joyce8/EMBER2024-capa huggingface dataset:
Function at 0x462e70
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5896e6
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x610304]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
lea ecx, [ebp - 0x224]
push ecx
mov dword [ebp - 0x220], eax
call fcn.0049a3b0
push esi
push eax
lea edx, [ebp - 0x21c]
push edx
mov dword [ebp - 4], 0
call sym.txupd.exe_class_CTXStringW___cdecl_operator_class_CTXStringW_const___class_CTXStringW_const__
add esp, 0x10
lea ecx, [ebp - 0x224]
mov byte [ebp - 4], 2
call sym.txupd.exe_public:_void___thiscall_CTXStringW::destructor_void_
push 0x206
lea eax, [ebp - 0x216]
push 0
push eax
mov word [ebp - 0x218], 0
call sub.MSVCR80.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x21c]
call sym.txupd.exe_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const
push eax
push 0x103
lea ecx, [ebp - 0x218]
push ecx
push 0
mov ecx, edi
call sym.txupd.exe_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const
push eax
push 0x5a696c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x218]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x462f34
sub eax, edx
sar eax, 1
jne 0x462f5b
lea ecx, [ebp - 0x21c]
mov dword [ebp - 4], 0xffffffff
call sym.txupd.exe_public:_void___thiscall_CTXStringW::destructor_void_
xor eax, eax
jmp 0x462f84
mov ecx, dword [ebp - 0x220]
lea edx, [ebp - 0x218]
push edx
call sym.txupd.exe_public:_class_CTXStringW____thiscall_CTXStringW::operator_wchar_t__
lea ecx, [ebp - 0x21c]
mov dword [ebp - 4], 0xffffffff
call sym.txupd.exe_public:_void___thiscall_CTXStringW::destructor_void_
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00584870
mov esp, ebp
pop ebp
ret 0xc
Function at 0x463280
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push esi
xor esi, esi
cmp dword [ebp + 0xc], esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0xc], str.E:_txupdatecodingTXUpdate_servicelogicDataReport.cpp
mov dword [ebp - 8], str.CDataReport::OnDownloadComplete
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x34], esi
jne 0x46331f
cmp dword [0x6112f0], esi
mov dword [ebp + 0xc], str.data_report:_sync_data_to_server_succeed.__n
mov dword [ebp - 0x38], 0x11c
je 0x4632cd
call edi
mov dword [ebp - 0x3c], 2
jmp 0x4632d6
call edi
mov dword [ebp - 0x3c], 3
mov dword [ebp - 0x30], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x28], esi
call dword [sym.imp.MSVCR80.dll__time64]
lea ecx, [ebp + 0xc]
push ecx
push 0x5a48f0
lea edx, [ebp - 0x40]
push 0x5a6934
push edx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
call sym.txupd.exe_void___cdecl_TXLog_DoTXLogVW_struct_tagLogObj___wchar_t_const___wchar_t_const___char__
add esp, 0x14
push str.data_report:_sync_data_to_server_succeed.__n
call dword [sym.imp.MSVCR80.dll_wprintf]
add esp, 4
jmp 0x46337a
mov dword [ebp + 0xc], str.data_report:_sync_data_to_server_failed_at_http_response.__n
mov dword [ebp - 0x38], 0x120
call edi
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x3c], 2
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x28], esi
call dword [sym.imp.MSVCR80.dll__time64]
lea ecx, [ebp + 0xc]
push ecx
push 0x5a48f0
lea edx, [ebp - 0x40]
push 0x5a6934
push edx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
call sym.txupd.exe_void___cdecl_TXLog_DoTXLogVW_struct_tagLogObj___wchar_t_const___wchar_t_const___char__
push str.data_report:_sync_data_to_server_failed_at_http_response.__n
call dword [sym.imp.MSVCR80.dll_wprintf]
add esp, 0x18
push esi
push esi
push 0x1789
call edi
push eax
call dword [sym.imp.USER32.dll_PostThreadMessageW]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x4680f0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58a2d0
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x610304]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp + 8]
mov dword [ebp - 4], 0
call sym.txupd.exe_public:_bool___thiscall_CTXStringW::IsEmpty_void_const
test al, al
je 0x46814a
lea ecx, [ebp + 8]
mov dword [ebp - 4], 0xffffffff
call sym.txupd.exe_public:_void___thiscall_CTXStringW::destructor_void_
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
push 0
push ecx
lea eax, [ebp + 8]
mov ecx, esp
mov dword [ebp - 0x10], esp
push eax
call sym.txupd.exe_public:_void___thiscall_CTXStringW::constructor_class_CTXStringW_const__
lea ecx, [ebp - 0x10]
push ecx
call fcn.00499e90
add esp, 0xc
push eax
lea ecx, [ebp + 8]
mov byte [ebp - 4], 1
call fcn.0049f0c7
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0
call sym.txupd.exe_public:_void___thiscall_CTXStringW::destructor_void_
lea edx, [ebp + 8]
push 1
push edx
call fcn.004991c0
add esp, 8
lea ecx, [ebp + 8]
call sym.txupd.exe_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
lea ecx, [ebp + 8]
jne 0x4681c7
mov dword [ebp - 4], 0xffffffff
call sym.txupd.exe_public:_void___thiscall_CTXStringW::destructor_void_
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
push 0
call sym.txupd.exe_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const
push eax
call fcn.004997e0
add esp, 8
lea ecx, [ebp + 8]
mov esi, eax
mov dword [ebp - 4], 0xffffffff
call sym.txupd.exe_public:_void___thiscall_CTXStringW::destructor_void_
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x46af60
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58a890
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x610304]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor esi, esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call dword [sym.imp.MSVCR80.dll_srand]
add esp, 4
lea ecx, [ebp - 0x10]
call sym.txupd.exe_public:_void___thiscall_CTXStringW::constructor_void_
mov edi, dword [sym.imp.MSVCR80.dll_rand]
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileW]
mov byte [ebp - 4], 1
call edi
cdq
mov ecx, 0x3e8
idiv ecx
lea ecx, [ebp + 8]
push edx
call sym.txupd.exe_public:_wchar_t____thiscall_CTXStringW::GetBuffer_void_
push eax
lea edx, [ebp - 0x10]
push 0x5a79c4
push edx
call sym.txupd.exe_public:_void___cdecl_CTXStringW::Format_wchar_t_const__
add esp, 0x10
lea ecx, [ebp - 0x10]
call sym.txupd.exe_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const
push eax
lea ecx, [ebp + 8]
call sym.txupd.exe_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const
push eax
call ebx
test eax, eax
jne 0x46b00a
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
add esi, 1
cmp esi, 0xa
jl 0x46afb8
mov esi, dword [ebp - 0x14]
jmp 0x46b00f
mov esi, 1
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x10]
push eax
call fcn.0049f0c7
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0
call sym.txupd.exe_public:_void___thiscall_CTXStringW::destructor_void_
lea ecx, [ebp + 8]
mov dword [ebp - 4], 0xffffffff
call sym.txupd.exe_public:_void___thiscall_CTXStringW::destructor_void_
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x46b050
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58a8b8
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x610304]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
mov dword [ebp - 4], esi
xor ebx, ebx
lea ecx, [ebp + 0xc]
call sym.txupd.exe_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const
push eax
lea ecx, [ebp + 8]
call sym.txupd.exe_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x46b0ac
push 0x32
call edi
add esi, 1
cmp esi, 0xa
jl 0x46b082
jmp 0x46b0b1
mov ebx, 1
lea ecx, [ebp + 8]
call sym.txupd.exe_public:_void___thiscall_CTXStringW::destructor_void_
lea ecx, [ebp + 0xc]
mov dword [ebp - 4], 0xffffffff
call sym.txupd.exe_public:_void___thiscall_CTXStringW::destructor_void_
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x46c0a0
Capabilities:
Delete file
Get file attributes
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
mov ecx, dword [esi + 4]
test ecx, ecx
push edi
je 0x46c0b7
call fcn.00474210
mov ecx, dword [esi + 0xc]
mov ebx, dword [ecx]
lea eax, [esi + 8]
mov edi, eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], edi
lea ebx, [ebx]
test edi, edi
mov esi, dword [eax + 4]
je 0x46c0db
cmp edi, eax
je 0x46c0e1
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
cmp ebx, esi
je 0x46c182
test edi, edi
jne 0x46c0f3
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
cmp ebx, dword [edi + 4]
jne 0x46c0fe
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
lea esi, [ebx + 0x10]
mov ecx, esi
call sym.txupd.exe_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
je 0x46c132
cmp ebx, dword [edi + 4]
jne 0x46c11e
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
push 1
mov ecx, esi
call sym.txupd.exe_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const
push eax
call fcn.004997e0
add esp, 8
jmp 0x46c16c
cmp ebx, dword [edi + 4]
jne 0x46c13d
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov ecx, esi
call sym.txupd.exe_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x46c16c
cmp ebx, dword [edi + 4]
jne 0x46c15a
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
push 4
push 0
mov ecx, esi
call sym.txupd.exe_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea ecx, [ebp - 0xc]
call fcn.0045c670
mov ebx, dword [ebp - 8]
mov edi, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
jmp 0x46c0d0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46c6e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58abfe
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x610304]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.CFastMerge.0
lea ecx, [esi + 0x84]
mov dword [ebp - 4], 9
call sym.txupd.exe_public:_void___thiscall_CTXStringW::destructor_void_
lea ecx, [esi + 0x80]
mov byte [ebp - 4], 8
call sym.txupd.exe_public:_void___thiscall_CTXStringW::destructor_void_
lea ecx, [esi + 0x70]
mov byte [ebp - 4], 7
call fcn.0046c330
lea ecx, [esi + 0x60]
mov byte [ebp - 4], 6
call fcn.0046c330
lea ecx, [esi + 0x50]
mov byte [ebp - 4], 5
call fcn.0046c330
lea ecx, [esi + 0x40]
mov byte [ebp - 4], 4
call fcn.0046c330
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 3
call fcn.0046c330
lea ecx, [esi + 0x20]
mov byte [ebp - 4], 2
call fcn.0046c330
mov eax, dword [esi + 0x18]
mov ecx, dword [eax]
lea edi, [esi + 0x14]
push eax
push edi
push ecx
push edi
lea eax, [ebp - 0x18]
push eax
mov ecx, edi
mov byte [ebp - 4], 1
call fcn.0045e720
mov eax, dword [edi + 4]
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
xor ebx, ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov eax, dword [esi + 0xc]
mov ecx, dword [eax]
add esp, 4
lea edi, [esi + 8]
push eax
push edi
push ecx
push edi
lea ecx, [ebp - 0x18]
push ecx
mov ecx, edi
mov byte [ebp - 4], bl
call fcn.0045e720
mov edx, dword [edi + 4]
push edx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
add esp, 4
mov dword [esi], vtable.IMergeStrategy.0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46f370
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0xc]
xor ebx, ebx
cmp eax, ebx
je 0x46f398
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
add esp, 4
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 4], ebx
cmp dword [esi + 0x1c], ebx
push edi
je 0x46f3b9
lea edi, [esi + 0x18]
push 0xffffffffffffffff
mov ecx, edi
call sym.txupd.exe_public:_void___thiscall_CTXStringW::ReleaseBuffer_int_
push 0x5a3f7c
mov ecx, edi
call fcn.0049f071
mov dword [esi + 0x1c], ebx
mov eax, dword [ebp + 8]
lea edi, [esi + 0x18]
push eax
mov ecx, edi
call fcn.0049f071
mov ecx, edi
call sym.txupd.exe_public:_int___thiscall_CTXStringW::GetLength_void_const
push eax
mov ecx, edi
call sym.txupd.exe_public:_wchar_t____thiscall_CTXStringW::GetBuffer_int_
push ebx
push eax
mov dword [esi + 0x1c], eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
cmp eax, ebx
mov dword [esi + 8], eax
pop edi
je 0x46f412
push eax
call fcn.0058432a
add esp, 4
cmp eax, ebx
mov dword [esi + 0xc], eax
je 0x46f412
mov ecx, dword [esi + 8]
mov edx, dword [esi + 0x1c]
push eax
push ecx
push ebx
push edx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x46f41a
mov ecx, esi
call fcn.0046f230
pop esi
xor eax, eax
pop ebx
pop ebp
ret 4
mov edx, dword [esi + 0xc]
lea eax, [esi + 0x14]
push eax
lea ecx, [esi + 0x10]
push ecx
push 0x5d13ac
push edx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x46f40b
mov eax, 1
mov dword [esi + 4], eax
pop esi
pop ebx
pop ebp
ret 4
Function at 0x4765e0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58c1f1
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x610304]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ebx, [esi + 4]
mov ecx, ebx
call sym.txupd.exe_public:_void___thiscall_CTXStringW::constructor_void_
xor edi, edi
lea ecx, [esi + 8]
mov dword [ebp - 4], edi
call sym.txupd.exe_public:_void___thiscall_CTXStringW::constructor_void_
lea ecx, [esi + 0xc]
mov byte [ebp - 4], 1
call sym.txupd.exe_public:_void___thiscall_CTXStringW::constructor_void_
push 0x5a3f7c
mov ecx, ebx
mov byte [ebp - 4], 2
mov dword [esi], edi
call fcn.0049f071
push 0x5a3f7c
lea ecx, [esi + 8]
call fcn.0049f071
push 0x5a3f7c
lea ecx, [esi + 0xc]
call fcn.0049f071
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x476690
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58c231
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x610304]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ebx, [esi + 4]
mov ecx, ebx
call sym.txupd.exe_public:_void___thiscall_CTXStringW::constructor_void_
lea ecx, [esi + 8]
mov dword [ebp - 4], 0
call sym.txupd.exe_public:_void___thiscall_CTXStringW::constructor_void_
lea ecx, [esi + 0xc]
mov byte [ebp - 4], 1
call sym.txupd.exe_public:_void___thiscall_CTXStringW::constructor_void_
mov edi, dword [ebp + 8]
mov eax, dword [edi]
lea ecx, [edi + 4]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 2
mov dword [esi], eax
call fcn.0049f0c7
lea edx, [edi + 8]
push edx
lea ecx, [esi + 8]
call fcn.0049f0c7
lea eax, [edi + 0xc]
push eax
lea ecx, [esi + 0xc]
call fcn.0049f0c7
mov ecx, dword [edi + 0x10]
mov dword [esi + 0x10], ecx
mov edx, dword [edi + 0x14]
mov dword [esi + 0x14], edx
mov eax, dword [edi + 0x18]
mov dword [esi + 0x18], eax
mov ecx, dword [edi + 0x1c]
mov dword [esi + 0x1c], ecx
mov edx, dword [edi + 0x24]
mov dword [esi + 0x24], edx
mov eax, dword [edi + 0x28]
mov dword [esi + 0x28], eax
mov ecx, dword [edi + 0x2c]
mov dword [esi + 0x2c], ecx
mov edx, dword [edi + 0x30]
mov dword [esi + 0x30], edx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4778e0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58c476
mov eax, dword fs:[0]
push eax
mov eax, 0x1014
call fcn.005848d0
mov eax, dword [0x610304]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov edi, ecx
mov ecx, esi
mov dword [ebp - 0x101c], eax
call sym.txupd.exe_public:_bool___thiscall_CTXStringW::IsEmpty_void_const
test al, al
jne 0x477a96
lea ecx, [ebp - 0x1020]
push ecx
call fcn.0049a3b0
push str.resume.db
push eax
lea edx, [ebp - 0x1014]
push edx
mov dword [ebp - 4], 0
call sym.txupd.exe_class_CTXStringW___cdecl_operator_class_CTXStringW_const___wchar_t_const__
add esp, 0x10
lea ecx, [ebp - 0x1020]
mov byte [ebp - 4], 2
call sym.txupd.exe_public:_void___thiscall_CTXStringW::destructor_void_
push 0xffe
lea eax, [ebp - 0x100e]
push 0
push eax
mov word [ebp - 0x1010], 0
call sub.MSVCR80.dll_memset
add esp, 0xc
mov ecx, esi
call sym.txupd.exe_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const
push eax
lea ecx, [ebp - 0x1018]
push ecx
mov ecx, edi
call fcn.004776a0
lea ecx, [ebp - 0x1014]
mov esi, eax
call sym.txupd.exe_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const
push eax
push 0x7ff
lea edx, [ebp - 0x1010]
push edx
push 0x5a9b0c
mov ecx, esi
call sym.txupd.exe_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const
push eax
push str.Resume
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [ebp - 0x1018]
call sym.txupd.exe_public:_void___thiscall_CTXStringW::destructor_void_
lea ecx, [ebp - 0x1010]
mov eax, 0x5a9b0c
mov dx, word [eax]
or edi, 0xffffffff
cmp dx, word [ecx]
jne 0x477a0b
test dx, dx
je 0x477a07
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x477a0b
add eax, 4
add ecx, 4
test dx, dx
jne 0x4779e2
xor eax, eax
jmp 0x477a0f
sbb eax, eax
sbb eax, edi
test eax, eax
je 0x477a88
lea eax, [ebp - 0x1010]
push eax
lea ecx, [ebp - 0x1018]
push ecx
call sym.txupd.exe_class_CTXStringW___cdecl_FS::ConvertToPureFile_wchar_t_const__
add esp, 8
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
mov ecx, eax
call sym.txupd.exe_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
lea ecx, [ebp - 0x1018]
mov esi, eax
call sym.txupd.exe_public:_void___thiscall_CTXStringW::destructor_void_
cmp esi, edi
je 0x477a88
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x101c]
lea edx, [ebp - 0x1010]
push edx
call sym.txupd.exe_public:_class_CTXStringW____thiscall_CTXStringW::operator_wchar_t__
lea ecx, [ebp - 0x1014]
mov dword [ebp - 4], edi
call sym.txupd.exe_public:_void___thiscall_CTXStringW::destructor_void_
mov eax, 1
jmp 0x477a98
lea ecx, [ebp - 0x1014]
mov dword [ebp - 4], edi
call sym.txupd.exe_public:_void___thiscall_CTXStringW::destructor_void_
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00584870
mov esp, ebp
pop ebp
ret 8
Function at 0x47c4f0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
cmp dword [ebp + 8], 0x13a1
push edi
mov edi, ecx
jne 0x47c5f9
push esi
xor esi, esi
cmp dword [ebp + 0xc], esi
mov dword [ebp - 0xc], str.E:_txupdatecodingTXUpdate_servicelogicNPkgFetcher.cpp
mov dword [ebp - method.CNPkgFetcher.3.virtual_8], str.CNPkgFetcher::OnThreadCallBack
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x34], esi
je 0x47c588
mov dword [ebp + 8], str.check_qq_setup_package_signature_pass_n
mov dword [ebp - 0x38], 0x86
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x3c], 2
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x28], esi
call dword [sym.imp.MSVCR80.dll__time64]
lea ecx, [ebp + 8]
push ecx
push 0x5a48f0
lea edx, [ebp - 0x40]
push 0x5aa820
push edx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
call sym.txupd.exe_void___cdecl_TXLog_DoTXLogVW_struct_tagLogObj___wchar_t_const___wchar_t_const___char__
push str.check_qq_setup_package_signature_pass_n
call dword [sym.imp.MSVCR80.dll_wprintf]
add esp, 0x18
push esi
push esi
jmp 0x47c5ed
mov dword [ebp + 8], str.fatal_error__bad_signature_info_in_qq_setup_package_n
mov dword [ebp - 0x38], 0x8b
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x3c], 2
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x28], esi
call dword [sym.imp.MSVCR80.dll__time64]
lea ecx, [ebp + 8]
push ecx
push 0x5a48f0
lea edx, [ebp - 0x40]
push 0x5aa820
push edx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
call sym.txupd.exe_void___cdecl_TXLog_DoTXLogVW_struct_tagLogObj___wchar_t_const___wchar_t_const___char__
push str.fatal_error__bad_signature_info_in_qq_setup_package_n
call dword [sym.imp.MSVCR80.dll_wprintf]
add esp, 0x18
push esi
push 0xfffffbd1
mov eax, dword [edi + 0x40]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
push eax
call edx
pop esi
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x47ce60
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58cbf0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x610304]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10]
push eax
call sym.txupd.exe_int___cdecl_Util::Data::CreateTXData_struct_ITXData___
mov esi, dword [ebp - 0x10]
lea ecx, [ebp - 0x14]
push str.progress
push ecx
call fcn.0044ced0
add esp, 0xc
mov edx, dword [ebp + 0xc]
mov ebx, dword [esi]
push edx
mov ecx, eax
mov byte [ebp - 4], 1
call sym.txupd.exe_public:_wchar_t____thiscall_CTXBSTR::operator_wchar_t__void_const
push eax
mov eax, dword [ebx + 0xe4]
push esi
call eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0
call sym.txupd.exe_public:_void___thiscall_CTXBSTR::destructor_void_
mov edx, dword [ebp - 0x10]
mov eax, dword [edi + 0x30]
mov ecx, dword [eax]
push edx
push 2
push eax
mov eax, dword [ecx + 0xc]
call eax
mov eax, dword [ebp - 0x10]
test eax, eax
mov dword [ebp - 4], 0xffffffff
je 0x47cefd
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc