joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001e9c8
Capabilities:
Create directory
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1a4
mov eax, dword [0x1010c070]
xor eax, esp
mov dword [esp + 0x1a0], eax
push ebx
mov ebx, dword [ebp + 8]
mov ecx, ebx
push esi
push edi
call fcn.10020663
xor esi, esi
mov dword [esp + 0x34], esi
call fcn.100017c6
push eax
lea ecx, [esp + 0x38]
call fcn.10001562
push str.Download_
lea ecx, [esp + 0x14]
mov dword [esp + 0x34], esi
call fcn.1001ac5b
mov edx, eax
lea ecx, [esp + 0x34]
call fcn.10001464
pop ecx
mov ecx, dword [esp + 0x10]
lea ecx, [ecx - 0x10]
call fcn.100018e3
push esi
push dword [esp + 0x34]
push esi
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
push 0xb
push str.QQPCFix.exe
lea ecx, [esp + 0x38]
call fcn.10003981
push dword [esp + 0x30]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [esp + 0x38]
call fcn.1001c3eb
push dword [esp + 0x30]
mov dword [esp + 0x40], 2
mov dword [esp + 0x44], esi
call fcn.10001a38
pop ecx
push eax
push dword [esp + 0x34]
lea ecx, [esp + 0x68]
call fcn.10001dcf
call fcn.10018b24
push 0x100d1a34
push 0x100f22ac
lea edi, [eax + 4]
lea eax, [esp + 0x20]
push eax
call fcn.10018b24
mov ecx, eax
call fcn.1000a03a
mov esi, eax
cmp dword [esi + 0x14], 8
jb 0x1001eaae
mov esi, dword [esi]
mov eax, dword [edi]
push 0
push 0x100ec2c0
push edi
call dword [eax + 0x10]
push eax
lea eax, [esp + 0x38]
push esi
push eax
call fcn.10005d9c
add esp, 0xc
lea ecx, [esp + 0x18]
push 0
push 1
call fcn.10001f43
lea ecx, [esp + 0xe0]
call fcn.1001beaa
mov esi, dword [esp + 0x34]
push esi
call fcn.10001a38
pop ecx
push eax
push esi
lea ecx, [esp + 0xe8]
call fcn.10001dcf
push dword [esp + 0x30]
call fcn.10001a38
pop ecx
push eax
push dword [esp + 0x34]
lea ecx, [esp + 0x100]
call fcn.10001dcf
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x14]
push eax
lea ecx, [ebx + 0x10]
call fcn.1002422e
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0xe0]
push eax
lea ecx, [ecx + 0xb8]
call fcn.1001bf37
lea eax, [ebx + 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
lea ecx, [esp + 0xe0]
call fcn.1001d8bd
lea ecx, [esp + 0x38]
call fcn.1001c4c3
mov ecx, dword [esp + 0x30]
lea ecx, [ecx - 0x10]
call fcn.100018e3
lea ecx, [esi - 0x10]
call fcn.100018e3
mov ecx, dword [esp + 0x1ac]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1008aeea
mov esp, ebp
pop ebp
ret 4

Function at 0x1001ed07
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, ecx
xor edi, edi
call fcn.10018b24
mov esi, dword [ebp + 8]
add eax, 4
push esi
push eax
mov edx, dword [eax]
call dword [edx + 4]
test eax, eax
js 0x1001ed46
mov ecx, ebx
call fcn.1001eda8
mov ecx, ebx
call fcn.1001f5b7
mov ecx, ebx
call fcn.1001fe1e
xor eax, eax
inc eax
cmp eax, dword [ebx + 0x14]
sbb edi, edi
neg edi
cmp dword [esi + 0x14], 8
jb 0x1001ed4e
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x1001eda8
Capabilities:
Check if file exists
Create directory
Get common file path
Query environment variable

Disassembly:
push 0x454
mov eax, 0x100be73b
call fcn.1008bbf4
mov edi, ecx
push 0x412
xor ebx, ebx
lea eax, [ebp - 0x428]
push ebx
push eax
call fcn.1008e420
add esp, 0xc
call fcn.1001ad58
test eax, eax
je 0x1001ee3a
push 0x208
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea edx, [ebp - 0x428]
lea ecx, [edi + 0x84]
lea esi, [edx + 2]
mov ax, word [edx]
add edx, 2
cmp ax, bx
jne 0x1001ee07
sub edx, esi
lea eax, [ebp - 0x428]
sar edx, 1
push edx
push eax
call fcn.10005c27
push 0xe
lea ecx, [edi + 0x88]
push str.YoudaoNote.exe
call fcn.10005c27
jmp 0x1001eff2
push str._appdata__tencentQQPCMgrDownload_
lea eax, [ebp - 0x444]
push str.PackageDirCfg
push eax
call fcn.10018b24
mov ecx, eax
call fcn.1000a03a
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x428]
cmp dword [ebp - 0x430], 8
lea eax, [ebp - 0x444]
push 0x208
cmovae eax, dword [ebp - 0x444]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp - 0x428]
push eax
call esi
test eax, eax
jne 0x1001ef0a
push ebx
lea eax, [ebp - 0x428]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
lea eax, [ebp - 0x428]
push eax
call esi
test eax, eax
je 0x1001eecc
lea edx, [ebp - 0x428]
lea ecx, [edi + 0x84]
lea esi, [edx + 2]
mov ax, word [edx]
add edx, 2
cmp ax, bx
jne 0x1001eebf
jmp 0x1001ef24
lea ecx, [ebp - 0x448]
call fcn.1001ac5b
lea esi, [edi + 0x84]
mov byte [ebp - 4], 1
push eax
mov ecx, esi
call fcn.100055ec
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x448]
lea ecx, [ecx - 0x10]
call fcn.100018e3
push 9
push str.Download_
mov ecx, esi
call fcn.10003981
jmp 0x1001ef35
lea edx, [ebp - 0x428]
lea ecx, [edi + 0x84]
lea esi, [edx + 2]
mov ax, word [edx]
add edx, 2
cmp ax, bx
jne 0x1001ef19
sub edx, esi
lea eax, [ebp - 0x428]
sar edx, 1
push edx
push eax
call fcn.10005c27
push 0x100d1a34
lea eax, [ebp - 0x460]
mov dword [ebp - 0x42c], ebx
push str.QQPCMgrNameCfg
push eax
call fcn.10018b24
mov ecx, eax
call fcn.1000a03a
mov byte [ebp - 4], 2
cmp dword [eax + 0x14], 8
jb 0x1001ef64
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x42c]
call fcn.1000563a
push ebx
push 1
lea ecx, [ebp - 0x460]
mov byte [ebp - 4], 4
call fcn.10001f43
mov eax, dword [ebp - 0x42c]
cmp dword [eax - 0xc], ebx
jne 0x1001efc4
call fcn.10018b24
add eax, 4
push ebx
push str.ModuleType
push eax
mov ecx, dword [eax]
call dword [ecx + 0x10]
test eax, eax
mov ecx, str.QQPCMgr_Setup.dll
mov esi, str.QQPCMgr_Setup.exe
cmovne esi, ecx
mov ecx, esi
call fcn.10001546
push eax
push esi
lea ecx, [ebp - 0x42c]
call fcn.10005c27
lea eax, [ebp - 0x42c]
push eax
lea ecx, [edi + 0x88]
call fcn.100055ec
mov ecx, dword [ebp - 0x42c]
lea ecx, [ecx - 0x10]
call fcn.100018e3
push ebx
push 1
lea ecx, [ebp - 0x444]
call fcn.10001f43
call fcn.1008bb9e
ret
Function at 0x100204a6
Capabilities:
Get common file path
Get program files directory

Disassembly:
push 0x220
mov eax, 0x100be9f9
call fcn.1008bbf4
mov edi, dword [ebp + 8]
xor ebx, ebx
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x224], ebx
call fcn.100017c6
push eax
lea ecx, [ebp - 0x224]
call fcn.10001562
mov dword [ebp - 4], ebx
call fcn.10018b24
add eax, 4
push ebx
push str.KvNoCmdline
push eax
mov ecx, dword [eax]
call dword [ecx + 0x18]
test eax, eax
je 0x1002050a
cmp dword [esi + 0x60], ebx
jne 0x1002050a
push ebx
push 0x100d1a34
lea ecx, [ebp - 0x224]
call fcn.10005c27
jmp 0x100205cc
push 0x20a
lea eax, [ebp - 0x21c]
push ebx
push eax
call fcn.1008e420
add esp, 0xc
lea eax, [ebp - 0x21c]
push ebx
push 0x26
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.Kingsoft
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov dword [ebp - 0x220], ebx
call fcn.100017c6
push eax
lea ecx, [ebp - 0x220]
call fcn.10001562
lea eax, [ebp - 0x21c]
mov byte [ebp - 4], 1
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x220]
push edi
push str._silence1handle_dsupply_dinstallpath__s_
push eax
call fcn.10005d9c
lea eax, [esi + 0x80]
add esp, 0x14
cmp dword [eax + 0x14], 8
jb 0x1002058a
mov eax, dword [eax]
push eax
lea edx, [ebp - 0x220]
lea ecx, [ebp - 0x22c]
call fcn.10001464
pop ecx
push eax
lea ecx, [ebp - 0x224]
mov byte [ebp - 4], 2
call fcn.100055ec
mov ecx, dword [ebp - 0x22c]
lea ecx, [ecx - 0x10]
call fcn.100018e3
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x220]
lea ecx, [ecx - 0x10]
call fcn.100018e3
cmp dword [esi + 0x78], 0
mov dword [ebp - 0x228], ebx
jne 0x100205df
mov eax, str.Install
jmp 0x100205ea
lea eax, [esi + 0x68]
cmp dword [eax + 0x14], 8
jb 0x100205ea
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x228]
call fcn.1000563a
xor ecx, ecx
mov byte [ebp - 4], 3
cmp dword [esi + 0x60], ebx
lea eax, [esi + 0x28]
setne cl
mov dword [esi + 0x98], ecx
cmp dword [eax + 0x14], 8
jb 0x10020613
mov eax, dword [eax]
push dword [esi + 4]
push ecx
push dword [ebp - 0x228]
push eax
call fcn.100233aa
mov ecx, eax
call fcn.10016f56
mov esi, dword [ebp - 0x224]
test eax, eax
je 0x10020640
mov edx, dword [eax]
mov ecx, eax
push esi
call dword [edx + 4]
test eax, eax
jne 0x10020643
push 9
pop ebx
mov ecx, dword [ebp - 0x228]
add ecx, 0xfffffff0
call fcn.100018e3
lea ecx, [esi - 0x10]
call fcn.100018e3
mov eax, ebx
call fcn.1008bb9e
ret 0xc
Function at 0x100209fb
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x1010c070]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, 0x20a
lea eax, [ebp - 0x210]
xor edi, edi
push esi
push edi
push eax
mov dword [ebp - 0x224], edi
call fcn.1008e420
add esp, 0xc
mov dword [ebp - 0x218], edi
call fcn.100017c6
push eax
lea ecx, [ebp - 0x218]
call fcn.10001562
lea eax, [ebp - 0x224]
mov dword [ebp - 0x21c], esi
push eax
push 0x20019
push edi
push str.SoftwareTencentQQPCMgr
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10020b34
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x220]
push eax
push edi
push str.InstallDir
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10020b28
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea ecx, [ebp - 0x210]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x10020ab5
sub ecx, edx
lea eax, [ebp - 0x210]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x218]
call fcn.10005c27
push str.QQRepair.exe
lea edx, [ebp - 0x218]
mov dword [ebp - 0x214], edi
lea ecx, [ebp - 0x214]
call fcn.10001464
pop ecx
push dword [ebp - 0x214]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10020b1a
push ecx
push edi
push ecx
mov ecx, dword [ebp - 0x214]
mov edx, str._ext1
call fcn.1001aff3
add esp, 0xc
mov ecx, dword [ebp - 0x214]
lea ecx, [ecx - 0x10]
call fcn.100018e3
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x218]
lea ecx, [ecx - 0x10]
call fcn.100018e3
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.1008aeea
mov esp, ebp
pop ebp
ret 4
Function at 0x10021dc5
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push 0x224
mov eax, 0x100bec81
call fcn.1008bbf4
mov ebx, ecx
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x224]
mov eax, dword [ebp + 0xc]
xor esi, esi
push edi
mov dword [ebp - 0x22c], eax
mov dword [ebp - 0x224], esi
call fcn.1000563a
mov dword [ebp - 4], esi
lea ecx, [ebp - 0x224]
mov eax, dword [ebp - 0x224]
push dword [eax - 0xc]
call fcn.10001a00
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x224]
call fcn.10005692
mov ecx, dword [ebp - 0x224]
lea ecx, [ecx - 0x10]
call fcn.1000158b
lea esi, [eax + 0x10]
mov dword [ebp - 0x228], esi
mov byte [ebp - 4], 1
mov ecx, ebx
push dword [ebp - 0x224]
push edi
call fcn.10021c43
test eax, eax
je 0x10021ee8
push str.Info.ini
lea ecx, [ebp - 0x224]
call fcn.10018a6c
push dword [ebp - 0x224]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
call ebx
test eax, eax
je 0x10021ee8
push 0x20a
xor edi, edi
lea eax, [ebp - 0x220]
push edi
push eax
call fcn.1008e420
add esp, 0xc
lea eax, [ebp - 0x220]
push dword [ebp - 0x224]
push 0x104
push eax
push str.setup.exe
push str.PacketExe
push str.setting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x228]
call fcn.10018a6c
mov esi, dword [ebp - 0x228]
push esi
call fcn.10001a38
pop ecx
mov ecx, dword [ebp - 0x22c]
push eax
push esi
add ecx, 0x28
call fcn.10001dcf
push esi
call ebx
mov edi, eax
jmp 0x10021eea
xor edi, edi
lea ecx, [esi - 0x10]
call fcn.100018e3
mov ecx, dword [ebp - 0x224]
lea ecx, [ecx - 0x10]
call fcn.100018e3
mov eax, edi
call fcn.1008bb9e
ret 8
Function at 0x100223cb
Capabilities:
Create process on windows

Disassembly:
push 0x94
mov eax, 0x100bedb4
call fcn.1008bbf4
mov edi, ecx
mov esi, dword [ebp + 8]
push str.CTxdlController::AsyncInstall_begin
push 0xd2
push str.D:qci_workspace_root_workspaces__qci_pipeline_10566830_1QQPCDownloadTxdlTxdlController.cpp
call fcn.1006ab44
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 0x68], esp
push 0x100d2e02
call fcn.1001116d
sub esp, 0x18
xor ebx, ebx
mov dword [ebp - 4], ebx
mov ecx, esp
mov dword [ebp - 0x6c], esp
push str.actionTBSInstalling
call fcn.1001116d
push 0x7db
mov byte [ebp - 4], 1
call fcn.100189ba
or dword [ebp - 4], 0xffffffff
mov ecx, eax
call fcn.100258b2
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x110], eax
test eax, eax
je 0x10022519
push str.CTxdlController::AsyncInstall_INTALL_THREAD_EVENT_EXIT
push 0xd2
push str.D:qci_workspace_root_workspaces__qci_pipeline_10566830_1QQPCDownloadTxdlTxdlController.cpp
call fcn.1006ab44
push 0x40
lea eax, [ebp - 0x50]
push ebx
push eax
call fcn.1008e420
lea eax, [esi + 0xf0]
mov dword [ebp - 0x54], 0x44
add esp, 0x18
mov dword [ebp - 0x28], 0x80
cmp dword [eax + 0x14], 8
xorps xmm0, xmm0
movups xmmword [ebp - 0x64], xmm0
jb 0x10022493
mov eax, dword [eax]
lea ecx, [ebp - 0x64]
push ecx
lea ecx, [ebp - 0x54]
push ecx
push ebx
push ebx
push 0x2000000
push ebx
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x10022519
push str.CTxdlController::AsyncInstall_CreateProcess
push 0xd2
push str.D:qci_workspace_root_workspaces__qci_pipeline_10566830_1QQPCDownloadTxdlTxdlController.cpp
call fcn.1006ab44
mov eax, dword [ebp - 0x64]
add esp, 0xc
mov dword [esi + 0x10c], eax
push 0x12c
push ebx
lea eax, [esi + 0x10c]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
cmp eax, 1
ja 0x10022505
push eax
push str.CTxdlController::AsyncInstall_event:_d
push 0xd2
push str.D:qci_workspace_root_workspaces__qci_pipeline_10566830_1QQPCDownloadTxdlTxdlController.cpp
call fcn.1006ab44
add esp, 0x10
mov esi, ebx
test esi, esi
jne 0x100224d1
push dword [ebp - 0x60]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x64]
call esi
push 0xa4d
push str.D:qci_workspace_root_workspaces__qci_pipeline_10566830_1QQPCDownloadTxdlTxdlController.cpp
push str.Txdl::CTxdlController::AsyncInstall
lea ecx, [ebp - 0xa0]
call fcn.10007bbe
mov esi, eax
push ebx
push 0x1001e182
lea ecx, [edi + 0x34]
mov dword [ebp - 4], 2
call fcn.10023d40
xor ecx, ecx
mov edx, esi
push eax
inc ecx
call fcn.1001c23e
pop ecx
lea ecx, [ebp - 0xa0]
call fcn.10007d00
call fcn.1008bb9e
ret 4
Function at 0x10022a2d
Capabilities:
Delete file
Get common file path

Disassembly:
push 0x230
mov eax, 0x100bee67
call fcn.1008bbf4
mov edi, dword [ebp + 8]
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x224], 7
mov dword [ebp - 0x228], ebx
mov word [ebp - 0x238], ax
mov dword [ebp - 4], ebx
call fcn.10018b24
add eax, 4
lea edx, [ebp - 0x238]
push 0x100d1a34
push edx
push str.NewUIurl
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
cmp dword [ebp - 0x224], 8
lea eax, [ebp - 0x238]
lea ecx, [ebp - 0x220]
mov dword [ebp - 0x220], ebx
cmovae eax, dword [ebp - 0x238]
push eax
call fcn.1000563a
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x220]
cmp dword [eax - 0xc], ebx
je 0x10022baf
call fcn.10022f8e
test eax, eax
je 0x10022baf
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [edi + 0x120], eax
cmp dword [edi + 0x9c], ebx
jne 0x10022af4
push 0xc8
call fcn.1008b26a
pop ecx
mov ecx, eax
mov dword [ebp - 0x23c], eax
call fcn.1001beaa
mov dword [edi + 0x9c], eax
push dword [ebp - 0x220]
call fcn.10001a38
pop ecx
mov ecx, dword [edi + 0x9c]
push eax
push dword [ebp - 0x220]
call fcn.10001dcf
push 0x20a
lea eax, [ebp - 0x21c]
push ebx
push eax
call fcn.1008e420
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push str.UIConfig.Zip
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x21c]
push eax
call fcn.10001a38
pop ecx
mov ecx, dword [edi + 0x9c]
push eax
lea eax, [ebp - 0x21c]
add ecx, 0x18
push eax
call fcn.10001dcf
mov ecx, dword [edi + 0x14]
lea eax, [edi + 0xa0]
push eax
push dword [edi + 0x9c]
mov edx, dword [ecx]
call dword [edx + 4]
test eax, eax
jne 0x10022baf
mov esi, dword [edi + 0x18]
jmp 0x10022baa
mov ecx, dword [esi]
test ecx, ecx
je 0x10022ba7
mov eax, dword [ecx]
push 0x12
push ecx
call dword [eax + 0x10]
add esi, 4
cmp esi, dword [edi + 0x1c]
jne 0x10022b99
mov ecx, dword [ebp - 0x220]
lea ecx, [ecx - 0x10]
call fcn.100018e3
push ebx
push 1
lea ecx, [ebp - 0x238]
call fcn.10001f43
xor eax, eax
call fcn.1008bb9e
ret 4
Function at 0x10023086
Capabilities:
Check if file exists

Disassembly:
push 0x1d0
mov eax, 0x100bef53
call fcn.1008bbf4
mov edi, dword [ebp + 8]
xor ebx, ebx
push 7
pop ecx
xor eax, eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], ebx
mov word [ebp - 0x2c], ax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x34], ebx
mov word [ebp - 0x44], ax
mov esi, 0x100d1a34
mov byte [ebp - 4], 1
push esi
lea eax, [ebp - 0x1dc]
push 0x100f3258
push eax
call fcn.10018b24
mov ecx, eax
call fcn.1000a03a
push eax
lea ecx, [ebp - 0x2c]
call fcn.1000283a
push ebx
push 1
lea ecx, [ebp - 0x1dc]
call fcn.10001f43
lea ecx, [ebp - 0xec]
call fcn.1001c3eb
lea ecx, [ebp - 0x1b4]
call fcn.1001beaa
push esi
lea eax, [ebp - 0x1dc]
mov byte [ebp - 4], 3
push str.offline_package
push eax
mov dword [ebp - 0x14], ebx
call fcn.10018b24
mov ecx, eax
call fcn.1000a03a
mov esi, eax
lea ecx, [ebp - 0x1bc]
mov byte [ebp - 4], 4
call fcn.1001c80b
push 0x100d2cf8
mov edx, eax
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x1b8]
call fcn.10001464
pop ecx
mov byte [ebp - 4], 6
cmp dword [esi + 0x14], 8
jb 0x10023159
mov esi, dword [esi]
push esi
mov edx, eax
lea ecx, [ebp - 0x14]
call fcn.10001464
pop ecx
mov ecx, dword [ebp - 0x1b8]
lea ecx, [ecx - 0x10]
call fcn.100018e3
mov ecx, dword [ebp - 0x1bc]
lea ecx, [ecx - 0x10]
call fcn.100018e3
xor esi, esi
mov byte [ebp - 4], 0xa
push ebx
inc esi
lea ecx, [ebp - 0x1dc]
push esi
call fcn.10001f43
push dword [ebp - 0x14]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100231ba
push dword [ebp - 0x14]
call fcn.10001a38
pop ecx
push eax
push dword [ebp - 0x14]
lea ecx, [ebp - 0x19c]
call fcn.10001dcf
push dword [ebp - 0x14]
call fcn.10001a38
pop ecx
push eax
push dword [ebp - 0x14]
lea ecx, [ebp - 0xc4]
call fcn.10001dcf
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0xdc]
call fcn.10001b7f
lea ecx, [edi + 0xc]
mov dword [ebp - 0xe8], esi
mov dword [ebp - 0x8c], ebx
mov dword [ebp - 0xe4], 8
call fcn.100234e3
lea eax, [ebp - 0xec]
push eax
lea eax, [ebp - 0x1c4]
push eax
lea ecx, [edi + 0xc]
call fcn.1002422e
mov ecx, dword [ebp - 0x1c4]
lea eax, [ebp - 0x1b4]
push eax
add ecx, 0xb8
call fcn.1001bf37
sub esp, 0x18
lea edx, [ebp - 0x2c]
mov ecx, esp
mov dword [ebp - 0x1c0], esp
push ecx
call fcn.1006e870
pop ecx
mov byte [ebp - 4], 0xb
call fcn.100189ba
mov ecx, eax
mov byte [ebp - 4], 0xa
call fcn.100268ff
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.100018e3
lea ecx, [ebp - 0x1b4]
call fcn.1001d8bd
lea ecx, [ebp - 0xec]
call fcn.1001c4c3
push ebx
push 1
lea ecx, [ebp - 0x44]
call fcn.10001f43
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.10001f43
xor eax, eax
inc eax
call fcn.1008bb9e
ret 4
Function at 0x1002c41a
Capabilities:
Delete registry value

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x1bc], 2
mov dword [esi + 0x1d4], 1
jne 0x1002c43c
call fcn.100189ba
mov ecx, eax
call fcn.10026964
cmp dword [esi + 0x1bc], 3
je 0x1002c461
cmp dword [esi + 0x1f0], 0
je 0x1002c453
call fcn.1002efe5
push ecx
mov ecx, esi
call fcn.10031a6c
pop esi
jmp fcn.1002c39d
pop esi
ret
Function at 0x1002efe5
Capabilities:
Delete file
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x1010c070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov ebx, 0x20a
lea eax, [ebp - 0x210]
push ebx
push 0
push eax
call fcn.1008e420
add esp, 0xc
lea eax, [ebp - 0x210]
push 0x104
push eax
push str._AppData_TencentQQ_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea ecx, [ebp - 0x214]
call fcn.1001b31c
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push dword [eax]
lea eax, [ebp - 0x210]
push eax
call edi
mov ecx, dword [ebp - 0x214]
lea ecx, [ecx - 0x10]
call fcn.100018e3
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.1008e420
add esp, 0xc
lea eax, [ebp - 0x210]
push 1
push 0x23
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.TencentQQ_
lea eax, [ebp - 0x210]
push eax
call edi
lea ecx, [ebp - 0x214]
call fcn.1001b31c
push dword [eax]
lea eax, [ebp - 0x210]
push eax
call edi
mov ecx, dword [ebp - 0x214]
lea ecx, [ecx - 0x10]
call fcn.100018e3
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.1008aeea
mov esp, ebp
pop ebp
ret

Function at 0x1002f18a
Capabilities:
Check if file exists

Disassembly:
push 0x20
mov eax, 0x100c03f5
call fcn.1008bbf4
and dword [ebp - 0x14], 0
lea ecx, [ebp - 0x2c]
call fcn.1001b151
and dword [ebp - 4], 0
cmp dword [eax + 0x14], 8
jb 0x1002f1ae
mov eax, dword [eax]
push str.QQPCTray.exe
mov edx, eax
lea ecx, [ebp - 0x14]
call fcn.1001c888
pop ecx
push 0
push 1
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 2
call fcn.10001f43
push dword [ebp - 0x14]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1002f1ef
push ecx
push 1
push ecx
mov ecx, dword [ebp - 0x14]
mov edx, str._showui__setup
call fcn.1001aff3
add esp, 0xc
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.100018e3
call fcn.1008bb9e
ret