joyce8/EMBER2024-capa huggingface dataset:
Function at 0x428bb8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp byte [0x48324c], 0
push esi
push edi
mov edi, ecx
je 0x428bf2
cmp word [0x482c40], 0
je 0x428bf2
mov esi, 0x104
push esi
push 0x482c40
push esi
push edi
call dword [0x455610]
xor eax, eax
add esp, 0x10
inc eax
jmp 0x428c7f
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push ebx
push eax
push 1
push 0
push str.SOFTWARETencentQQPCMgr
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, 0x104
mov ebx, 0x482c40
test eax, eax
jne 0x428c52
lea eax, [ebp - 8]
mov dword [ebp - 8], esi
push eax
push ebx
push 0
push 0
push 0x45f5a0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x428c52
cmp word [0x482c40], ax
je 0x428c52
push ebx
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
mov byte [0x48324c], 1
cmp dword [ebp - 4], 0
je 0x428c61
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [0x48324c], 0
je 0x428c77
push esi
push ebx
push esi
push edi
call dword [0x455610]
add esp, 0x10
movzx eax, byte [0x48324c]
pop ebx
pop edi
pop esi
leave
ret

Function at 0x428c83
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x47c00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x4832c4]
push esi
mov esi, ecx
test eax, eax
jne 0x428da6
push ebx
push edi
push 0x20a
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.0044fa15
add esp, 0xc
lea eax, [ebp - 0x210]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x210]
push str.QMPrivilege.dll
push eax
call edi
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp - 0x210]
push eax
call ebx
test eax, eax
jne 0x428d8a
push 0x104
lea eax, [ebp - 0x210]
push eax
push 0x400000
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.QMPrivilege.dll
lea eax, [ebp - 0x210]
push eax
call edi
lea eax, [ebp - 0x210]
push eax
call ebx
test eax, eax
jne 0x428d8a
lea ecx, [ebp - 0x210]
call fcn.00428bb8
push str.QMPrivilege.dll
lea eax, [ebp - 0x210]
push eax
call edi
lea eax, [ebp - 0x210]
push eax
call ebx
test eax, eax
jne 0x428d8a
mov eax, 0x104
push eax
push str.QMPrivilege.dll
push eax
lea eax, [ebp - 0x210]
push eax
call dword [0x455610]
add esp, 0x10
push 8
push 0
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [0x4832c4], eax
pop edi
pop ebx
test eax, eax
je 0x428dae
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0044e9b2
leave
ret
Function at 0x4290ad
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x450
mov eax, dword [0x47c00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x208
xor edi, edi
lea eax, [ebp - 0x234]
push edi
push eax
call fcn.0044fa15
push 0x5c
pop edx
push 0x55
pop eax
push 0x6e
pop ecx
push 0x69
mov word [ebp - 0x2a], ax
mov ebx, str.SOFTWAREMicrosoftWindowsCurrentVersion
pop eax
push 0x73
mov word [ebp - 0x26], ax
pop eax
push 0x74
mov word [ebp - 0x22], ax
pop eax
push 0x61
mov esi, dword [0x455638]
mov word [ebp - 0x20], ax
pop eax
push 0x6c
mov word [ebp - 0x1e], ax
pop eax
push 0x33
mov word [ebp - 0x1c], ax
mov word [ebp - 0x1a], ax
pop eax
push 0x36
mov word [ebp - 0x16], ax
pop eax
mov word [ebp - 0x14], ax
push 0x30
pop eax
mov word [ebp - 0x12], ax
xor eax, eax
push ebx
mov word [ebp - 0x2c], dx
mov word [ebp - 0x28], cx
mov word [ebp - 0x24], cx
mov word [ebp - 0x18], dx
mov dword [ebp - 0x10], 0x51685b89
mov dword [ebp - 0xc], 0x58eb536b
mov word [ebp - 8], ax
call esi
push eax
lea eax, [ebp - 0x234]
push ebx
push eax
call dword [0x45563c]
lea eax, [ebp - 0x2c]
push eax
call esi
push eax
lea eax, [ebp - 0x2c]
mov esi, 0x104
push eax
lea eax, [ebp - 0x234]
push esi
push eax
call dword [0x455624]
add esp, 0x30
mov dword [ebp - 0x450], edi
lea eax, [ebp - 0x234]
mov dword [ebp - 0x44c], edi
lea ecx, [ebp - 0x450]
mov dword [ebp - 0x448], edi
push 0x20019
push eax
push 0x80000002
call fcn.00412cf7
test eax, eax
jne 0x429206
push 0x20a
lea eax, [ebp - 0x440]
mov dword [ebp - 0x444], esi
push edi
push eax
call fcn.0044fa15
add esp, 0xc
lea eax, [ebp - 0x444]
lea ecx, [ebp - 0x450]
push eax
lea eax, [ebp - 0x440]
push eax
push str.DisplayIcon
call fcn.0041efe8
test eax, eax
jne 0x429206
lea eax, [ebp - 0x440]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor ecx, ecx
inc ecx
test eax, eax
cmovne edi, ecx
lea ecx, [ebp - 0x450]
call fcn.00412cdd
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044e9b2
leave
ret

Function at 0x42bb4a
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
xor esi, esi
mov dword [ebp - 8], ecx
push esi
lea eax, [ebp - 4]
push eax
push esi
push 0x20006
push esi
push esi
push esi
push str.SOFTWARETencentQQPCMgr
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x42bb7b
xor eax, eax
jmp 0x42bb9f
push 4
lea eax, [ebp - 8]
push eax
push 4
push esi
push str.RtpState
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret
Function at 0x42c110
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x46c
mov eax, dword [0x47c00c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
push 0x20a
mov dword [ebp - 0x460], eax
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.0044fa15
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov dword [ebp - 0x45c], str.riched20.dll
xor esi, esi
mov dword [ebp - 0x458], str.d2d1.dll
mov dword [ebp - 0x454], str.DWrite.dll
mov dword [ebp - 0x450], str.dxcore.dll
mov dword [ebp - 0x44c], str.D3D10Warp.dll
mov dword [ebp - 0x448], str.dxgi.dll
mov dword [ebp - 0x444], str.d3d11.dll
mov dword [ebp - 0x440], str.uxtheme.dll
mov dword [ebp - 0x43c], str.dbghelp.dll
mov dword [ebp - 0x438], str.dxva2.dll
mov dword [ebp - 0x434], str.d3d9.dll
mov dword [ebp - 0x430], str.nvEncodeAPI.dll
mov dword [ebp - 0x42c], str.DXCore.dll
cmp dword [ebp + esi*4 - 0x45c], 0
je 0x42c22a
push 0x20a
lea eax, [ebp - 0x428]
push 0
push eax
call fcn.0044fa15
add esp, 0xc
lea eax, [ebp - 0x218]
push dword [ebp + esi*4 - 0x45c]
push eax
lea eax, [ebp - 0x428]
push str._s_s
push eax
call fcn.0042de33
add esp, 0x10
lea eax, [ebp - 0x428]
push eax
call fcn.0042d22d
inc esi
cmp esi, 0xd
jb 0x42c1dc
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
mov esi, eax
sub esi, dword [ebp - 0x460]
call fcn.004138dc
push 5
mov ecx, eax
call fcn.0043a060
test eax, eax
je 0x42c27b
call fcn.004138dc
push esi
mov ecx, str.CRTPServer::PreLoadSystemModule
push ecx
push str.__s__:_dwElaspedTime__d_.
push ecx
push 0x68d
push 0x461610
push 0
push 5
push 0
push eax
call fcn.0043a100
add esp, 0x28
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0044e9b2
leave
ret
Function at 0x42d22d
Capabilities:
Check if file exists
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
test esi, esi
je 0x42d31a
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42d31a
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
xor edi, edi
mov dword [ebp - 4], eax
push edi
push 0x80
push 3
push edi
push 7
push 0x80000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x42d31a
push 4
push 0x1000
push 0x80000
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
test edi, edi
je 0x42d2c5
and dword [ebp + 8], 0
push 0
lea eax, [ebp + 8]
push eax
push 0x80000
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x42d2b7
cmp dword [ebp + 8], 0
ja 0x42d29a
push 0x8000
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
mov edi, eax
sub edi, dword [ebp - 4]
call fcn.004138dc
push 5
mov ecx, eax
call fcn.0043a060
test eax, eax
je 0x42d315
call fcn.004138dc
push esi
push edi
mov ecx, str.CRTPServer::PreLoadModule
push ecx
push str.__s__:_dwElaspedTime__d___lpFileName__s_.
push ecx
push 0x83c
push 0x461610
push 0
push 5
push 0
push eax
call fcn.0043a100
add esp, 0x2c
xor eax, eax
inc eax
jmp 0x42d31c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x42d323
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [ebp + 8], 0
push ebx
push edi
je 0x42d406
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
xor edi, edi
mov dword [ebp - 0xc], eax
push edi
push 0x80
push 3
push edi
push 7
push 0x80000000
push dword [ebp + 8]
mov dword [ebp - 4], edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x42d406
push 4
push 0x1000
push 0x80000
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
test edi, edi
je 0x42d3af
and dword [ebp - 4], 0
push 0
lea eax, [ebp - 4]
push eax
push 0x80000
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x42d3a1
cmp dword [ebp - 4], 0
ja 0x42d384
push 0x8000
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
mov edi, eax
sub edi, dword [ebp - 0xc]
call fcn.004138dc
push 5
mov ecx, eax
call fcn.0043a060
test eax, eax
je 0x42d401
call fcn.004138dc
push dword [ebp + 8]
mov ecx, str.CRTPServer::PreLoadData
push edi
push ecx
push str.__s__:_dwElaspedTime__d___lpFileName__s_.
push ecx
push 0x854
push 0x461610
push 0
push 5
push 0
push eax
call fcn.0043a100
add esp, 0x2c
xor eax, eax
inc eax
jmp 0x42d408
xor eax, eax
pop edi
pop ebx
leave
ret 4
Function at 0x42e811
Capabilities:
Create service
Modify service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 2
xor esi, esi
mov ebx, ecx
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x42e834
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x42e896
push esi
push esi
push esi
push esi
push str.COM_Infrastructure
push ebx
push 1
push 2
push 0x110
push 0xf01ff
push str.QQPCMgr_RTP_Service
push str.QQPCRTP
push edi
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov ebx, eax
test ebx, ebx
jne 0x42e86d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x42e888
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x45f778
push eax
push 1
push ebx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call fcn.0042e908
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x42ea74
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 4]
push esi
push eax
push 0x20019
xor esi, esi
push esi
push str.SYSTEMCurrentControlSet_servicesQQPCRTP
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42ead2
lea eax, [ebp - 8]
mov dword [ebp - 0xc], esi
push eax
lea eax, [ebp - 0xc]
mov dword [ebp - 8], 4
push eax
push esi
push esi
push str.RtpFlag
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, 2
jne 0x42ead2
xor eax, eax
inc eax
jmp 0x42ead4
xor eax, eax
pop esi
leave
ret
Function at 0x42eb72
Capabilities:
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x47c00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x20a
xor esi, esi
mov edi, 0x47f420
push esi
push edi
call dword [0x4554f0]
push 0x104
mov ebx, str.QQPCRTP
push ebx
push edi
call dword [0x45563c]
add esp, 0x18
push 0xf003f
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
mov dword [ebp - 0x24], edi
test edi, edi
jne 0x42ebd1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x42ec59
push 0xf01ff
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, eax
test ebx, ebx
jne 0x42ebee
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x42ec52
push esi
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x42ec05
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x42ec4b
mov dword [ebp - 0x28], 7
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x42ec40
cmp dword [ebp - 0x1c], 4
je 0x42ec48
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
test eax, eax
jg 0x42ec0c
jmp 0x42ec48
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov edi, dword [ebp - 0x24]
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044e9b2
leave
ret

Function at 0x42f124
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
mov eax, dword [0x47c00c]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
push edi
mov edx, str.E11173AE_6007_4a43_811E_6069470B72E6
lea ecx, [esp + 0xc]
xor esi, esi
call fcn.0041ea77
cmp dword [esp + 0x20], 8
lea eax, [esp + 0xc]
cmovae eax, dword [esp + 0xc]
push eax
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov edi, eax
test edi, edi
je 0x42f17f
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
inc ecx
cmp eax, 0xb7
push edi
cmove esi, ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0xc]
call fcn.004023ee
mov ecx, dword [esp + 0x24]
mov eax, esi
pop edi
pop esi
xor ecx, esp
call fcn.0044e9b2
mov esp, ebp
pop ebp
ret
Function at 0x42f19b
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x47c00c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push str.84B48DA1_935E_457d_9566_68C2222F9609
lea ecx, [ebp - 0x1c]
xor esi, esi
call fcn.00413997
cmp dword [ebp - 8], 8
lea eax, [ebp - 0x1c]
cmovae eax, dword [ebp - 0x1c]
push eax
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov edi, eax
test edi, edi
je 0x42f1ee
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
inc ecx
cmp eax, 0xb7
push edi
cmove esi, ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x1c]
call fcn.004023ee
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.0044e9b2
leave
ret

Function at 0x42fbd3
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x47c00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
push 6
mov ebx, ecx
mov dword [ebp - 0x24], eax
pop ecx
xor eax, eax
mov dword [ebp - 0x28], edx
lea edi, [ebp - 0x1c]
xor esi, esi
push str.ZwQueryInformationProcess
rep stosd dword es:[edi], eax
push str.ntdll.dll
mov edi, esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x20], eax
test eax, eax
je 0x42fc86
push ebx
push esi
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
je 0x42fc86
push esi
push 0x18
lea eax, [ebp - 0x1c]
push eax
push esi
push ebx
call dword [ebp - 0x20]
test eax, eax
jne 0x42fc76
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 8]
test ecx, ecx
je 0x42fc4c
mov dword [ecx], eax
push eax
push esi
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x42fc76
push 0x104
push dword [ebp - 0x28]
push edi
call dword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
xor ecx, ecx
inc ecx
test eax, eax
cmovne esi, ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
test edi, edi
je 0x42fc86
push edi
call ebx
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044e9b2
leave
ret
Function at 0x42fc97
Capabilities:
Check if file exists
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x47c00c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x20a
xor edi, edi
lea eax, [ebp - 0x218]
push edi
push eax
mov esi, ecx
call fcn.0044fa15
add esp, 0xc
lea eax, [ebp - 0x218]
push esi
push str.Global04CE0CB6_CDF3_4a4b_8B9D_292A455FAF5B
push str._s__u
push 0x104
push eax
call fcn.00412b5e
add esp, 0x14
lea eax, [ebp - 0x218]
push eax
push edi
push edi
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
test eax, eax
jne 0x42fd45
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x42fd4c
call fcn.004138dc
push 5
mov ecx, eax
call fcn.0043a060
test eax, eax
je 0x42fd41
call fcn.004138dc
lea ecx, [ebp - 0x218]
push ecx
push str._Mutex_s_:_Not_exist
push str.CTrayElevator::IsQMTrayExist
push 0x3af
push str.D:qci_workspace_root_workspaces__qci_pipeline_10989745_2FTHardwareQMPublicExeQMServiceTrayElevator.cpp
push edi
push 5
push edi
push eax
call fcn.0043a100
add esp, 0x24
xor eax, eax
jmp 0x42fd8e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.004138dc
push 5
mov ecx, eax
call fcn.0043a060
test eax, eax
je 0x42fd8b
call fcn.004138dc
lea ecx, [ebp - 0x218]
push ecx
push str._Mutex_s_:_Exist
push str.CTrayElevator::IsQMTrayExist
push 0x3b6
push str.D:qci_workspace_root_workspaces__qci_pipeline_10989745_2FTHardwareQMPublicExeQMServiceTrayElevator.cpp
push edi
push 5
push edi
push eax
call fcn.0043a100
add esp, 0x24
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0044e9b2
leave
ret
Function at 0x4345e7
Capabilities:
Get number of processors

Disassembly:
add esp, 4
call 0x4345e7
add byte [ebx + 0x32], cl
xor eax, 0x36323c34
inc ecx
dec eax
dec esp
add esp, 4
pop esi
movzx edx, word [ebp - 0x100]
test edx, edx
jne 0x43460e
Function at 0x438a00
Capabilities:
Encode data using xor

Disassembly:
push ecx
pop eax
dec ecx
mov eax, ebp
ljmp 0x895e
or dword [eax], ecx
pushal
pop esi
invalid
xlatb
nop
nop
or byte [eax], cl
mov eax, ebp
xor al, 4
pop es
pop es
or byte [ebp + 0x16], bh
xchg ebp, eax
popfd
mov cl, dh
pop es
pop es
xchg ecx, eax
popfd
in al, 2
pop es
pop es
jge 0x4389a9
lds esi, [esp + eax]
pop es
pop es
or dword [ebp + 0x16], edi
xchg ebp, eax
lea ebx, [eax - 0xf]
pop es
pop es
xchg ecx, eax
lea esi, [eax]
pop es
pop es
pop edx
mov eax, ebp
xor al, 4
pop es
pop es
or bh, byte [ebp + 0x16]
xchg ebp, eax
xchg ebp, eax
js 0x438a32
pop es
pop es
xchg ecx, eax
xchg ebp, eax
xor al, 0xf2
pop es
pop es
aaa
mov eax, ebp
xor al, 4
pop es
pop es
or edi, dword [ebp + 0x16]
xchg ebp, eax
popfd
push 0x910707f1
popfd
cmp dl, dh
pop es
pop es
adc al, 0x95
lea ebx, [eax - 0x6ef8f80f]
lea edi, [eax]
pop es
pop es
xchg ebx, eax
xchg ebp, eax
cmp dl, dh
pop es
pop es
xchg ecx, eax
xchg ebp, eax
xor al, 0xf2
pop es
pop es
xchg ebx, eax
popfd
xor al, 0xf2
pop es
pop es
xchg ecx, eax
popfd
xor dl, dh
pop es
pop es
xchg ebx, eax
lea esi, [eax]
pop es
pop es
xchg ecx, eax
invalid
Function at 0x4067e1
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x42b20e
mov eax, dword fs:[0]
push eax
sub esp, 0xb8
push ebx
push esi
push edi
mov eax, dword [0x43637c]
xor eax, esp
push eax
lea eax, [esp + 0xc8]
mov dword fs:[0], eax
mov esi, ecx
push 2
xor edi, edi
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [esp + 0x14], eax
cmp eax, edi
jne 0x4068c1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x90]
push eax
call fcn.0040d24d
mov esi, eax
lea eax, [esp + 0x24]
push 0x4c3
push eax
mov dword [esp + 0xe0], edi
call fcn.0040d24d
push 0x42eacc
push eax
xor ebx, ebx
lea eax, [esp + 0x6c]
inc ebx
push eax
mov byte [esp + 0xec], bl
call fcn.00402a83
mov ecx, esp
mov dword [esp + 0x30], esp
push esi
push eax
push ecx
mov byte [esp + 0xf8], 2
call fcn.00402ac9
add esp, 0xc
push 2
call fcn.0040cf44
add esp, 0x20
push edi
push ebx
lea esi, [esp + 0x5c]
call fcn.004023e7
push edi
push ebx
lea esi, [esp + 0x24]
call fcn.004023e7
push edi
push ebx
lea esi, [esp + 0x94]
call fcn.004023e7
xor al, al
jmp 0x4069e2
cmp dword [esi + 0x18], 8
jb 0x4068cc
mov edx, dword [esi + 4]
jmp 0x4068cf
lea edx, [esi + 4]
cmp dword [esi + 0x50], 8
jb 0x4068da
mov ecx, dword [esi + 0x3c]
jmp 0x4068dd
lea ecx, [esi + 0x3c]
cmp dword [esi + 0x34], 8
jb 0x4068e8
mov eax, dword [esi + 0x20]
jmp 0x4068eb
lea eax, [esi + 0x20]
push edi
push edi
push edi
push edi
push edi
push edx
xor ebx, ebx
inc ebx
push ebx
push 3
push 0x10
push 0x30
push ecx
push eax
push dword [esp + 0x44]
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
cmp eax, edi
jne 0x4069ad
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0xac]
push eax
call fcn.0040d24d
mov esi, eax
lea eax, [esp + 0x78]
push 0x4c4
push eax
mov dword [esp + 0xe0], 3
call fcn.0040d24d
push 0x42eacc
push eax
lea eax, [esp + 0x50]
push eax
mov byte [esp + 0xec], 4
call fcn.00402a83
mov ecx, esp
mov dword [esp + 0x34], esp
push esi
push eax
push ecx
mov byte [esp + 0xf8], 5
call fcn.00402ac9
add esp, 0xc
push 2
call fcn.0040cf44
add esp, 0x20
push edi
push ebx
lea esi, [esp + 0x40]
call fcn.004023e7
push edi
push ebx
lea esi, [esp + 0x78]
call fcn.004023e7
call dword [edi + 0x53]
lea esi, [esp + 0xb0]
call fcn.004023e7
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x4068ba
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push eax
call ebx
push dword [esp + 0x14]
call ebx
sub esp, 0x1c
mov eax, esp
mov dword [esp + 0x34], esp
push 0x643
push eax
call fcn.0040d24d
pop ecx
pop ecx
push edi
call fcn.0040cf44
add esp, 0x20
mov ecx, esi
call fcn.0040729e
mov ecx, dword [esp + 0xc8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret