joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10004440
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10030350
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x1003f050]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, dword [ebp + 8]
xor ebx, ebx
push 0x40
mov byte [esi + 0x1d], bl
mov byte [esi + 0x1c], 1
mov byte [esi + 0x262], bl
mov dword [ebp - 4], ebx
call fcn.1001d454
add esp, 4
mov dword [esi + 8], eax
jmp 0x100044bd
mov eax, dword [esi + 8]
mov dword [esi + 4], eax
mov dword [esi + 0x228], ebx
mov dword [esi + 0x22c], ebx
mov dword [esi + 0xc], 0x67452301
mov dword [esi + 0x10], 0xefcdab89
mov dword [esi + 0x14], 0x98badcfe
mov dword [esi + 0x18], 0x10325476
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10004510
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, eax
mov eax, dword [esi]
push eax
call fcn.1001d420
add esp, 4
test eax, eax
jne 0x1000459d
mov ecx, dword [esi]
mov edx, dword [esi + 8]
push edi
push ecx
push 0x40
push 1
push edx
call fcn.1001d7e5
mov edi, eax
cdq
add esp, 0x10
add dword [esi + 0x228], eax
adc dword [esi + 0x22c], edx
cmp edi, 0x40
jge 0x10004598
push ebx
mov ebx, dword [esi + 8]
mov eax, 0x40
sub eax, edi
push eax
add ebx, edi
push 0
push ebx
call fcn.1001eb30
add esp, 0xc
cmp edi, 0x38
mov byte [ebx], 0x80
mov byte [0x100404a4], 0
pop ebx
jge 0x10004598
mov ecx, dword [esi + 0x22c]
mov edx, dword [esi + 0x228]
push 0
push 8
push ecx
push edx
call fcn.1002ac40
mov esi, dword [esi + 8]
mov dword [esi + 0x38], eax
pop edi
mov dword [esi + 0x3c], edx
xor al, al
pop esi
ret
pop edi
mov al, 1
pop esi
ret
mov eax, dword [esi + 8]
push 0x40
push 0
push eax
call fcn.1001eb30
add esp, 0xc
cmp byte [0x100404a4], 0
je 0x100045bc
mov ecx, dword [esi + 8]
mov byte [ecx], 0x80
mov edx, dword [esi + 0x22c]
mov eax, dword [esi + 0x228]
push 0
push 8
push edx
push eax
call fcn.1002ac40
mov esi, dword [esi + 8]
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], edx
xor al, al
pop esi
ret
Function at 0x100052c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10030728
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x1003f050]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], 0
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0x2c], 0
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [esp + 0x30]
test eax, eax
je 0x1000530d
mov eax, dword [eax]
jmp 0x1000530f
xor eax, eax
mov ecx, dword [esi]
lea edx, [esp + 0xc]
push edx
mov edx, dword [esp + 0x38]
push edx
push eax
mov eax, dword [ecx + 0x74]
push esi
call eax
test eax, eax
jge 0x10005332
push 0x1003669c
push esi
push eax
call fcn.1001c3b0
push 0x10
lea ecx, [esp + 0x10]
push ecx
push 0x10
push ebx
call fcn.1001d016
mov esi, dword [esp + 0x40]
xor edx, edx
add esp, 0x10
mov word [esp + 0xc], dx
test esi, esi
je 0x1000538b
lea eax, [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x1000538b
test esi, esi
je 0x1000538b
mov eax, dword [esi]
test eax, eax
je 0x10005372
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esi + 4]
test eax, eax
je 0x10005382
push eax
call fcn.1001c891
add esp, 4
push esi
call fcn.1001c891
add esp, 4
mov eax, ebx
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x24
ret 8

Function at 0x10005ac0
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push 0xffffffffffffffff
push 0x10030cba
mov eax, dword fs:[0]
push eax
sub esp, 0x1a4
mov eax, dword [0x1003f050]
xor eax, esp
mov dword [esp + 0x19c], eax
push edi
mov eax, dword [0x1003f050]
xor eax, esp
push eax
lea eax, [esp + 0x1ac]
mov dword fs:[0], eax
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0
xor eax, eax
push 0x18e
push eax
lea ecx, [esp + 0x1e]
mov dword [esp + 0x1bc], 1
push ecx
mov word [esp + 0x20], ax
call fcn.1001eb30
add esp, 0xc
lea edx, [esp + 0x14]
push edx
push 0x202
call sub.WS2_32.dll_WSAStartup
cmp dword [esp + 0x1d4], 0x10
mov eax, dword [esp + 0x1c0]
jae 0x10005b50
lea eax, [esp + 0x1c0]
push eax
call sub.WS2_32.dll_gethostbyname
push 0
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], 0
push 0x10035375
mov ecx, esi
mov edi, eax
mov byte [esi + 4], 0
call fcn.10002a20
mov dword [esp + 0xc], 1
test edi, edi
je 0x10005bb4
cmp word [edi + 8], 2
jne 0x10005bb4
mov edi, dword [edi + 0xc]
cmp dword [edi], 0
je 0x10005bb4
mov edi, dword [edi]
mov eax, dword [edi]
push eax
call sub.WS2_32.dll_inet_ntoa
mov ecx, eax
lea edi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x10005ba2
sub ecx, edi
push ecx
push eax
mov ecx, esi
call fcn.10002a20
call sub.WS2_32.dll_WSACleanup
cmp dword [esp + 0x1d4], 0x10
jb 0x10005bd3
mov ecx, dword [esp + 0x1c0]
push ecx
call fcn.1001c891
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x1ac]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [esp + 0x19c]
xor ecx, esp
call fcn.1001c89c
add esp, 0x1b0
ret
Function at 0x10005ce0
Capabilities:
Print debug messages

Disassembly:
mov eax, 0x1004
call fcn.10023d10
mov eax, dword [0x1003f050]
xor eax, esp
mov dword [esp + 0x1000], eax
push 0xfff
lea eax, [esp + 5]
push 0
push eax
mov byte [esp + 0xc], 0
call fcn.1001eb30
mov edx, dword [esp + 0x1014]
add esp, 0xc
lea ecx, [esp + 0x100c]
push ecx
push edx
lea eax, [esp + 8]
push eax
call dword [sym.imp.USER32.dll_wvsprintfA]
lea ecx, [esp]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [esp + 0x1000]
xor ecx, esp
call fcn.1001c89c
add esp, 0x1004
ret
Function at 0x1000dd30
Capabilities:
Create thread

Disassembly:
push ecx
push esi
push edi
push 0xa38
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, eax
mov eax, dword [esp + 0x10]
push eax
push esi
mov dword [esp + 0x10], 0
call edi
mov ecx, dword [esp + 0x14]
push ecx
lea edx, [esi + 0x514]
push edx
call edi
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x24]
lea edx, [eax + ecx]
mov ecx, dword [esp + 0x18]
push edx
mov edx, dword [esp + 0x24]
add edx, ecx
push edx
push eax
push ecx
lea eax, [esi + 0xa28]
push eax
call dword [sym.imp.USER32.dll_SetRect]
cmp dword [esp + 0x28], 0
jne 0x1000ddbc
lea ecx, [esp + 8]
push ecx
push 0
push esi
push sym.QQUtil.dll_ThreadProc_CreateWebCtl
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop edi
pop esi
pop ecx
ret 0x1c
push esi
call sym.QQUtil.dll_ThreadProc_CreateWebCtl
pop edi
mov eax, 1
pop esi
pop ecx
ret 0x1c

Function at 0x10010110
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x110
mov eax, dword [0x1003f050]
xor eax, esp
mov dword [esp + 0x10c], eax
xor eax, eax
push 0x103
push eax
mov dword [esp + 0xc], eax
mov byte [esp + 0x10], al
lea eax, [esp + 0x11]
push eax
mov dword [esp + 0xc], 0x1000
call fcn.1001eb30
add esp, 0xc
push str.SYSTEMCurrentControlSetServices_
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp]
push eax
push edi
lea ecx, [esp + 0xc]
push ecx
push 0x1003726c
lea edx, [esp + 0x18]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
mov ecx, dword [esp + 0x10c]
neg eax
sbb eax, eax
not eax
and eax, dword [esp]
xor ecx, esp
call fcn.1001c89c
add esp, 0x110
ret

Function at 0x100101b0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x110
mov eax, dword [0x1003f050]
xor eax, esp
mov dword [esp + 0x10c], eax
xor eax, eax
push 0x103
push eax
mov dword [esp + 0xc], eax
mov byte [esp + 0x10], al
lea eax, [esp + 0x11]
push eax
mov dword [esp + 0xc], 0x104
call fcn.1001eb30
add esp, 0xc
push str.SYSTEMCurrentControlSetServices_
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp]
push eax
push edi
lea ecx, [esp + 0xc]
push ecx
push str.displayname
lea edx, [esp + 0x18]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
mov ecx, dword [esp + 0x10c]
neg eax
sbb eax, eax
not eax
and eax, dword [esp]
xor ecx, esp
call fcn.1001c89c
add esp, 0x110
ret
Function at 0x10010250
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x110
mov eax, dword [0x1003f050]
xor eax, esp
mov dword [esp + 0x10c], eax
push esi
xor eax, eax
push 0x103
push eax
mov dword [esp + 0x10], eax
mov byte [esp + 0x14], al
lea eax, [esp + 0x15]
push eax
mov esi, ecx
mov dword [esp + 0x10], 0x104
call fcn.1001eb30
add esp, 0xc
push str.SYSTEMCurrentControlSetServices_
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0x10]
push edx
call esi
push str.Parameters
lea eax, [esp + 0x10]
push eax
call esi
lea ecx, [esp + 4]
push ecx
push edi
lea edx, [esp + 0x10]
push edx
push str.ServiceDll
lea eax, [esp + 0x1c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
mov ecx, dword [esp + 0x110]
neg eax
sbb eax, eax
pop esi
not eax
and eax, dword [esp]
xor ecx, esp
call fcn.1001c89c
add esp, 0x110
ret

Function at 0x10010300
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x114
mov eax, dword [0x1003f050]
xor eax, esp
mov dword [esp + 0x110], eax
push esi
xor eax, eax
push 0x103
push eax
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], eax
mov byte [esp + 0x18], al
lea eax, [esp + 0x19]
push eax
mov esi, ecx
mov dword [esp + 0x18], 4
call fcn.1001eb30
add esp, 0xc
push str.SYSTEMCurrentControlSetServices_
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0x14]
push edx
call esi
push str.Parameters
lea eax, [esp + 0x14]
push eax
call esi
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x10]
push eax
push str.interval
lea ecx, [esp + 0x20]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
pop esi
test eax, eax
je 0x100103aa
xor eax, eax
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.1001c89c
add esp, 0x114
ret
mov ecx, dword [esp + 0x110]
xor eax, eax
cmp dword [esp + 4], 4
setne al
xor ecx, esp
dec eax
and eax, dword [esp]
call fcn.1001c89c
add esp, 0x114
ret

Function at 0x100103d0
Capabilities:
Query service status

Disassembly:
sub esp, 0x1c
push ebx
push edi
push SysReAllocString
xor edi, edi
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, eax
cmp ebx, edi
jne 0x100103f2
pop edi
xor eax, eax
pop ebx
add esp, 0x1c
ret
mov eax, dword [esp + 0x28]
push ebp
push esi
push SysReAllocString
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, eax
cmp esi, edi
je 0x1001044b
xor eax, eax
lea ecx, [esp + 0x10]
push ecx
push esi
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
push esi
call ebp
mov edx, 1
cmp edx, dword [esp + 0x14]
sbb edi, edi
neg edi
push ebx
call ebp
pop esi
pop ebp
mov eax, edi
pop edi
pop ebx
add esp, 0x1c
ret
Function at 0x10010460
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x114
mov eax, dword [0x1003f050]
xor eax, esp
mov dword [esp + 0x110], eax
xor eax, eax
push 0x103
push eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov byte [esp + 0x14], al
lea eax, [esp + 0x15]
push eax
mov dword [esp + 0x14], 4
call fcn.1001eb30
add esp, 0xc
push str.SYSTEMCurrentControlSetServices_
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 8]
push eax
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0xc]
push edx
push str.start
lea eax, [esp + 0x1c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
je 0x100104f8
xor eax, eax
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.1001c89c
add esp, 0x114
ret
xor eax, eax
cmp dword [esp + 4], 4
jne 0x10010508
cmp dword [esp], 2
sete al
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.1001c89c
add esp, 0x114
ret

Function at 0x10010520
Capabilities:
Persist via windows service
Set registry value

Disassembly:
sub esp, 0x10c
mov eax, dword [0x1003f050]
xor eax, esp
mov dword [esp + 0x108], eax
push 0x103
lea eax, [esp + 9]
push 0
push eax
mov dword [esp + 0xc], 2
mov byte [esp + 0x10], 0
call fcn.1001eb30
add esp, 0xc
push str.SYSTEMCurrentControlSetServices_
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
lea edx, [esp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 4
lea eax, [esp + 4]
push eax
push 4
push str.start
lea ecx, [esp + 0x14]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
mov ecx, dword [esp + 0x108]
neg eax
sbb eax, eax
xor ecx, esp
inc eax
call fcn.1001c89c
add esp, 0x10c
ret

Function at 0x100107d0
Capabilities:
Check mutex on windows
Create thread

Disassembly:
sub esp, 0x20c
mov eax, dword [0x1003f050]
xor eax, esp
mov dword [esp + 0x208], eax
push ebx
push esi
push edi
push 0x207
lea eax, [esp + 0x11]
push 0
push eax
mov esi, ecx
mov byte [esp + 0x18], 0
call fcn.1001eb30
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
push esi
push str.protect_service
lea ecx, [esp + 0x20]
push str._s:_S
push ecx
call ebx
add esp, 0x1c
lea edx, [esp + 0xc]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1001084d
push str.protect_service
push str._s:disallow_mutiple_instance_
call fcn.10005ce0
add esp, 8
push edi
jmp 0x10010888
push 0x104
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push esi
mov edi, eax
push 0x100353a8
push edi
call ebx
add esp, 0xc
push 0
push 0
push edi
push 0x100105b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x214]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1001c89c
add esp, 0x20c
ret
Function at 0x100108b0
Capabilities:
Create thread

Disassembly:
sub esp, 0x110
mov eax, dword [0x1003f050]
xor eax, esp
mov dword [esp + 0x10c], eax
push esi
push 0x103
lea eax, [esp + 0x11]
push 0
push eax
mov esi, ecx
mov dword [esp + 0x10], 0
mov byte [esp + 0x18], 0
call fcn.1001eb30
add esp, 0xc
push 0x104
lea ecx, [esp + 0x10]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0xc]
push edx
call fcn.10014390
lea eax, [esp + 0x10]
push str.QQ.exe
push eax
call fcn.1001dbf0
add esp, 0xc
test eax, eax
je 0x1001095a
push edi
call fcn.10010b90
lea ecx, [esp + 8]
push ecx
push 0
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x10010e60
push 0
push 0
call esi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
lea edx, [esp + 0xc]
push edx
push 0
push 0
push fcn.10012700
push 0
push 0
call esi
push eax
call edi
pop edi
mov ecx, dword [esp + 0x110]
pop esi
xor ecx, esp
call fcn.1001c89c
add esp, 0x110
ret

Function at 0x10010f40
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
jne 0x10010f4f
xor eax, eax
pop esi
ret 0xc
cmp dword [esp + 0xc], 0
je 0x10010f49
cmp dword [esp + 0x10], 0
je 0x10010f49
push ebx
push ebp
push edi
xor edi, edi
push edi
push edi
push edi
push edi
push 0x64
push 0x12c
push edi
push 0xc8
push SysReAllocString
push 0x10035375
push 0x100367fc
push edi
call dword [sym.imp.USER32.dll_CreateWindowExA]
push 0xa
push edi
push esi
mov ebx, eax
call fcn.1001d374
add esp, 0xc
push edi
push str.HummerEngine_aec3a622_bf49_420e_a062_08d7a0c00d31
push edi
push edi
mov ebp, eax
call dword [sym.imp.USER32.dll_FindWindowExA]
mov esi, eax
test esi, esi
je 0x10010ffd
lea ecx, [ecx]
push ebp
push ebx
push 0x8001
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
test edi, edi
jne 0x10010fe8
push eax
push str.HummerEngine_aec3a622_bf49_420e_a062_08d7a0c00d31
push esi
push eax
call dword [sym.imp.USER32.dll_FindWindowExA]
mov esi, eax
test esi, esi
jne 0x10010fb0
push ebx
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, edi
pop edi
pop ebp
pop ebx
pop esi
ret 0xc
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
push eax
push ecx
push 0xd
push ebx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
push ebx
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, edi
pop edi
pop ebp
pop ebx
pop esi
ret 0xc
Function at 0x100110d0
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x448
mov eax, dword [0x1003f050]
xor eax, esp
mov dword [esp + 0x444], eax
push ebx
mov ebx, dword [esp + 0x450]
mov dword [esp + 4], ebx
test ebx, ebx
jne 0x1001110e
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x444]
xor ecx, esp
call fcn.1001c89c
add esp, 0x448
ret 8
push esi
push edi
push 0x3ff
lea eax, [esp + 0x55]
push 0
push eax
mov byte [esp + 0x5c], 0
call fcn.1001eb30
push 0x3c
lea ecx, [esp + 0x21]
push 0
push ecx
mov byte [esp + 0x28], 0
call fcn.1001eb30
add esp, 0x18
push 0
push 0
push 0
push 0
push 0x64
push 0x12c
push 0
push 0xc8
push SysReAllocString
push 0x10035375
push 0x100367fc
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
push 0
push str.HummerEngine_aec3a622_bf49_420e_a062_08d7a0c00d31
push 0
push 0
mov edi, eax
call dword [sym.imp.USER32.dll_FindWindowExA]
mov esi, eax
test esi, esi
je 0x100111de
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
push ebp
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
nop
push 0
push edi
push 0x8002
push esi
call ebp
test eax, eax
je 0x100111c3
lea edx, [esp + 0x14]
push edx
push 0x3c
push 0xd
push edi
call ebp
push 0x100374b0
lea eax, [esp + 0x58]
push eax
call ebx
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x58]
push edx
call ebx
push 0
push str.HummerEngine_aec3a622_bf49_420e_a062_08d7a0c00d31
push esi
push 0
call dword [sym.imp.USER32.dll_FindWindowExA]
mov esi, eax
test esi, esi
jne 0x10011190
mov ebx, dword [esp + 0x10]
pop ebp
push edi
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [esp + 0x45c]
push eax
lea ecx, [esp + 0x55]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [esp + 0x450]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1001c89c
add esp, 0x448
ret 8
Function at 0x10011280
Capabilities:
Enumerate process modules
Enumerate processes
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x54c
mov eax, dword [0x1003f050]
xor eax, esp
mov dword [esp + 0x548], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x100112f8
cmp dword [ebp + 0xc], 0
je 0x100112f8
push 0
push 2
mov dword [esp + 0x14], 0
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
push 0x124
mov ebx, eax
lea eax, [esp + 0x430]
push 0
push eax
mov dword [esp + 0x434], 0x128
call fcn.1001eb30
add esp, 0xc
lea ecx, [esp + 0x428]
push ecx
push ebx
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x10011311
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x548]
xor ecx, esp
call fcn.1001c89c
mov esp, ebp
pop ebp
ret 8
lea edx, [esp + 0x44c]
push 0x100374b4
push edx
call fcn.10024c19
add esp, 8
test eax, eax
je 0x100113c5
lea eax, [esp + 0x428]
push eax
push ebx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x10011311
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call esi
cmp dword [esp + 0xc], 0
jne 0x10011387
mov esi, dword [ebp + 0xc]
lea eax, [esp + 0x10]
push eax
push edi
lea ecx, [esp + 0x1c]
push ecx
push str.Install
push str.SOFTWARETencentQQ2009
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x2c], 1
mov dword [esp + 0x28], esi
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x100113aa
mov dword [esp + 0xc], esi
push edi
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
dec edi
mov eax, edi
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x10011391
mov edx, dword [str.Bin_]
mov dword [eax], edx
mov cl, byte [0x100374e0]
mov byte [eax + 4], cl
mov ecx, dword [esp + 0x554]
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1001c89c
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [esp + 0x430]
push ecx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0x40c
lea edx, [esp + 0x20]
push 0
push edx
mov esi, eax
mov dword [esp + 0x24], 0
call fcn.1001eb30
add esp, 0xc
lea eax, [esp + 0x10]
push eax
push 0x410
lea ecx, [esp + 0x20]
push ecx
push esi
mov dword [esp + 0x20], 0
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x10011440
mov edx, dword [esp + 0x18]
push 0x104
push edi
push edx
push esi
call sub.PSAPI.DLL_GetModuleFileNameExA
mov dword [esp + 0xc], eax
test eax, eax
je 0x10011440
push edi
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
push edi
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push ebx
call esi
jmp 0x10011346
Function at 0x100114c0
Capabilities:
Get file version info

Disassembly:
sub esp, 0xc
test ebx, ebx
jne 0x100114cf
xor eax, eax
add esp, 0xc
ret 8
cmp dword [esp + 0x10], 0
je 0x100114c7
cmp dword [esp + 0x14], 0
je 0x100114c7
push esi
lea eax, [esp + 4]
push eax
push ebx
mov dword [esp + 0xc], 0
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
jne 0x100114fe
pop esi
add esp, 0xc
ret 8
push edi
push esi
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ecx, dword [esp + 8]
mov edi, eax
push edi
push esi
push ecx
push ebx
call sub.VERSION.dll_GetFileVersionInfoA
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x14]
push eax
push str.StringFileInfo080404B0ProductName
push edi
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
call sub.VERSION.dll_VerQueryValueA
cmp dword [esp + 0xc], 0
jne 0x10011554
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
xor eax, eax
pop esi
add esp, 0xc
ret 8
mov eax, dword [esp + 0x10]
test eax, eax
je 0x1001156d
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push ecx
push eax
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
pop edi
pop esi
add esp, 0xc
ret 8

Function at 0x10011660
Capabilities:
Get file version info

Disassembly:
sub esp, 0xc
cmp dword [esp + 0x10], 0
jne 0x10011672
xor eax, eax
add esp, 0xc
ret 8
push esi
lea eax, [esp + 4]
push eax
push ebx
mov dword [esp + 0xc], 0
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
jne 0x10011693
pop esi
add esp, 0xc
ret 8
push edi
push esi
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ecx, dword [esp + 8]
mov edi, eax
push edi
push esi
push ecx
push ebx
call sub.VERSION.dll_GetFileVersionInfoA
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x14]
push eax
push str.StringFileInfo080404B0ProductVersion
push edi
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
call sub.VERSION.dll_VerQueryValueA
cmp dword [esp + 0xc], 0
jne 0x100116e9
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
xor eax, eax
pop esi
add esp, 0xc
ret 8
mov eax, dword [esp + 0x10]
test eax, eax
je 0x10011702
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push ecx
push eax
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
pop edi
pop esi
add esp, 0xc
ret 8