joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44b3a0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
xor esi, esi
lea eax, [edi + 0x32550]
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], eax
jmp 0x44b3c0
xor edx, edx
lea ecx, [edx + 1]
mov dword [esp + 0xc], 4
lea ecx, [ecx]
movzx ebx, word [edi + ecx*2 + 0x32bf4]
mov eax, esi
and eax, 1
mov ebp, eax
neg ebp
sar ebp, 4
shr ebx, 4
and ebp, 0x7f
xor ebx, ebp
add edx, dword [edi + ebx*4 + 0x30ea0]
add ecx, ecx
shr esi, 1
or ecx, eax
sub dword [esp + 0xc], 1
jne 0x44b3d0
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
add esi, 1
mov dword [eax], edx
add eax, 4
cmp esi, 0x10
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], eax
jb 0x44b3c0
pop esi
pop ebp
mov dword [edi + 0x32590], 0
pop ebx
add esp, 0xc
ret

Function at 0x44b430
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x210
push ebx
push ebp
push edi
mov edi, 4
lea ebp, [esi + 0x30ea0]
movzx ebx, byte [esi + edi + 0x306a0]
mov ecx, ebx
mov edx, ebx
and edx, 1
shr ecx, 1
or edx, 2
sub ecx, 1
shl edx, cl
mov eax, edi
push ebp
sub eax, edx
sub edx, ebx
lea edx, [esi + edx*2 + 0x32b0e]
push edx
call fcn.00449530
mov dword [esp + edi*4 + 0x24], eax
add edi, 1
add esp, 8
cmp edi, 0x80
jb 0x44b444
lea ebp, [esp + 0x1c]
sub ebp, esi
lea eax, [esi + 0x32910]
lea ecx, [esi + 0x31d58]
sub ebp, 0x31d50
lea edi, [esi + 0x31950]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], 4
jmp 0x44b4c4
mov ecx, dword [esp + 0xc]
xor ebx, ebx
cmp dword [esi + 0x32594], ebx
jbe 0x44b521
mov edi, edi
mov eax, ebx
or eax, 0x40
xor edx, edx
cmp eax, 1
je 0x44b513
lea esp, [esp]
mov ebp, dword [esp + 0x10]
mov ecx, eax
and eax, 1
shr ecx, 1
movzx ebp, word [ebp + ecx*2]
neg eax
sar eax, 4
and eax, 0x7f
shr ebp, 4
xor ebp, eax
add edx, dword [esi + ebp*4 + 0x30ea0]
mov eax, ecx
cmp eax, 1
jne 0x44b4e0
mov ebp, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
mov dword [edi + ebx*4], edx
add ebx, 1
cmp ebx, dword [esi + 0x32594]
jb 0x44b4d0
mov eax, 0xe
cmp dword [esi + 0x32594], eax
jbe 0x44b548
mov edi, edi
mov edx, eax
shr edx, 1
sub edx, 5
shl edx, 4
add dword [edi + eax*4], edx
add eax, 1
cmp eax, dword [esi + 0x32594]
jb 0x44b530
mov eax, dword [edi]
mov dword [ecx - 8], eax
mov edx, dword [edi + 4]
mov dword [ecx - 4], edx
mov eax, dword [edi + 8]
mov dword [ecx], eax
mov edx, dword [edi + 0xc]
mov dword [ecx + 4], edx
mov eax, 4
add ecx, 8
jmp 0x44b570
movzx edx, byte [esi + eax + 0x306a0]
mov edx, dword [edi + edx*4]
add edx, dword [ecx + ebp]
add eax, 1
mov dword [ecx], edx
add ecx, 4
cmp eax, 0x80
jb 0x44b570
add dword [esp + 0x10], 0x80
add dword [esp + 0xc], 0x200
sub ebp, 0x200
add edi, 0x100
sub dword [esp + 0x18], 1
mov dword [esp + 0x14], ebp
jne 0x44b4c0
pop edi
pop ebp
mov dword [esi + 0x3bcf8], 0
pop ebx
add esp, 0x210
ret
Function at 0x44c520
Capabilities:
Create thread

Disassembly:
push ecx
lea eax, [esp]
push eax
push 0
push ecx
push edx
push 0
push 0
call fcn.004b92a4
mov ecx, dword [esp + 0x20]
add esp, 0x18
test eax, eax
mov dword [ecx], eax
je 0x44c543
xor eax, eax
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x44c552
mov eax, 1
pop ecx
ret
Function at 0x451810
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4dbf45
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x50f130]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov edi, dword [esp + 0x1c]
xor eax, eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], 4
mov dword [edi], vtable.CObjectVector_struct_NArchive::N7z::CMethodFull_.0
mov dword [esp + 0x14], eax
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], eax
mov dword [edi + 0x20], eax
mov dword [edi + 0x24], 0x10
mov dword [edi + 0x14], vtable.CRecordVector_struct_NArchive::N7z::CBind_.0
mov ecx, 1
mov byte [esp + 0x14], cl
lea esi, [edi + 0x30]
mov dword [edi + 0x28], ecx
mov byte [edi + 0x2c], al
push 4
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
call fcn.0043d840
mov eax, edi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4
Function at 0x452f10
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4dbf0a
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x50f130]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, dword [esp + 0x20]
xor ebx, ebx
mov dword [esp + 0x18], ebx
mov eax, dword [edi + 0x30]
push eax
call fcn.004b8802
mov eax, dword [edi + 0x1c]
lea esi, [edi + 0x14]
add esp, 4
push eax
push ebx
mov ecx, esi
mov dword [esi], vtable.CBaseRecordVector.0
call dword [0x4f42c8]
mov eax, dword [esi + 0xc]
push eax
call fcn.004b8802
add esp, 4
push edi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esp + 0x1c], 0xffffffff
call fcn.004538c0
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 4
Function at 0x454100
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4dca53
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x50f130]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
mov al, byte [ebx]
mov byte [esi], al
lea edi, [ebx + 4]
lea eax, [esi + 4]
call fcn.00443b20
mov dword [esp + 0x14], 0
mov ecx, dword [ebx + 0x10]
mov dword [esi + 0x10], ecx
mov byte [esp + 0x14], 1
mov edx, dword [ebx + 0x14]
mov dword [esi + 0x14], edx
mov eax, dword [ebx + 0x18]
mov dword [esi + 0x18], eax
lea edi, [ebx + 0x1c]
lea eax, [esi + 0x1c]
call fcn.00443b20
mov cl, byte [ebx + 0x28]
mov byte [esi + 0x28], cl
mov edx, dword [ebx + 0x30]
mov dword [esi + 0x30], edx
mov eax, dword [ebx + 0x34]
mov dword [esi + 0x34], eax
mov ecx, dword [ebx + 0x38]
mov dword [esi + 0x38], ecx
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4
Function at 0x459500
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e3538
mov eax, dword fs:[0]
push eax
sub esp, 0x44
push ebx
push esi
push edi
mov eax, dword [0x50f130]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edx, dword [edi + 0x248]
mov eax, dword [edi + 0x240]
mov eax, dword [eax + 4]
lea ecx, [edi + 0x240]
push edx
push ebx
call eax
lea esi, [edi + 0xc]
call fcn.00443140
lea ecx, [ebp - 0x50]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [ebp - 0x3c]
or eax, 0xffffffff
mov dword [esi + 0x48], edx
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x44], ebx
mov dword [esi + 4], 4
xor esi, esi
lea esp, [esp]
cmp esi, dword [ebp + 0x14]
jge 0x4596cd
mov eax, dword [ebp + 0xc]
mov ebx, dword [eax + esi*4]
lea eax, [ebp - 0x1c]
call fcn.0043eec0
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.USER32.dll_CharUpperW]
mov edx, dword [ebp - 0x18]
test edx, edx
jne 0x4595d1
mov edx, dword [ebp - 0x1c]
push edx
call fcn.004b8802
add esp, 4
mov eax, 0x80070057
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp - 0x1c]
mov eax, esi
shl eax, 4
add eax, dword [ebp + 0x10]
cmp word [ecx], 0x42
jne 0x459683
mov edi, 1
cmp edx, edi
jge 0x4595f5
test edx, edx
mov edi, edx
jle 0x45960c
sub edx, edi
lea eax, [edx + edx + 2]
push eax
lea edx, [ecx + edi*2]
push edx
push ecx
call fcn.004bc3c0
add esp, 0xc
sub dword [ebp - 0x18], edi
lea ebx, [ebp - 0x2c]
lea edi, [ebp - 0x1c]
call fcn.00459490
mov edi, eax
test edi, edi
je 0x45963f
mov eax, dword [ebp - 0x1c]
push eax
call fcn.004b8802
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x28]
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [ebp - 0x24]
mov dword [eax + 4], edx
mov edx, dword [ebp - 0x20]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
mov eax, dword [ebp + 8]
add eax, 0x240
call fcn.00454300
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x1c]
push eax
call fcn.004b8802
mov edi, dword [ebp + 8]
add esp, 4
add esi, 1
jmp 0x459580
push eax
lea edx, [edi + 0xc]
push edx
call fcn.004431a0
mov ebx, eax
test ebx, ebx
je 0x4596b5
mov eax, dword [ebp - 0x1c]
push eax
call fcn.004b8802
add esp, 4
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.004b8802
add esp, 4
add esi, 1
jmp 0x459580
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x466d90
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4e3418
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x50f130]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [0x5143cc]
mov edx, dword [eax + 0xc]
mov ecx, 0x5143cc
call edx
add eax, 0x10
mov dword [esp + 0x14], eax
push str.crc.dat
lea ecx, [esp + 0x1c]
lea esi, [esp + 0x18]
mov edx, edi
mov dword [esp + 0x34], 0
call fcn.00467930
test eax, eax
jne 0x466e2d
mov dword [esp + 0x30], 0xffffffff
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x466e17
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
mov ebx, dword [esp + 0x18]
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea ecx, [esp + 0x20]
push ecx
push 0x20
push str.qqpcmgr_pkg_crc_file
push ebx
call ebp
mov eax, dword [edi + 0x20]
mov esi, dword [eax]
add edi, 0x1c
cmp edi, edi
mov edx, dword [edi + 4]
mov dword [esp + 0x24], edx
je 0x466e60
call fcn.004b9ac9
cmp esi, dword [esp + 0x24]
je 0x466e99
cmp esi, dword [edi + 4]
jne 0x466e70
call fcn.004b9ac9
mov eax, dword [esi + 8]
mov ecx, dword [eax + 0x10]
push 0
lea edx, [esp + 0x20]
push edx
push 4
lea eax, [esp + 0x24]
push eax
push ebx
mov dword [esp + 0x2c], ecx
call ebp
cmp esi, dword [edi + 4]
jne 0x466e95
call fcn.004b9ac9
mov esi, dword [esi]
jmp 0x466e50
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x30], 0xffffffff
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x466ec8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x467d60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4e4933
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x50f130]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [0x5143cc]
mov edx, dword [eax + 0xc]
mov ecx, 0x5143cc
call edx
add eax, 0x10
mov dword [esp + 0x14], eax
xor ebx, ebx
mov dword [esp + 0x24], ebx
mov edx, dword [esp + 0x2c]
push edi
lea ecx, [esp + 0x30]
lea esi, [esp + 0x18]
call fcn.00467930
test eax, eax
jne 0x467dea
mov dword [esp + 0x24], 0xffffffff
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x467de3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
jmp 0x467e9a
push 0x24
call fcn.004b9140
add esp, 4
mov dword [esp + 0x18], eax
cmp eax, ebx
mov byte [esp + 0x24], 1
je 0x467e17
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
push ecx
push edx
push eax
mov ecx, edi
call fcn.0046a5b0
mov esi, eax
jmp 0x467e19
xor esi, esi
mov byte [esp + 0x24], bl
mov edi, dword [esp + 0x14]
cmp edi, ebx
lea eax, [esi + 0xc]
jne 0x467e2c
xor ecx, ecx
jmp 0x467e40
mov ecx, edi
lea ebp, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
cmp dx, bx
jne 0x467e31
sub ecx, ebp
sar ecx, 1
push edi
mov ebx, ecx
call fcn.00401470
mov ecx, dword [esp + 0x2c]
mov eax, dword [esi]
mov edx, dword [eax + 4]
push ecx
mov ecx, esi
call edx
test eax, eax
jne 0x467e74
mov eax, dword [esi]
mov edx, dword [eax]
push 1
mov ecx, esi
call edx
mov dword [esp + 0x24], 0xffffffff
lea eax, [edi - 0x10]
jmp 0x467dca
lea eax, [edi - 0x10]
mov dword [esp + 0x24], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x467e98
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0xc

Function at 0x4681b0
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
push edi
push 0
mov esi, eax
lea eax, [esp + 0x10]
push eax
mov edi, ecx
push edi
push esi
push ebx
mov dword [esp + 0x20], 0
call ebp
test eax, eax
je 0x4681f0
mov eax, dword [esp + 0xc]
add esi, eax
sub edi, eax
je 0x4681f7
push 0
lea ecx, [esp + 0x10]
push ecx
push edi
push esi
push ebx
call ebp
test eax, eax
jne 0x4681d6
pop edi
pop esi
xor eax, eax
pop ebp
pop ecx
ret
pop edi
pop esi
mov eax, 1
pop ebp
pop ecx
ret
Function at 0x468210
Capabilities:
Create directory
Delete file
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x4e2dc8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x50f130]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, dword [esp + 0x28]
lea eax, [esp + 0x14]
push eax
mov ecx, esi
call fcn.00409c00
push esi
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or ebp, 0xffffffff
cmp eax, ebp
je 0x4682a5
test al, 0x10
jne 0x468306
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4682a5
mov dword [esp + 0x20], ebp
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], ebp
dec ebp
test ebp, ebp
jg 0x46828f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0
push esi
call edi
test eax, eax
jne 0x468306
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
cmp eax, 0xb7
je 0x468306
lea ecx, [esp + 0x14]
call fcn.00468100
mov eax, dword [esp + 0x14]
cmp dword [eax - 0xc], 0
jne 0x4682dc
mov dword [esp + 0x20], ebp
jmp 0x468276
push eax
call fcn.00468210
add esp, 4
test eax, eax
jne 0x4682f4
lea ecx, [esp + 0x14]
call fcn.004016d0
jmp 0x46828f
push 0
push esi
call edi
test eax, eax
jne 0x468306
call ebx
cmp eax, 0xb7
jne 0x4682e9
mov dword [esp + 0x20], ebp
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], ebp
dec ebp
test ebp, ebp
jg 0x468327
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x46a330
Capabilities:
Get file size
Read file on windows

Disassembly:
push ecx
push ebx
push esi
push edi
xor edi, edi
push edi
push 0x80
push 3
push edi
mov esi, ecx
mov eax, dword [esi + 0xc]
push 1
push SysReAllocString
push eax
mov dword [esi + 0x1c], edi
mov dword [esp + 0x28], edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x46a3a7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x46a398
cmp eax, 0x20
je 0x46a398
cmp eax, 2
je 0x46a389
cmp eax, 3
je 0x46a389
mov dword [esi + 0x1c], 0x6c
mov eax, dword [esi + 0x1c]
pop edi
pop esi
pop ebx
pop ecx
ret
mov dword [esi + 0x1c], 0x6b
mov eax, dword [esi + 0x1c]
pop edi
pop esi
pop ebx
pop ecx
ret
mov dword [esi + 0x1c], 0x67
mov eax, dword [esi + 0x1c]
pop edi
pop esi
pop ebx
pop ecx
ret
push ebp
mov ebp, dword [esi + 0x14]
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, ebp
je 0x46a3c1
mov dword [esi + 0x1c], 0x64
jmp 0x46a414
push ebp
call fcn.004b73e1
mov ecx, dword [esi + 0x14]
add esp, 4
push 0
mov edi, eax
lea eax, [esp + 0x14]
push eax
push ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x46a40d
mov eax, dword [esp + 0x10]
cmp eax, dword [esi + 0x14]
jne 0x46a40d
push 0x5173a0
push eax
mov edx, edi
or ecx, 0xffffffff
call dword [0x5152f4]
not eax
cmp eax, dword [esi + 0x10]
je 0x46a414
mov dword [esi + 0x1c], 0x65
jmp 0x46a414
mov dword [esi + 0x1c], 0x6a
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
pop ebp
je 0x46a429
push edi
call fcn.004b8802
add esp, 4
mov eax, dword [esi + 0x1c]
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x46abf0
Capabilities:
Delete file
Set file attributes

Disassembly:
cmp byte [edi], 0
jne 0x46abf8
mov al, 1
ret
push esi
mov esi, dword [edi + 4]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x46ac1d
xor al, al
test al, al
sete al
xor ecx, ecx
test al, al
sete cl
mov byte [edi], al
mov al, cl
pop esi
ret
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne al
test al, al
sete al
xor ecx, ecx
test al, al
sete cl
mov byte [edi], al
mov al, cl
pop esi
ret
Function at 0x46b470
Capabilities:
Set registry value

Disassembly:
sub esp, 0x220
mov eax, dword [0x50f130]
xor eax, esp
mov dword [esp + 0x218], eax
mov eax, dword [esp + 0x22c]
push ebp
mov ebp, dword [esp + 0x22c]
push esi
xor esi, esi
cmp ebx, esi
push edi
mov dword [esp + 0x14], eax
je 0x46b577
cmp ebp, esi
je 0x46b577
cmp dword [esp + 0x230], esi
je 0x46b577
push 0x206
lea ecx, [esp + 0x1e]
push esi
push ecx
mov dword [esp + 0x1c], esi
mov word [esp + 0x24], si
call fcn.004be240
add esp, 0xc
push 0xffffffffffffffff
push str.QMConfig
lea edx, [esp + 0x20]
push 0x104
push edx
call fcn.004b9b37
push 0xffffffffffffffff
push 0x4f09a4
lea eax, [esp + 0x30]
push 0x104
push eax
call fcn.004bc754
push 0x103
push str.QQDoctorQQDoctorComCfg
lea ecx, [esp + 0x40]
push 0x104
push ecx
call fcn.004bc754
add esp, 0x30
push esi
lea edi, [esp + 0x1c]
lea esi, [esp + 0x14]
call fcn.0046b1e0
test eax, eax
je 0x46b568
mov eax, dword [esp + 0x10]
test eax, eax
je 0x46b577
mov esi, dword [esp + 0x23c]
mov edx, dword [esp + 0x14]
push esi
push edx
push 3
push 0
push ebp
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x46b568
mov eax, dword [esp + 0x10]
test eax, eax
mov dword [ebx], esi
je 0x46b564
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x46b57c
mov eax, dword [esp + 0x10]
test eax, eax
je 0x46b577
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x80004005
mov ecx, dword [esp + 0x224]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.004b83ee
add esp, 0x220
ret 0x10
Function at 0x46b830
Capabilities:
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x204
mov eax, dword [0x50f130]
xor eax, esp
mov dword [esp + 0x200], eax
mov eax, dword [esp + 0x20c]
push ebp
mov ebp, dword [esp + 0x20c]
push esi
mov esi, edx
test esi, esi
push edi
mov edi, ecx
jne 0x46b878
pop edi
pop esi
or eax, 0xffffffff
pop ebp
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.004b83ee
add esp, 0x204
ret
test edi, edi
jg 0x46b899
pop edi
pop esi
mov eax, 0xfffffffe
pop ebp
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.004b83ee
add esp, 0x204
ret
cmp dword [esp + 0x21c], 0
jne 0x46b8c0
pop edi
pop esi
mov eax, 0xfffffffd
pop ebp
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.004b83ee
add esp, 0x204
ret
test eax, eax
jg 0x46b8e1
pop edi
pop esi
mov eax, 0xfffffffc
pop ebp
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.004b83ee
add esp, 0x204
ret
test ebp, ebp
jne 0x46b900
pop edi
pop esi
lea eax, [ebp - 5]
pop ebp
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.004b83ee
add esp, 0x204
ret
mov ecx, dword [esp + 0x220]
test ecx, ecx
jg 0x46b928
pop edi
pop esi
mov eax, 0xfffffffa
pop ebp
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.004b83ee
add esp, 0x204
ret
cmp eax, ecx
jge 0x46b949
pop edi
pop esi
mov eax, 0xfffffff9
pop ebp
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.004b83ee
add esp, 0x204
ret
xor edx, edx
xor ecx, ecx
lea ecx, [ecx]
mov al, byte [edx + esi]
mov byte [esp + ecx + 0x10c], al
lea eax, [edx + 1]
cdq
mov byte [esp + ecx + 0xc], cl
add ecx, 1
idiv edi
cmp ecx, 0x100
jl 0x46b950
xor ecx, ecx
xor eax, eax
push ebx
jmp 0x46b980
mov dl, byte [esp + eax + 0x10]
movzx esi, byte [esp + eax + 0x110]
movzx edi, dl
add esi, ecx
add edi, esi
mov ecx, edi
and ecx, 0x800000ff
jns 0x46b9a5
dec ecx
or ecx, 0xffffff00
inc ecx
mov bl, byte [esp + ecx + 0x10]
mov byte [esp + ecx + 0x10], dl
mov byte [esp + eax + 0x10], bl
add eax, 1
cmp eax, 0x100
jl 0x46b980
mov edx, dword [esp + 0x224]
xor esi, esi
xor ecx, ecx
test edx, edx
jle 0x46ba47
mov edi, dword [esp + 0x220]
mov eax, ebp
sub edi, ebp
mov ebp, edx
jmp 0x46b9e0
add ecx, 1
and ecx, 0x800000ff
jns 0x46b9f3
dec ecx
or ecx, 0xffffff00
inc ecx
movzx edx, byte [esp + ecx + 0x10]
add esi, edx
and esi, 0x800000ff
jns 0x46ba0a
dec esi
or esi, 0xffffff00
inc esi
mov bl, byte [esp + ecx + 0x10]
mov dl, byte [esp + esi + 0x10]
mov byte [esp + esi + 0x10], bl
mov byte [esp + ecx + 0x10], dl
movzx ebx, byte [esp + esi + 0x10]
movzx edx, dl
add edx, ebx
and edx, 0x800000ff
jns 0x46ba34
dec edx
or edx, 0xffffff00
inc edx
movzx edx, byte [esp + edx + 0x10]
xor dl, byte [edi + eax]
add eax, 1
sub ebp, 1
mov byte [eax - 1], dl
jne 0x46b9e0
mov ecx, dword [esp + 0x210]
pop ebx
pop edi
pop esi
pop ebp
xor ecx, esp
xor eax, eax
call fcn.004b83ee
add esp, 0x204
ret