lea esi, [ebp - 0x670]
mov byte [ebp - 4], 1
call fcn.100040e3
lea eax, [ebp - 0x648]
push eax
mov eax, esi
mov byte [ebp - 4], 2
call fcn.1002770a
pop ecx
push 0
push 1
mov byte [ebp - 4], 1
call fcn.1000457f
cmp dword [ebp - 0x630], 8
mov eax, dword [ebp - 0x644]
jae 0x1001ecfd
lea eax, [ebp - 0x644]
push eax
push str.UninstallString
lea eax, [ebp - 0x654]
push eax
call fcn.1002753a
mov eax, 0x10094c38
lea ecx, [ebp - 0x648]
call fcn.100042f6
push str.app.ico
lea esi, [ebp - 0x670]
call fcn.100040e3
lea eax, [ebp - 0x648]
push eax
mov eax, esi
mov byte [ebp - 4], 3
call fcn.1002770a
pop ecx
push 0
push 1
call fcn.1000457f
cmp dword [ebp - 0x630], 8
mov eax, dword [ebp - 0x644]
jae 0x1001ed60
lea eax, [ebp - 0x644]
push eax
push str.DisplayIcon
lea eax, [ebp - 0x654]
push eax
call fcn.1002753a
xor eax, eax
push ebx
push eax
mov word [ebp - 0x62c], ax
lea eax, [ebp - 0x62a]
push eax
call fcn.10051a60
push 0x190
push 0xe36
push 2
push 8
push str._d._d._d._d
lea eax, [ebp - 0x62c]
push edi
push eax
call fcn.1004c98d
add esp, 0x28
lea eax, [ebp - 0x62c]
push eax
push str.DisplayVersion
lea eax, [ebp - 0x654]
push eax
call fcn.1002753a
push str.http:__www.qq.com
push str.URLInfoAbout
lea eax, [ebp - 0x654]
push eax
call fcn.1002753a
push 0x100790fc
push str.Publisher
lea eax, [ebp - 0x654]
push eax
call fcn.1002753a
push 0
push 1
lea esi, [ebp - 0x648]
call fcn.1000457f
lea esi, [ebp - 0x654]
mov dword [ebp - method.Util::RegKey.virtual_0], vtable.Util::RegKey.0
call fcn.10027392
xor eax, eax
call fcn.10052279
ret
Function at 0x1001ee1c
Capabilities:
Delete registry value

Disassembly:
push 0x70
mov eax, 0x1006cfb0
call fcn.1005218d
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.1001e963
xor edi, edi
pop ecx
pop ecx
cmp dword [ebp + 0xc], edi
je 0x1001ee46
call fcn.1001eff6
call fcn.1001f35f
cmp dword [ebp + 0x14], edi
je 0x1001ee50
call fcn.1001f04e
push str.Learned
lea esi, [ebp - 0x44]
call fcn.100040e3
push str.SoftwareTencentQQBrowserLaunch
lea esi, [ebp - 0x28]
mov dword [ebp - 4], edi
call fcn.100040e3
mov edi, reloc.gdiplus.dll_Ordinal_1
xor ebx, ebx
push edi
inc ebx
push ebx
lea ecx, [ebp - 0x44]
mov eax, esi
call fcn.1001f9a2
push 0
push ebx
call fcn.1000457f
or dword [ebp - 4], 0xffffffff
push 0
push ebx
lea esi, [ebp - 0x44]
call fcn.1000457f
call fcn.1001f156
call fcn.1001f1cf
call fcn.1001f26a
push str.AbpCalcFlag
lea esi, [ebp - 0x28]
call fcn.100040e3
push str.SoftwareTencentQQBrowserLaunch
lea esi, [ebp - 0x44]
mov dword [ebp - 4], ebx
call fcn.100040e3
push edi
push ebx
lea ecx, [ebp - 0x28]
mov eax, esi
call fcn.1001f9a2
push 0
push ebx
call fcn.1000457f
or dword [ebp - 4], 0xffffffff
push 0
push ebx
lea esi, [ebp - 0x28]
call fcn.1000457f
mov esi, dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
push 0x100792fc
push str.SoftwareTencentQQBrowserSecurityPrivacy
push edi
call esi
push str.suk_
push str.SoftwareTencentQQBrowserSecurityPrivacy
push edi
call esi
push dword [ebp + 0x1c]
push dword [ebp + 0xc]
push dword [ebp + 0x18]
call fcn.1002026f
call fcn.1001ebb6
push 0x100798c4
push str.SoftwareTencentQQBrowser
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push 0x100798cc
push str.SoftwareTencentQQBrowser
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push str.InstallModeForExtension
lea esi, [ebp - 0x7c]
call fcn.100040e3
push str.SoftwareTencentQQBrowserInstallInfo
lea esi, [ebp - 0x60]
mov dword [ebp - 4], 2
call fcn.100040e3
push edi
push dword [ebp + 0x20]
lea ecx, [ebp - 0x7c]
mov eax, esi
call fcn.1001f9a2
push 0
push ebx
call fcn.1000457f
push 0
push ebx
lea esi, [ebp - 0x7c]
call fcn.1000457f
mov al, bl
call fcn.10052265
ret 0x1c
Function at 0x1002047b
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push esi
push edi
push 0x40
xor esi, esi
lea eax, [ebp - 0x58]
push esi
push eax
mov dword [ebp - 0x5c], 0x44
call fcn.10051a60
add esp, 0xc
cmp dword [ebp + 0x10], esi
jne 0x100204af
xor eax, eax
mov word [ebp - 0x2c], ax
mov dword [ebp - 0x30], 1
jmp 0x100204b6
mov dword [ebp - 0x30], 0x80
xor eax, eax
mov dword [ebp - 0x14], esi
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x5c]
push eax
push esi
push esi
push esi
push 1
push esi
push esi
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x10020503
cmp dword [ebp + 0xc], esi
je 0x100204ee
push 0xffffffffffffffff
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x10]
call esi
xor eax, eax
inc eax
jmp 0x10020505
xor eax, eax
pop edi
pop esi
leave
ret

Function at 0x100206fe
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x1008f210]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x118
lea eax, [ebp - 0x11c]
push 0
push eax
call fcn.10051a60
add esp, 0xc
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x10020759
cmp dword [ebp - 0x110], 2
jne 0x10020759
cmp dword [ebp - 0x11c], 6
jb 0x10020759
xor eax, eax
inc eax
jmp 0x1002075b
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004c55d
leave
ret

Function at 0x10020bd1
Capabilities:
Get common file path

Disassembly:
push 0x264
mov eax, 0x1006befe
call fcn.100521f6
push 0x10094c38
lea esi, [ebp - 0x254]
call fcn.100040e3
xor ebx, ebx
push str.WebpDecodeFilter.dll
lea esi, [ebp - 0x270]
mov dword [ebp - 4], ebx
call fcn.100040e3
lea eax, [ebp - 0x254]
push eax
mov eax, esi
mov byte [ebp - 4], 1
call fcn.1002770a
pop ecx
push ebx
push 1
mov byte [ebp - 4], bl
call fcn.1000457f
push 0x104
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edi, 0x10079910
push edi
lea esi, [ebp - 0x238]
call fcn.100040e3
lea eax, [ebp - 0x21c]
push eax
mov eax, esi
push eax
mov byte [ebp - 4], 2
call fcn.10004241
push str._regsvr32.exe___s__
mov eax, esi
push eax
call fcn.10004241
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x254]
mov ecx, esi
call fcn.10004676
push edi
mov eax, esi
push eax
call fcn.10004241
cmp dword [ebp - 0x220], 8
mov eax, dword [ebp - 0x234]
jae 0x10020c94
lea eax, [ebp - 0x234]
push 1
push ebx
push eax
call fcn.1002047b
add esp, 0xc
push ebx
push 1
lea esi, [ebp - 0x238]
mov edi, eax
call fcn.1000457f
push ebx
push 1
lea esi, [ebp - 0x254]
call fcn.1000457f
mov eax, edi
call fcn.10052279
ret
Function at 0x10021377
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x1008f210]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x110
lea eax, [ebp - 0x130]
push 0
push eax
mov dword [ebp - 0x134], 0x114
call fcn.10051a60
add esp, 0xc
lea eax, [ebp - 0x134]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x10021412
cmp dword [ebp - 0x124], 2
jne 0x10021412
cmp dword [ebp - 0x130], 6
jb 0x10021412
cmp dword [ebp - 0x12c], 1
jb 0x10021412
push ebx
push esi
push str._sc__config_fontcache_start_auto
lea esi, [ebp - 0x20]
call fcn.100040e3
cmp dword [ebp - 8], 8
mov eax, dword [ebp - 0x1c]
jae 0x100213f1
lea eax, [ebp - 0x1c]
push 0
push 0
push eax
call fcn.1002047b
add esp, 0xc
push 0
push 1
lea esi, [ebp - 0x20]
mov ebx, eax
call fcn.1000457f
pop esi
mov eax, ebx
pop ebx
jmp 0x10021414
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004c55d
leave
ret

Function at 0x10021648
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push str.FF8E5145_A2C0_44d3_A637_50DEAD0EC960
push 0x40
xor esi, esi
push esi
push 4
push esi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, eax
cmp ebx, esi
jne 0x10021677
mov dword [ebp - 4], esi
jmp 0x100216b0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x10021689
push ebx
call edi
jmp 0x10021672
push esi
push 0x40
push esi
push esi
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFileEx]
cmp eax, esi
je 0x10021684
mov ecx, dword [eax]
push eax
mov dword [ebp - 4], ecx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push ebx
call edi
mov eax, dword [ebp - 4]
mov dword [ebp - 4], eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x10021731
lea eax, [ebp - 0xc]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x10]
push eax
mov ebx, 0xbb8
push ebx
push esi
lea eax, [ebp - 0x1c]
push eax
push 7
push 0x4a
push dword [ebp - 4]
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], 4
mov dword [ebp - 0x10], esi
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push dword [ebp - 8]
push esi
push 0x100001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 4], eax
cmp eax, esi
je 0x10021731
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1002172c
push 1
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [ebp - 4]
call edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10021947
Capabilities:
Check if file exists
Delete file
Get common file path

Disassembly:
push 0x2fc
mov eax, 0x1006be78
call fcn.100521f6
mov ebx, str.QQBrowser.exe.new
push ebx
lea esi, [ebp - 0x26c]
call fcn.100040e3
and dword [ebp - 4], 0
mov edi, str.QQBrowserUpdateService.exe.new
push edi
lea esi, [ebp - 0x250]
call fcn.100040e3
xor eax, eax
push 0x206
mov dword [ebp - 4], 1
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call fcn.10051a60
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x10021a30
lea eax, [ebp - 0x26c]
mov dword [ebp - 0x308], eax
mov dword [ebp - 0x304], 2
lea eax, [ebp - 0x218]
push eax
lea esi, [ebp - 0x234]
call fcn.100040e3
mov eax, esi
push eax
mov eax, dword [ebp - 0x308]
mov byte [ebp - 4], 2
call fcn.1002770a
cmp dword [ebp - 0x21c], 8
mov eax, dword [ebp - 0x230]
pop ecx
jae 0x10021a07
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push 1
lea esi, [ebp - 0x234]
mov byte [ebp - 4], 1
call fcn.1000457f
add dword [ebp - 0x308], 0x1c
dec dword [ebp - 0x304]
jne 0x100219cd
push str.QQBrowser.exe.old
lea esi, [ebp - 0x300]
call fcn.100040e3
push str.QQBrowser.exe.old2
lea esi, [ebp - 0x2e4]
mov byte [ebp - 4], 3
call fcn.100040e3
push ebx
lea esi, [ebp - 0x2c8]
mov byte [ebp - 4], 4
call fcn.100040e3
push str.QQBrowserExtHost.exe.new
lea esi, [ebp - 0x2ac]
mov byte [ebp - 4], 5
call fcn.100040e3
push edi
lea esi, [ebp - 0x290]
mov byte [ebp - 4], 6
call fcn.100040e3
mov byte [ebp - 4], 7
call fcn.1001936e
mov dword [ebp - 0x304], eax
test eax, eax
je 0x10021b04
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10021b04
push 5
lea edi, [ebp - 0x300]
pop ebx
push dword [ebp - 0x304]
lea esi, [ebp - 0x234]
call fcn.100040e3
mov eax, esi
push eax
mov eax, edi
mov byte [ebp - 4], 8
call fcn.1002770a
cmp dword [ebp - 0x21c], 8
mov eax, dword [ebp - 0x230]
pop ecx
jae 0x10021ae4
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push 1
lea esi, [ebp - 0x234]
mov byte [ebp - 4], 7
call fcn.1000457f
add edi, 0x1c
dec ebx
jne 0x10021aaf
mov esi, 0x10004127
push esi
push 5
push 0x1c
lea eax, [ebp - 0x300]
push eax
mov byte [ebp - 4], 1
call fcn.1004c892
or dword [ebp - 4], 0xffffffff
push esi
push 2
push 0x1c
lea eax, [ebp - 0x26c]
push eax
call fcn.1004c892
call fcn.10052279
ret
Function at 0x10021b39
Capabilities:
Check if file exists
Delete file

Disassembly:
push 0x5c
mov eax, 0x1006f0ec
call fcn.100521f6
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x4c], esi
cmp dword [esi + 0x14], ebx
je 0x10021c59
cmp dword [esi + 0x18], 8
jb 0x10021b60
mov eax, dword [esi + 4]
jmp 0x10021b63
lea eax, [esi + 4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10021c59
push esi
lea esi, [ebp - 0x48]
call fcn.10004103
mov dword [ebp - 4], ebx
push dword [0x10090d14]
lea esi, [ebp - 0x2c]
call fcn.100040e3
lea eax, [ebp - 0x48]
push eax
mov eax, esi
mov byte [ebp - 4], 1
call fcn.1002770a
pop ecx
push ebx
push 1
mov byte [ebp - 4], bl
call fcn.1000457f
cmp dword [ebp - 0x30], 8
mov eax, dword [ebp - 0x44]
jae 0x10021bb3
lea eax, [ebp - 0x44]
push eax
call fcn.10027d3b
pop ecx
test al, al
je 0x10021be6
cmp dword [ebp - 0x30], 8
mov eax, dword [ebp - 0x44]
jae 0x10021bca
lea eax, [ebp - 0x44]
push eax
lea esi, [ebp - 0x2c]
call fcn.100040e3
mov eax, esi
mov byte [ebp - 4], 2
call fcn.10027878
push ebx
push 1
call fcn.1000457f
or dword [ebp - 4], 0xffffffff
push ebx
push 1
lea esi, [ebp - 0x48]
call fcn.1000457f
xor edi, edi
push dword [ebp - 0x4c]
lea esi, [ebp - 0x2c]
call fcn.10004103
mov dword [ebp - 4], 3
push dword [edi + 0x10090d18]
lea esi, [ebp - 0x68]
call fcn.100040e3
lea eax, [ebp - 0x2c]
push eax
mov eax, esi
mov byte [ebp - 4], 4
call fcn.1002770a
pop ecx
push ebx
push 1
call fcn.1000457f
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x10021c3b
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
or dword [ebp - 4], 0xffffffff
push ebx
push 1
lea esi, [ebp - 0x2c]
call fcn.1000457f
add edi, 4
cmp edi, 0x34
jb 0x10021bf7
call fcn.10021947
call fcn.10052279
ret
Function at 0x100220de
Capabilities:
Check for time delay via gettickcount
Delete service
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push esi
push 0xf003f
xor esi, esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x10], eax
cmp eax, esi
je 0x100221f7
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_OpenServiceW]
push edi
push 0xf01ff
push dword [ebp + 8]
push eax
call ebx
mov edi, eax
mov dword [ebp - 0xc], edi
cmp edi, esi
je 0x100221ec
lea eax, [ebp - 0x30]
push eax
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x10022141
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x426
jne 0x100221e3
lea eax, [ebp - 0x14]
push eax
push 0x24
lea eax, [ebp - 0x54]
push eax
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
call edi
test eax, eax
je 0x100221e3
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 4], eax
jmp 0x100221bc
mov eax, dword [ebp - 0x3c]
push 0xa
xor edx, edx
pop ecx
div ecx
mov ecx, 0x3e8
cmp eax, ecx
jb 0x1002218c
mov ecx, 0x2710
cmp eax, ecx
jbe 0x1002218e
mov eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x14]
push eax
push 0x24
lea eax, [ebp - 0x54]
push eax
push 0
push dword [ebp - 0xc]
call edi
test eax, eax
je 0x100221c2
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x40], eax
ja 0x10022163
call esi
sub eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x3c]
ja 0x100221c2
cmp dword [ebp - 0x50], 3
je 0x10022170
push 0x10000
push dword [ebp + 8]
push dword [ebp - 0x10]
call ebx
mov esi, eax
test esi, esi
je 0x100221e3
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop ebx
pop esi
leave
ret 4

Function at 0x100222b7
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, eax
lea eax, [ebp - 8]
push eax
push 0x2001f
xor ebx, ebx
push ebx
push str.SoftwareTencentQQBrowser
push reloc.OLEAUT32.dll_SysReAllocString
mov esi, ecx
mov byte [ebp - 1], bl
mov dword [ebp - 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10022344
cmp dword [esi + 0x18], 0x10
mov eax, dword [esi + 0x14]
jb 0x100222f7
mov esi, dword [esi + 4]
jmp 0x100222fa
add esi, 4
push eax
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 1
push ebx
push 0x1007a764
push dword [ebp - 8]
call esi
test eax, eax
jne 0x1002233b
cmp dword [edi + 0x18], 0x10
mov eax, dword [edi + 0x14]
jb 0x10022321
mov edi, dword [edi + 4]
jmp 0x10022324
add edi, 4
push eax
push edi
push 1
push ebx
push 0x1007a768
push dword [ebp - 8]
call esi
test eax, eax
jne 0x1002233b
mov byte [ebp - 1], 1
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1002241a
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
xor edi, edi
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocString
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp + 8], edi
cmp esi, 0xffffffff
je 0x1002245f
push ebx
lea eax, [ebp + 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, edi
pop ebx
jbe 0x1002245f
inc edi
mov eax, edi
pop edi
pop esi
pop ebp
ret 4