joyce8/EMBER2024-capa huggingface dataset:
Function at 0x527a90
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53dc69
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x59a0a0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0xa30]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], vtable.GameDownload::CMainUIInstallApkFromBS.0
mov dword [esi + method.GameDownload::CMainUIInstallApkFromBS.3.virtual_0], vtable.GameDownload::CMainUIInstallApkFromBS.3.0
mov dword [esi + method.ATL::CComObjectStackEx_class_GameDownload::CMainUISpecial_.3.virtual_0], vtable.GameDownload::CMainUIInstallApkFromBS.2.0
mov dword [esi + method.ATL::CComObjectStackEx_class_GameDownload::CMainUISpecial_.2.virtual_0], vtable.GameDownload::CMainUIInstallApkFromBS.5.0
mov dword [esi + method.ATL::CComObjectStackEx_class_GameDownload::CMainUISpecial_.1.virtual_0], vtable.GameDownload::CMainUIInstallApkFromBS.4.0
mov dword [esi + method.ATL::CComObjectStackEx_class_GameDownload::CMainUISpecial_.virtual_0], vtable.GameDownload::CMainUIInstallApkFromBS.1.0
test eax, eax
je 0x527b0b
push eax
call edi
mov dword [esi + 0xa30], 0
mov eax, dword [esi + 0xa34]
test eax, eax
je 0x527b22
push eax
call edi
mov dword [esi + 0xa34], 0
mov eax, dword [esi + 0xa54]
test eax, eax
je 0x527b35
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [esi + 0xa48]
or eax, 0xffffffff
sub ecx, 0x10
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x527b6e
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov edi, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x527b6a
mov eax, dword [edx + 4]
push 0
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x527b6e
mov ecx, edx
call edi
lea ecx, [esi + 0x9e8]
call fcn.0041bb00
mov ecx, esi
call fcn.0050f290
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x527cc0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53dcc2
mov eax, dword fs:[0]
push eax
sub esp, 0x9c
mov eax, dword [0x59a0a0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
call fcn.0050e0b0
mov eax, dword [esi + 0x3fc]
cmp eax, 1
jne 0x527d66
cmp dword [esi + 0x4a4], 0
je 0x527e07
mov eax, dword [esi + 0xa54]
test eax, eax
je 0x527d1e
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea ecx, [ebp - 0x5c]
call fcn.00448070
lea eax, [ebp - 0x5c]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.00520aa0
mov dword [ebp - 0x4c], 0x10
or dword [ebp - 0x2c], 0x80
lea eax, [ebp - 0x5c]
push ecx
push eax
call fcn.0044c609
mov ecx, eax
call fcn.00448570
mov ecx, esi
call fcn.0050e390
lea ecx, [ebp - 0x5c]
jmp 0x527e02
cmp eax, 5
je 0x527da7
cmp dword [esi + 0x4a4], 0
je 0x527e07
mov eax, dword [esi + 0xa54]
test eax, eax
je 0x527d8b
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea ecx, [ebp - 0x5c]
call fcn.00448070
lea eax, [ebp - 0x5c]
mov dword [ebp - 4], 1
push eax
mov ecx, esi
call fcn.00520aa0
jmp 0x527d3f
mov eax, dword [esi + 0xa54]
test eax, eax
je 0x527dba
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea ecx, [ebp - 0xa8]
call fcn.00448070
lea eax, [ebp - 0xa8]
mov dword [ebp - 4], 2
push eax
mov ecx, esi
call fcn.00520aa0
or dword [ebp - 0x78], 0x80
lea eax, [ebp - 0xa8]
push ecx
push eax
call fcn.0044c609
mov ecx, eax
call fcn.00448570
mov ecx, esi
call fcn.0050e390
lea ecx, [ebp - 0xa8]
call fcn.004483c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049aa22
mov esp, ebp
pop ebp
ret
Function at 0x528a90
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53de68
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x59a0a0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea ebx, [esi + 0x64]
test ebx, ebx
je 0x528ac9
lea edi, [ebx - 0x24]
jmp 0x528acb
xor edi, edi
mov eax, dword [edi + 0x24]
lea ecx, [edi + 0x24]
push 0x7d
call dword [eax + 0x38]
test eax, eax
jne 0x528b04
mov eax, dword [edi + 0x114]
lea ecx, [edi + 0x114]
push 0x7d
call dword [eax + 0x38]
test eax, eax
jne 0x528b04
mov eax, dword [edi + 0x204]
lea ecx, [edi + 0x204]
push 0x7d
call dword [eax + 0x38]
test eax, eax
je 0x528b0f
mov edi, dword [eax + 0x7c]
shr edi, 2
and edi, 1
jmp 0x528b11
xor edi, edi
lea ecx, [ebp - 0x5c]
call fcn.00448070
lea eax, [ebp - 0x5c]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
mov dword [esi + 0xa38], 2
mov dword [esi + 0xa3c], 0x3e8
call fcn.00520aa0
test edi, edi
je 0x528b47
or dword [ebp - 0x2c], 0x20
push ecx
lea eax, [ebp - 0x5c]
push eax
call fcn.0044c609
mov ecx, eax
call fcn.00448570
mov ecx, esi
test edi, edi
je 0x528b8f
call fcn.00526ce0
push 0x572250
push 0x7f
mov ecx, ebx
call fcn.00443e40
push 0
push 0
push esi
push 0x5267d0
push 0
push 0
call fcn.004a6774
add esp, 0x18
mov dword [esi + 0xa34], eax
jmp 0x528b94
call fcn.00526bc0
lea ecx, [ebp - 0x5c]
call fcn.004483c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049aa22
mov esp, ebp
pop ebp
ret

Function at 0x528f90
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, ecx
call fcn.00504f60
mov ecx, esi
test eax, eax
je 0x528fd3
mov dword [esi + 0x400], 3
call fcn.00528e30
push 0
push 0
push 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x3b4], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_PostThreadMessageW]
pop esi
ret
push 2
push 1
mov dword [esi + 0x400], 2
call fcn.0050fd60
mov ecx, esi
pop esi
jmp fcn.00504660
mov dword [ecx + 0x3b0], 0
cmp dword [0x59fb08], 0
je 0x52904d
mov eax, dword [0x59fb0c]
mov dword [ecx + 0x474], eax
mov dword [0x59fb28], 1
jmp 0x528f90
cmp dword [0x59fb10], 0
je 0x529060
mov dword [ecx + 0x474], 0xffffffff
mov dword [0x59fb28], 1
jmp 0x528f90
Function at 0x529800
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53df98
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x59a0a0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
call fcn.00504f60
mov ecx, esi
test eax, eax
je 0x529874
mov dword [esi + 0x400], 3
call fcn.00529230
push 0
push 0
push 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x3b4], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_PostThreadMessageW]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 2
push 1
mov dword [esi + 0x400], 2
call fcn.0050fd60
push 0x574858
lea edx, [esi + 0x438]
lea ecx, [ebp - 0x10]
call fcn.00401d60
add esp, 4
mov dword [ebp - 4], 0
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, esi
test eax, eax
je 0x5298cc
push dword [ebp - 0x10]
call fcn.00501830
lea eax, [ebp - 0x10]
push eax
lea ecx, [esi + 0x480]
call fcn.00411620
jmp 0x5298d1
call fcn.00504660
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x52991c
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x529918
mov eax, dword [edx + 4]
push 0
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, edx
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x529930
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53dfbe
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x59a0a0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [0x59fb4c]
cmp dword [eax - 0xc], 0
jne 0x529a95
push 0x20a
lea eax, [ebp - 0x21c]
push 0
push eax
call fcn.0049e130
add esp, 0xc
lea eax, [ebp - 0x21c]
push 1
push 0x23
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x529a9a
call fcn.00401980
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x5299bb
push 0x80004005
call fcn.00401b40
mov eax, dword [edx]
mov esi, dword [eax + 0xc]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x5299d0
lock inc dword [edx + 0x14]
lea eax, [edx + 8]
jmp 0x5299d4
mov ecx, edx
call esi
add eax, 0x10
mov dword [ebp - 0x220], eax
lea eax, [ebp - 0x21c]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x220]
push str._sTencentTemp_
push eax
call fcn.004023f0
add esp, 0xc
lea eax, [ebp - 0x220]
lea ecx, [edi + 0x438]
push eax
call fcn.00401f90
push dword [edi + 0x438]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x529a31
push dword [edi + 0x438]
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x529a55
push ecx
mov ecx, dword [edi + 0x438]
mov esi, esp
sub ecx, 0x10
mov dword [ebp - 0x224], esi
call fcn.004021e0
add eax, 0x10
mov dword [esi], eax
call fcn.004e1680
add esp, 4
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov ecx, dword [ebp - 0x220]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x529a95
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x529a91
mov eax, dword [edx + 4]
push 0
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x529a95
mov ecx, edx
call esi
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049aa22
mov esp, ebp
pop ebp
ret

Function at 0x529af0
Capabilities:
Check if file exists

Disassembly:
push esi
mov esi, ecx
mov dword [esi + 0x3b0], 0
cmp dword [0x59fb08], 0
je 0x529b13
mov eax, dword [0x59fb0c]
mov dword [esi + 0x474], eax
jmp 0x529b26
cmp dword [0x59fb10], 0
je 0x529b26
mov dword [esi + 0x474], 0xffffffff
mov dword [0x59fb28], 0
call fcn.00529930
mov ecx, esi
pop esi
jmp fcn.00529800

Function at 0x529d90
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, ecx
mov dword [esi + 0x3b0], 0
mov dword [esi + 0x474], 0xffffffff
mov dword [0x59fb28], 1
call fcn.00504f60
test eax, eax
je 0x529dea
push 0
push 0
push 0
mov dword [esi + 0x400], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x3b4], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_PostThreadMessageW]
pop esi
ret
push 2
push 1
mov ecx, esi
mov dword [esi + 0x400], 2
call fcn.0050fd60
mov ecx, esi
pop esi
jmp fcn.00504660
Function at 0x529fd0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53e000
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x59a0a0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 1
push eax
push 0x2001f
push 0
push 0x5749fc
push reloc.WS2_32.dll_bind
mov dword [ebp - 0x10], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x52a096
mov esi, dword [ebp - 0x10]
xor ecx, ecx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
test eax, eax
mov dword [ebp - 0x1c], esi
setne cl
test ecx, ecx
jne 0x52a05e
push 0x80004005
call fcn.00401b40
mov edx, eax
lea edi, [edx + 2]
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x52a063
sub edx, edi
sar edx, 1
lea ecx, [edx*2 + 2]
push ecx
push eax
push 1
push 0
push 0x574a38
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test esi, esi
je 0x52a096
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x52a0e4
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x52a0e0
mov eax, dword [edx + 4]
push 0
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
mov ecx, edx
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x52a410
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53e030
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x59a0a0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 1
push eax
push 0x2001f
push 0
push str.SOFTWARETencentMobileGamePC
push reloc.WS2_32.dll_bind
mov dword [ebp - 0x10], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x52a4d6
mov esi, dword [ebp - 0x10]
xor ecx, ecx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
test eax, eax
mov dword [ebp - 0x1c], esi
setne cl
test ecx, ecx
jne 0x52a49e
push 0x80004005
call fcn.00401b40
mov edx, eax
lea edi, [edx + 2]
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x52a4a3
sub edx, edi
sar edx, 1
lea ecx, [edx*2 + 2]
push ecx
push eax
push 1
push 0
push str.Cpath
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test esi, esi
je 0x52a4d6
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x52a524
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x52a520
mov eax, dword [edx + 4]
push 0
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
mov ecx, edx
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x52a540
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53e053
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x59a0a0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [0x59fb2c], 0
je 0x52a58a
call fcn.00504660
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00504f60
mov ecx, ebx
test eax, eax
je 0x52a5da
mov dword [ebx + 0x400], 3
call fcn.00510380
push 0
push 0
push 0
mov dword [ebx + 0x3c], 0
mov dword [ebx + 0x3b4], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_PostThreadMessageW]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 2
push 1
mov dword [ebx + 0x400], 2
call fcn.0050fd60
push ecx
mov ecx, dword [ebx + 0x438]
mov esi, esp
sub ecx, 0x10
mov dword [ebp - 0x14], esi
call fcn.004021e0
add eax, 0x10
mov dword [esi], eax
call fcn.0052a410
push str.compoment.xml
lea edx, [ebx + 0x438]
lea ecx, [ebp - 0x10]
call fcn.00401d60
add esp, 4
mov dword [ebp - 4], 0
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, ebx
test eax, eax
je 0x52a641
push dword [ebp - 0x10]
call fcn.00501830
jmp 0x52a646
call fcn.00504660
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x52a693
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x52a68f
mov eax, dword [edx + 4]
push 0
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, edx
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x52b5b0
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, ecx
call fcn.00504f60
test eax, eax
je 0x52b5fc
mov dword [esi + 0x400], 3
cmp dword [0x59fadc], 0xc
jne 0x52b5d6
mov ecx, esi
call fcn.0052b4a0
push 0
push 0
push 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x3b4], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_PostThreadMessageW]
pop esi
ret
push 2
push 1
mov ecx, esi
mov dword [esi + 0x400], 2
call fcn.0050fd60
mov ecx, esi
pop esi
jmp fcn.00504660
mov dword [ecx + 0x3b0], 0
cmp dword [0x59fb08], 0
je 0x52b67d
mov eax, dword [0x59fb0c]
mov dword [ecx + 0x474], eax
mov dword [0x59fb28], 1
jmp 0x52b5b0
cmp dword [0x59fb10], 0
je 0x52b690
mov dword [ecx + 0x474], 0xffffffff
mov dword [0x59fb28], 1
jmp 0x52b5b0
Function at 0x52c160
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
push 2
lea eax, [ebp - 4]
push eax
call fcn.004059d0
mov esi, dword [ebp - 4]
lea eax, [ebp - 0xc]
push 0
push 0
push eax
push esi
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
cmp dword [ebp - 8], 0
ja 0x52c1a8
jb 0x52c1a4
cmp dword [ebp - 0xc], 0x1f400000
jae 0x52c1a8
xor edi, edi
jmp 0x52c1ad
mov edi, 1
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x52c1e3
mov eax, dword [esi]
push esi
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
cmp ecx, vtable.ATL::CAtlStringMgr.0
jne 0x52c1eb
mov ecx, dword [eax + 4]
push 0
push dword [ecx + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, eax
call edx
jmp 0x52c1e3
Function at 0x52f1d0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53e5f8
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x59a0a0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi + 0x400]
push 0
mov edx, dword [eax + 0x70]
mov ecx, dword [eax + 0x48]
call fcn.004e0890
add esp, 4
test eax, eax
mov eax, dword [edi + 0x400]
je 0x52f2c8
mov ecx, dword [eax + 0x70]
lea esi, [eax + 0x50]
mov ebx, dword [esi]
sub ebx, 0x10
mov dword [ebp - 0x48], esi
lea edx, [ecx - 0x10]
cmp edx, ebx
je 0x52f267
cmp dword [ebx + 0xc], 0
jl 0x52f25c
mov eax, dword [edx]
cmp eax, dword [ebx]
jne 0x52f25c
mov ecx, edx
call fcn.004021e0
mov ecx, ebx
mov esi, eax
call fcn.00402e90
mov ecx, dword [ebp - 0x48]
lea eax, [esi + 0x10]
mov dword [ecx], eax
jmp 0x52f267
push dword [ecx - 0xc]
push ecx
mov ecx, esi
call fcn.00402d50
mov eax, dword [edi + 0x400]
lea ecx, [ebp - 0x44]
push 0x263
push 0x575fa8
push str.GameDownload::CQQPcmgrDllSetup::OnComponentQQPcmgrDownloadSucc
mov dword [eax + 4], 1
mov eax, dword [edi + 0x400]
mov dword [eax + 8], 1
call fcn.00428d70
mov esi, eax
push 0
push 0x52f140
lea ecx, [edi + 0x3d4]
mov dword [ebp - 4], 0
call fcn.00449500
push eax
mov edx, esi
call fcn.00530d10
add esp, 4
lea ecx, [ebp - 0x44]
call fcn.00428f50
jmp 0x52f313
push dword [eax + 0x48]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [edi + 0x400]
cmp dword [eax + 0x10], 0xa
jae 0x52f2e6
mov ecx, edi
call fcn.005302b0
jmp 0x52f313
push 0
push 0
push 0
push dword [edi + 0x3b8]
mov dword [edi + 0x520], 0x2c0
mov dword [edi + 0x3c], 0x2c0
mov dword [edi + 0x3b4], 1
call dword [sym.imp.USER32.dll_PostThreadMessageW]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049aa22
mov esp, ebp
pop ebp
ret
Function at 0x5309c0
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x3ec]
test ecx, ecx
je 0x5309e9
mov eax, dword [ecx]
push 0
call dword [eax + 4]
mov ecx, dword [esi + 0x3ec]
mov eax, dword [ecx]
call dword [eax + 0x28]
mov dword [esi + 0x3ec], 0
mov eax, dword [esi + 0x3e8]
test eax, eax
je 0x530a1b
push str.TenioDL_CleanUp
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x530a05
call eax
push dword [esi + 0x3e8]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [esi + 0x3e8], 0
lea ecx, [esi + 0x3d4]
call fcn.00442ce0
lea ecx, [esi + 0x528]
pop esi
jmp fcn.004dfec0
Function at 0x2e01416e
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x10
mov eax, 0x2e0306d8
call fcn.2e001511
mov edi, ecx
mov dword [ebp - 0x18], edi
xor ebx, ebx
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], ebx
mov byte [edi], bl
mov dword [ebp - 4], ebx
call fcn.2e014eb5
test ax, ax
je 0x2e014216
lea eax, [ebp - 0x10]
push eax
push str.softwaremicrosoftwindows_shell_associationsurlassociationshttpuserchoice
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x2e014216
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
push str.progid
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e01420d
mov eax, dword [ebp - 0x14]
inc eax
push eax
call fcn.2e01fee4
mov esi, eax
pop ecx
mov dword [ebp - 0x1c], esi
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 1
push eax
push esi
push ebx
push ebx
push str.progid
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e014200
push esi
mov ecx, edi
call fcn.2e010e6c
push 1
push esi
mov byte [ebp - 4], bl
call fcn.2e01fee4
pop ecx
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
call fcn.2e00155b
ret

Function at 0x2e014ca3
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x28
mov eax, 0x2e030759
call fcn.2e02e6de
mov esi, dword [ebp + 8]
xor eax, eax
mov bl, al
mov edi, dword [ebp + 0xc]
cmp dword [ecx + 0x10], eax
jbe 0x2e014da7
push ecx
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
call fcn.2e014b8d
and dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
push esi
call fcn.2e010d8f
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x30]
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push ecx
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x2e014d65
lea eax, [ebp - 0x2c]
push eax
push 0
push 0x2e033941
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x2e014d5c
mov eax, dword [ebp - 0x2c]
inc eax
push eax
call fcn.2e01fee4
mov esi, eax
pop ecx
mov dword [ebp - 0x34], esi
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 1
push eax
push esi
push 0
push 0
push 0x2e033941
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e014d4e
push esi
mov ecx, edi
call fcn.2e010e6c
mov bl, 1
push 1
push esi
mov byte [ebp - 4], 0
call fcn.2e01fee4
pop ecx
pop ecx
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x2e014da7
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 4], 2
cmp eax, 0x1000
jb 0x2e014d9e
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.2e01fee4
mov eax, dword [ebp - 0x2c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x34]
push eax
push ecx
call fcn.2e01fee4
pop ecx
pop ecx
mov al, bl
call fcn.2e02e6bc
ret 8