joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4751ae
Capabilities:
Create a process with modified i/o handles and window
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [0x7b088c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
cmp dword [edi], 0xffffffff
je 0x475259
cmp dword [esi], 0xffffffff
je 0x475259
push 0x10
lea eax, [ebp - 0x30]
push 0
push eax
call fcn.00689b00
push 0x44
lea eax, [ebp - 0x74]
push 0
push eax
call fcn.00689b00
mov eax, dword [edi]
add esp, 0x18
mov dword [ebp - 0x34], eax
lea edi, [ebp - 0x20]
mov dword [ebp - 0x38], eax
mov eax, dword [esi]
mov esi, str.ipconfig__all
push 7
pop ecx
or dword [ebp - 0x48], 0x101
mov dword [ebp - 0x3c], eax
xor eax, eax
mov word [ebp - 0x44], ax
lea eax, [ebp - 0x30]
push eax
rep movsd dword es:[edi], dword [esi]
xor ecx, ecx
mov dword [ebp - 0x74], 0x44
lea eax, [ebp - 0x74]
push eax
push ecx
push ecx
push ecx
push 1
push ecx
push ecx
lea eax, [ebp - 0x20]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edi, eax
test edi, edi
je 0x475259
push dword [ebp - 0x30]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x2c]
call esi
mov eax, edi
jmp 0x47525b
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00682c16
mov esp, ebp
pop ebp
ret 8
Function at 0x475e1b
Capabilities:
Create pipe
Create two anonymous pipes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
push edi
xor edi, edi
mov dword [ebp - 0x24], 0xc
push 0xfffffffffffffff5
mov esi, ecx
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x20], edi
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
or dword [ebp - 8], 0xffffffff
lea eax, [ebp - 0x24]
or dword [ebp - 4], 0xffffffff
push edi
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x475f88
or dword [ebp - 0x14], 0xffffffff
lea eax, [ebp - 0x14]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 2
push edi
push edi
push eax
call ebx
push eax
push dword [ebp - 8]
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
mov ecx, esi
lea eax, [ebp - 8]
jne 0x475e9e
xor ebx, ebx
inc ebx
push ebx
push ebx
push eax
call fcn.00475139
lea eax, [ebp - 4]
jmp 0x475f13
push 1
push 1
push eax
call fcn.00475139
or dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x24]
or dword [ebp - 0xc], 0xffffffff
push edi
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x475f1d
or dword [ebp - 0x18], 0xffffffff
lea eax, [ebp - 0x18]
push 2
push edi
push edi
push eax
call ebx
push eax
push dword [ebp - 0xc]
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
xor ebx, ebx
mov ecx, esi
inc ebx
push ebx
push ebx
test eax, eax
jne 0x475f21
lea eax, [ebp - 8]
push eax
call fcn.00475139
push ebx
push ebx
lea eax, [ebp - 4]
mov ecx, esi
push eax
call fcn.00475139
push ebx
push ebx
lea eax, [ebp - 0x10]
mov ecx, esi
push eax
call fcn.00475139
lea eax, [ebp - 0xc]
push ebx
push ebx
push eax
mov ecx, esi
call fcn.00475139
xor eax, eax
jmp 0x475f87
lea eax, [ebp - 0xc]
push eax
call fcn.00475139
lea eax, [ebp - 0x10]
mov ecx, esi
push eax
lea eax, [ebp - 4]
push eax
call fcn.004751ae
test eax, eax
je 0x475f51
push dword [ebp + 8]
lea eax, [ebp - 4]
mov ecx, esi
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0047624b
mov edi, eax
push ebx
push ebx
lea eax, [ebp - 0x14]
mov ecx, esi
push eax
call fcn.00475139
push ebx
push ebx
lea eax, [ebp - 4]
mov ecx, esi
push eax
call fcn.00475139
push ebx
push ebx
lea eax, [ebp - 0x10]
mov ecx, esi
push eax
call fcn.00475139
push ebx
push ebx
lea eax, [ebp - 0x18]
mov ecx, esi
push eax
call fcn.00475139
mov eax, edi
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x47624b
Capabilities:
Read file on windows

Disassembly:
push 0x414
mov eax, 0x6e44a6
call fcn.00682c92
mov edi, ecx
mov dword [ebp - 0x420], edi
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x414], eax
call fcn.004727a7
push eax
lea ecx, [ebp - 0x418]
call fcn.00474663
xor ebx, ebx
mov ecx, edi
push ebx
push 1
push esi
mov dword [ebp - 4], ebx
call fcn.00475139
test eax, eax
je 0x47634f
push ebx
lea eax, [ebp - 0x41c]
push eax
push 0x400
lea eax, [ebp - 0x410]
push eax
mov eax, dword [ebp - 0x414]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x476330
mov edi, dword [ebp - 0x414]
mov esi, dword [ebp - 0x41c]
test esi, esi
je 0x47632a
call fcn.004727a7
push eax
push esi
lea eax, [ebp - 0x410]
push eax
lea ecx, [ebp - 0x414]
call fcn.0047468c
mov esi, dword [ebp - 0x414]
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 1
push dword [esi - 0xc]
push esi
call fcn.00474f10
lea ecx, [esi - 0x10]
mov byte [ebp - 4], bl
call fcn.004769de
push ebx
lea eax, [ebp - 0x41c]
push eax
push 0x400
lea eax, [ebp - 0x410]
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4762c3
mov edi, dword [ebp - 0x420]
lea eax, [ebp - 0x418]
mov ecx, edi
push eax
call fcn.00474895
push dword [ebp + 0x10]
mov ecx, edi
call fcn.00475828
test eax, eax
je 0x47634f
xor ebx, ebx
inc ebx
mov ecx, dword [ebp - 0x418]
add ecx, 0xfffffff0
call fcn.004769de
mov eax, ebx
call fcn.00682c3c
ret 0xc

Function at 0x477606
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ebp + 8]
push esi
mov esi, dword [0xabf6f4]
push edi
push dword [ebp + 0xc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x477695
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x477694
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push ebx
push edi
push eax
call fcn.00689000
add esp, 0xc
lea eax, [ebp + 8]
push eax
push 0
push esi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
push 0
push dword [ebp + 8]
call fcn.00477b56
pop ecx
pop ecx
mov ecx, dword [ebp + 0x10]
push esi
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor eax, eax
inc eax
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x4793da
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x7b088c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push 0x110
xor ebx, ebx
mov dword [ebp - 0x118], 0x114
lea eax, [ebp - 0x114]
push ebx
push eax
call fcn.00689b00
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x47942a
cmp dword [ebp - 0x114], 6
jb 0x47942a
inc ebx
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.00682c16
mov esp, ebp
pop ebp
ret

Function at 0x47b0ee
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
call fcn.0047b039
lea eax, [esi + 4]
push eax
xor eax, eax
push eax
push esi
push 0x47b1bf
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
mov dword [esi + 8], eax
test eax, eax
mov edx, 0x80004005
pop esi
cmove ecx, edx
mov eax, ecx
ret

Function at 0x47b11e
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi + 8], 0
jne 0x47b131
mov eax, 0x80004005
jmp 0x47b15b
call fcn.0047b074
test al, al
jne 0x47b159
cmp byte [ebp + 8], al
je 0x47b14c
push 0
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
jmp 0x47b159
push 0xffffffffffffffff
mov ecx, esi
mov byte [esi + 0xc], 1
call fcn.0047b196
xor eax, eax
pop esi
pop ebp
ret 4

Function at 0x47b1ce
Capabilities:
Check mutex on windows

Disassembly:
push esi
push edi
xor edi, edi
mov esi, ecx
push 0x6f4458
push edi
push edi
mov dword [esi], edi
mov dword [esi + 4], edi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x47b205
cmp eax, 5
je 0x47b205
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x47b20c
mov dword [esi + 4], 1
pop edi
mov eax, esi
pop esi
ret
Function at 0x49f4d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
movsx edx, word [ebx + 0x4c]
mov eax, dword [ebx]
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], edx
mov ecx, dword [ebx + edx*4 + 0x78]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
mov ax, word [ebx + edx*2 + 0x4e]
cmp ax, word [ecx + 0x12]
jae 0x49f6a8
cmp byte [ebx + 0x49], 1
jne 0x49f6a8
mov esi, dword [ebx + edx*4 + 0x78]
movzx ecx, ax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x1c], esi
mov eax, dword [esi + 0x40]
movzx edi, byte [eax + ecx*2]
movzx eax, byte [eax + ecx*2 + 1]
shl edi, 8
or edi, eax
movzx eax, word [esi + 0x14]
and edi, eax
add edi, dword [esi + 0x38]
cmp byte [esi + 5], 0
jne 0x49f550
and dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push ebx
call fcn.004a07ef
pop ecx
pop ecx
test eax, eax
jne 0x49f6ab
push ebx
push dword [ebx + 0x3c]
push dword [ebp - 0xc]
call fcn.0049b0d6
add esp, 0xc
test eax, eax
jne 0x49f6ab
cmp dword [ebx + 0x10], eax
jne 0x49f57e
push eax
push dword [ebx + 0x1c]
push dword [ebx + 0x18]
push dword [ebp - 4]
call fcn.004932b3
add esp, 0x10
push dword [esi + 0x44]
call fcn.004ad8d9
pop ecx
test eax, eax
jne 0x49f6ab
lea eax, [ebp - 4]
push eax
push edi
push esi
call fcn.0048a56e
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
movzx eax, word [ebp - 4]
push eax
push dword [ebp - 0x10]
push esi
call fcn.0048e204
mov eax, dword [ebp - 8]
add esp, 0x1c
test eax, eax
jne 0x49f6ab
cmp byte [esi + 5], al
jne 0x49f657
movsx eax, word [ebx + 0x4c]
mov edx, dword [ebx + eax*4 + 0x78]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], edx
movzx ecx, word [edx + 0x12]
mov eax, dword [ebx + eax*4 + 0x7c]
mov eax, dword [eax + 0x48]
mov dword [ebp - 0x18], eax
mov eax, dword [edx + 0x40]
movzx ebx, byte [eax + ecx*2 - 2]
movzx eax, byte [eax + ecx*2 - 1]
shl ebx, 8
or ebx, eax
movzx eax, word [edx + 0x14]
and ebx, eax
add ebx, dword [edx + 0x38]
push ebx
push edx
call fcn.00489b37
movzx edi, ax
mov eax, dword [ebp - 0xc]
mov esi, dword [eax + 0x50]
mov eax, dword [ebp - 4]
push dword [eax + 0x44]
call fcn.004ad8d9
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x18]
lea eax, [edi + 4]
push esi
push eax
lea eax, [ebx - 4]
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x1c]
call fcn.004930f9
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push edi
movzx eax, word [ecx + 0x12]
dec eax
push eax
push ecx
call fcn.0048e204
mov eax, dword [ebp - 8]
add esp, 0x38
test eax, eax
jne 0x49f6ab
mov ebx, dword [ebp + 8]
push ebx
call fcn.004878eb
mov edi, eax
pop ecx
test edi, edi
jne 0x49f6a4
movsx ecx, word [ebx + 0x4c]
mov esi, dword [ebp - 0x14]
cmp ecx, esi
jle 0x49f69d
movzx ecx, word [ebx + 0x4c]
movsx eax, cx
mov edx, dword [ebx + eax*4 + 0x78]
lea eax, [ecx - 1]
push edx
mov word [ebx + 0x4c], ax
call fcn.00499ca3
movsx eax, word [ebx + 0x4c]
pop ecx
cmp eax, esi
jg 0x49f66f
push ebx
call fcn.004878eb
mov edi, eax
pop ecx
test edi, edi
jne 0x49f6a4
push ebx
call fcn.004947f6
pop ecx
mov eax, edi
jmp 0x49f6ab
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a64ef
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
jne 0x4a6504
xor eax, eax
jmp 0x4a65ea
push edi
push 0
push 8
push dword [ebp + 8]
call fcn.004a2b9f
mov edi, eax
add esp, 0xc
mov dword [ebp - 0xc], edi
test edi, edi
je 0x4a65e9
test byte [ebp + 0x10], 1
mov eax, dword [esi]
mov dword [edi], eax
jne 0x4a6538
xor eax, eax
inc eax
cmp dword [esi], eax
jle 0x4a6538
add eax, eax
cmp eax, dword [esi]
jl 0x4a6532
imul eax, eax, 0x18
push ebx
push 0
push eax
push dword [ebp + 8]
call fcn.004a2b9f
mov ebx, eax
add esp, 0xc
mov dword [edi + 4], ebx
test ebx, ebx
jne 0x4a6565
push edi
push dword [ebp + 8]
call fcn.004a2b4f
pop ecx
pop ecx
xor eax, eax
jmp 0x4a65e8
and dword [ebp - 4], 0
cmp dword [esi], 0
mov eax, dword [esi + 4]
mov dword [ebp - 8], eax
jle 0x4a65e6
mov edi, dword [ebp - 8]
lea eax, [ebx + 0x10]
mov dword [ebp + 0xc], eax
sub ebx, edi
push 0
push dword [ebp + 0x10]
push dword [edi]
push dword [ebp + 8]
call fcn.0048f9ca
mov dword [ebx + edi], eax
push dword [edi + 4]
push dword [ebp + 8]
call fcn.004a2dae
mov ecx, dword [ebp + 0xc]
mov dword [ecx - 0xc], eax
push dword [edi + 8]
push dword [ebp + 8]
call fcn.004a2dae
mov ecx, dword [ebp + 0xc]
lea edi, [edi + 0x18]
add esp, 0x20
mov dword [ecx - 8], eax
mov al, byte [edi - 0xc]
and dword [ecx], 0xfffffffe
mov byte [ecx - 4], al
mov eax, dword [edi - 8]
xor eax, dword [ecx]
and eax, 2
xor dword [ecx], eax
mov eax, dword [edi - 4]
mov dword [ecx + 4], eax
add ecx, 0x18
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp + 0xc], ecx
mov dword [ebp - 4], eax
cmp eax, dword [esi]
jl 0x4a657f
mov edi, dword [ebp - 0xc]
mov eax, edi
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4b44ff
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
push 0
push 0x14
and dword [edi], 0
call fcn.004ab777
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x4b4520
push 7
pop eax
jmp 0x4b457c
cmp dword [0x7a647c], 0
push ebx
mov ebx, dword [ebp + 0x10]
je 0x4b4553
mov eax, dword [ebp + 0xc]
mov dword [esi + 8], eax
lea eax, [esi + 4]
push eax
xor eax, eax
mov dword [esi + 0xc], ebx
push eax
push esi
push 0x4b45d7
push eax
push eax
call fcn.006ad77b
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x4b4560
push 0x14
push 0
push esi
call fcn.00689b00
add esp, 0xc
cmp dword [esi + 8], 0
jne 0x4b4577
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push ebx
mov dword [esi + 4], eax
call dword [ebp + 0xc]
pop ecx
mov dword [esi + 0x10], eax
mov dword [edi], esi
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x4cd13a
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
cmp dword [esi + 0x5c], edi
je 0x4cd177
call fcn.004cd574
test eax, eax
je 0x4cd17f
lea eax, [ebp - 8]
push eax
push 4
push esi
push 0x4ce2da
push edi
push edi
call fcn.006ad77b
add esp, 0x18
mov dword [esi + 0x78], eax
test eax, eax
je 0x4cd177
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi + 0x80]
test ecx, ecx
je 0x4cd177
mov eax, dword [ecx]
lea edx, [ebp - 8]
push edx
push ecx
call dword [eax + 0x18]
mov eax, dword [esi + 0x80]
lea edx, [ebp - 4]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [ebp - 4]
mov ecx, dword [esi + 0x80]
neg eax
push edi
push eax
push dword [ebp - 8]
mov edx, dword [ecx]
push dword [ebp - 4]
push edi
push dword [esi + 0x38]
push dword [esi + 0x34]
push edi
push edi
push dword [esi + 0x60]
push ecx
call dword [edx + 0x20]
test eax, eax
jne 0x4cd177
push edi
push edi
push dword [esi + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
xor eax, eax
inc eax
jmp 0x4cd179

Function at 0x4cd8cb
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [ebp + 0xc]
mov dword [ebp - 4], ecx
push dword [ebp + 8]
push dword [0xabf6f4]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
push edi
push dword [0xabf6f4]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test edi, edi
je 0x4cd97a
test esi, esi
je 0x4cd97a
push edi
push dword [0xabf6f4]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
push ebx
push 0x22
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x4cd973
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push esi
mov dword [ebp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, eax
test ecx, ecx
je 0x4cd96c
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4cd96c
push ebx
push ecx
push eax
call fcn.00689000
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov ecx, dword [ebp - 4]
push ebx
push edi
call fcn.004cd5a0
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, esi
jmp 0x4cd97c
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4ce672
Capabilities:
Check if file exists
Get common file path

Disassembly:
push 0x214
mov eax, 0x6e49e8
call fcn.00682c92
mov esi, ecx
call sym.txupd.exe_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4ce6d1
mov ecx, esi
call sym.txupd.exe_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const
push eax
mov edi, str.CLinkChange::ChangeQQLink_txupd_do_not_exist:_s_n
push edi
push 0x6fdc1c
push 2
push str.CLinkChange::ChangeQQLink
push 0x35
push str.E:FixReplayAttackscoding_baseutilfunLinkChange.cpp
call fcn.004ce3cb
add esp, 0x1c
mov ecx, esi
call sym.txupd.exe_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const
push eax
push edi
call fcn.0047380a
pop ecx
pop ecx
jmp 0x4ce7cf
push 0x208
xor ebx, ebx
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.00689b00
add esp, 0xc
lea ecx, [ebp - 0x21c]
call sym.txupd.exe_public:_void___thiscall_CTXStringW::constructor_void_
push 1
push 0x19
lea eax, [ebp - 0x218]
mov dword [ebp - 4], ebx
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x4ce71e
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x21c]
call sym.txupd.exe_public:_class_CTXStringW____thiscall_CTXStringW::operator_wchar_t__
lea ecx, [ebp - 0x21c]
call sym.txupd.exe_public:_bool___thiscall_CTXStringW::IsEmpty_void_const
test al, al
jne 0x4ce7c4
push 1
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x21c]
call sym.txupd.exe_public:_class_CTXStringW___thiscall_CTXStringW::Right_int_
mov edi, 0x6fdc28
mov byte [ebp - 4], 1
push edi
push eax
call fcn.0051b7e6
pop ecx
pop ecx
lea ecx, [ebp - 0x220]
mov byte [ebp - 4], 0
mov bl, al
call sym.txupd.exe_public:_void___thiscall_CTXStringW::destructor_void_
test bl, bl
je 0x4ce778
push edi
lea ecx, [ebp - 0x21c]
call sym.txupd.exe_public:_class_CTXStringW____thiscall_CTXStringW::operator_wchar_t_const__
push 2
call fcn.004d2ce7
pop ecx
test eax, eax
je 0x4ce78b
push str.TIM.lnk
jmp 0x4ce7a3
push 3
call fcn.004d2ce7
pop ecx
test eax, eax
je 0x4ce79e
push 0x6fde48
jmp 0x4ce7a3
push 0x6fde60
lea ecx, [ebp - 0x21c]
call sym.txupd.exe_public:_class_CTXStringW____thiscall_CTXStringW::operator_wchar_t_const__
push dword [ebp + 8]
lea ecx, [ebp - 0x21c]
call sym.txupd.exe_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const
push eax
mov ecx, esi
call fcn.004ce85b
lea ecx, [ebp - 0x21c]
call sym.txupd.exe_public:_void___thiscall_CTXStringW::destructor_void_
call fcn.00682c3c
ret 4
Function at 0x4ce85b
Capabilities:
Create shortcut via ishelllink
Delete file

Disassembly:
push 8
mov eax, 0x6e4a41
call fcn.00682c5e
mov ebx, ecx
mov edi, dword [ebp + 8]
test edi, edi
je 0x4ce9b1
push edi
mov esi, str.CLinkChange::SetLink_change_link__s__to_txupd_n
push esi
push 0x6fdc1c
push 2
push str.CLinkChange::SetLink
push 0x60
push str.E:FixReplayAttackscoding_baseutilfunLinkChange.cpp
call fcn.004ce3cb
push edi
push esi
call fcn.0047380a
add esp, 0x24
lea eax, [ebp + 8]
xor esi, esi
mov dword [ebp + 8], esi
mov dword [ebp - 0x10], esi
push eax
push 0x74fcb4
push 1
push esi
push 0x752474
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x4ce994
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x4ce997
mov eax, dword [ecx]
lea edx, [ebp - 0x10]
push edx
push 0x751354
push ecx
call dword [eax]
test eax, eax
js 0x4ce994
cmp dword [ebp - 0x10], esi
je 0x4ce9a4
push edi
mov dword [ebx + 0x10], 1
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4ce90c
mov eax, dword [ebp - 0x10]
push 2
push edi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
lea ecx, [ebp - 0x14]
call sym.txupd.exe_public:_void___thiscall_CTXStringW::constructor_void_
push dword [ebp + 0xc]
lea eax, [ebp - 0x14]
mov dword [ebp - 4], esi
push str._notify__d
push eax
call sym.txupd.exe_public:_void___cdecl_CTXStringW::Format_wchar_t_const__
mov eax, dword [ebp + 8]
add esp, 0xc
mov ecx, ebx
mov esi, dword [eax]
call sym.txupd.exe_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const
push eax
push dword [ebp + 8]
call dword [esi + 0x50]
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x14]
mov esi, dword [eax]
call sym.txupd.exe_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const
push eax
push dword [ebp + 8]
call dword [esi + 0x2c]
mov eax, dword [ebp + 8]
lea ecx, [ebx + 4]
mov esi, dword [eax]
call sym.txupd.exe_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const
push eax
push dword [ebp + 8]
call dword [esi + 0x24]
mov eax, dword [ebp + 8]
lea ecx, [ebx + 8]
push 0
mov esi, dword [eax]
call sym.txupd.exe_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const
push eax
push dword [ebp + 8]
call dword [esi + 0x44]
mov eax, dword [ebp - 0x10]
push 1
push edi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x18]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call sym.txupd.exe_public:_void___thiscall_CTXStringW::destructor_void_
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
test edx, edx
je 0x4ce9a7
mov eax, dword [edx]
push edx
call dword [eax + 8]
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x4ce9b1
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
call fcn.00682c27
ret 8