joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100036ef
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x164
mov eax, dword [0x10027120]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov ebx, ecx
mov edi, str.017BEFE6_75D6_4129_8475_356B0774B0DE
push eax
mov ecx, edi
mov dword [ebp - 0x164], eax
call fcn.1000499d
pop ecx
test eax, eax
je 0x1000389c
xor eax, eax
push 0xee
mov word [ebp - 0x154], ax
xor esi, esi
lea eax, [ebp - 0x152]
push esi
push eax
mov dword [ebp - 0x64], 0x66296635
mov dword [ebp - 0x60], 0x66326620
mov dword [ebp - 0x5c], 0x66276631
mov dword [ebp - 0x58], 0x66236634
mov dword [ebp - 0x54], 0x6625663a
mov dword [ebp - 0x50], 0x6607660a
mov dword [ebp - 0x4c], 0x66156615
mov dword [ebp - 0x48], 0x66156603
mov dword [ebp - 0x44], 0x664c663a
mov dword [ebp - 0x40], 0x6615663a
mov dword [ebp - 0x3c], 0x6603660e
mov dword [ebp - 0x38], 0x660a660a
mov dword [ebp - 0x34], 0x661e6603
mov dword [ebp - 0x30], 0x6625663a
mov dword [ebp - 0x2c], 0x66086609
mov dword [ebp - 0x28], 0x66036612
mov dword [ebp - 0x24], 0x6612661e
mov dword [ebp - 0x20], 0x6603662b
mov dword [ebp - 0x1c], 0x66136608
mov dword [ebp - 0x18], 0x6607662e
mov dword [ebp - 0x14], 0x66026608
mov dword [ebp - 0x10], 0x6603660a
mov dword [ebp - 0xc], 0x66156614
mov word [ebp - 8], 0x6666
call fcn.1000f470
add esp, 0xc
xor eax, eax
xor byte [ebp + eax - 0x64], 0x66
inc eax
cmp eax, 0x5e
jb 0x100037ef
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x154]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x10024328
lea eax, [ebp - 0x154]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov dword [ebp - 0x160], esi
mov dword [ebp - 0x15c], esi
mov dword [ebp - 0x158], esi
call fcn.1000b059
neg eax
sbb eax, eax
and eax, 0x100
lea ecx, [ebp - 0x154]
push ecx
xor ecx, ecx
or eax, 0x20006
cmp dword [ebp - 0x164], esi
setne cl
add ecx, 0x80000001
push ecx
lea ecx, [ebp - 0x160]
call fcn.1000b627
test eax, eax
jne 0x10003891
push edi
push esi
lea eax, [ebp - 0x160]
push eax
call fcn.10005161
neg eax
lea esi, [ebp - 0x160]
sbb edi, edi
call fcn.1000b7ae
call fcn.1000b7ae
lea eax, [edi + 1]
jmp 0x1000389e
lea esi, [ebp - 0x160]
call fcn.1000b7ae
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000d755
leave
ret
Function at 0x100038ad
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push 0x164
mov eax, 0x1001f2e8
call fcn.1001b357
xor eax, eax
push 0xee
mov word [ebp - 0x160], ax
xor esi, esi
lea eax, [ebp - 0x15e]
push esi
push eax
mov dword [ebp - 0x70], 0x66296635
mov dword [ebp - 0x6c], 0x66326620
mov dword [ebp - 0x68], 0x66276631
mov dword [ebp - 0x64], 0x66236634
mov dword [ebp - 0x60], 0x6625663a
mov dword [ebp - 0x5c], 0x6607660a
mov dword [ebp - 0x58], 0x66156615
mov dword [ebp - 0x54], 0x66156603
mov dword [ebp - 0x50], 0x664c663a
mov dword [ebp - 0x4c], 0x6615663a
mov dword [ebp - 0x48], 0x6603660e
mov dword [ebp - 0x44], 0x660a660a
mov dword [ebp - 0x40], 0x661e6603
mov dword [ebp - 0x3c], 0x6625663a
mov dword [ebp - 0x38], 0x66086609
mov dword [ebp - 0x34], 0x66036612
mov dword [ebp - 0x30], 0x6612661e
mov dword [ebp - 0x2c], 0x6603662b
mov dword [ebp - 0x28], 0x66136608
mov dword [ebp - 0x24], 0x6607662e
mov dword [ebp - 0x20], 0x66026608
mov dword [ebp - 0x1c], 0x6603660a
mov dword [ebp - 0x18], 0x66156614
mov word [ebp - 0x14], 0x6666
call fcn.1000f470
add esp, 0xc
xor eax, eax
xor byte [ebp + eax - 0x70], 0x66
inc eax
cmp eax, 0x5e
jb 0x10003985
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x160]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [ebp - 0x170], esi
mov dword [ebp - 0x16c], esi
mov dword [ebp - 0x168], esi
mov dword [ebp - 4], esi
call fcn.1000b059
neg eax
sbb eax, eax
and eax, 0x100
lea ecx, [ebp - 0x160]
push ecx
xor ecx, ecx
or eax, 0x20006
cmp edi, esi
setne cl
lea ebx, [ebp - 0x170]
add ecx, 0x80000001
push ecx
call fcn.1000b6ef
test eax, eax
jne 0x10003a11
lea eax, [ebp - 0x161]
push eax
call fcn.10005736
push str.Hash_Me
push dword [ebp - 0x170]
call dword [0x10029574]
mov esi, ebx
call fcn.1000b7ae
lea esi, [ebp - 0x170]
call fcn.1000b7ae
call fcn.1001b3a1
ret
Function at 0x1000499d
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2a0
mov eax, dword [0x10027120]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
xor esi, esi
push edi
mov dword [ebp - 0x2a0], eax
mov edi, ecx
mov dword [ebp - 0x29c], esi
mov dword [ebp - 0x298], esi
mov dword [ebp - 0x294], esi
mov dword [ebp - 0x88], 0x66296635
mov dword [ebp - 0x84], 0x66326620
mov dword [ebp - 0x80], 0x66276631
mov dword [ebp - 0x7c], 0x66236634
mov dword [ebp - 0x78], 0x6625663a
mov dword [ebp - 0x74], 0x6607660a
mov dword [ebp - 0x70], 0x66156615
mov dword [ebp - 0x6c], 0x66156603
mov dword [ebp - 0x68], 0x6625663a
mov dword [ebp - 0x64], 0x6635662a
mov dword [ebp - 0x60], 0x6622662f
mov dword [ebp - 0x5c], 0x6666663a
mov dword [ebp - 0x38], 0x6608662f
mov dword [ebp - 0x34], 0x66146636
mov dword [ebp - 0x30], 0x66056609
mov dword [ebp - 0x2c], 0x66036635
mov dword [ebp - 0x28], 0x66106614
mov dword [ebp - 0x24], 0x66146603
mov dword [ebp - 0x20], 0x66546655
mov word [ebp - 0x1c], 0x6666
xor eax, eax
xor byte [ebp + eax - 0x88], 0x66
inc eax
cmp eax, 0x30
jb 0x10004a64
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x290]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x290]
push eax
call edi
push 0x1002431c
lea eax, [ebp - 0x290]
push eax
call edi
xor eax, eax
xor byte [ebp + eax - 0x38], 0x66
inc eax
cmp eax, 0x1e
jb 0x10004aa6
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x290]
push eax
call edi
call fcn.1000b059
neg eax
sbb eax, eax
and eax, 0x100
lea ecx, [ebp - 0x290]
push ecx
xor ecx, ecx
or eax, 0x20006
cmp dword [ebp - 0x2a0], esi
setne cl
add ecx, 0x80000001
push ecx
lea ecx, [ebp - 0x29c]
call fcn.1000b627
test eax, eax
jne 0x10004bc6
push ebx
push esi
lea eax, [ebp - 0x29c]
push eax
mov dword [ebp - 0x58], 0x660e6632
mov dword [ebp - 0x54], 0x66036614
mov dword [ebp - 0x50], 0x66026607
mov dword [ebp - 0x4c], 0x6608660f
mov dword [ebp - 0x48], 0x662b6601
mov dword [ebp - 0x44], 0x66026609
mov dword [ebp - 0x40], 0x660a6603
mov word [ebp - 0x3c], 0x6666
mov dword [ebp - 0x18], 0x66166627
mov dword [ebp - 0x14], 0x66146607
mov dword [ebp - 0x10], 0x660b6612
mov dword [ebp - 0xc], 0x66086603
mov dword [ebp - 8], 0x66666612
call fcn.10005161
test eax, eax
jne 0x10004b9e
xor byte [ebp + eax - 0x18], 0x66
inc eax
cmp eax, 0x14
jb 0x10004b69
xor eax, eax
xor byte [ebp + eax - 0x58], 0x66
inc eax
cmp eax, 0x1e
jb 0x10004b76
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x29c]
push eax
call fcn.10005161
test eax, eax
jne 0x10004b9e
xor edi, edi
inc edi
jmp 0x10004ba0
xor edi, edi
lea esi, [ebp - 0x29c]
call fcn.1000b7ae
lea esi, [ebp - 0x29c]
call fcn.1000b7ae
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.1000d755
leave
ret
xor edi, edi
jmp 0x10004bab
Function at 0x10004d2b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
mov esi, eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x10004d82
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x10004d74
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, edi
and esi, 0xf
jbe 0x10004d70
cmp edi, eax
jae 0x10004d74
dec esi
movzx ecx, word [edi]
lea edi, [edi + ecx*2 + 2]
jne 0x10004d62
cmp edi, eax
jb 0x10004d78
xor eax, eax
jmp 0x10004d81
movzx eax, word [edi]
neg eax
sbb eax, eax
and eax, edi
pop edi
pop esi
pop ebp
ret
Function at 0x100055f9
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push 0x44
mov eax, 0x1001f285
call fcn.1001b357
xor esi, esi
mov dword [ebp - 0x40], 0x66296635
mov dword [ebp - 0x3c], 0x66326620
mov dword [ebp - 0x38], 0x66276631
mov dword [ebp - 0x34], 0x66236634
mov dword [ebp - 0x30], 0x6625663a
mov dword [ebp - 0x2c], 0x6607660a
mov dword [ebp - 0x28], 0x66156615
mov dword [ebp - 0x24], 0x66156603
mov dword [ebp - 0x20], 0x6625663a
mov dword [ebp - 0x1c], 0x6635662a
mov dword [ebp - 0x18], 0x6622662f
mov dword [ebp - 0x14], 0x6666663a
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x48], esi
mov dword [ebp - 4], esi
xor eax, eax
xor byte [ebp + eax - 0x40], 0x66
inc eax
cmp eax, 0x30
jb 0x10005669
call fcn.1000b059
neg eax
sbb eax, eax
and eax, 0x100
lea ecx, [ebp - 0x40]
push ecx
xor ecx, ecx
or eax, 0x20006
cmp edi, esi
setne cl
add ecx, 0x80000001
push ecx
lea ecx, [ebp - 0x50]
call fcn.1000b627
test eax, eax
jne 0x100056c0
lea eax, [ebp - 0x41]
push eax
call fcn.10005736
push ebx
push dword [ebp - 0x50]
call dword [0x10029574]
lea esi, [ebp - 0x50]
call fcn.1000b7ae
lea esi, [ebp - 0x50]
call fcn.1000b7ae
call fcn.1001b3a1
ret

Function at 0x100056ce
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [esi]
and dword [esi], 0
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push 0
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10005732
cmp dword [ebp + 0xc], 1
je 0x1000570a
cmp dword [ebp + 0xc], 2
je 0x1000570a
push 0xd
pop eax
jmp 0x10005732
mov eax, dword [ebp - 4]
test edi, edi
je 0x1000572c
test eax, eax
je 0x10005727
test al, 1
jne 0x10005705
mov ecx, eax
shr ecx, 1
cmp word [edi + ecx*2 - 2], 0
je 0x1000572c
jmp 0x10005705
xor ecx, ecx
mov word [edi], cx
shr eax, 1
mov dword [esi], eax
xor eax, eax
leave
ret 8
Function at 0x1000a85c
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push 0x14
mov eax, 0x1001f433
call fcn.1001b2ee
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov eax, dword [edi]
cmp eax, ebx
je 0x1000a87d
mov dword [edi], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 0x18], ebx
lea eax, [ebp - 0x18]
push eax
push 0x1002450c
push 0x17
push ebx
push 0x10020384
mov dword [ebp - 4], ebx
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x1000a99e
mov esi, dword [ebp - 0x18]
cmp esi, ebx
je 0x1000a99e
mov dword [ebp - 0x14], ebx
push str.ROOTCIMV2
mov byte [ebp - 4], 1
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0x20], eax
cmp eax, ebx
jne 0x1000a8d0
push 0x8007000e
call fcn.1000a9b7
lea edx, [ebp - 0x14]
push edx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
mov byte [ebp - 4], 2
mov ecx, dword [esi]
push eax
push esi
mov dword [ebp - 0x1c], 1
call dword [ecx + 0xc]
test eax, eax
js 0x1000a8f9
mov byte [ebp - 0xd], 1
cmp dword [ebp - 0x14], ebx
jne 0x1000a8fc
mov byte [ebp - 0xd], bl
mov dword [ebp - 4], 1
push dword [ebp - 0x20]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
cmp byte [ebp - 0xd], bl
je 0x1000a98e
mov eax, dword [ebp - 0x18]
cmp eax, ebx
je 0x1000a921
mov dword [ebp - 0x18], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push ebx
push ebx
push 3
push 3
push ebx
push ebx
push 0xa
push dword [ebp - 0x14]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x1000a95e
mov esi, dword [ebp - 0x14]
cmp esi, ebx
je 0x1000a95e
mov dword [ebp - 0x14], ebx
cmp dword [edi], esi
je 0x1000a95e
cmp esi, ebx
je 0x1000a950
mov eax, dword [esi]
push esi
call dword [eax + 4]
mov eax, dword [edi]
cmp eax, ebx
je 0x1000a95c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [edi], esi
mov edi, dword [edi]
xor eax, eax
cmp edi, ebx
setne al
mov byte [ebp - 4], bl
mov esi, eax
mov eax, dword [ebp - 0x14]
cmp eax, ebx
je 0x1000a979
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x18]
cmp eax, ebx
je 0x1000a98a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, esi
jmp 0x1000a9b1
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x14]
cmp eax, ebx
je 0x1000a99e
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x18]
cmp eax, ebx
je 0x1000a9af
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor eax, eax
call fcn.1001b38d
ret
Function at 0x1000ab25
Capabilities:
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1001f3ef
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x10027120]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov esi, dword [eax]
xor ebx, ebx
cmp esi, ebx
je 0x1000ac63
cmp dword [ebp + 0xc], ebx
je 0x1000ac63
mov dword [esp + 0x18], ebx
push str.SELECT__FROM_Win32_DiskDrive
mov dword [esp + 0x34], ebx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, eax
mov dword [esp + 0x20], edi
cmp edi, ebx
jne 0x1000ab90
push 0x8007000e
call fcn.1000a9b7
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x30
push edi
push 0x100243e4
mov byte [esp + 0x44], 1
mov eax, dword [esi]
push esi
call dword [eax + 0x50]
test eax, eax
push edi
setns byte [esp + 0x1b]
mov byte [esp + 0x34], bl
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
cmp byte [esp + 0x17], bl
je 0x1000ac50
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x1000ac3c
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x30], 2
mov dword [esp + 0x20], ebx
jmp 0x1000ac0a
cmp dword [esp + 0x20], ebx
je 0x1000ac26
push dword [ebp + 0xc]
lea ecx, [esp + 0x20]
call fcn.1000a9e0
test eax, eax
je 0x1000ac26
mov eax, dword [esp + 0x1c]
cmp eax, ebx
je 0x1000ac0a
mov dword [esp + 0x1c], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
lea edx, [esp + 0x20]
push edx
lea edx, [esp + 0x20]
push edx
push 1
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
test eax, eax
jns 0x1000abe2
mov byte [esp + 0x30], bl
mov eax, dword [esp + 0x1c]
cmp eax, ebx
je 0x1000ac38
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x18]
or dword [esp + 0x30], 0xffffffff
cmp eax, ebx
je 0x1000ac4b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor eax, eax
inc eax
jmp 0x1000ac65
or dword [esp + 0x30], 0xffffffff
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x1000ac63
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor eax, eax
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1000ad6e
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x62c
mov eax, dword [0x10027120]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x62c], ecx
mov dword [ebp - 0x628], eax
test eax, eax
je 0x1000ae99
xor edx, edx
mov word [eax], dx
xor eax, eax
mov word [ebp - 0x214], ax
test ecx, ecx
je 0x1000ae99
lea eax, [ebp - 0x214]
push eax
push 0x103
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x1000ae99
push ebx
push esi
push edi
mov esi, 0x10022eec
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor esi, esi
lea ebx, [ebp - 0x214]
mov ax, word [ebx]
mov word [ebp - 0xc], ax
push 0x104
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x1000ae6d
lea eax, [ebp - 0x41c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1000ae08
sub eax, edx
sar eax, 1
mov edi, eax
push edi
lea eax, [ebp - 0x41c]
push eax
push dword [ebp - 0x62c]
call fcn.1000de30
add esp, 0xc
mov esi, eax
neg esi
sbb esi, esi
inc esi
je 0x1000ae6d
mov eax, dword [ebp - 0x62c]
lea eax, [eax + edi*2]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x624]
push str._s_s
push eax
call fcn.1000ad52
add esp, 0x10
lea eax, [ebp - 0x624]
push eax
push dword [ebp - 0x628]
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ax, word [ebx]
add ebx, 2
test ax, ax
jne 0x1000ae6d
test esi, esi
jne 0x1000ae85
cmp word [ebx], si
jne 0x1000adde
mov ecx, dword [ebp - 0x628]
movzx eax, word [ecx]
neg eax
pop edi
sbb eax, eax
pop esi
and eax, ecx
pop ebx
jmp 0x1000ae9b
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000d755
leave
ret

Function at 0x1000bc19
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x10027120]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push dword [0x10029420]
lea eax, [ebp - 0x20c]
push str.SoftwareTencent_bugReportQQ_u
push eax
mov esi, ecx
call dword [sym.imp.USER32.dll_wsprintfW]
xor edi, edi
add esp, 0xc
mov dword [ebp - 0x218], edi
mov dword [ebp - 0x214], edi
mov dword [ebp - 0x210], edi
call fcn.1000d2f0
neg eax
sbb eax, eax
and eax, 0x100
lea ecx, [ebp - 0x20c]
push ecx
xor ecx, ecx
or eax, 0x20006
cmp esi, edi
setne cl
add ecx, 0x80000001
push ecx
lea ecx, [ebp - 0x218]
call fcn.1000b627
test eax, eax
jne 0x1000bcc0
push dword [ebp + 8]
push ebx
push 3
push edi
push str.cache32
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
neg edi
sbb edi, edi
lea esi, [ebp - 0x218]
inc edi
call fcn.1000b7ae
lea esi, [ebp - 0x218]
call fcn.1000b7ae
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.1000d755
leave
ret
Function at 0x1000c8d9
Capabilities:
Encode data using xor
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x10027120]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
xor esi, esi
cmp edi, esi
je 0x1000caaf
cmp dword [ebp + 8], esi
je 0x1000caaf
mov dword [ebp - 0x84], 0xa8c7a8fb
mov dword [ebp - 0x80], 0xa8dca8ce
mov dword [ebp - 0x7c], 0xa8c9a8df
mov dword [ebp - 0x78], 0xa8cda8da
mov dword [ebp - 0x74], 0xa8e5a8f4
mov dword [ebp - 0x70], 0xa8cba8c1
mov dword [ebp - 0x6c], 0xa8c7a8da
mov dword [ebp - 0x68], 0xa8c7a8db
mov dword [ebp - 0x64], 0xa8dca8ce
mov dword [ebp - 0x60], 0xa8ffa8f4
mov dword [ebp - 0x5c], 0xa8c6a8c1
mov dword [ebp - 0x58], 0xa8c7a8cc
mov dword [ebp - 0x54], 0xa8dba8df
mov dword [ebp - 0x50], 0xa8fba888
mov dword [ebp - 0x4c], 0xa8daa8cb
mov dword [ebp - 0x48], 0xa8d8a8c1
mov dword [ebp - 0x44], 0xa8f4a8dc
mov dword [ebp - 0x40], 0xa8cda8fb
mov dword [ebp - 0x3c], 0xa8dca8dc
mov dword [ebp - 0x38], 0xa8c6a8c1
mov dword [ebp - 0x34], 0xa8dba8cf
mov dword [ebp - 0x30], 0xa8eca8f4
mov dword [ebp - 0x2c], 0xa8c5a8c7
mov dword [ebp - 0x28], 0xa8c1a8c9
mov dword [ebp - 0x24], 0xa8dba8c6
mov word [ebp - 0x20], 0xa8a8
mov dword [ebp - 0x1c], 0xa8c9a8cc
mov dword [ebp - 0x18], 0xa8c9a8dc
mov word [ebp - 0x14], 0xa8a8
mov dword [ebp - 0x10], 0xa8c1a8dc
mov dword [ebp - 0xc], 0xa8cda8c5
mov word [ebp - 8], 0xa8a8
mov dword [ebp - 0x90], esi
mov dword [ebp - 0x8c], esi
mov dword [ebp - 0x88], esi
xor eax, eax
xor byte [ebp + eax - 0x84], 0xa8
inc eax
cmp eax, 0x66
jb 0x1000c9f7
lea eax, [ebp - 0x84]
push eax
push SysReAllocString
mov eax, 0x20006
lea ecx, [ebp - 0x90]
call fcn.1000b627
test eax, eax
jne 0x1000caa4
xor byte [ebp + eax - 0x1c], 0xa8
inc eax
cmp eax, 0xa
jb 0x1000ca25
push dword [ebp + 8]
lea eax, [ebp - 0x1c]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 3
push esi
push eax
push dword [ebp - 0x90]
call edi
test eax, eax
jne 0x1000ca8e
push esi
call fcn.1000db6e
pop ecx
mov dword [ebp - 0x94], edx
xor ecx, ecx
xor byte [ebp + ecx - 0x10], 0xa8
inc ecx
cmp ecx, 0xa
jb 0x1000ca5c
push 4
mov dword [ebp - 0x94], eax
lea eax, [ebp - 0x94]
push eax
push 4
push esi
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x90]
call edi
test eax, eax
jne 0x1000ca8e
xor edi, edi
inc edi
jmp 0x1000ca90
xor edi, edi
lea esi, [ebp - 0x90]
call fcn.1000b7ae
call fcn.1000b7ae
mov eax, edi
jmp 0x1000cab1
lea esi, [ebp - 0x90]
call fcn.1000b7ae
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1000d755
leave
ret
Function at 0x1000d755
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10027120]
jne 0x1000d75f
repz ret
jmp fcn.1000f5a4

Function at 0x10018a0c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10027120]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.100100c7
and dword [ebp - 0x14], 0
cmp dword [0x100293e8], 0
mov dword [ebp - 0x18], eax
jne 0x10018abf
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x10018b67
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x10018b67
mov esi, dword [0x10027fd0]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x100293e8], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x100293ec], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x100293f0], eax
call edi
push eax
call esi
mov dword [0x100293f8], eax
test eax, eax
je 0x10018abf
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x100293f4], eax
mov eax, dword [0x100293f4]
mov ecx, dword [ebp - 0x18]
mov esi, dword [0x10027fd4]
cmp eax, ecx
je 0x10018b18
cmp dword [0x100293f8], ecx
je 0x10018b18
push eax
call esi
push dword [0x100293f8]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x10018b18
test ebx, ebx
je 0x10018b18
call edi
test eax, eax
je 0x10018b0f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x10018b0f
test byte [ebp - 8], 1
jne 0x10018b18
or dword [ebp + 0x10], 0x200000
jmp 0x10018b4b
mov eax, dword [0x100293ec]
cmp eax, dword [ebp - 0x18]
je 0x10018b4b
push eax
call esi
test eax, eax
je 0x10018b4b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x10018b4b
mov eax, dword [0x100293f0]
cmp eax, dword [ebp - 0x18]
je 0x10018b4b
push eax
call esi
test eax, eax
je 0x10018b4b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x100293e8]
call esi
test eax, eax
je 0x10018b67
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x10018b69
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000d755
leave
ret