joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001d539
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
lea ecx, [esi + 0x30]
call fcn.10032ed5
mov ecx, dword [esi + 0x38]
test ecx, ecx
je 0x1001d561
call fcn.10007a47
push dword [esi + 0x3c]
mov ecx, dword [esi + 0x38]
call fcn.10007a80
xor ebx, ebx
cmp dword [esi + 0x104], 0xffffffff
je 0x1001d5b9
mov eax, dword [esi + 0x10c]
test eax, eax
je 0x1001d57d
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0xffffffffffffffff
push dword [esi + 0x104]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esi + 0x104]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
or dword [esi + 0x104], 0xffffffff
mov eax, dword [esi + 0x10c]
mov dword [esi + 0x108], ebx
test eax, eax
je 0x1001d5b9
push eax
call edi
mov dword [esi + 0x10c], ebx
cmp dword [esi + 0x14], ebx
je 0x1001d5ca
push dword [esi + 0x14]
call fcn.100b3180
pop ecx
mov dword [esi + 0x14], ebx
mov eax, dword [esi + 0x18]
mov dword [esi + 0x1c], eax
mov eax, dword [esi + 0x24]
mov dword [esi + 0x28], eax
cmp dword [esi + 0x4c], ebx
je 0x1001d5e7
push dword [esi + 0x4c]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [esi + 0x4c], ebx
lea edi, [esi - 4]
mov ecx, edi
call fcn.10020624
call fcn.1002336b
mov ecx, eax
call fcn.1001729d
call fcn.10032d1f
lea ebx, [edi + 0x8c]
mov esi, dword [ebx]
jmp 0x1001d622
cmp dword [esi + 0x14], 8
jb 0x1001d616
mov eax, dword [esi]
jmp 0x1001d618
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
add esi, 0x18
cmp esi, dword [edi + 0x90]
jne 0x1001d60c
mov ecx, ebx
call fcn.10023566
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 4
Function at 0x1001d63a
Capabilities:
Delete file

Disassembly:
push 0x1a4
mov eax, 0x100bdf75
call fcn.1008b701
mov dword [ebp - 0x190], ecx
xor ebx, ebx
mov byte [ebp - 0x189], bl
mov dword [ebp - 0x14], ebx
call fcn.100017c6
push eax
lea ecx, [ebp - 0x14]
call fcn.10001562
mov dword [ebp - 4], ebx
mov dword [ebp - 0x18], ebx
call fcn.100017c6
push eax
lea ecx, [ebp - 0x18]
call fcn.10001562
push str.15.10.10357.201
lea ecx, [ebp - 0x194]
mov byte [ebp - 4], 1
call fcn.100055e9
mov byte [ebp - 4], 2
call fcn.10018ae4
push 0x100d0a34
push 0x100f129c
lea edi, [eax + 4]
lea eax, [ebp - 0x1b0]
push eax
call fcn.10018ae4
mov ecx, eax
call fcn.10009fe8
mov esi, eax
push ebx
mov byte [ebp - 4], 3
mov eax, dword [edi]
push 0x100eb2b8
push edi
call dword [eax + 0x10]
lea eax, [ebp - 0x14]
push eax
push esi
push ecx
lea eax, [ebp - 0x194]
push eax
call fcn.1001ebc3
push ebx
push 1
lea ecx, [ebp - 0x1b0]
call fcn.10001f43
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x194]
lea ecx, [ecx - 0x10]
call fcn.100018e3
lea eax, [ebp - 0x194]
push eax
call fcn.1001eb4e
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 4
call fcn.1000559b
mov ecx, dword [ebp - 0x194]
lea ecx, [ecx - 0x10]
call fcn.100018e3
mov edi, dword [ebp - 0x18]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x188]
call fcn.1001be6d
lea ecx, [ebp - 0xc0]
call fcn.1001c3ae
mov byte [ebp - 4], 6
push edi
mov dword [ebp - 0xbc], 0x186a0
call fcn.10001a38
pop ecx
push eax
push edi
lea ecx, [ebp - 0x98]
call fcn.10001dcf
mov ebx, dword [ebp - 0x14]
push ebx
call fcn.10001a38
pop ecx
push eax
push ebx
lea ecx, [ebp - 0x188]
call fcn.10001dcf
push edi
call fcn.10001a38
pop ecx
push eax
push edi
lea ecx, [ebp - 0x170]
call fcn.10001dcf
mov esi, dword [ebp - 0x190]
lea edx, [ebp - 0xc0]
push edx
lea edx, [ebp - 0x188]
push edx
mov ecx, dword [esi + 0x18]
mov eax, dword [ecx]
call dword [eax + 4]
test eax, eax
je 0x1001d7d8
mov eax, dword [ebp - 0xc0]
and dword [esi + 0x78], 0
and dword [ebp - 0xb4], 0
mov byte [ebp - 0x189], 1
mov dword [esi + 0x44], eax
mov dword [ebp - 0xb8], 5
jmp 0x1001d7ee
push 0x12
pop eax
mov dword [esi + 0x78], eax
mov dword [ebp - 0xb8], 7
mov dword [ebp - 0xb4], eax
lea eax, [ebp - 0xc0]
push eax
lea eax, [ebp - 0x198]
push eax
lea ecx, [esi + 0x10]
call fcn.100241ea
mov ecx, dword [ebp - 0x198]
lea eax, [ebp - 0x188]
push eax
lea ecx, [ecx + 0xb8]
call fcn.1001befa
cmp byte [ebp - 0x189], 0
jne 0x1001d84e
mov eax, dword [ebp - 0x190]
mov esi, dword [esi + 0x1c]
cmp esi, dword [eax + 0x20]
je 0x1001d84e
mov ebx, eax
mov ecx, dword [esi]
test ecx, ecx
je 0x1001d843
push dword [ebx + 0x78]
mov eax, dword [ecx]
push ecx
call dword [eax]
add esi, 4
cmp esi, dword [ebx + 0x20]
jne 0x1001d835
mov ebx, dword [ebp - 0x14]
lea ecx, [ebp - 0xc0]
call fcn.1001c486
lea ecx, [ebp - 0x188]
call fcn.1001d880
lea ecx, [edi - 0x10]
call fcn.100018e3
lea ecx, [ebx - 0x10]
call fcn.100018e3
mov al, byte [ebp - 0x189]
call fcn.1008b6ab
ret
Function at 0x1001e068
Capabilities:
Create thread

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x100], ebx
jne 0x1001e0e3
mov ebx, 0x100d1f38
lea esi, [edi + 0xf0]
push ebx
call fcn.10001a38
pop ecx
push eax
push ebx
mov ecx, esi
call fcn.10001dcf
mov eax, dword [edi + 0xa8]
mov ecx, esi
push 0xffffffffffffffff
push 0
add eax, 0x18
push eax
call fcn.10002a95
push ebx
call fcn.10001a38
pop ecx
push eax
push ebx
mov ecx, esi
call fcn.100056fa
mov ebx, 0x100d1cac
push ebx
call fcn.10001a38
pop ecx
push eax
push ebx
mov ecx, esi
call fcn.100056fa
mov ebx, 0x100f17f0
push ebx
call fcn.10001a38
pop ecx
push eax
push ebx
mov ecx, esi
call fcn.100056fa
xor ebx, ebx
push ebx
push ebx
push edi
push 0x1001e052
push ebx
push ebx
call fcn.100963ac
add esp, 0x18
mov dword [edi + 0x108], eax
cmp eax, 0xffffffff
jne 0x1001e11c
push str.CTxdlController::StartTbsPackage__beginthreadex_failed
push 0xd2
push str.E:qci_workspace_root_workspaces__qci_pipeline_10566830_1QQPCDownloadTxdlTxdlController.cpp
call fcn.1006a644
xor eax, eax
add esp, 0xc
inc eax
jmp 0x1001e141
call fcn.1001897a
mov dword [eax + 0xe4], 2
call fcn.1001897a
push ebx
mov esi, eax
call fcn.1009ffdc
mov dword [esi + 0x138], eax
xor eax, eax
pop ecx
pop edi
pop esi
pop ebx
ret
Function at 0x1001e364
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x1010b070]
xor eax, esp
mov dword [esp + 0x20], eax
and dword [esp + 4], 0
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0x10]
cmp dword [ebx + 4], 1
push 9
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], edi
pop esi
jne 0x1001e3bc
cmp dword [ecx + 0x114], 0
jne 0x1001e3bc
call fcn.1001e582
movzx esi, ax
test si, si
jne 0x1001e49b
mov dword [esp + 0x10], 1
call fcn.10018ae4
add eax, 4
push 0
push str.VerMode
push eax
mov ecx, dword [eax]
call dword [ecx + 0x10]
mov dword [esp + 0x1c], eax
test eax, eax
je 0x1001e456
xor eax, eax
lea edi, [esp + 0x20]
stosd dword es:[edi], eax
lea ecx, [esp + 0x20]
push 0x2001f
push str.SoftwareTencentQQPCMgr
push reloc.OLEAUT32.dll_SysReAllocString
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor edi, edi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], edi
call fcn.10003d33
test eax, eax
je 0x1001e428
push ecx
push ecx
push 0x2001f
push ecx
push ecx
push str.SoftwareTencentQQPCMgr
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x3c]
call fcn.100192df
mov eax, dword [esp + 0x1c]
push 4
mov dword [esp + 0x20], eax
lea eax, [esp + 0x20]
push eax
push 4
push edi
push str.VerMode
push dword [esp + 0x34]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea ecx, [esp + 0x20]
call fcn.10003d19
mov edi, dword [esp + 0x14]
lea eax, [ebx + 0x28]
cmp dword [eax + 0x14], 8
jb 0x1001e461
mov eax, dword [eax]
push dword [ebx + 4]
push dword [ebx + 0x98]
push dword [esp + 0x20]
push eax
call fcn.1002336b
mov ecx, eax
call fcn.10016f16
test eax, eax
je 0x1001e48f
mov edx, dword [eax]
mov ecx, eax
push edi
call dword [edx + 4]
test eax, eax
je 0x1001e48f
xor esi, esi
jmp 0x1001e49b
cmp dword [esp + 0x10], 0
je 0x1001e49b
call fcn.100193e5
mov ecx, dword [esp + 0x2c]
mov ax, si
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1008a9f7
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1001e61b
Capabilities:
Create process on windows

Disassembly:
push 0x88
mov eax, 0x100be108
call fcn.1008b701
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x18], edi
call fcn.100017c6
push eax
lea ecx, [ebp - 0x18]
call fcn.10001562
push 0x100f1b9c
push str.QQPCRtp.exe
push esi
lea eax, [ebp - 0x18]
mov dword [ebp - 4], edi
push str.__s_s___d
push eax
call fcn.10005d4b
push 0x44
lea eax, [ebp - 0x84]
push edi
push eax
call fcn.1008df10
mov esi, dword [ebp - 0x18]
lea eax, [ebp - 0x94]
add esp, 0x20
xorps xmm0, xmm0
movups xmmword [ebp - 0x94], xmm0
push eax
lea eax, [ebp - 0x84]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1001e72a
jmp 0x1001e6d7
cmp dword [ebp - 0x34], 0x113
jne 0x1001e6b0
cmp dword [ebp - 0x30], 0x32
je 0x1001e6c4
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 1
push edi
push edi
push edi
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x1001e6a1
push 0xf
push dword [ebp - 0x94]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x1001e6c4
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x94]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x1001e703
cmp dword [ebp - 0x1c], 0
je 0x1001e72a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call fcn.1001897a
mov dword [eax + 0x158], edi
mov edi, dword [ebp - 0x1c]
call fcn.1001897a
push 2
mov dword [eax + 0x20], edi
mov dword [eax + 0x15c], edi
pop edi
lea ecx, [esi - 0x10]
call fcn.100018e3
mov eax, edi
call fcn.1008b6ab
ret 4
Function at 0x1001e98b
Capabilities:
Create directory
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1a4
mov eax, dword [0x1010b070]
xor eax, esp
mov dword [esp + 0x1a0], eax
push ebx
mov ebx, dword [ebp + 8]
mov ecx, ebx
push esi
push edi
call fcn.10020624
xor esi, esi
mov dword [esp + 0x34], esi
call fcn.100017c6
push eax
lea ecx, [esp + 0x38]
call fcn.10001562
push str.Download_
lea ecx, [esp + 0x14]
mov dword [esp + 0x34], esi
call fcn.1001ac1b
mov edx, eax
lea ecx, [esp + 0x34]
call fcn.10001464
pop ecx
mov ecx, dword [esp + 0x10]
lea ecx, [ecx - 0x10]
call fcn.100018e3
push esi
push dword [esp + 0x34]
push esi
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
push 0xb
push str.QQPCFix.exe
lea ecx, [esp + 0x38]
call fcn.10003930
push dword [esp + 0x30]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [esp + 0x38]
call fcn.1001c3ae
push dword [esp + 0x30]
mov dword [esp + 0x40], 2
mov dword [esp + 0x44], esi
call fcn.10001a38
pop ecx
push eax
push dword [esp + 0x34]
lea ecx, [esp + 0x68]
call fcn.10001dcf
call fcn.10018ae4
push 0x100d0a34
push 0x100f129c
lea edi, [eax + 4]
lea eax, [esp + 0x20]
push eax
call fcn.10018ae4
mov ecx, eax
call fcn.10009fe8
mov esi, eax
cmp dword [esi + 0x14], 8
jb 0x1001ea71
mov esi, dword [esi]
mov eax, dword [edi]
push 0
push 0x100eb2b8
push edi
call dword [eax + 0x10]
push eax
lea eax, [esp + 0x38]
push esi
push eax
call fcn.10005d4b
add esp, 0xc
lea ecx, [esp + 0x18]
push 0
push 1
call fcn.10001f43
lea ecx, [esp + 0xe0]
call fcn.1001be6d
mov esi, dword [esp + 0x34]
push esi
call fcn.10001a38
pop ecx
push eax
push esi
lea ecx, [esp + 0xe8]
call fcn.10001dcf
push dword [esp + 0x30]
call fcn.10001a38
pop ecx
push eax
push dword [esp + 0x34]
lea ecx, [esp + 0x100]
call fcn.10001dcf
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x14]
push eax
lea ecx, [ebx + 0x10]
call fcn.100241ea
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0xe0]
push eax
lea ecx, [ecx + 0xb8]
call fcn.1001befa
lea eax, [ebx + 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
lea ecx, [esp + 0xe0]
call fcn.1001d880
lea ecx, [esp + 0x38]
call fcn.1001c486
mov ecx, dword [esp + 0x30]
lea ecx, [ecx - 0x10]
call fcn.100018e3
lea ecx, [esi - 0x10]
call fcn.100018e3
mov ecx, dword [esp + 0x1ac]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1008a9f7
mov esp, ebp
pop ebp
ret 4

Function at 0x1001ecca
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, ecx
xor edi, edi
call fcn.10018ae4
mov esi, dword [ebp + 8]
add eax, 4
push esi
push eax
mov edx, dword [eax]
call dword [edx + 4]
test eax, eax
js 0x1001ed09
mov ecx, ebx
call fcn.1001ed6b
mov ecx, ebx
call fcn.1001f578
mov ecx, ebx
call fcn.1001fddf
xor eax, eax
inc eax
cmp eax, dword [ebx + 0x14]
sbb edi, edi
neg edi
cmp dword [esi + 0x14], 8
jb 0x1001ed11
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x1001ed6b
Capabilities:
Check if file exists
Create directory
Get common file path
Query environment variable

Disassembly:
push 0x454
mov eax, 0x100be21b
call fcn.1008b701
mov edi, ecx
push 0x412
xor ebx, ebx
lea eax, [ebp - 0x428]
push ebx
push eax
call fcn.1008df10
add esp, 0xc
call fcn.1001ad18
test eax, eax
je 0x1001edfd
push 0x208
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea edx, [ebp - 0x428]
lea ecx, [edi + 0x84]
lea esi, [edx + 2]
mov ax, word [edx]
add edx, 2
cmp ax, bx
jne 0x1001edca
sub edx, esi
lea eax, [ebp - 0x428]
sar edx, 1
push edx
push eax
call fcn.10005bd6
push 0xe
lea ecx, [edi + 0x88]
push str.YoudaoNote.exe
call fcn.10005bd6
jmp 0x1001efb5
push str._appdata__tencentQQPCMgrDownload_
lea eax, [ebp - 0x444]
push str.PackageDirCfg
push eax
call fcn.10018ae4
mov ecx, eax
call fcn.10009fe8
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x428]
cmp dword [ebp - 0x430], 8
lea eax, [ebp - 0x444]
push 0x208
cmovae eax, dword [ebp - 0x444]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp - 0x428]
push eax
call esi
test eax, eax
jne 0x1001eecd
push ebx
lea eax, [ebp - 0x428]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
lea eax, [ebp - 0x428]
push eax
call esi
test eax, eax
je 0x1001ee8f
lea edx, [ebp - 0x428]
lea ecx, [edi + 0x84]
lea esi, [edx + 2]
mov ax, word [edx]
add edx, 2
cmp ax, bx
jne 0x1001ee82
jmp 0x1001eee7
lea ecx, [ebp - 0x448]
call fcn.1001ac1b
lea esi, [edi + 0x84]
mov byte [ebp - 4], 1
push eax
mov ecx, esi
call fcn.1000559b
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x448]
lea ecx, [ecx - 0x10]
call fcn.100018e3
push 9
push str.Download_
mov ecx, esi
call fcn.10003930
jmp 0x1001eef8
lea edx, [ebp - 0x428]
lea ecx, [edi + 0x84]
lea esi, [edx + 2]
mov ax, word [edx]
add edx, 2
cmp ax, bx
jne 0x1001eedc
sub edx, esi
lea eax, [ebp - 0x428]
sar edx, 1
push edx
push eax
call fcn.10005bd6
push 0x100d0a34
lea eax, [ebp - 0x460]
mov dword [ebp - 0x42c], ebx
push str.QQPCMgrNameCfg
push eax
call fcn.10018ae4
mov ecx, eax
call fcn.10009fe8
mov byte [ebp - 4], 2
cmp dword [eax + 0x14], 8
jb 0x1001ef27
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x42c]
call fcn.100055e9
push ebx
push 1
lea ecx, [ebp - 0x460]
mov byte [ebp - 4], 4
call fcn.10001f43
mov eax, dword [ebp - 0x42c]
cmp dword [eax - 0xc], ebx
jne 0x1001ef87
call fcn.10018ae4
add eax, 4
push ebx
push str.ModuleType
push eax
mov ecx, dword [eax]
call dword [ecx + 0x10]
test eax, eax
mov ecx, str.QQPCMgr_Setup.dll
mov esi, str.QQPCMgr_Setup.exe
cmovne esi, ecx
mov ecx, esi
call fcn.10001546
push eax
push esi
lea ecx, [ebp - 0x42c]
call fcn.10005bd6
lea eax, [ebp - 0x42c]
push eax
lea ecx, [edi + 0x88]
call fcn.1000559b
mov ecx, dword [ebp - 0x42c]
lea ecx, [ecx - 0x10]
call fcn.100018e3
push ebx
push 1
lea ecx, [ebp - 0x444]
call fcn.10001f43
call fcn.1008b6ab
ret
Function at 0x10020467
Capabilities:
Get common file path
Get program files directory

Disassembly:
push 0x220
mov eax, 0x100be4d9
call fcn.1008b701
mov edi, dword [ebp + 8]
xor ebx, ebx
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x224], ebx
call fcn.100017c6
push eax
lea ecx, [ebp - 0x224]
call fcn.10001562
mov dword [ebp - 4], ebx
call fcn.10018ae4
add eax, 4
push ebx
push str.KvNoCmdline
push eax
mov ecx, dword [eax]
call dword [ecx + 0x18]
test eax, eax
je 0x100204cb
cmp dword [esi + 0x60], ebx
jne 0x100204cb
push ebx
push 0x100d0a34
lea ecx, [ebp - 0x224]
call fcn.10005bd6
jmp 0x1002058d
push 0x20a
lea eax, [ebp - 0x21c]
push ebx
push eax
call fcn.1008df10
add esp, 0xc
lea eax, [ebp - 0x21c]
push ebx
push 0x26
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.Kingsoft
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov dword [ebp - 0x220], ebx
call fcn.100017c6
push eax
lea ecx, [ebp - 0x220]
call fcn.10001562
lea eax, [ebp - 0x21c]
mov byte [ebp - 4], 1
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x220]
push edi
push str._silence1handle_dsupply_dinstallpath__s_
push eax
call fcn.10005d4b
lea eax, [esi + 0x80]
add esp, 0x14
cmp dword [eax + 0x14], 8
jb 0x1002054b
mov eax, dword [eax]
push eax
lea edx, [ebp - 0x220]
lea ecx, [ebp - 0x22c]
call fcn.10001464
pop ecx
push eax
lea ecx, [ebp - 0x224]
mov byte [ebp - 4], 2
call fcn.1000559b
mov ecx, dword [ebp - 0x22c]
lea ecx, [ecx - 0x10]
call fcn.100018e3
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x220]
lea ecx, [ecx - 0x10]
call fcn.100018e3
cmp dword [esi + 0x78], 0
mov dword [ebp - 0x228], ebx
jne 0x100205a0
mov eax, str.Install
jmp 0x100205ab
lea eax, [esi + 0x68]
cmp dword [eax + 0x14], 8
jb 0x100205ab
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x228]
call fcn.100055e9
xor ecx, ecx
mov byte [ebp - 4], 3
cmp dword [esi + 0x60], ebx
lea eax, [esi + 0x28]
setne cl
mov dword [esi + 0x98], ecx
cmp dword [eax + 0x14], 8
jb 0x100205d4
mov eax, dword [eax]
push dword [esi + 4]
push ecx
push dword [ebp - 0x228]
push eax
call fcn.1002336b
mov ecx, eax
call fcn.10016f16
mov esi, dword [ebp - 0x224]
test eax, eax
je 0x10020601
mov edx, dword [eax]
mov ecx, eax
push esi
call dword [edx + 4]
test eax, eax
jne 0x10020604
push 9
pop ebx
mov ecx, dword [ebp - 0x228]
add ecx, 0xfffffff0
call fcn.100018e3
lea ecx, [esi - 0x10]
call fcn.100018e3
mov eax, ebx
call fcn.1008b6ab
ret 0xc
Function at 0x100209bc
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x1010b070]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, 0x20a
lea eax, [ebp - 0x210]
xor edi, edi
push esi
push edi
push eax
mov dword [ebp - 0x224], edi
call fcn.1008df10
add esp, 0xc
mov dword [ebp - 0x218], edi
call fcn.100017c6
push eax
lea ecx, [ebp - 0x218]
call fcn.10001562
lea eax, [ebp - 0x224]
mov dword [ebp - 0x21c], esi
push eax
push 0x20019
push edi
push str.SoftwareTencentQQPCMgr
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10020af5
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x220]
push eax
push edi
push str.InstallDir
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10020ae9
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea ecx, [ebp - 0x210]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x10020a76
sub ecx, edx
lea eax, [ebp - 0x210]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x218]
call fcn.10005bd6
push str.QQRepair.exe
lea edx, [ebp - 0x218]
mov dword [ebp - 0x214], edi
lea ecx, [ebp - 0x214]
call fcn.10001464
pop ecx
push dword [ebp - 0x214]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10020adb
push ecx
push edi
push ecx
mov ecx, dword [ebp - 0x214]
mov edx, str._ext1
call fcn.1001afb6
add esp, 0xc
mov ecx, dword [ebp - 0x214]
lea ecx, [ecx - 0x10]
call fcn.100018e3
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x218]
lea ecx, [ecx - 0x10]
call fcn.100018e3
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.1008a9f7
mov esp, ebp
pop ebp
ret 4
Function at 0x10021d86
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push 0x224
mov eax, 0x100be761
call fcn.1008b701
mov ebx, ecx
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x224]
mov eax, dword [ebp + 0xc]
xor esi, esi
push edi
mov dword [ebp - 0x22c], eax
mov dword [ebp - 0x224], esi
call fcn.100055e9
mov dword [ebp - 4], esi
lea ecx, [ebp - 0x224]
mov eax, dword [ebp - 0x224]
push dword [eax - 0xc]
call fcn.10001a00
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x224]
call fcn.10005641
mov ecx, dword [ebp - 0x224]
lea ecx, [ecx - 0x10]
call fcn.1000158b
lea esi, [eax + 0x10]
mov dword [ebp - 0x228], esi
mov byte [ebp - 4], 1
mov ecx, ebx
push dword [ebp - 0x224]
push edi
call fcn.10021c04
test eax, eax
je 0x10021ea9
push str.Info.ini
lea ecx, [ebp - 0x224]
call fcn.10018a2c
push dword [ebp - 0x224]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
call ebx
test eax, eax
je 0x10021ea9
push 0x20a
xor edi, edi
lea eax, [ebp - 0x220]
push edi
push eax
call fcn.1008df10
add esp, 0xc
lea eax, [ebp - 0x220]
push dword [ebp - 0x224]
push 0x104
push eax
push str.setup.exe
push str.PacketExe
push str.setting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x228]
call fcn.10018a2c
mov esi, dword [ebp - 0x228]
push esi
call fcn.10001a38
pop ecx
mov ecx, dword [ebp - 0x22c]
push eax
push esi
add ecx, 0x28
call fcn.10001dcf
push esi
call ebx
mov edi, eax
jmp 0x10021eab
xor edi, edi
lea ecx, [esi - 0x10]
call fcn.100018e3
mov ecx, dword [ebp - 0x224]
lea ecx, [ecx - 0x10]
call fcn.100018e3
mov eax, edi
call fcn.1008b6ab
ret 8
Function at 0x1002238c
Capabilities:
Create process on windows

Disassembly:
push 0x94
mov eax, 0x100be894
call fcn.1008b701
mov edi, ecx
mov esi, dword [ebp + 8]
push str.CTxdlController::AsyncInstall_begin
push 0xd2
push str.E:qci_workspace_root_workspaces__qci_pipeline_10566830_1QQPCDownloadTxdlTxdlController.cpp
call fcn.1006a644
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 0x68], esp
push 0x100d1e02
call fcn.1001111d
sub esp, 0x18
xor ebx, ebx
mov dword [ebp - 4], ebx
mov ecx, esp
mov dword [ebp - 0x6c], esp
push str.actionTBSInstalling
call fcn.1001111d
push 0x7db
mov byte [ebp - 4], 1
call fcn.1001897a
or dword [ebp - 4], 0xffffffff
mov ecx, eax
call fcn.1002586e
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x110], eax
test eax, eax
je 0x100224da
push str.CTxdlController::AsyncInstall_INTALL_THREAD_EVENT_EXIT
push 0xd2
push str.E:qci_workspace_root_workspaces__qci_pipeline_10566830_1QQPCDownloadTxdlTxdlController.cpp
call fcn.1006a644
push 0x40
lea eax, [ebp - 0x50]
push ebx
push eax
call fcn.1008df10
lea eax, [esi + 0xf0]
mov dword [ebp - 0x54], 0x44
add esp, 0x18
mov dword [ebp - 0x28], 0x80
cmp dword [eax + 0x14], 8
xorps xmm0, xmm0
movups xmmword [ebp - 0x64], xmm0
jb 0x10022454
mov eax, dword [eax]
lea ecx, [ebp - 0x64]
push ecx
lea ecx, [ebp - 0x54]
push ecx
push ebx
push ebx
push 0x2000000
push ebx
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x100224da
push str.CTxdlController::AsyncInstall_CreateProcess
push 0xd2
push str.E:qci_workspace_root_workspaces__qci_pipeline_10566830_1QQPCDownloadTxdlTxdlController.cpp
call fcn.1006a644
mov eax, dword [ebp - 0x64]
add esp, 0xc
mov dword [esi + 0x10c], eax
push 0x12c
push ebx
lea eax, [esi + 0x10c]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
cmp eax, 1
ja 0x100224c6
push eax
push str.CTxdlController::AsyncInstall_event:_d
push 0xd2
push str.E:qci_workspace_root_workspaces__qci_pipeline_10566830_1QQPCDownloadTxdlTxdlController.cpp
call fcn.1006a644
add esp, 0x10
mov esi, ebx
test esi, esi
jne 0x10022492
push dword [ebp - 0x60]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x64]
call esi
push 0xa4d
push str.E:qci_workspace_root_workspaces__qci_pipeline_10566830_1QQPCDownloadTxdlTxdlController.cpp
push str.Txdl::CTxdlController::AsyncInstall
lea ecx, [ebp - 0xa0]
call fcn.10007b6e
mov esi, eax
push ebx
push 0x1001e145
lea ecx, [edi + 0x34]
mov dword [ebp - 4], 2
call fcn.10023cfc
xor ecx, ecx
mov edx, esi
push eax
inc ecx
call fcn.1001c201
pop ecx
lea ecx, [ebp - 0xa0]
call fcn.10007cb0
call fcn.1008b6ab
ret 4