joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b04f0
Capabilities:
Get number of processors

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4f0140
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [esp + 0x30]
mov esi, ecx
mov eax, dword [edi]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x4b0697
mov ecx, dword [0x76da6c]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ecx
mov dword [esp + 0x28], 0
mov dword [esp + 0x30], ecx
mov ecx, dword [eax - 8]
mov bl, 1
test ecx, ecx
mov byte [esp + 0x28], bl
jle 0x4b05ec
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
push edi
push ecx
mov ecx, esi
call fcn.004af210
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 2
call fcn.004deb34
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], bl
call fcn.004dea47
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x76a66c
call fcn.004deab5
lea edx, [esp + 0x14]
push 0x3d
push edx
lea eax, [esp + 0x24]
push edi
push eax
mov ecx, esi
call fcn.004af5d0
push eax
lea ecx, [esp + 0x34]
mov byte [esp + 0x2c], 3
call fcn.004deb34
lea ecx, [esp + 0x18]
mov byte [esp + 0x28], bl
call fcn.004dea47
lea ecx, [esp + 0xc]
call fcn.004def0f
mov ecx, dword [esp + 0xc]
push 0x76b0ac
push ecx
call fcn.004cd4b4
add esp, 8
test eax, eax
je 0x4b0614
mov edx, dword [edi]
mov ecx, dword [esp + 0x10]
mov eax, dword [edx - 8]
cmp ecx, eax
jl 0x4b054d
mov esi, dword [esp + 0x34]
lea ecx, [esp + 0x30]
mov byte [esp + 0x28], 0
call fcn.004dea47
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.004dea47
jmp 0x4b069b
lea eax, [esp + 0x30]
mov ecx, esi
push eax
call fcn.004b0290
test eax, eax
push 0
je 0x4b067f
lea ecx, [esp + 0x34]
push 0x64
push ecx
mov ecx, esi
call fcn.004ae930
mov ecx, dword [esp + 0x3c]
test ecx, ecx
je 0x4b0665
cmp eax, 0x64
jg 0x4b0653
mov edx, dword [esp + 0x38]
push eax
push 0x64
push edx
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov esi, eax
jmp 0x4b05f0
push 0x64
push eax
mov eax, dword [esp + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov esi, eax
jmp 0x4b05f0
cmp eax, 0x64
jge 0x4b05ec
mov ecx, dword [esp + 0x34]
push 0x64
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov esi, eax
jmp 0x4b05f0
mov edx, dword [esp + 0x3c]
lea eax, [esp + 0x34]
push edx
push eax
mov ecx, esi
call fcn.004ae930
mov esi, eax
jmp 0x4b05f0
mov esi, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
cmp esi, eax
jl 0x4b06a5
mov eax, esi
mov ecx, dword [esp + 0x20]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x20
ret 0x10
Function at 0x4baba0
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xf4
xor ecx, ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x104]
push edi
xor eax, eax
mov al, byte [ecx + str.80_]
mov edx, eax
and eax, 7
sar edx, 3
mov bl, byte [eax*2 + 0x76ba74]
mov dl, byte [edx + esi]
test bl, dl
setne al
mov byte [esp + ecx + 0x4c], al
inc ecx
cmp ecx, 0x38
jl 0x4babb3
mov eax, 0x1e
xor edx, edx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10c], 1
je 0x4babf4
lea eax, [edx + edx]
lea edi, [esp + eax*4 + 0x88]
lea ebp, [esp + eax*4 + 0x84]
xor eax, eax
xor ecx, ecx
mov cl, byte [edx + 0x76bb1c]
mov dword [edi], 0
mov dword [ebp], 0
mov esi, ecx
cmp ecx, 0x1c
jge 0x4bac26
mov bl, byte [esp + ecx + 0x4c]
jmp 0x4bac2a
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x1c
jl 0x4bac1b
mov eax, 0x1c
lea ecx, [esi + 0x1c]
cmp ecx, 0x38
jge 0x4bac48
mov bl, byte [esp + ecx + 0x4c]
jmp 0x4bac4c
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x38
jl 0x4bac3d
xor ecx, ecx
mov eax, 0x76ba84
xor ebx, ebx
mov bl, byte [ecx + 0x76bb2c]
cmp byte [esp + ebx + 0x14], 0
je 0x4bac77
mov esi, dword [eax]
mov ebx, dword [ebp]
or ebx, esi
mov dword [ebp], ebx
xor ebx, ebx
mov bl, byte [ecx + 0x76bb44]
cmp byte [esp + ebx + 0x14], 0
je 0x4bac8e
mov esi, dword [eax]
mov ebx, dword [edi]
or ebx, esi
mov dword [edi], ebx
add eax, 4
inc ecx
cmp eax, str.80_
jl 0x4bac5e
mov eax, dword [esp + 0x10]
inc edx
sub eax, 2
cmp eax, 0xfffffffe
mov dword [esp + 0x10], eax
jg 0x4babe7
lea edx, [esp + 0x84]
push edx
call fcn.004bacd0
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf4
ret
Function at 0x4e0e55
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4e0e8d
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004deea2
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004dee7a
jmp 0x4e0e99
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4e254c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4e258e
call fcn.004e86e9
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4e258e
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4e2585
xor eax, eax
jmp 0x4e2596
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004e259c
pop edi
pop esi
pop ebx
ret 4

Function at 0x4e8c19
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4e8c47
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4e8c65
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004e8b7f
jmp 0x4e8c65
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4e8c65
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004e8b7f
test edi, edi
mov eax, edi
jne 0x4e8c4f
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x402460
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x437d73
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov eax, dword [esp + 0x34]
push esi
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 8], 0
call dword [0x43c828]
mov ecx, dword [esp + 0x3c]
push ecx
mov ecx, eax
mov dword [esp + 0x30], 1
call dword [0x43c824]
mov esi, dword [esp + 0x34]
push eax
mov ecx, esi
call dword [0x43c828]
lea ecx, [esp + 8]
mov dword [esp + 4], 1
mov byte [esp + 0x2c], 0
call dword [0x43c820]
mov ecx, dword [esp + 0x24]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret

Function at 0x4025e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x437e03
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov eax, dword [esp + 0x34]
push esi
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 8], 0
call dword [0x43c828]
mov ecx, dword [esp + 0x3c]
push ecx
mov ecx, eax
mov dword [esp + 0x30], 1
call dword [0x43c834]
mov esi, dword [esp + 0x34]
push eax
mov ecx, esi
call dword [0x43c828]
lea ecx, [esp + 8]
mov dword [esp + 4], 1
mov byte [esp + 0x2c], 0
call dword [0x43c820]
mov ecx, dword [esp + 0x24]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret

Function at 0x404560
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x438119
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov edi, dword [esp + 0x20]
mov ecx, edi
mov dword [esp + 8], 0
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::GetManager]
push eax
lea ecx, [esp + 0x24]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_4]
mov edx, dword [esp + 0x24]
test edx, edx
mov dword [esp + 0x14], 0
jne 0x4045ab
xor eax, eax
jmp 0x4045b9
mov eax, edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4045b0
sub eax, esi
mov ecx, dword [edi]
push eax
mov eax, dword [ecx - 0xc]
push edx
push eax
push ecx
lea ecx, [esp + 0x30]
push ecx
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::Concatenate]
mov esi, dword [esp + 0x30]
add esp, 0x14
lea edx, [esp + 0x20]
push edx
mov ecx, esi
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_5]
lea ecx, [esp + 0x20]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x407c10
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x110
mov eax, dword [0x44fba0]
mov ecx, dword [esp + 0x118]
xor eax, esp
push esi
push edi
mov edi, dword [esp + 0x124]
lea edx, [esp + 8]
push edx
push 1
push 0
mov dword [esp + 0x120], eax
mov eax, dword [esp + 0x128]
push ecx
push eax
call dword [0x43c008]
mov esi, eax
test esi, esi
jne 0x407c8c
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x14]
push ecx
push esi
push edx
mov dword [esp + 0x1c], 0x104
call dword [0x43c004]
push 0x104
lea eax, [esp + 0x14]
push eax
push edi
call dword [0x43c1b0]
mov ecx, dword [esp + 8]
push ecx
call dword [0x43c010]
mov ecx, dword [esp + 0x114]
pop edi
mov eax, esi
pop esi
xor ecx, esp
call fcn.0043146e
add esp, 0x110
ret 0xc

Function at 0x407de0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4384a9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, dword [esp + 0x24]
mov ecx, esi
mov dword [esp + 8], 0
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::GetManager]
push eax
lea ecx, [esp + 0x28]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_4]
mov edx, dword [esp + 0x20]
test edx, edx
mov esi, dword [esi]
mov ebp, dword [esi - 0xc]
mov dword [esp + 0x14], 0
jne 0x407e30
xor eax, eax
jmp 0x407e40
mov eax, edx
push edi
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x407e36
sub eax, edi
pop edi
push ebp
push esi
push eax
push edx
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::Concatenate]
mov esi, dword [esp + 0x30]
add esp, 0x14
lea ecx, [esp + 0x24]
push ecx
mov ecx, esi
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_5]
lea ecx, [esp + 0x24]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x408430
Capabilities:
Get common file path

Disassembly:
sub esp, 0x98
mov eax, dword [0x44fba0]
xor eax, esp
push esi
mov esi, dword [esp + 0xa0]
mov dword [esp + 0x98], eax
push edi
lea eax, [esp + 8]
push eax
xor edi, edi
mov dword [esp + 0xc], 0x94
call dword [0x43c0d8]
cmp dword [esp + 0xc], 6
push esi
push edi
push edi
jb 0x408495
push 0x1c
push edi
call dword [0x43caf0]
test eax, eax
jl 0x4084a8
pop edi
mov eax, 1
pop esi
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.0043146e
add esp, 0x98
ret
push 0x23
push 0
call dword [0x43caf0]
test eax, eax
mov eax, 1
jge 0x4084aa
mov eax, edi
mov ecx, dword [esp + 0x9c]
pop edi
pop esi
xor ecx, esp
call fcn.0043146e
add esp, 0x98
ret
Function at 0x408850
Capabilities:
Get file version info

Disassembly:
sub esp, 0x1c
push esi
push edi
mov edi, dword [esp + 0x28]
push 0
push edi
call fcn.00433524
mov esi, eax
test esi, esi
jne 0x40886d
pop edi
pop esi
add esp, 0x1c
ret
push ebx
lea eax, [esi + 2]
push ebp
push eax
call sub.MFC71.DLL_operator_new
add esp, 4
mov ebp, eax
push ebp
push esi
push 0
push edi
call fcn.0043351e
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
push edx
push 0x43d724
push ebp
call fcn.00433518
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx + 8]
mov edi, dword [ecx + 0xc]
mov esi, eax
and eax, 0xffff
mov dword [esp + 0x1c], eax
mov ecx, edi
shr ecx, 0x10
mov eax, 0x51eb851f
mul ecx
mov ebx, edx
shr ebx, 5
mov eax, ebx
imul eax, eax, 0x64
sub ecx, eax
push ebp
shr esi, 0x10
mov dword [esp + 0x28], ecx
and edi, 0xffff
call sub.MFC71.DLL_operator_delete
imul esi, esi, 0x64
mov ebp, dword [esp + 0x20]
mov edx, dword [esp + 0x28]
add esi, ebp
lea ecx, [esi + esi*4]
lea eax, [ebx + ecx*2]
imul eax, eax, 0x64
add eax, edx
imul eax, eax, 0x64
add esp, 4
pop ebp
pop ebx
add eax, edi
pop edi
pop esi
add esp, 0x1c
ret
Function at 0x408a50
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x320
mov eax, dword [0x44fba0]
push esi
xor eax, ebp
push edi
push str.openfulldump
mov dword [esp + 0x328], eax
mov esi, ecx
call fcn.00406a80
add esp, 4
test al, al
je 0x408ace
lea eax, [esp + 8]
push eax
push str.SOFTWARE_tencentBugReportQQSpeedLoader_
push 0x80000001
mov dword [esp + 0x14], 0
call dword [section..rdata]
mov eax, dword [esp + 8]
test eax, eax
je 0x408ace
push 4
lea ecx, [esp + 0x10]
push ecx
push 4
push 0
push str.LoaderFullDump
push eax
mov dword [esp + 0x24], 2
call dword [0x43c014]
mov edx, dword [esp + 8]
push edx
call dword [0x43c010]
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
push 0x104
lea eax, [esp + 0x14]
push eax
push str.QQSpeed_loader.exe
call fcn.00408730
add esp, 0xc
xor eax, eax
mov word [esp + 0x118], 0
mov ecx, 0x81
lea edi, [esp + 0x11a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x10]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x408b15
push 0x104
sub eax, ecx
lea ecx, [esp + 0x11c]
push ecx
push eax
lea edx, [esp + 0x1c]
push edx
push 0
push 0
call dword [0x43c0d4]
lea eax, [esp + 8]
push eax
mov ecx, esi
mov dword [esp + 0xc], 0
call fcn.00408980
mov ecx, dword [esp + 8]
mov eax, 0x6b5fca6b
mul ecx
mov esi, edx
shr esi, 0x16
mov edx, esi
imul edx, edx, 0xff676980
add ecx, edx
mov eax, 0x4f8b588f
mul ecx
mov eax, ecx
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 0x10
imul eax, eax, 0xfffe7960
add ecx, eax
mov eax, 0xd1b71759
mul ecx
shr edx, 0xd
imul edx, edx, 0xffffd8f0
add ecx, edx
mov eax, 0x51eb851f
mul ecx
shr edx, 5
mov eax, edx
imul eax, eax, 0x64
sub ecx, eax
mov eax, dword [sym.imp.BugReportEx.dll_int___stdcall_BugReportDetail_struct_TXBugReport::tagBugReportInfo___char_const___char_const___unsigned_short_int_const___unsigned_short_int_const___void____unsigned_long_int___void__]
push eax
push 0
push 0x804
push 1
push 1
push ecx
push edx
push esi
push 0x43e334
lea ecx, [esp + 0x13c]
push ecx
push 0x43e328
push 0x43e318
call fcn.0042fff0
push 0
push 0
call fcn.0042ff10
add esp, 0x38
call fcn.0042fe90
mov ecx, dword [esp + 0x324]
pop edi
xor ecx, ebp
pop esi
call fcn.0043146e
mov esp, ebp
pop ebp
ret
Function at 0x409700
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x43861e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x48
mov eax, dword [0x44fba0]
xor eax, esp
push esi
mov esi, dword [esp + 0x5c]
mov dword [esp + 0x48], eax
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0
lea eax, [esp + 0x60]
push eax
lea ecx, [esp + 0x30]
mov dword [esp + 0x58], 1
call dword [0x43c828]
mov ecx, dword [0x43c88c]
mov eax, dword [ecx]
push 1
push eax
lea edx, [esp + 0xc]
push edx
lea ecx, [esp + 0x6c]
mov byte [esp + 0x60], 2
mov byte [esp + 0x10], 0x5c
call dword [0x43c92c]
mov ecx, dword [esp + 0x74]
dec ecx
cmp eax, ecx
jne 0x4097a9
push eax
push 0
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x6c]
call dword [0x43c930]
push eax
lea ecx, [esp + 0x64]
mov byte [esp + 0x58], 3
call dword [0x43c934]
lea ecx, [esp + 0x10]
mov byte [esp + 0x54], 2
call dword [0x43c820]
mov eax, dword [0x43c88c]
mov eax, dword [eax]
push 1
push eax
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x6c]
mov byte [esp + 0x10], 0x5c
call dword [0x43c92c]
test eax, eax
jle 0x4097fc
push eax
push 0
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x6c]
call dword [0x43c930]
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0x58], 4
call dword [0x43c934]
lea ecx, [esp + 0x10]
mov byte [esp + 0x54], 2
call dword [0x43c820]
lea eax, [esp + 0x2c]
push eax
mov ecx, esi
call dword [0x43c828]
lea ecx, [esp + 0x2c]
mov dword [esp + 8], 1
mov byte [esp + 0x54], 1
call dword [0x43c820]
lea ecx, [esp + 0x60]
mov byte [esp + 0x54], 0
call dword [0x43c820]
mov ecx, dword [esp + 0x4c]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x48]
mov eax, esi
pop esi
xor ecx, esp
call fcn.0043146e
add esp, 0x54
ret

Function at 0x409ac0
Capabilities:
Terminate process

Disassembly:
sub esp, 0x404
mov eax, dword [0x44fba0]
mov ecx, dword [esp + 0x408]
xor eax, esp
push esi
mov dword [esp + 0x404], eax
lea eax, [esp + 0x410]
push eax
push ecx
lea edx, [esp + 0xc]
push 0x3ff
push edx
call dword [sym.imp.MSVCR71.dll__vsnprintf]
mov esi, dword [0x43c190]
add esp, 0x10
push str.___error_
call esi
lea eax, [esp + 4]
push eax
call esi
push 0x43f8f8
call esi
push 0x1010
push 0x43f8f0
lea ecx, [esp + 0xc]
push ecx
push 0
call dword [0x43cb9c]
push 0
call dword [sym.imp.MSVCR71.dll_exit]
pop esi
int3
Function at 0x40aaa0
Capabilities:
Check if file exists
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x234
mov eax, dword [0x44fba0]
xor eax, ebp
push ebx
mov dword [esp + 0x234], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
cmp eax, ebx
push edi
mov dword [esp + 0x10], eax
je 0x40ac7b
cmp esi, ebx
je 0x40ac7b
cmp dword [ebp + 0x10], 1
jle 0x40ac7b
xor eax, eax
mov byte [esp + 0x130], bl
mov ecx, 0x40
lea edi, [esp + 0x131]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x14]
push eax
push 0x20019
push ebx
push str.SOFTWARETencentTXSSO
push 0x80000002
mov dword [esp + 0x30], ebx
call dword [0x43c008]
test eax, eax
jne 0x40ab7a
lea ecx, [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x134]
push edx
lea eax, [esp + 0x28]
push eax
push ebx
push str.Version
push ecx
mov dword [esp + 0x38], 4
mov dword [esp + 0x3c], 0x104
call dword [0x43c00c]
test eax, eax
jne 0x40ab6f
mov ecx, dword [esp + 0x20]
mov eax, 1
cmp ecx, eax
jne 0x40ab6f
cmp dword [esp + 0x24], 7
jb 0x40ab6f
mov dword [esp + 0x1c], eax
mov edx, dword [esp + 0x14]
push edx
call dword [0x43c010]
xor eax, eax
mov byte [esp + 0x28], 0
mov ecx, 0x40
lea edi, [esp + 0x29]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x18]
push eax
push 0x2b
push ebx
mov dword [esp + 0x24], ebx
call dword [0x43cae4]
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x28]
push ecx
push edx
call dword [0x43cae8]
lea eax, [esp + 0x28]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40abb8
sub eax, edx
mov ebx, eax
je 0x40ac7b
mov edi, dword [0x43cafc]
lea eax, [esp + 0x28]
push eax
call edi
test eax, eax
je 0x40ac7b
mov cl, byte [esp + ebx + 0x27]
cmp cl, 0x5c
lea eax, [esp + ebx + 0x27]
je 0x40abf0
cmp cl, 0x2f
jne 0x40abf3
mov byte [eax], 0
mov eax, dword [esp + 0x1c]
test eax, eax
lea eax, [esp + 0x28]
je 0x40ac41
mov ecx, dword [esp + 0x10]
mov ebx, dword [sym.imp.MSVCR71.dll__snprintf]
push ecx
mov ecx, dword [ebp + 0x10]
lea edx, [esp + 0x134]
push edx
push eax
push str._sTencentTXSSO_sBin_s
push ecx
push esi
call ebx
add esp, 0x18
push esi
call edi
test eax, eax
jne 0x40ac61
mov edx, dword [esp + 0x10]
mov ecx, dword [ebp + 0x10]
push edx
lea eax, [esp + 0x2c]
push eax
push str._sTencentTXSSOBin_s
push ecx
push esi
call ebx
jmp 0x40ac57
mov edx, dword [esp + 0x10]
mov ecx, dword [ebp + 0x10]
push edx
push eax
push str._sTencentTXSSOBin_s
push ecx
push esi
call dword [sym.imp.MSVCR71.dll__snprintf]
add esp, 0x14
push esi
call edi
test eax, eax
je 0x40ac7b
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x230]
xor ecx, ebp
call fcn.0043146e
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x23c]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.0043146e
mov esp, ebp
pop ebp
ret
Function at 0x40aca0
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4386b9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push 0
push 0
push 0
mov dword [esp + 0x1c], 0
call fcn.00433540
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x24]
push 0x43fa38
push eax
call dword [sym.imp.MSVCR71.dll_fopen]
mov esi, eax
add esp, 0x14
test esi, esi
je 0x40ad54
push ebx
push ebp
push edi
mov edi, dword [sym.imp.MSVCR71.dll_fseek]
push 2
push 0
push esi
call edi
push esi
call dword [sym.imp.MSVCR71.dll_ftell]
push 0
push 0
push esi
mov ebx, eax
call edi
push ebx
call sub.MFC71.DLL_operator_new
mov ebp, eax
mov ecx, ebx
mov edx, ecx
shr ecx, 2
xor eax, eax
mov edi, ebp
rep stosd dword es:[edi], eax
push esi
push 1
mov ecx, edx
and ecx, 3
push ebx
push ebp
rep stosb byte es:[edi], al
call dword [sym.imp.MSVCR71.dll_fread]
push esi
call dword [sym.imp.MSVCR71.dll_fclose]
mov eax, dword [esp + 0x44]
push ebx
push ebp
push eax
call fcn.00433540
add esp, 0x40
push ebp
mov dword [esp + 0x14], eax
call sub.MFC71.DLL_operator_delete
add esp, 4
pop edi
pop ebp
pop ebx
lea ecx, [esp + 0x18]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
mov ecx, dword [esp + 8]
mov eax, dword [esp + 4]
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x40ade0
Capabilities:
Read file on windows

Disassembly:
push ecx
push esi
push edi
push 0
push 0
push 0
call fcn.00433540
mov edi, eax
mov eax, dword [esp + 0x1c]
mov eax, dword [eax]
push 0x43fa38
push eax
mov dword [esp + 0x1c], edi
call dword [sym.imp.MSVCR71.dll_fopen]
mov esi, eax
add esp, 0x14
test esi, esi
je 0x40ae7e
mov edi, dword [sym.imp.MSVCR71.dll_fseek]
push ebx
push ebp
push 2
push 0
push esi
call edi
push esi
call dword [sym.imp.MSVCR71.dll_ftell]
push 0
push 0
push esi
mov ebx, eax
call edi
push ebx
call sub.MFC71.DLL_operator_new
mov ebp, eax
mov ecx, ebx
mov edx, ecx
shr ecx, 2
xor eax, eax
mov edi, ebp
rep stosd dword es:[edi], eax
push esi
push 1
mov ecx, edx
and ecx, 3
push ebx
push ebp
rep stosb byte es:[edi], al
call dword [sym.imp.MSVCR71.dll_fread]
push esi
call dword [sym.imp.MSVCR71.dll_fclose]
mov eax, dword [esp + 0x44]
push ebx
push ebp
push eax
call fcn.00433540
add esp, 0x40
push ebp
mov esi, eax
call sub.MFC71.DLL_operator_delete
add esp, 4
pop ebp
pop ebx
pop edi
mov eax, esi
pop esi
pop ecx
ret
mov eax, edi
pop edi
pop esi
pop ecx
ret