joyce8/EMBER2024-capa huggingface dataset:
Function at 0x464130
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4ef6a3
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x52b360]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
mov esi, dword [esp + 0x18]
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esi], vtable.HistoryData::CHistoryDataElement.0
mov dword [esi + 8], vtable.HistoryData::CJsonHistoryStringValue.0
mov dword [esi + 0x24], 0xf
mov dword [esi + 0x20], eax
mov byte [esi + 0x10], al
mov dword [esi + 0x28], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
push eax
push 0x4feaba
lea ecx, [esi + 0xc]
mov byte [esp + 0x18], 1
call fcn.00404980
mov eax, esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0xc
ret 4

Function at 0x465560
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x4f1f98
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x52b360]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push ebp
push edi
mov eax, dword [0x52b360]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
xor ebx, ebx
cmp byte [esi + 0xd], bl
jne 0x465610
cmp dword [esi + 0x24], ebx
je 0x465610
lea eax, [esp + 0x10]
push eax
mov edi, str.Config.json.temp
call fcn.0047fc80
add esp, 4
mov dword [esp + 0x38], ebx
lea ecx, [esi + 0x54]
mov ebp, 8
mov byte [ecx], bl
cmp dword [esi + 0x28], ebp
jb 0x4655c7
mov eax, dword [esi + 0x14]
jmp 0x4655ca
lea eax, [esi + 0x14]
mov dword [esi + 0x5c], eax
mov eax, dword [esp + 0x14]
cmp dword [esp + 0x28], ebp
jae 0x4655db
lea eax, [esp + 0x14]
mov dword [esi + 0x60], eax
mov dword [esi + 0x58], ebx
mov eax, dword [0x532fe0]
cmp eax, ebx
je 0x4655ed
push ecx
call eax
cmp byte [esi + 0xd], bl
je 0x465630
mov eax, dword [esp + 0x14]
cmp dword [esp + 0x28], ebp
jae 0x465600
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [esp + 0x10]
call fcn.004016f0
xor al, al
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.004c8f08
add esp, 0x2c
ret
cmp dword [esi + 0x58], 2
jne 0x465683
mov eax, dword [esp + 0x14]
cmp dword [esp + 0x28], ebp
jae 0x465644
lea eax, [esp + 0x14]
push eax
call fcn.004661d0
add esp, 4
test al, al
je 0x465683
mov ecx, dword [esi + 0x50]
push ecx
mov edi, str.jsoncon_ver
call fcn.0047f9a0
mov edx, dword [esi + 0x48]
push edx
mov edi, str.jsoncon_resolvH
call fcn.0047f9a0
mov eax, dword [esi + 0x4c]
push eax
mov edi, str.jsoncon_resolvV
call fcn.0047f9a0
mov byte [esi + 0xc], bl
add esp, 0xc
mov bl, 1
mov eax, dword [esp + 0x14]
cmp dword [esp + 0x28], ebp
jae 0x465691
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [esp + 0x10]
call fcn.004016f0
mov al, bl
jmp 0x465612
Function at 0x465f30
Capabilities:
Check if file exists
Read .ini file

Disassembly:
sub esp, 0x3c
mov eax, dword [0x52b360]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push ebp
push esi
push edi
lea esi, [esp + 0x10]
call fcn.0047fd60
mov ebp, 8
cmp dword [eax + 0x18], ebp
jb 0x465f5a
mov eax, dword [eax + 4]
jmp 0x465f5d
add eax, 4
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push eax
push 0
push str.jsoncon_resolvH
push str.wallpaper
call edi
mov ebx, eax
cmp dword [esp + 0x28], ebp
jb 0x465f87
mov eax, dword [esp + 0x14]
push eax
call fcn.004c8f17
add esp, 4
lea esi, [esp + 0x10]
call fcn.0047fd60
cmp dword [eax + 0x18], ebp
jb 0x465f9a
mov eax, dword [eax + 4]
jmp 0x465f9d
add eax, 4
push eax
push 0
push str.jsoncon_resolvV
push str.wallpaper
call edi
mov esi, eax
cmp dword [esp + 0x28], ebp
jb 0x465fc1
mov ecx, dword [esp + 0x14]
push ecx
call fcn.004c8f17
add esp, 4
mov eax, dword [esp + 0x50]
cmp ebx, dword [eax + 0x48]
jne 0x466041
cmp dword [eax + 0x4c], esi
jne 0x466041
test ebx, ebx
je 0x466041
push 0
push str.jsoncon_ver
call fcn.0047f8b0
mov esi, eax
add esp, 8
test esi, esi
je 0x466041
lea edx, [esp + 0x2c]
push edx
mov edi, 0x50a018
call fcn.0047fc80
mov eax, dword [esp + 0x34]
add esp, 4
cmp dword [esp + 0x44], ebp
jae 0x466008
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea ecx, [esp + 0x2c]
test eax, eax
je 0x46603c
mov eax, dword [esp + 0x50]
cmp esi, dword [eax + 0x50]
jne 0x46603c
call fcn.004016f0
pop edi
pop esi
pop ebp
xor al, al
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.004c8f08
add esp, 0x3c
ret 4
call fcn.004016f0
mov ecx, dword [esp + 0x48]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
mov al, 1
call fcn.004c8f08
add esp, 0x3c
ret 4
Function at 0x466750
Capabilities:
Read file via mapping

Disassembly:
cmp byte [eax], 0
jne 0x46675a
xor eax, eax
ret 4
mov eax, dword [eax + 4]
push esi
push 0
push 0
push 0
push 6
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
jne 0x466777
pop esi
ret 4
push 0x100c
push 0
push esi
call fcn.004d1df0
mov ecx, dword [esp + 0x14]
push 0x100c
push ecx
push esi
call fcn.004d0a80
add esp, 0x18
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, 1
pop esi
ret 4

Function at 0x4667b0
Capabilities:
Read file via mapping

Disassembly:
cmp byte [eax], 0
jne 0x4667b8
xor eax, eax
ret
mov eax, dword [eax + 4]
push esi
push 0
push 0
push 0
push 6
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
jne 0x4667d3
pop esi
ret
push 0x100c
push 0
push edi
call fcn.004d1df0
push 0x100c
push esi
push edi
call fcn.004d0a80
add esp, 0x18
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, 1
pop esi
ret
Function at 0x468d40
Capabilities:
Check internet connectivity via wininet

Disassembly:
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCheckConnectionW]
push 0
push 1
push 0x50a1bc
call esi
test eax, eax
jne 0x468d6e
push eax
push 1
push str.http:__www.qq.com
call esi
test eax, eax
jne 0x468d6e
push eax
push 1
push str.http:__www.160.com
call esi
xor ecx, ecx
test eax, eax
setne cl
mov al, cl
pop esi
ret

Function at 0x469240
Capabilities:
Check if file exists
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x4ed4d9
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x52b360]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov eax, 7
xor esi, esi
xor ecx, ecx
mov dword [esp + 0x10], 0x534200
mov dword [0x534218], eax
mov dword [0x534214], esi
mov word [0x534204], cx
mov dword [esp + 0x38], esi
xor edx, edx
mov dword [0x534234], eax
mov dword [0x534230], esi
mov word [0x534220], dx
mov dword [0x534250], eax
mov dword [0x53424c], esi
mov word [0x53423c], cx
mov dword [0x53426c], eax
mov dword [0x534268], esi
mov word [0x534258], dx
mov bl, 3
mov edi, str.DTLScreenSave.exe
lea ecx, [esp + 0x14]
mov byte [esp + 0x38], bl
call fcn.0047fda0
push 0xffffffffffffffff
push esi
push eax
mov eax, 0x534200
mov byte [esp + 0x44], 4
call fcn.00401850
mov byte [esp + 0x38], bl
mov ebx, 8
cmp dword [esp + 0x2c], ebx
jb 0x469308
mov eax, dword [esp + 0x18]
push eax
call fcn.004c8f17
add esp, 4
mov ecx, str._screensave
lea edi, [esp + 0x14]
call fcn.0047e4c0
push 0xffffffffffffffff
push esi
push eax
mov eax, 0x534254
mov byte [esp + 0x44], 5
call fcn.00401850
cmp dword [esp + 0x2c], ebx
jb 0x46933c
mov ecx, dword [esp + 0x18]
push ecx
call fcn.004c8f17
add esp, 4
mov eax, dword [0x534258]
cmp dword [0x53426c], ebx
jae 0x46934e
mov eax, 0x534258
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x469373
mov eax, dword [0x534258]
cmp dword [0x53426c], ebx
jae 0x46936b
mov eax, 0x534258
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov eax, 0x534200
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x2c
ret
Function at 0x469450
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x4f1f38
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x52b360]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
mov eax, dword [0x52b360]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov eax, dword [esp + 0x38]
mov esi, ecx
xor ecx, ecx
push 0xffffffffffffffff
add eax, 0x54
push ecx
push eax
lea eax, [esp + 0x14]
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], 0
mov word [esp + 0x18], cx
call fcn.00401850
push 1
push 0x4fea60
lea eax, [esp + 0x10]
mov dword [esp + 0x38], 0
call fcn.004088a0
mov eax, esi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4694d0
sub eax, edx
sar eax, 1
push eax
push esi
lea eax, [esp + 0x10]
call fcn.004088a0
mov eax, dword [esp + 0xc]
mov esi, 8
cmp dword [esp + 0x20], esi
jae 0x4694fd
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [esp + 0x20], esi
jb 0x469517
mov edx, dword [esp + 0xc]
push edx
call fcn.004c8f17
add esp, 4
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.004c8f08
add esp, 0x2c
ret 4
Function at 0x469800
Capabilities:
Check if file exists

Disassembly:
push ecx
push ebx
push edi
test ecx, ecx
jne 0x46980d
xor al, al
pop edi
pop ebx
pop ecx
ret
push esi
call fcn.00469e70
test al, al
je 0x469807
cmp dword [esi + 0x50], 8
jb 0x469822
mov eax, dword [esi + 0x3c]
jmp 0x469825
lea eax, [esi + 0x3c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x469807
cmp dword [esi + 0x4c], 0
je 0x469807
mov edi, esi
call fcn.004698f0
mov bl, al
mov byte [esp + 8], bl
test bl, bl
je 0x469859
cmp dword [esi + 0x6c], 8
jb 0x469853
mov eax, dword [esi + 0x58]
push eax
jmp 0x46985e
lea eax, [esi + 0x58]
push eax
jmp 0x46985e
push 0x502ad8
mov edi, str.screensave
call fcn.0047f900
mov eax, dword [esp + 0xc]
add esp, 4
push eax
push esi
call fcn.00469540
neg al
sbb al, al
pop edi
and al, bl
pop ebx
pop ecx
ret
Function at 0x4698f0
Capabilities:
Check if file exists
Copy file
Get common file path
Get startup folder
Write file to startup folder

Disassembly:
push 0xffffffffffffffff
push 0x4f055b
mov eax, dword fs:[0]
push eax
sub esp, 0x230
mov eax, dword [0x52b360]
xor eax, esp
mov dword [esp + 0x22c], eax
push ebx
push ebp
push esi
mov eax, dword [0x52b360]
xor eax, esp
push eax
lea eax, [esp + 0x240]
mov dword fs:[0], eax
cmp dword [edi + 0x18], 8
lea ebp, [edi + 4]
jb 0x469938
mov eax, dword [ebp]
jmp 0x46993a
mov eax, ebp
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x469ab8
mov eax, dword [edi + 0x14]
xor ebx, ebx
cmp eax, ebx
je 0x469ab8
push 0x206
lea ecx, [esp + 0x3a]
xor eax, eax
push ebx
push ecx
mov word [esp + 0x40], ax
call fcn.004d1df0
add esp, 0xc
push ebx
push 0x25
lea edx, [esp + 0x3c]
push edx
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
xor eax, eax
mov word [esp + 0x1c], ax
lea eax, [esp + 0x34]
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], ebx
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4699a0
sub eax, edx
sar eax, 1
push eax
lea ecx, [esp + 0x38]
push ecx
lea esi, [esp + 0x20]
call fcn.00401760
push 1
push 0x4fea60
mov eax, esi
mov dword [esp + 0x250], ebx
call fcn.004088a0
push 0x11
push str.dtlscreensave.scr
mov eax, esi
call fcn.004088a0
push 0xffffffffffffffff
push ebx
mov edx, esi
push edx
lea eax, [edi + 0x1c]
call fcn.00401850
mov dword [esp + 0x14], ebx
call fcn.00462170
test al, al
je 0x469a08
lea eax, [esp + 0x14]
push eax
call fcn.00469e00
mov ebx, eax
mov ecx, edi
call fcn.00469b70
test al, al
je 0x469a31
test ebx, ebx
je 0x469a21
lea ecx, [esp + 0x14]
push ecx
call fcn.00469e00
lea ecx, [esp + 0x18]
call fcn.004016f0
mov al, 1
jmp 0x469aba
mov ecx, dword [esp + 0x1c]
mov eax, 8
cmp dword [esp + 0x30], eax
jae 0x469a44
lea ecx, [esp + 0x1c]
cmp dword [edi + 0x18], eax
jb 0x469a4e
mov eax, dword [ebp]
jmp 0x469a50
mov eax, ebp
push 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov esi, eax
test esi, esi
jne 0x469a87
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.screensave_wallpaper_CopyFile_fail_error___d
push 0xb0
push 1
call fcn.004845b0
mov ecx, eax
mov eax, str..wallpaperScreenSaveMgr.cpp
call fcn.00484890
add esp, 0x10
cmp dword [esp + 0x30], 8
mov eax, dword [esp + 0x1c]
jae 0x469a96
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x469ae1
test ebx, ebx
je 0x469aaf
mov edx, dword [esp + 0x14]
push edx
call fcn.00469e30
lea ecx, [esp + 0x18]
call fcn.004016f0
xor al, al
mov ecx, dword [esp + 0x240]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x22c]
xor ecx, esp
call fcn.004c8f08
add esp, 0x23c
ret
test ebx, ebx
je 0x469aef
mov eax, dword [esp + 0x14]
push eax
call fcn.00469e30
lea ecx, [esp + 0x18]
call fcn.004016f0
test esi, esi
setne al
jmp 0x469aba
Function at 0x469b00
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x3c
push esi
push 0x38
mov esi, eax
lea eax, [esp + 0xc]
push 0
push eax
call fcn.004d1df0
add esp, 0xc
cmp dword [esi + 0x34], 8
mov dword [esp + 4], 0x3c
mov dword [esp + 8], 0x440
mov dword [esp + 0x1c], 0
jb 0x469b3e
mov ecx, dword [esi + 0x20]
mov dword [esp + 0x14], ecx
jmp 0x469b45
add esi, 0x20
mov dword [esp + 0x14], esi
lea edx, [esp + 4]
push edx
mov dword [esp + 0x1c], 0x4feab8
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
setne al
pop esi
add esp, 0x3c
ret

Function at 0x469b70
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x28
mov eax, dword [0x52b360]
xor eax, esp
mov dword [esp + 0x20], eax
xor eax, eax
push esi
mov esi, ecx
cmp dword [esi + 0x34], 8
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
jb 0x469bae
mov eax, dword [esi + 0x20]
jmp 0x469bb1
lea eax, [esi + 0x20]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x469bce
xor al, al
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.004c8f08
add esp, 0x28
ret
cmp dword [esi + 0x18], 8
jb 0x469bd9
mov eax, dword [esi + 4]
jmp 0x469bdc
lea eax, [esi + 4]
lea ecx, [esp + 0x14]
push ecx
push eax
call fcn.00469c30
cmp dword [esi + 0x34], 8
jb 0x469bf2
mov esi, dword [esi + 0x20]
jmp 0x469bf5
add esi, 0x20
lea edx, [esp + 4]
push edx
push esi
call fcn.00469c30
lea ecx, [esp + 4]
lea edx, [esp + 0x14]
call fcn.0045e880
mov ecx, dword [esp + 0x24]
test al, al
setne al
pop esi
xor ecx, esp
call fcn.004c8f08
add esp, 0x28
ret
Function at 0x469c30
Capabilities:
Hash data with md5
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4ee42b
mov eax, dword fs:[0]
push eax
sub esp, 0x84
mov eax, dword [0x52b360]
xor eax, esp
mov dword [esp + 0x80], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x52b360]
xor eax, esp
push eax
lea eax, [esp + 0x98]
mov dword fs:[0], eax
mov eax, dword [esp + 0xa8]
mov ebp, dword [esp + 0xac]
xor ebx, ebx
mov esi, vtable.CBaseFile.0
mov dword [esp + 0x18], esi
mov dword [esp + 0x20], ebx
mov byte [esp + 0x1c], bl
push 0x11
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0xa8], ebx
call fcn.0045e490
mov byte [esp + 0x17], al
cmp al, bl
jne 0x469cc3
mov eax, dword [esp + 0x20]
mov dword [esp + 0x18], esi
cmp eax, ebx
je 0x469cbc
push eax
call fcn.004c9c66
add esp, 4
xor al, al
jmp 0x469dcf
push 0x2d000
call fcn.004c85fa
add esp, 4
mov edi, eax
push 0x2d000
push edi
lea ecx, [esp + 0x20]
call fcn.0045e6b0
mov esi, eax
cmp esi, ebx
mov byte [esp + 0x8c], bl
mov dword [esp + 0x38], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x24], 0x67452301
mov dword [esp + 0x28], 0xefcdab89
mov dword [esp + 0x2c], 0x98badcfe
mov dword [esp + 0x30], 0x10325476
jle 0x469d5d
push edi
mov eax, esi
lea ecx, [esp + 0x28]
call fcn.004668a0
cmp esi, 0x2d000
jl 0x469d5d
cmp byte [esp + 0x1c], bl
je 0x469d5d
mov eax, dword [esp + 0x20]
cmp eax, ebx
je 0x469d76
push eax
push 0x2d000
push 1
push edi
call fcn.004c9ab9
mov esi, eax
mov eax, dword [esp + 0x30]
push eax
call fcn.004cc4c8
add esp, 0x14
test eax, eax
jne 0x469d5d
cmp esi, ebx
jg 0x469d16
mov eax, dword [esp + 0x20]
cmp eax, ebx
je 0x469d76
push eax
call fcn.004c9c66
add esp, 4
test eax, eax
jne 0x469d7a
mov dword [esp + 0x20], ebx
mov byte [esp + 0x1c], bl
push edi
call fcn.004ca215
add esp, 4
cmp byte [esp + 0x8c], bl
jne 0x469d9d
lea esi, [esp + 0x24]
mov byte [esp + 0x8c], 1
call fcn.00466940
push 0x10
lea ecx, [esp + 0x80]
push ecx
push 0x10
push ebp
call fcn.004c9253
mov eax, dword [esp + 0x30]
add esp, 0x10
mov dword [esp + 0x18], vtable.CBaseFile.0
cmp eax, ebx
je 0x469dcb
push eax
call fcn.004c9c66
add esp, 4
mov al, byte [esp + 0x17]
mov ecx, dword [esp + 0x98]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.004c8f08
add esp, 0x90
ret 8
Function at 0x469e70
Capabilities:
Copy file

Disassembly:
push 0xffffffffffffffff
push 0x4ee3f0
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x52b360]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push esi
push edi
mov eax, dword [0x52b360]
xor eax, esp
push eax
lea eax, [esp + 0x4c]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x5c]
test ecx, ecx
je 0x469f34
xor eax, eax
mov word [esp + 0x14], ax
mov eax, ecx
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], 0
lea esi, [eax + 2]
lea esp, [esp]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x469ed0
sub eax, esi
sar eax, 1
push eax
push ecx
lea esi, [esp + 0x18]
call fcn.00401760
push 0x4fea60
mov ecx, esi
push ecx
mov edi, 1
mov dword [esp + 0x5c], 0
call fcn.00440eb0
push 0x506464
lea edx, [esp + 0x14]
push edx
mov esi, eax
call fcn.00440eb0
cmp esi, eax
jg 0x469f1b
mov esi, eax
cmp esi, 0xffffffff
jne 0x469f3b
cmp dword [esp + 0x28], 8
jb 0x469f34
mov eax, dword [esp + 0x14]
push eax
call fcn.004c8f17
add esp, 4
xor al, al
jmp 0x469fc7
lea ecx, [esp + 0x10]
push ecx
mov edx, esi
or ecx, 0xffffffff
lea esi, [esp + 0x30]
call fcn.00408160
push 0xffffffffffffffff
lea esi, [ebx + 0x38]
push 0
add ebx, 0x54
push ebx
mov eax, esi
mov byte [esp + 0x60], 1
call fcn.00401850
push 0xffffffffffffffff
push 0
lea edx, [esp + 0x34]
push edx
call fcn.00408f90
mov eax, 8
cmp dword [esi + 0x18], eax
jb 0x469f82
mov esi, dword [esi + 4]
jmp 0x469f85
add esi, 4
cmp dword [esp + 0x28], eax
mov eax, dword [esp + 0x14]
jae 0x469f93
lea eax, [esp + 0x14]
push 0
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea ecx, [esp + 0x2c]
test eax, eax
jne 0x469fb7
call fcn.004016f0
lea ecx, [esp + 0x10]
call fcn.004016f0
xor al, al
jmp 0x469fc7
call fcn.004016f0
lea ecx, [esp + 0x10]
call fcn.004016f0
mov al, 1
mov ecx, dword [esp + 0x4c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.004c8f08
add esp, 0x48
ret 4

Function at 0x46a1d0
Capabilities:
Create thread

Disassembly:
cmp dword [0x52dd50], 0
mov byte [0x52dd74], 0
jne 0x46a218
push 0x52dd38
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0
push 0
push 0
push 0x469ff0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0
mov dword [0x52dd50], eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x52dd54], eax
ret

Function at 0x46b840
Capabilities:
Create thread

Disassembly:
push esi
mov esi, eax
call fcn.0046b880
push 0
push 0
push 1
push 0
mov byte [esi + 0xc], 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push esi
push 0x46b810
push 0
push 0
mov dword [esi + 8], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 4], eax
pop esi
ret
Function at 0x46b920
Capabilities:
Link many functions at runtime

Disassembly:
push 0x50a3ec
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi], eax
test eax, eax
jne 0x46b934
xor al, al
ret
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.TPSetInService
push eax
mov bl, 1
call edi
mov dword [esi + 4], eax
test eax, eax
jne 0x46b94f
xor bl, bl
mov eax, dword [esi]
push str.TPAppID
push eax
call edi
mov dword [esi + 8], eax
test eax, eax
jne 0x46b962
xor bl, bl
mov ecx, dword [esi]
push str.TPUnionID
push ecx
call edi
mov dword [esi + 0xc], eax
test eax, eax
jne 0x46b975
xor bl, bl
mov edx, dword [esi]
push str.TPSetSWVersion
push edx
call edi
mov dword [esi + 0x10], eax
test eax, eax
jne 0x46b988
xor bl, bl
mov eax, dword [esi]
push str.TPPcid
push eax
call edi
mov dword [esi + 0x14], eax
test eax, eax
jne 0x46b99b
xor bl, bl
mov ecx, dword [esi]
push str.TPSetProcessRootPath
push ecx
call edi
mov dword [esi + 0x18], eax
test eax, eax
jne 0x46b9ae
xor bl, bl
mov edx, dword [esi]
push str.TPSetProcessFileName
push edx
call edi
mov dword [esi + 0x1c], eax
test eax, eax
jne 0x46b9c1
xor bl, bl
mov eax, dword [esi]
push str.TPAddr
push eax
call edi
mov dword [esi + 0x20], eax
test eax, eax
jne 0x46b9d4
xor bl, bl
mov ecx, dword [esi]
push str.TPInit
push ecx
call edi
mov dword [esi + 0x24], eax
test eax, eax
jne 0x46b9e7
xor bl, bl
mov edx, dword [esi]
push str.TPClose
push edx
call edi
mov dword [esi + 0x28], eax
test eax, eax
jne 0x46b9fa
xor bl, bl
pop edi
mov al, bl
pop ebx
ret

Function at 0x46c4c0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4f2e49
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x52b360]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov dword [esi + 4], vtable.JsonSetting::IJsonElement.0
mov dword [esi], vtable.JsonSetting::CJsonCateElement.0
mov dword [esi + 4], vtable.JsonSetting::CJsonCateElement.1.0
mov dword [esi + 8], vtable.FastJson::CJsonIntValue.0
mov dword [esi + 0xc], ebx
mov ecx, vtable.FastJson::CJsonWStringValue.0
mov dword [esi + 0x10], ecx
mov eax, 7
xor edx, edx
mov dword [esi + 0x2c], eax
mov dword [esi + 0x28], ebx
mov word [esi + 0x18], dx
mov dword [esi + 0x30], ecx
mov dword [esi + 0x4c], eax
xor eax, eax
mov dword [esi + 0x48], ebx
mov word [esi + 0x38], ax
lea ecx, [esi + 0x50]
push ecx
mov byte [esp + 0x18], 3
call fcn.0046c1c0
mov byte [esi + 0x8c], bl
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xc
ret 4
Function at 0x46c850
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4f1ca6
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x52b360]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x2c]
mov dword [esi], vtable.JsonSetting::CJsonCateArray.0
lea edi, [esi + 4]
mov dword [esp + 0x24], 2
mov eax, dword [edi + 0x10]
sub eax, dword [edi + 0xc]
xor ebx, ebx
sar eax, 2
test eax, eax
jbe 0x46c8d2
jmp 0x46c8a0
mov ecx, dword [edi + 0x10]
sub ecx, dword [edi + 0xc]
sar ecx, 2
cmp ebx, ecx
jb 0x46c8b2
call fcn.004c96d9
mov edx, dword [edi + 0xc]
mov ecx, dword [edx + ebx*4]
test ecx, ecx
je 0x46c8c4
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
mov eax, dword [edi + 0x10]
sub eax, dword [edi + 0xc]
inc ebx
sar eax, 2
cmp ebx, eax
jb 0x46c8a0
mov eax, edi
call fcn.00459cd0
mov ecx, dword [esi + 0x34]
mov ebx, dword [ecx + 4]
add esi, 0x1c
cmp byte [ebx + 0x15], 0
mov ebp, ebx
jne 0x46c90f
lea ebx, [ebx]
mov edx, dword [ebp + 8]
push edx
mov ecx, esi
call fcn.0043aa60
mov ebp, dword [ebp]
push ebx
call fcn.004c8f17
add esp, 4
cmp byte [ebp + 0x15], 0
mov ebx, ebp
je 0x46c8f0
mov eax, dword [esi + 0x18]
mov dword [eax + 4], eax
mov eax, dword [esi + 0x18]
xor ebx, ebx
mov dword [esi + 0x1c], ebx
mov dword [eax], eax
mov eax, dword [esi + 0x18]
mov dword [eax + 8], eax
mov dword [esp + 0x18], esi
mov byte [esp + 0x24], 3
call fcn.0043aaa0
mov eax, dword [esi]
push eax
call fcn.004c8f17
mov eax, dword [edi + 0xc]
add esp, 4
cmp eax, ebx
je 0x46c94e
push eax
call fcn.004c8f17
add esp, 4
mov ecx, dword [edi]
push ecx
mov dword [edi + 0xc], ebx
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
call fcn.004c8f17
mov edx, dword [esp + 0x30]
add esp, 4
mov dword [edx], vtable.FastJson::CJsonValue.0
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 4