joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10022272
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push 0x224
mov eax, 0x100bf90d
call fcn.1008c851
mov ebx, ecx
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x224]
mov eax, dword [ebp + 0xc]
xor esi, esi
push edi
mov dword [ebp - 0x22c], eax
mov dword [ebp - 0x224], esi
call fcn.1000564f
mov dword [ebp - 4], esi
lea ecx, [ebp - 0x224]
mov eax, dword [ebp - 0x224]
push dword [eax - 0xc]
call fcn.10001a10
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x224]
call fcn.100056a7
mov ecx, dword [ebp - 0x224]
lea ecx, [ecx - 0x10]
call fcn.1000159b
lea esi, [eax + 0x10]
mov dword [ebp - 0x228], esi
mov byte [ebp - 4], 1
mov ecx, ebx
push dword [ebp - 0x224]
push edi
call fcn.100220f0
test eax, eax
je 0x10022395
push str.Info.ini
lea ecx, [ebp - 0x224]
call fcn.10018acc
push dword [ebp - 0x224]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
call ebx
test eax, eax
je 0x10022395
push 0x20a
xor edi, edi
lea eax, [ebp - 0x220]
push edi
push eax
call fcn.1008f060
add esp, 0xc
lea eax, [ebp - 0x220]
push dword [ebp - 0x224]
push 0x104
push eax
push str.setup.exe
push str.PacketExe
push str.setting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x228]
call fcn.10018acc
mov esi, dword [ebp - 0x228]
push esi
call fcn.10001a48
pop ecx
mov ecx, dword [ebp - 0x22c]
push eax
push esi
add ecx, 0x28
call fcn.10001ddf
push esi
call ebx
mov edi, eax
jmp 0x10022397
xor edi, edi
lea ecx, [esi - 0x10]
call fcn.100018f3
mov ecx, dword [ebp - 0x224]
lea ecx, [ecx - 0x10]
call fcn.100018f3
mov eax, edi
call fcn.1008c7fb
ret 8
Function at 0x10022878
Capabilities:
Create process on windows

Disassembly:
push 0x94
mov eax, 0x100bfa40
call fcn.1008c851
mov edi, ecx
mov esi, dword [ebp + 8]
push str.CTxdlController::AsyncInstall_begin
push 0xd2
push str.D:qci_workspace_root_workspaces__qci_pipeline_10566830_1QQPCDownloadTxdlTxdlController.cpp
call fcn.1006b794
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 0x68], esp
push 0x100d3e22
call fcn.100111cd
sub esp, 0x18
xor ebx, ebx
mov dword [ebp - 4], ebx
mov ecx, esp
mov dword [ebp - 0x6c], esp
push str.actionTBSInstalling
call fcn.100111cd
push 0x7db
mov byte [ebp - 4], 1
call fcn.10018a1a
or dword [ebp - 4], 0xffffffff
mov ecx, eax
call fcn.10025d5f
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x110], eax
test eax, eax
je 0x100229c6
push str.CTxdlController::AsyncInstall_INTALL_THREAD_EVENT_EXIT
push 0xd2
push str.D:qci_workspace_root_workspaces__qci_pipeline_10566830_1QQPCDownloadTxdlTxdlController.cpp
call fcn.1006b794
push 0x40
lea eax, [ebp - 0x50]
push ebx
push eax
call fcn.1008f060
lea eax, [esi + 0xf0]
mov dword [ebp - 0x54], 0x44
add esp, 0x18
mov dword [ebp - 0x28], 0x80
cmp dword [eax + 0x14], 8
xorps xmm0, xmm0
movups xmmword [ebp - 0x64], xmm0
jb 0x10022940
mov eax, dword [eax]
lea ecx, [ebp - 0x64]
push ecx
lea ecx, [ebp - 0x54]
push ecx
push ebx
push ebx
push 0x2000000
push ebx
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x100229c6
push str.CTxdlController::AsyncInstall_CreateProcess
push 0xd2
push str.D:qci_workspace_root_workspaces__qci_pipeline_10566830_1QQPCDownloadTxdlTxdlController.cpp
call fcn.1006b794
mov eax, dword [ebp - 0x64]
add esp, 0xc
mov dword [esi + 0x10c], eax
push 0x12c
push ebx
lea eax, [esi + 0x10c]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
cmp eax, 1
ja 0x100229b2
push eax
push str.CTxdlController::AsyncInstall_event:_d
push 0xd2
push str.D:qci_workspace_root_workspaces__qci_pipeline_10566830_1QQPCDownloadTxdlTxdlController.cpp
call fcn.1006b794
add esp, 0x10
mov esi, ebx
test esi, esi
jne 0x1002297e
push dword [ebp - 0x60]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x64]
call esi
push 0xa4d
push str.D:qci_workspace_root_workspaces__qci_pipeline_10566830_1QQPCDownloadTxdlTxdlController.cpp
push str.Txdl::CTxdlController::AsyncInstall
lea ecx, [ebp - 0xa0]
call fcn.10007bde
mov esi, eax
push ebx
push 0x1001e631
lea ecx, [edi + 0x34]
mov dword [ebp - 4], 2
call fcn.100241ed
xor ecx, ecx
mov edx, esi
push eax
inc ecx
call fcn.1001c6ed
pop ecx
lea ecx, [ebp - 0xa0]
call fcn.10007d20
call fcn.1008c7fb
ret 4
Function at 0x10022eda
Capabilities:
Delete file
Get common file path

Disassembly:
push 0x230
mov eax, 0x100bfaf3
call fcn.1008c851
mov edi, dword [ebp + 8]
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x224], 7
mov dword [ebp - 0x228], ebx
mov word [ebp - 0x238], ax
mov dword [ebp - 4], ebx
call fcn.10018b84
add eax, 4
lea edx, [ebp - 0x238]
push 0x100d2a54
push edx
push str.NewUIurl
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
cmp dword [ebp - 0x224], 8
lea eax, [ebp - 0x238]
lea ecx, [ebp - 0x220]
mov dword [ebp - 0x220], ebx
cmovae eax, dword [ebp - 0x238]
push eax
call fcn.1000564f
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x220]
cmp dword [eax - 0xc], ebx
je 0x1002305c
call fcn.1002343b
test eax, eax
je 0x1002305c
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [edi + 0x120], eax
cmp dword [edi + 0x9c], ebx
jne 0x10022fa1
push 0xc8
call fcn.1008bec7
pop ecx
mov ecx, eax
mov dword [ebp - 0x23c], eax
call fcn.1001c359
mov dword [edi + 0x9c], eax
push dword [ebp - 0x220]
call fcn.10001a48
pop ecx
mov ecx, dword [edi + 0x9c]
push eax
push dword [ebp - 0x220]
call fcn.10001ddf
push 0x20a
lea eax, [ebp - 0x21c]
push ebx
push eax
call fcn.1008f060
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push str.UIConfig.Zip
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x21c]
push eax
call fcn.10001a48
pop ecx
mov ecx, dword [edi + 0x9c]
push eax
lea eax, [ebp - 0x21c]
add ecx, 0x18
push eax
call fcn.10001ddf
mov ecx, dword [edi + 0x14]
lea eax, [edi + 0xa0]
push eax
push dword [edi + 0x9c]
mov edx, dword [ecx]
call dword [edx + 4]
test eax, eax
jne 0x1002305c
mov esi, dword [edi + 0x18]
jmp 0x10023057
mov ecx, dword [esi]
test ecx, ecx
je 0x10023054
mov eax, dword [ecx]
push 0x12
push ecx
call dword [eax + 0x10]
add esi, 4
cmp esi, dword [edi + 0x1c]
jne 0x10023046
mov ecx, dword [ebp - 0x220]
lea ecx, [ecx - 0x10]
call fcn.100018f3
push ebx
push 1
lea ecx, [ebp - 0x238]
call fcn.10001f53
xor eax, eax
call fcn.1008c7fb
ret 4
Function at 0x10023533
Capabilities:
Check if file exists

Disassembly:
push 0x1d0
mov eax, 0x100bfbdf
call fcn.1008c851
mov edi, dword [ebp + 8]
xor ebx, ebx
push 7
pop ecx
xor eax, eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], ebx
mov word [ebp - 0x2c], ax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x34], ebx
mov word [ebp - 0x44], ax
mov esi, 0x100d2a54
mov byte [ebp - 4], 1
push esi
lea eax, [ebp - 0x1dc]
push 0x100f42d8
push eax
call fcn.10018b84
mov ecx, eax
call fcn.1000a09a
push eax
lea ecx, [ebp - 0x2c]
call fcn.1000284a
push ebx
push 1
lea ecx, [ebp - 0x1dc]
call fcn.10001f53
lea ecx, [ebp - 0xec]
call fcn.1001c89a
lea ecx, [ebp - 0x1b4]
call fcn.1001c359
push esi
lea eax, [ebp - 0x1dc]
mov byte [ebp - 4], 3
push str.offline_package
push eax
mov dword [ebp - 0x14], ebx
call fcn.10018b84
mov ecx, eax
call fcn.1000a09a
mov esi, eax
lea ecx, [ebp - 0x1bc]
mov byte [ebp - 4], 4
call fcn.1001ccba
push 0x100d3d18
mov edx, eax
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x1b8]
call fcn.10001474
pop ecx
mov byte [ebp - 4], 6
cmp dword [esi + 0x14], 8
jb 0x10023606
mov esi, dword [esi]
push esi
mov edx, eax
lea ecx, [ebp - 0x14]
call fcn.10001474
pop ecx
mov ecx, dword [ebp - 0x1b8]
lea ecx, [ecx - 0x10]
call fcn.100018f3
mov ecx, dword [ebp - 0x1bc]
lea ecx, [ecx - 0x10]
call fcn.100018f3
xor esi, esi
mov byte [ebp - 4], 0xa
push ebx
inc esi
lea ecx, [ebp - 0x1dc]
push esi
call fcn.10001f53
push dword [ebp - 0x14]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10023667
push dword [ebp - 0x14]
call fcn.10001a48
pop ecx
push eax
push dword [ebp - 0x14]
lea ecx, [ebp - 0x19c]
call fcn.10001ddf
push dword [ebp - 0x14]
call fcn.10001a48
pop ecx
push eax
push dword [ebp - 0x14]
lea ecx, [ebp - 0xc4]
call fcn.10001ddf
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0xdc]
call fcn.10001b8f
lea ecx, [edi + 0xc]
mov dword [ebp - 0xe8], esi
mov dword [ebp - 0x8c], ebx
mov dword [ebp - 0xe4], 8
call fcn.10023990
lea eax, [ebp - 0xec]
push eax
lea eax, [ebp - 0x1c4]
push eax
lea ecx, [edi + 0xc]
call fcn.100246db
mov ecx, dword [ebp - 0x1c4]
lea eax, [ebp - 0x1b4]
push eax
add ecx, 0xb8
call fcn.1001c3e6
sub esp, 0x18
lea edx, [ebp - 0x2c]
mov ecx, esp
mov dword [ebp - 0x1c0], esp
push ecx
call fcn.1006f4c0
pop ecx
mov byte [ebp - 4], 0xb
call fcn.10018a1a
mov ecx, eax
mov byte [ebp - 4], 0xa
call fcn.10026dac
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.100018f3
lea ecx, [ebp - 0x1b4]
call fcn.1001dd6c
lea ecx, [ebp - 0xec]
call fcn.1001c972
push ebx
push 1
lea ecx, [ebp - 0x44]
call fcn.10001f53
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.10001f53
xor eax, eax
inc eax
call fcn.1008c7fb
ret 4
Function at 0x1002d02e
Capabilities:
Delete registry value

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x1c0], 2
mov dword [esi + 0x1d8], 1
jne 0x1002d050
call fcn.10018a1a
mov ecx, eax
call fcn.10026e11
cmp dword [esi + 0x1c0], 3
je 0x1002d075
cmp dword [esi + 0x1f4], 0
je 0x1002d067
call fcn.1002fc41
push ecx
mov ecx, esi
call fcn.100325d1
pop esi
jmp fcn.1002cfb1
pop esi
ret
Function at 0x1002f1b5
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 0x3c
mov eax, 0x100c0f94
call fcn.1008c851
mov ebx, ecx
push str.CMainWndUI::ShowDownloadingUI
mov edi, 0xd2
mov esi, str.D:qci_workspace_root_workspaces__qci_pipeline_10566830_1QQPCDownloadTxdlUIMainWndUI.cpp
push edi
push esi
call fcn.1006b794
add esp, 0xc
push str.CMainWndUI::begin_to_set_timer
push edi
push esi
call fcn.1006b794
add esp, 0xc
mov ecx, ebx
push 0xfa0
call fcn.10051360
push eax
push str.CMainWndUI::end_to_set_timer_m_dwSwitchTimeId__d_
push edi
push esi
mov dword [ebx + 0x8c], eax
call fcn.1006b794
add esp, 0x10
xor esi, esi
xor eax, eax
mov dword [ebp - 0x30], esi
mov word [ebp - 0x40], ax
push 7
pop edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 4], esi
mov eax, dword [ebx + 0xa4]
sub eax, dword [ebx + 0xa0]
push 0x18
pop ecx
cdq
idiv ecx
mov ecx, dword [ebx + 0x1b0]
cmp eax, ecx
jbe 0x1002f256
imul eax, ecx, 0x18
lea ecx, [ebp - 0x40]
add eax, dword [ebx + 0xa0]
cmp ecx, eax
je 0x1002f256
push 0xffffffffffffffff
push esi
push eax
call fcn.10001b8f
xor eax, eax
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], esi
mov word [ebp - 0x28], ax
mov byte [ebp - 4], 1
mov eax, dword [ebx + 0xb0]
sub eax, dword [ebx + 0xac]
push 0x18
pop ecx
cdq
idiv ecx
mov ecx, dword [ebx + 0x1b0]
cmp eax, ecx
jbe 0x1002f29b
imul eax, ecx, 0x18
lea ecx, [ebp - 0x28]
add eax, dword [ebx + 0xac]
cmp ecx, eax
je 0x1002f29b
push 0xffffffffffffffff
push esi
push eax
call fcn.10001b8f
mov ecx, dword [ebx + 0x1b0]
lea eax, [ebp - 0x28]
push esi
push eax
lea eax, [ebp - 0x40]
push eax
mov eax, dword [ebx + 0x1d0]
lea eax, [eax + ecx*4]
mov ecx, ebx
add eax, 8
push eax
call fcn.10032266
inc dword [ebx + 0x1b0]
lea ecx, [ebx + 0x70]
mov eax, dword [ecx]
push 2
call dword [eax + 8]
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x44], esp
push str.homepagestay
call fcn.100111cd
sub esp, 0x18
mov byte [ebp - 4], 2
mov ecx, esp
mov dword [ebp - 0x48], esp
push str.costHomePageStay
call fcn.100111cd
mov byte [ebp - 4], 3
call fcn.1001c2c8
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword [eax + 0x118]
call edi
sub eax, esi
push eax
push 0x138a
call fcn.10018a1a
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.10025dd1
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x48], esp
push 0x100d3e22
call fcn.100111cd
sub esp, 0x18
mov byte [ebp - 4], 4
mov ecx, esp
mov dword [ebp - 0x44], esp
push str.actionEnterDownloading
call fcn.100111cd
push 0x7d4
mov byte [ebp - 4], 5
call fcn.10018a1a
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.10025d5f
call edi
mov esi, eax
call fcn.1001c2c8
push 0
push 1
lea ecx, [ebp - 0x28]
mov dword [eax + 0x118], esi
mov dword [ebx + 0x1c0], 2
call fcn.10001f53
push 0
push 1
lea ecx, [ebp - 0x40]
call fcn.10001f53
call fcn.1008c7fb
ret
Function at 0x1002fc41
Capabilities:
Delete file
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x1010e070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov ebx, 0x20a
lea eax, [ebp - 0x210]
push ebx
push 0
push eax
call fcn.1008f060
add esp, 0xc
lea eax, [ebp - 0x210]
push 0x104
push eax
push str._AppData_TencentQQ_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea ecx, [ebp - 0x214]
call fcn.1001b7ca
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push dword [eax]
lea eax, [ebp - 0x210]
push eax
call edi
mov ecx, dword [ebp - 0x214]
lea ecx, [ecx - 0x10]
call fcn.100018f3
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.1008f060
add esp, 0xc
lea eax, [ebp - 0x210]
push 1
push 0x23
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.TencentQQ_
lea eax, [ebp - 0x210]
push eax
call edi
lea ecx, [ebp - 0x214]
call fcn.1001b7ca
push dword [eax]
lea eax, [ebp - 0x210]
push eax
call edi
mov ecx, dword [ebp - 0x214]
lea ecx, [ecx - 0x10]
call fcn.100018f3
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.1008bb47
mov esp, ebp
pop ebp
ret

Function at 0x1002fde6
Capabilities:
Check if file exists

Disassembly:
push 0x20
mov eax, 0x100c1111
call fcn.1008c851
and dword [ebp - 0x14], 0
lea ecx, [ebp - 0x2c]
call fcn.1001b5ff
and dword [ebp - 4], 0
cmp dword [eax + 0x14], 8
jb 0x1002fe0a
mov eax, dword [eax]
push str.QQPCTray.exe
mov edx, eax
lea ecx, [ebp - 0x14]
call fcn.1001cd37
pop ecx
push 0
push 1
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 2
call fcn.10001f53
push dword [ebp - 0x14]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1002fe4b
push ecx
push 1
push ecx
mov ecx, dword [ebp - 0x14]
mov edx, str._showui__setup
call fcn.1001b4a1
add esp, 0xc
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.100018f3
call fcn.1008c7fb
ret
Function at 0x10031076
Capabilities:
Create thread

Disassembly:
push ebx
push esi
push edi
xor ebx, ebx
mov esi, ecx
push ebx
push ebx
push esi
push 0x10030a96
push ebx
push ebx
call fcn.100974fc
add esp, 0x18
test eax, eax
je 0x1003109a
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.10018b84
add eax, 4
push ebx
push str.target
push eax
mov ecx, dword [eax]
call dword [ecx + 0x10]
mov edi, eax
call fcn.1001c2c8
add eax, 4
push eax
mov ecx, dword [eax]
call dword [ecx + 0x70]
test eax, eax
je 0x100310cf
mov ecx, esi
call fcn.10031057
push 1
mov ecx, esi
jmp 0x10031102
cmp dword [esi + 0x1ac], ebx
jne 0x10031109
cmp edi, 1
jne 0x10031109
mov ecx, esi
call fcn.10031057
call fcn.10018b84
add eax, 4
push ebx
push 0x100f8528
push eax
mov ecx, dword [eax]
call dword [ecx + 0x10]
mov ecx, esi
cmp eax, 3
jne 0x10031101
push edi
jmp 0x10031102
push ebx
call fcn.1003260d
jmp 0x10031117
push ebx
mov ecx, esi
call fcn.1003260d
mov dword [esi + 0x1c0], ebx
pop edi
pop esi
pop ebx
ret

Function at 0x100312c8
Capabilities:
Create process on windows

Disassembly:
push 0x244
mov eax, 0x100c12d9
call fcn.1008c851
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x220], ebx
call fcn.10018b84
add eax, 4
push ebx
push str.bShowPacketInstallProgross
push eax
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov edi, eax
call fcn.1001c2c8
add eax, 4
lea edx, [ebp - 0x220]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x48]
mov ecx, dword [ebp - 0x220]
cmp ecx, 1
jne 0x1003144d
push 7
pop ecx
xor eax, eax
mov dword [ebp - 0x224], ecx
mov dword [ebp - 0x228], ebx
mov word [ebp - 0x238], ax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x23c], ecx
mov dword [ebp - 0x240], ebx
mov word [ebp - 0x250], ax
push 0x20a
lea eax, [ebp - 0x21c]
mov byte [ebp - 4], 1
push ebx
push eax
call fcn.1008f060
lea eax, [ebp - 0x21c]
mov edx, str.InstallDir
push eax
mov ecx, str.SOFTWARETencentQQPCMgr
call fcn.1001ae46
add esp, 0x10
test eax, eax
je 0x1003142b
call fcn.10018b84
add eax, 4
lea edx, [ebp - 0x238]
mov ebx, 0x100d2a54
push ebx
push edx
mov ecx, dword [eax]
push str.NewVersionRunExe
push eax
call dword [ecx + 8]
call fcn.10018b84
add eax, 4
lea edx, [ebp - 0x250]
push ebx
push edx
push str.NewVersionRunExeParam
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [ebp - 0x228], 0
je 0x10031429
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
cmp dword [ebp - 0x224], 8
lea eax, [ebp - 0x238]
cmovae eax, dword [ebp - 0x238]
push eax
lea eax, [ebp - 0x21c]
push 0x104
push eax
call fcn.1009715a
add esp, 0xc
lea eax, [ebp - 0x250]
cmp dword [ebp - 0x23c], 8
cmovae eax, dword [ebp - 0x250]
xor ebx, ebx
push 1
push ebx
push eax
lea eax, [ebp - 0x21c]
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x1003142b
xor ebx, ebx
push ebx
push 1
lea ecx, [ebp - 0x250]
call fcn.10001f53
push ebx
push 1
lea ecx, [ebp - 0x238]
call fcn.10001f53
mov ecx, dword [ebp - 0x220]
cmp dword [esi + 0x1ac], ebx
jne 0x1003146f
cmp dword [esi + 0x1d8], ebx
jne 0x1003146f
test edi, edi
je 0x10031466
cmp ecx, 1
jne 0x1003146f
push 1
mov ecx, esi
call fcn.1003260d
call fcn.1008c7fb
ret
Function at 0x10031475
Capabilities:
Get disk size

Disassembly:
push 0x44c
mov eax, 0x100c119a
call fcn.1008c851
mov ebx, ecx
mov esi, 0x20a
lea eax, [ebp - 0x428]
push esi
xor edi, edi
push edi
push eax
call fcn.1008f060
push esi
lea eax, [ebp - 0x21c]
push edi
push eax
call fcn.1008f060
add esp, 0x18
jmp 0x100307c6
lea ecx, [ebp - 0x21c]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x1003091f
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x42c], edi
push eax
lea ecx, [ebp - 0x42c]
call fcn.1000564f
mov dword [ebp - 4], edi
mov eax, dword [ebp - 0x42c]
cmp dword [eax - 0xc], 2
jl 0x1003079a
push 2
lea eax, [ebp - 0x430]
mov dword [ebp - 0x430], edi
push eax
lea ecx, [ebp - 0x42c]
call fcn.1000559a
mov esi, dword [ebp - 0x430]
lea eax, [ebp - 0x438]
push edi
push edi
push eax
push esi
mov dword [ebp - 0x438], edi
mov dword [ebp - 0x434], edi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
cmp dword [ebp - 0x434], edi
ja 0x10030828
jb 0x10030792
cmp dword [ebp - 0x438], 0x6400000
jae 0x10030828
lea ecx, [esi - 0x10]
call fcn.100018f3
push 0x40
push 0x100f6e40
push 0x100f84dc
mov ecx, ebx
call fcn.100530c0
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x42c]
lea ecx, [ecx - 0x10]
call fcn.100018f3
push 7
mov dword [ebp - 0x458], edi
xor eax, eax
pop ecx
lea edi, [ebp - 0x454]
rep stosd dword es:[edi], eax
mov ecx, ebx
call fcn.100530c0
mov dword [ebp - 0x458], eax
xor edi, edi
lea eax, [ebp - 0x428]
mov dword [ebp - 0x454], edi
mov dword [ebp - 0x450], eax
lea eax, [ebp - 0x458]
push eax
mov dword [ebp - 0x44c], 0x100f84cc
mov dword [ebp - 0x448], 0x43
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderW]
test eax, eax
jne 0x100306fb
jmp 0x1003091f
lea ecx, [esi - 0x10]
call fcn.100018f3
mov dword [ebp - 0x430], edi
lea ecx, [ebp - 0x42c]
mov byte [ebp - 4], 1
call fcn.1001b8c1
push eax
lea ecx, [ebp - 0x42c]
call fcn.10005601
push edi
push str.qqpcmgr
lea ecx, [ebp - 0x42c]
call fcn.1000b090
cmp eax, 0xffffffff
lea eax, [ebp - 0x21c]
push eax
jne 0x100308b7
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea ecx, [ebp - 0x21c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x1003087d
sub ecx, edx
lea eax, [ebp - 0x21c]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x42c]
call fcn.10005c3c
push 7
push str.QQPCMgr
lea ecx, [ebp - 0x42c]
call fcn.10003991
push dword [ebp - 0x42c]
lea ecx, [ebp - 0x430]
call fcn.10031a69
call fcn.1001c2c8
push dword [ebp - 0x430]
add eax, 4
push eax
mov edx, dword [eax]
call dword [edx + 0x2c]
push edi
push 0x10110758
push 0x10110524
push edi
push 0x6a
mov ecx, ebx
call fcn.100530d0
push eax
call fcn.100bbbfd
add esp, 0x14
test eax, eax
je 0x10030905
push dword [ebp - 0x430]
mov ecx, eax
call fcn.100555c0
push dword [ebp - 0x430]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov ecx, dword [ebp - 0x42c]
lea ecx, [ecx - 0x10]
call fcn.100018f3
call fcn.1008c7fb
ret
mov dword [ecx + 0x1d8], 1
jmp 0x100306bf
Function at 0x10033cb0
Capabilities:
Terminate process

Disassembly:
push 0x24
mov eax, 0x100c1780
call fcn.1008c851
mov esi, 0x10112d40
mov dword [ebp - 0x28], 3
mov ebx, 0x1010ec84
push 0x40
call fcn.1008bec7
pop ecx
mov dword [ebp - 0x30], eax
and dword [ebp - 4], 0
mov ecx, eax
push dword [ebx + 4]
push dword [ebx]
push dword [ebx - 4]
call fcn.1003c7dc
or dword [ebp - 4], 0xffffffff
mov edi, eax
mov ecx, dword [esi]
cmp edi, ecx
je 0x10033d03
test ecx, ecx
je 0x10033d01
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esi], edi
and dword [ebp - 0x24], 0
lea edi, [ebp - 0x20]
mov ecx, dword [esi]
lea edx, [ebp - 0x24]
xor eax, eax
stosd dword es:[edi], eax
push edx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ecx]
call dword [eax + 0xc]
test al, al
je 0x10033d57
mov ecx, dword [esi]
lea eax, [ebp - 0x2c]
push eax
call fcn.10033b97
mov dword [ebp - 4], 1
lea ecx, [esi + 0x10]
push dword [eax]
call fcn.10033ea6
mov dword [ebp - 4], 2
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x10033d51
lea ecx, [eax + 4]
call fcn.10008132
or dword [ebp - 4], 0xffffffff
jmp 0x10033d66
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
add ebx, 0xc
add esi, 4
sub dword [ebp - 0x28], 1
jne 0x10033ccd
xor eax, eax
inc eax
call fcn.1008c7fb
ret
Function at 0x10037600
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 8]
mov dword [ebp - 0xc], 4
push eax
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0xc]
mov dword [ebp - 8], 4
push eax
push str.DebugBeacon
push str.SOFTWARETencentQQPCMgr
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
xor eax, eax
cmp eax, dword [ebp - 4]
sbb eax, eax
neg eax
mov esp, ebp
pop ebp
ret