joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000ef2b
Capabilities:
Check if file exists
Get file attributes
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1005fc23
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
mov eax, dword [0x10072414]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x10], ebx
je 0x1000f03b
cmp dword [esi + 0x14], 8
jb 0x1000ef6d
mov eax, dword [esi]
jmp 0x1000ef6f
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1000f03b
cmp dword [esi + 0x14], 8
jb 0x1000ef89
mov ecx, dword [esi]
jmp 0x1000ef8b
mov ecx, esi
call fcn.10010c12
test eax, eax
je 0x1000f03b
cmp dword [esi + 0x14], 8
jb 0x1000efa2
mov ecx, dword [esi]
jmp 0x1000efa4
mov ecx, esi
call fcn.10012bf3
test eax, eax
je 0x1000f03b
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
push 0x20006
push str.SoftwareTencentTodayDo
lea eax, [esp + 0x18]
push eax
mov ecx, 0x80000001
mov dword [esp + 0x34], ebx
call fcn.10011c38
test eax, eax
jne 0x1000f02b
cmp dword [esi + 0x14], 8
jb 0x1000efe6
mov esi, dword [esi]
cmp esi, ebx
jne 0x1000efef
push 0xd
pop eax
jmp 0x1000f00e
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push esi
push 1
push ebx
push str.QBRepairPath
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor ecx, ecx
cmp eax, ebx
sete cl
mov esi, ecx
cmp dword [esp + 0x10], ebx
je 0x1000f027
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x1000f03d
cmp dword [esp + 0x10], ebx
je 0x1000f03b
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000f943
Capabilities:
Read file on windows

Disassembly:
push 0x44
mov eax, 0x1005f3b2
call fcn.10046e1e
xor esi, esi
xor eax, eax
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], esi
mov word [ebp - 0x2c], ax
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 4], esi
call fcn.1001244f
pop ecx
test eax, eax
je 0x1000fa11
cmp dword [ebp - 0x1c], esi
je 0x1000fa11
push str.ExtraInfo.ini
lea esi, [ebp - 0x48]
call fcn.1000bc8f
mov eax, esi
lea ebx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.10012382
mov bl, al
neg bl
sbb bl, bl
push 1
xor edi, edi
mov byte [ebp - 4], 0
call fcn.10003982
inc bl
jne 0x1000fa11
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x1000f9bd
lea eax, [ebp - 0x2c]
push 1
call fcn.10012423
pop ecx
test eax, eax
je 0x1000fa11
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x1000f9d5
lea eax, [ebp - 0x2c]
xor esi, esi
push esi
push esi
push 3
push esi
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
mov dword [ebp - 0x50], ebx
cmp ebx, esi
je 0x1000fa11
cmp ebx, 0xffffffff
je 0x1000fa11
mov esi, 0x400
push esi
call fcn.1004251a
mov edi, eax
pop ecx
test edi, edi
jne 0x1000fa25
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
xor edi, edi
lea esi, [ebp - 0x2c]
call fcn.10003982
xor eax, eax
call fcn.10046e68
ret
push esi
push 0
push edi
call fcn.100464a0
add esp, 0xc
xor esi, esi
push esi
lea eax, [ebp - 0x4c]
push eax
push 0x3ff
push edi
push ebx
mov dword [ebp - 0x4c], esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1000fa9d
cmp dword [ebp - 0x4c], esi
jbe 0x1000fa9d
push str.Item1
push edi
call fcn.10045c70
pop ecx
pop ecx
cmp eax, esi
je 0x1000fa9d
sub eax, edi
mov ecx, eax
cmp ecx, 0xffffffff
je 0x1000fa9d
mov eax, edi
lea ebx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1000fa70
sub eax, ebx
lea edx, [ecx + 7]
cmp eax, edx
jbe 0x1000fa9d
mov cl, byte [ecx + edi + 6]
cmp cl, 0x30
jl 0x1000fa8e
cmp cl, 0x39
jle 0x1000fa98
cmp cl, 0x41
jl 0x1000fa9d
cmp cl, 0x46
jg 0x1000fa9d
xor ebx, ebx
inc ebx
jmp 0x1000fa9f
xor ebx, ebx
push dword [ebp - 0x50]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call fcn.10043b1e
pop ecx
push 1
xor edi, edi
lea esi, [ebp - 0x2c]
call fcn.10003982
mov eax, ebx
jmp 0x1000fa1f
Function at 0x1000fac2
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1005fbf3
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x10072414]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
mov eax, dword [0x10072414]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
lea eax, [esp + 0x14]
push eax
xor ebx, ebx
call fcn.1000ea05
pop ecx
mov dword [esp + 0x40], ebx
cmp dword [esp + 0x24], ebx
je 0x1000fb94
mov eax, dword [esp + 0x14]
push 8
pop esi
cmp dword [esp + 0x28], esi
jae 0x1000fb25
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1000fb90
mov ecx, dword [esp + 0x14]
cmp dword [esp + 0x28], esi
jae 0x1000fb3f
lea ecx, [esp + 0x14]
call fcn.10010c12
test eax, eax
je 0x1000fb8c
mov ecx, dword [esp + 0x14]
cmp dword [esp + 0x28], esi
jae 0x1000fb56
lea ecx, [esp + 0x14]
call fcn.10012bf3
test eax, eax
je 0x1000fb88
mov eax, dword [esp + 0x14]
cmp dword [esp + 0x28], esi
jae 0x1000fb6d
lea eax, [esp + 0x14]
push eax
call fcn.10012207
pop ecx
test eax, eax
je 0x1000fb84
push 6
call fcn.1000e90a
xor ebx, ebx
inc ebx
jmp 0x1000fb9b
push 5
jmp 0x1000fb96
push 4
jmp 0x1000fb96
push 7
jmp 0x1000fb96
push 3
jmp 0x1000fb96
push 2
call fcn.1000e90a
pop ecx
push 1
xor edi, edi
lea esi, [esp + 0x18]
call fcn.10003982
mov eax, ebx
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.10042ec5
mov esp, ebp
pop ebp
ret

Function at 0x10010120
Capabilities:
Create thread

Disassembly:
push 0
mov eax, 0x10060622
call fcn.10046db5
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
lea esi, [ebx + 8]
call fcn.1000fe02
mov esi, 0x10075808
push esi
mov dword [ebp + 8], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor edi, edi
mov dword [ebp - 4], edi
mov eax, dword [ebp + 0xc]
cmp eax, edi
je 0x10010160
mov ecx, dword [eax]
push eax
mov dword [0x10075444], eax
call dword [ecx + 4]
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea esi, [ebx + 0x10]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [esi], edi
jne 0x10010188
lea eax, [ebp + 0xc]
push eax
push edi
push esi
push 0x1000e805
push edi
push edi
mov dword [ebp + 0xc], edi
call ebx
mov dword [esi], eax
cmp dword [esi + 4], edi
jne 0x100101a2
lea eax, [ebp + 0xc]
push eax
push edi
push edi
push 0x1000e81b
push edi
push edi
mov dword [ebp + 0xc], edi
call ebx
mov dword [esi + 4], eax
xor eax, eax
call fcn.10046e54
ret 8
Function at 0x100101ac
Capabilities:
Terminate thread

Disassembly:
push 0
mov eax, 0x10060622
call fcn.10046db5
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x10]
xor edi, edi
cmp eax, edi
je 0x100101f2
lea ecx, [ebp + 8]
push ecx
push eax
mov dword [ebp + 8], edi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [ebp + 8], 0x103
jne 0x100101e6
push 1
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x10], edi
mov eax, dword [esi + 8]
cmp eax, edi
je 0x10010202
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esi + 8], edi
mov esi, 0x10075808
push esi
mov dword [ebp + 8], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 4], edi
mov eax, dword [0x10075444]
cmp eax, edi
je 0x10010229
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [0x10075444], edi
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
call fcn.10046e54
ret 4

Function at 0x10010b15
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x10072414]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
and dword [ebp - 0x54], 0
and dword [ebp - 0x58], 0
push eax
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x68]
mov dword [ebp - 0x68], 0x67452301
mov dword [ebp - 0x64], 0xefcdab89
mov dword [ebp - 0x60], 0x98badcfe
mov dword [ebp - 0x5c], 0x10325476
call fcn.1001038d
pop ecx
push 8
pop edx
lea eax, [ebp - 0x58]
lea ecx, [ebp - 0xc]
call fcn.10010ae4
mov ecx, dword [ebp - 0x58]
shr ecx, 3
push 0x38
and ecx, 0x3f
pop eax
cmp ecx, eax
jb 0x10010b7a
push 0x78
pop eax
sub eax, ecx
push 0x10073bf8
lea ecx, [ebp - 0x68]
call fcn.1001038d
lea eax, [ebp - 0xc]
push eax
push 8
pop eax
lea ecx, [ebp - 0x68]
call fcn.1001038d
pop ecx
pop ecx
push 0x10
pop edx
lea eax, [ebp - 0x68]
mov ecx, esi
call fcn.10010ae4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10042ec5
leave
ret

Function at 0x10010bb3
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov ecx, dword [edx + 0x3c]
add ecx, edx
movzx edx, word [ecx + 0x14]
push esi
mov esi, dword [ecx + 0x28]
push edi
movzx edi, word [ecx + 6]
lea edx, [edx + ecx + 0x18]
xor eax, eax
xor ecx, ecx
mov dword [ebp - 8], edi
test edi, edi
je 0x10010c0e
lea edi, [edx + 0xc]
mov dword [ebp - 4], edi
push ebx
mov ebx, dword [edi]
cmp esi, ebx
jb 0x10010bf2
mov edi, dword [edi - 4]
add edi, ebx
cmp esi, edi
jb 0x10010c00
mov edi, dword [ebp - 4]
inc ecx
add edi, 0x28
mov dword [ebp - 4], edi
cmp ecx, dword [ebp - 8]
jb 0x10010be0
jmp 0x10010c0d
imul ecx, ecx, 0x28
mov eax, dword [ecx + edx + 0x14]
sub eax, dword [ecx + edx + 0xc]
add eax, esi
pop ebx
pop edi
pop esi
leave
ret
Function at 0x10010c12
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x10072414]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
xor eax, eax
mov byte [ebp - 0x14], bl
lea edi, [ebp - 0x13]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x7f
stosb byte es:[edi], al
lea eax, [ebp - 0x97]
mov esi, ecx
push ebx
push eax
mov dword [ebp - 0x11c], esi
mov dword [ebp - 0x124], ebx
mov dword [ebp - 0x128], ebx
mov byte [ebp - 0x98], bl
call fcn.100464a0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea eax, [ebp - 0x120]
push eax
push esi
mov dword [ebp - 0x120], ebx
call dword [sym.imp.KERNEL32.dll_GetBinaryTypeW]
test eax, eax
je 0x10010dba
cmp dword [ebp - 0x120], ebx
je 0x10010c9b
cmp dword [ebp - 0x120], 6
jne 0x10010dba
push ebx
mov esi, 0x80
push esi
push 3
push ebx
push 1
push 0xc0000000
push dword [ebp - 0x11c]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x11c], eax
cmp eax, 0xffffffff
je 0x10010dba
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
push edi
mov dword [ebp - 0x130], edi
call fcn.100439b0
mov ebx, eax
pop ecx
test ebx, ebx
je 0x10010da5
push 0
lea eax, [ebp - 0x128]
push eax
push edi
push ebx
push dword [ebp - 0x11c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10010d9e
cmp dword [ebp - 0x128], edi
jne 0x10010d9e
cmp edi, esi
jbe 0x10010d9e
mov eax, dword [ebx + 0x28]
add edi, 0xffffff80
cmp eax, edi
ja 0x10010d9e
test eax, eax
je 0x10010d9e
lea esi, [eax + ebx]
push 0x20
pop ecx
lea eax, [ebp - 0x98]
push eax
lea edi, [ebp - 0x118]
lea eax, [ebp - 0x118]
rep movsd dword es:[edi], dword [esi]
push eax
lea edi, [ebp - 0x12c]
mov dword [ebp - 0x12c], 0x18
call fcn.100118a0
pop ecx
pop ecx
test eax, eax
je 0x10010d9e
mov esi, dword [ebp - 0x98]
cmp esi, dword [ebp - 0x130]
ja 0x10010d9e
mov edx, ebx
call fcn.10010bb3
cmp eax, esi
jb 0x10010d9e
mov ecx, dword [ebp - 0x94]
lea edx, [ecx + esi]
cmp eax, edx
ja 0x10010d9e
add esi, ebx
push ecx
push esi
lea esi, [ebp - 0x14]
call fcn.10010b15
pop ecx
pop ecx
mov dword [ebp - 0x124], 1
push ebx
call fcn.10043976
pop ecx
cmp dword [ebp - 0x11c], 0
je 0x10010dba
push dword [ebp - 0x11c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x124]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10042ec5
leave
ret
Function at 0x10011aab
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
push esi
xor esi, esi
mov dword [ebp - 4], esi
call fcn.100119a5
test eax, eax
je 0x10011ae1
call dword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
lea ecx, [ebp - 0xc]
push ecx
push eax
mov dword [ebp - 0xc], esi
call dword [sym.imp.WTSAPI32.dll_WTSQueryUserToken]
neg eax
sbb eax, eax
and eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
jmp 0x10011af7
lea eax, [ebp - 4]
push eax
push 0xf01ff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov eax, dword [ebp - 4]
cmp eax, esi
je 0x10011b09
call fcn.10011a58
mov ebx, eax
cmp ebx, esi
jne 0x10011b0d
xor eax, eax
jmp 0x10011b74
push 0x44
lea eax, [ebp - 0x60]
push esi
push eax
call fcn.100464a0
add esp, 0xc
push esi
push ebx
lea eax, [ebp - 8]
push eax
mov dword [ebp - 0x60], 0x44
mov dword [ebp - 0x58], str.winsta0default
mov dword [ebp - 8], esi
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x60]
push eax
push esi
push dword [ebp - 8]
push 0x430
push esi
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
push dword [ebp - 8]
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
cmp dword [ebp - 0x18], esi
je 0x10011b71
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x1c]
pop esi
pop ebx
leave
ret

Function at 0x10012207
Capabilities:
Create process on windows

Disassembly:
push 0x80
mov eax, 0x1005e32b
call fcn.10046e1e
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x34], eax
cmp eax, ebx
je 0x100122f9
cmp word [eax], bx
je 0x100122f9
push 0x44
pop esi
push esi
lea eax, [ebp - 0x8c]
push ebx
push eax
call fcn.100464a0
xor eax, eax
lea edi, [ebp - 0x44]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
push 5
pop eax
xor edi, edi
mov word [ebp - 0x5c], ax
inc edi
xor eax, eax
mov dword [ebp - 0x8c], esi
mov dword [ebp - 0x60], edi
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x20], ebx
mov word [ebp - 0x30], ax
push 0x22
lea esi, [ebp - 0x30]
mov dword [ebp - 4], ebx
call fcn.1000dc50
mov eax, dword [ebp - 0x34]
lea ecx, [eax + 2]
mov dx, word [eax]
add eax, 2
cmp dx, bx
jne 0x10012282
push dword [ebp - 0x34]
sub eax, ecx
sar eax, 1
mov edi, eax
lea eax, [ebp - 0x30]
call fcn.1000bb5a
xor edi, edi
push 0x22
inc edi
lea esi, [ebp - 0x30]
call fcn.1000dc50
push 0x20
call fcn.1000dc50
push str._fromQD
push 7
pop edi
mov eax, esi
call fcn.1000bb5a
cmp dword [ebp - 0x1c], 8
mov eax, dword [ebp - 0x30]
jae 0x100122cc
mov eax, esi
lea ecx, [ebp - 0x44]
push ecx
lea ecx, [ebp - 0x8c]
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push eax
push dword [ebp - 0x34]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push 1
xor edi, edi
lea esi, [ebp - 0x30]
mov ebx, eax
call fcn.10003982
mov eax, ebx
jmp 0x100122fb
xor eax, eax
call fcn.10046e68
ret
Function at 0x10012301
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x10072414]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
push 0x208
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
mov esi, ecx
call fcn.100464a0
add esp, 0xc
push 0
push 0x25
lea eax, [ebp - 0x210]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x10012350
xor al, al
jmp 0x10012375
lea eax, [ebp - 0x210]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10012359
sub eax, edx
sar eax, 1
lea ecx, [ebp - 0x210]
call fcn.1000b42e
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10042ec5
leave
ret

Function at 0x10012423
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
test eax, eax
je 0x1001244b
cmp word [eax], 0
je 0x1001244b
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1001244b
cmp dword [ebp + 8], 0
jne 0x10012447
xor eax, eax
inc eax
pop ebp
ret
test al, 0x10
je 0x10012442
xor eax, eax
pop ebp
ret

Function at 0x1001244f
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x220
mov eax, 0x1005e904
call fcn.10046e1e
mov eax, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0x22c], eax
mov dword [ebp - 0x224], esi
mov dword [ebp - 0x220], esi
mov dword [ebp - 0x21c], esi
push str.SOFTWARETENCENTQQ2009
push 0x80000002
mov eax, 0x2001f
lea ebx, [ebp - 0x224]
mov dword [ebp - 4], esi
call fcn.100038f2
test eax, eax
je 0x100124a7
cmp dword [ebp - 0x224], esi
jmp 0x1001255d
xor eax, eax
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push esi
push eax
call fcn.100464a0
add esp, 0xc
push str.Install
lea eax, [ebp - 0x224]
push eax
lea esi, [ebp - 0x228]
lea edi, [ebp - 0x218]
mov dword [ebp - 0x228], 0x104
call fcn.1000382b
xor edi, edi
test eax, eax
jne 0x10012557
cmp dword [ebp - 0x228], edi
je 0x10012557
cmp word [ebp - 0x218], di
je 0x10012557
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10012557
lea eax, [ebp - 0x218]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x1001251e
mov esi, dword [ebp - 0x22c]
sub eax, edx
sar eax, 1
lea ecx, [ebp - 0x218]
call fcn.1000b42e
cmp dword [ebp - 0x224], edi
je 0x10012552
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
jmp 0x1001256d
cmp dword [ebp - 0x224], edi
je 0x1001256b
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
call fcn.10046e68
ret
Function at 0x10012a5d
Capabilities:
Check if file exists

Disassembly:
push 0x98
mov eax, 0x1005f2fc
call fcn.10046e1e
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x60], eax
cmp eax, ebx
je 0x10012ad2
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10012ad2
mov eax, 0xcd44
mov word [ebp - 0x20], ax
xor eax, eax
mov dword [ebp - 0x24], 0xaac56b
mov dword [ebp - 0x1e], 0xc28c11d0
mov dword [ebp - 0x1a], 0xc24fc000
mov word [ebp - 0x16], 0xee95
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x30], ebx
mov word [ebp - 0x40], ax
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], ebx
call fcn.10012301
test al, al
jne 0x10012ada
push 1
xor edi, edi
lea esi, [ebp - 0x40]
call fcn.10003982
xor eax, eax
call fcn.10046e68
ret
push str.Wintrust.dll
lea esi, [ebp - 0x5c]
call fcn.1000bc8f
mov eax, esi
lea ebx, [ebp - 0x40]
mov byte [ebp - 4], 1
call fcn.10012382
xor ebx, ebx
push 1
xor edi, edi
mov byte [ebp - 4], bl
call fcn.10003982
cmp dword [ebp - 0x2c], 8
mov eax, dword [ebp - 0x40]
jae 0x10012b0f
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x64], eax
cmp eax, ebx
jne 0x10012b2b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x60], eax
jmp 0x10012bda
push str.WinVerifyTrust
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
cmp esi, ebx
jne 0x10012b48
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x10012bce
xor eax, eax
lea edi, [ebp - 0x74]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp - 0x60]
push 0x30
pop edi
push edi
mov dword [ebp - 0x70], eax
lea eax, [ebp - 0xa4]
push ebx
push eax
mov dword [ebp - 0x74], 0x10
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x68], ebx
call fcn.100464a0
lea eax, [ebp - 0x74]
add esp, 0xc
mov dword [ebp - 0x8c], eax
lea eax, [ebp - 0xa4]
push eax
lea eax, [ebp - 0x24]
push eax
push ebx
mov dword [ebp - 0xa4], edi
mov dword [ebp - 0xa0], ebx
mov dword [ebp - 0x98], 2
mov dword [ebp - 0x94], ebx
mov dword [ebp - 0x90], 1
mov dword [ebp - 0x88], ebx
mov dword [ebp - 0x84], ebx
mov dword [ebp - 0x80], ebx
mov dword [ebp - 0x7c], pe_nt_image_headers32
mov dword [ebp - 0x78], ebx
call esi
push dword [ebp - 0x64]
mov dword [ebp - 0x60], eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 1
xor edi, edi
lea esi, [ebp - 0x40]
call fcn.10003982
xor eax, eax
cmp dword [ebp - 0x60], ebx
sete al
jmp 0x10012ad4
Function at 0x100133c0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], 0x10325476
pop ebp
ret
Function at 0x10014cb0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x10072414]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x100741a8], 0xffffffff
jne 0x10014e97
mov dword [0x100741a8], 0xfffffc18
mov dword [ebp - 0x120], 0x114
push 0x110
push 0
lea eax, [ebp - 0x11c]
push eax
call fcn.100464a0
add esp, 0xc
lea ecx, [ebp - 0x120]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x10014e97
cmp dword [ebp - 0x110], 2
jne 0x10014e97
cmp dword [ebp - 0x11c], 5
jne 0x10014de0
cmp dword [ebp - 0x118], 0
jne 0x10014d41
mov dword [0x100741a8], 1
jmp 0x10014ddb
cmp dword [ebp - 0x118], 1
jne 0x10014dc8
push 0x7f
lea edx, [ebp - 0x10c]
push edx
push 0x100695a4
call fcn.10044e1c
add esp, 0xc
test eax, eax
jne 0x10014d70
mov dword [0x100741a8], 3
jmp 0x10014dc6
push 0x7f
lea eax, [ebp - 0x10c]
push eax
push 0x100695c4
call fcn.10044e1c
add esp, 0xc
test eax, eax
jne 0x10014d96
mov dword [0x100741a8], 4
jmp 0x10014dc6
push 0x7f
lea ecx, [ebp - 0x10c]
push ecx
push str.Service_Pack_3
call fcn.10044e1c
add esp, 0xc
test eax, eax
jne 0x10014dbc
mov dword [0x100741a8], 5
jmp 0x10014dc6
mov dword [0x100741a8], 2
jmp 0x10014ddb
cmp dword [ebp - 0x118], 2
jne 0x10014ddb
mov dword [0x100741a8], 6
jmp 0x10014e97
cmp dword [ebp - 0x11c], 6
jne 0x10014e6f
cmp dword [ebp - 0x118], 0
jne 0x10014e4e
push 0x7f
lea edx, [ebp - 0x10c]
push edx
push str.Service_Pack_1
call fcn.10044e1c
add esp, 0xc
test eax, eax
jne 0x10014e1c
mov dword [0x100741a8], 8
jmp 0x10014e4c
push 0x7f
lea eax, [ebp - 0x10c]
push eax
push str.Service_Pack_2
call fcn.10044e1c
add esp, 0xc
test eax, eax
jne 0x10014e42
mov dword [0x100741a8], 9
jmp 0x10014e4c
mov dword [0x100741a8], 7
jmp 0x10014e6d
cmp dword [ebp - 0x118], 1
jne 0x10014e63
mov dword [0x100741a8], 0xa
jmp 0x10014e6d
mov dword [0x100741a8], 0xb
jmp 0x10014e97
cmp dword [ebp - 0x11c], 0xa
jne 0x10014e84
mov dword [0x100741a8], 0xd
jmp 0x10014e97
cmp dword [ebp - 0x11c], 0xa
jbe 0x10014e97
mov dword [0x100741a8], 0x3e8
mov eax, dword [0x100741a8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10042ec5
mov esp, ebp
pop ebp
ret

Function at 0x10014eb0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [ebp - 0xc], 0x20
mov dword [ebp - 8], 0
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 4], eax
push str.GetNativeSystemInfo
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10014ef3
lea ecx, [ebp - 0x30]
push ecx
call dword [ebp - 8]
jmp 0x10014efd
lea edx, [ebp - 0x30]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, word [ebp - 0x30]
cmp eax, 9
je 0x10014f0f
movzx ecx, word [ebp - 0x30]
cmp ecx, 6
jne 0x10014f16
mov dword [ebp - 0xc], 0x40
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret