joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401cc0
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x430080]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x418]
push eax
lea ecx, [ebp - 0x41c]
push ecx
lea edx, [ebp - 0x420]
push edx
push str.InstallTime
push str.SOFTWARESogouComponentsDOWNLOAD
push 0x80000002
mov dword [ebp - 0x41c], 0
mov dword [ebp - 0x418], 4
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x401d30
cmp dword [ebp - 0x41c], eax
je 0x401d30
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040e806
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x418]
push eax
push 0x20219
push 0
push str.CLSIDD1871D0A_4929_4A3C_AAE5_684235E62244
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x401d6f
mov ecx, dword [ebp - 0x418]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040e806
mov esp, ebp
pop ebp
ret
push esi
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x20a]
push eax
mov word [ebp - 0x20c], dx
call fcn.0040edd0
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x412]
push edx
mov word [ebp - 0x414], cx
call fcn.0040edd0
add esp, 0x18
lea esi, [ebp - 0x20c]
call fcn.00402dc0
mov eax, esi
push eax
lea ecx, [ebp - 0x414]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push str.npdownload.dll
lea edx, [ebp - 0x414]
push edx
call esi
push str.SogouDownLoad.dll
lea eax, [ebp - 0x20c]
push eax
call esi
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea ecx, [ebp - 0x20c]
push ecx
call esi
test eax, eax
jne 0x401e15
lea edx, [ebp - 0x414]
push edx
call esi
test eax, eax
jne 0x401e15
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040e806
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 1
pop esi
call fcn.0040e806
mov esp, ebp
pop ebp
ret

Function at 0x402cf0
Capabilities:
Accept command line arguments
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x628
mov eax, dword [0x430080]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x20c]
push eax
push 0x104
call esi
call fcn.00401cc0
test eax, eax
je 0x402d9b
push 2
call fcn.00401790
add esp, 4
lea ecx, [ebp - 0x420]
xor eax, eax
push ecx
push 0x104
mov dword [ebp - method.UtilNetwork::CBindStatusCallback.virtual_0], vtable.UtilNetwork::CBindStatusCallback.0
mov dword [ebp - 0x214], eax
mov dword [ebp - 0x210], eax
call esi
push 0x104
lea edx, [ebp - 0x420]
push edx
lea eax, [ebp - 0x628]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push 0x42c9fc
lea ecx, [ebp - 0x628]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea esi, [ebp - 0x628]
call fcn.0040cf60
test eax, eax
je 0x402da8
mov edx, esi
push edx
call fcn.0040cff0
jmp 0x402da8
push ebx
lea ebx, [ebp - 0x20c]
call fcn.00401690
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 1
pop esi
call fcn.0040e806
mov esp, ebp
pop ebp
ret 0x10
Function at 0x402dc0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 4]
push eax
push esi
lea ecx, [ebp - 8]
push ecx
push str.InstallPath
push str.SOFTWARESogouComponentsDOWNLOAD
push 0x80000002
mov dword [ebp - 4], 0x104
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x402e1f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x104
push esi
push str.PROGRAMFILES
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push str.SogouDownLoad
push esi
push str._s_s
push 0x104
push esi
call fcn.0040e98b
add esp, 0x14
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x402e30
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1284
call fcn.004159e0
mov eax, dword [0x430080]
xor eax, esp
mov dword [esp + 0x1280], eax
mov eax, dword [ebp + 8]
push esi
lea ecx, [esp + 8]
push ecx
push edi
lea edx, [esp + 0x14]
push edx
push str.Version
push str.SOFTWARESogouComponentsDOWNLOAD
push 0x80000002
mov dword [esp + 0x20], eax
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x402f01
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x1082]
push ecx
mov word [esp + 0x1084], ax
call fcn.0040edd0
add esp, 0xc
lea esi, [esp + 0x1078]
call fcn.00402dc0
push str.DlgHandler.dll
mov edx, esi
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x402f19
mov ecx, esi
push ecx
lea edx, [esp + 0x14]
push edx
call fcn.00404d00
test edi, edi
je 0x402f19
movzx eax, word [esp + 0x26]
movzx ecx, word [esp + 0x24]
movzx edx, word [esp + 0x22]
push eax
movzx eax, word [esp + 0x24]
push ecx
push edx
push eax
push str._d._d._d._d
push 0x104
push edi
call fcn.0040e98b
add esp, 0x1c
mov eax, 1
pop esi
mov ecx, dword [esp + 0x1280]
xor ecx, esp
call fcn.0040e806
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x1284]
pop esi
xor ecx, esp
xor eax, eax
call fcn.0040e806
mov esp, ebp
pop ebp
ret
Function at 0x402f30
Capabilities:
Check if file exists
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1288
call fcn.004159e0
mov eax, dword [0x430080]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x216]
push ecx
mov word [ebp - 0x218], ax
call fcn.0040edd0
add esp, 0xc
lea edx, [ebp - 0x1284]
push edx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 8]
push ecx
push str.InstallPath
push str.SOFTWARESogouComponentsDOWNLOAD
push 0x80000002
mov dword [ebp - 0x1284], 0x104
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x402fd8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x104
lea edx, [ebp - 0x218]
push edx
push str.PROGRAMFILES
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push str.SogouDownLoad
lea eax, [ebp - 0x218]
push eax
push str._s_s
mov ecx, eax
push 0x104
push ecx
call fcn.0040e98b
add esp, 0x14
push str.DownLoadDlg.exe
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40304b
lea ecx, [ebp - 0x218]
push ecx
lea edx, [ebp - 0x1280]
push edx
call fcn.00404d00
mov eax, dword [ebp - 0x1270]
mov ecx, dword [ebp - 0x126c]
mov dword [ebp - 0xc], eax
movzx edx, word [ebp - 0xa]
movzx eax, ax
shl eax, 8
add eax, edx
mov dword [ebp - 8], ecx
movzx edx, word [ebp - 6]
shl eax, 8
movzx ecx, cx
add eax, ecx
shl eax, 8
add eax, edx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040e806
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.0040e806
mov esp, ebp
pop ebp
ret

Function at 0x403060
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x428a18
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x430080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x10]
push eax
push esi
lea ecx, [ebp - 0x14]
push ecx
push str.HWID
push str.SOFTWARESogouComponentsDOWNLOAD
push 0x80000002
mov dword [ebp - 0x10], edi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x4030be
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x4030f4
push edi
push 0
push esi
call fcn.0040edd0
add esp, 0xc
mov dword [ebp - 0x14], vtable.CQMSeqIDGen.0
push esi
mov dword [ebp - 4], 0
call fcn.00406560
movzx eax, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x403110
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x480
mov eax, dword [0x430080]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x40
xor edi, edi
lea eax, [ebp - 0x47c]
push edi
push eax
mov esi, ecx
mov dword [ebp - 0x480], 0x44
call fcn.0040edd0
xor eax, eax
push 0x40e
lea edx, [ebp - 0x416]
xor ecx, ecx
push edi
mov dword [ebp - 0x420], eax
mov dword [ebp - 0x41c], eax
push edx
mov dword [ebp - 0x424], 0xc
mov dword [ebp - 0x420], edi
mov dword [ebp - 0x41c], 1
mov dword [ebp - 0x434], eax
mov dword [ebp - 0x430], eax
mov dword [ebp - 0x42c], eax
mov dword [ebp - 0x428], eax
mov word [ebp - 0x418], cx
call fcn.0040edd0
push 0x207
lea eax, [ebp - 0x418]
push esi
push eax
call fcn.0041ca5d
add esp, 0x24
lea ecx, [ebp - 0x434]
push ecx
lea edx, [ebp - 0x480]
push edx
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x424]
push eax
mov ecx, eax
push ecx
lea edx, [ebp - 0x418]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x4031f8
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040e806
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x434]
push 0x2710
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x403211
lea edi, [eax + 1]
mov ecx, dword [ebp - 0x434]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [ebp - 0x430]
push edx
call esi
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.0040e806
mov esp, ebp
pop ebp
ret

Function at 0x4046e0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x430080]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push 0x103
lea eax, [ebp - 0x107]
push 0
push eax
mov byte [ebp - 0x108], 0
call fcn.0040edd0
add esp, 0xc
push str.DebugMsg
push str.32770
call dword [sym.imp.USER32.dll_FindWindowW]
mov edi, eax
test edi, edi
je 0x4047c0
push esi
push str.Mutex_DebugMsg
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
test esi, esi
je 0x4047bf
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4047b8
mov edx, dword [ebp + 8]
lea ecx, [ebp + 0xc]
push ecx
push edx
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.0041cb94
lea eax, [ebp - 0x108]
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x404773
push 0
push 0x32
push 0
sub eax, edx
lea edx, [ebp - 0x114]
push edx
push 0
push 0x4a
inc eax
lea ecx, [ebp - 0x108]
push edi
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x10c], ecx
mov dword [ebp - 0x114], 1
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0040e806
mov esp, ebp
pop ebp
ret
Function at 0x4047d0
Capabilities:
Query remote server for available data
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
sub esp, 8
push ebx
push esi
push edi
xor edi, edi
push edi
push edi
lea eax, [ebp - 4]
push eax
push ecx
call dword [sym.imp.WININET.dll_InternetQueryDataAvailable]
test eax, eax
je 0x40486c
nop
mov eax, dword [ebp - 4]
test eax, eax
je 0x4048a5
inc eax
push eax
call fcn.0040e7f0
mov esi, eax
add esp, 4
test esi, esi
je 0x40486c
mov edx, dword [ebp - 4]
inc edx
push edx
push 0
push esi
call fcn.0040edd0
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
add esp, 0xc
lea eax, [ebp - 8]
push eax
push ecx
push esi
push edx
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x404875
mov eax, dword [ebp - 8]
lea ebx, [eax + edi]
cmp ebx, 0x32000
ja 0x40488a
add edi, dword [ebp + 0xc]
push eax
push esi
push edi
call fcn.004150e0
push esi
mov edi, ebx
call fcn.0040eabb
mov edx, dword [ebp + 8]
add esp, 0x10
push 0
push 0
lea ecx, [ebp - 4]
push ecx
push edx
call dword [sym.imp.WININET.dll_InternetQueryDataAvailable]
test eax, eax
jne 0x4047f0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call fcn.0040eabb
add esp, 4
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0x32000
sub eax, edi
add edi, dword [ebp + 0xc]
push eax
push esi
push edi
call fcn.004150e0
push esi
call fcn.0040eabb
add esp, 0x10
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x404d00
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0x410
xor edi, edi
lea esi, [ebx + 0x28]
push edi
push esi
call fcn.0040edd0
mov eax, dword [ebp + 0xc]
add esp, 0xc
cmp eax, edi
je 0x404d39
cmp word [eax], di
je 0x404d39
push 0x40f
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov dword [ebx], edi
mov dword [ebx + 4], edi
lea eax, [ebx + 0x10]
mov ecx, 4
xor edx, edx
mov word [eax - 8], dx
mov word [eax], dx
add eax, 2
dec ecx
jne 0x404d46
push 0x410
lea eax, [ebx + 0x438]
push edi
push eax
mov dword [ebx + 0x18], edi
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x20], edi
mov dword [ebx + 0x24], edi
mov dword [ebp - 8], eax
call fcn.0040edd0
push 0x410
lea eax, [ebx + 0x848]
push edi
push eax
mov dword [ebp - 0x10], eax
call fcn.0040edd0
push 0x410
lea eax, [ebx + 0xc58]
push edi
push eax
mov dword [ebp - 0xc], eax
call fcn.0040edd0
add esp, 0x24
lea eax, [ebp - 4]
push eax
lea eax, [ebx + 0x28]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov esi, eax
cmp esi, edi
je 0x404eb3
lea edi, [esi + 1]
push edi
call fcn.0040e7f0
push edi
push 0
push eax
mov dword [ebx], eax
call fcn.0040edd0
mov ecx, dword [ebx]
mov edx, dword [ebp - 4]
add esp, 0x10
push ecx
push esi
push edx
lea eax, [ebx + 0x28]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x404eb3
mov eax, dword [ebx]
mov dword [ebp + 0xc], 0
test eax, eax
je 0x404eb3
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp + 0xc]
push edx
push 0x42c5b8
push eax
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x404eb3
mov esi, dword [ebp + 0xc]
mov ecx, 0xd
lea edi, [ebp - 0x48]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x40]
mov esi, dword [ebp + 8]
mov ecx, eax
mov word [ebx + 0xa], ax
mov eax, dword [ebp - 0x3c]
mov edx, eax
mov word [ebx + 0xe], ax
mov eax, dword [ebp - 0x38]
shr ecx, 0x10
mov word [ebx + 8], cx
shr edx, 0x10
mov ecx, eax
mov word [ebx + 0x12], ax
mov eax, dword [ebp - 0x34]
mov word [ebx + 0xc], dx
mov edx, eax
mov word [ebx + 0x16], ax
mov eax, dword [ebp - 0x2c]
shr ecx, 0x10
shr edx, 0x10
mov word [ebx + 0x10], cx
mov ecx, dword [ebp - 0x28]
mov word [ebx + 0x14], dx
mov edx, dword [ebp - 0x24]
mov dword [ebx + 0x18], eax
mov eax, dword [ebp - 0x20]
mov dword [ebx + 0x1c], ecx
mov dword [ebx + 0x20], edx
mov dword [ebx + 0x24], eax
mov ebx, dword [ebp - 8]
mov edi, 0x42c550
call fcn.00404ec0
mov ebx, dword [ebp - 0xc]
mov edi, 0x42c568
call fcn.00404ec0
mov ebx, dword [ebp - 0x10]
mov edi, 0x42c588
call fcn.00404ec0
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x406950
Capabilities:
Copy file
Delete file
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4287ab
mov eax, dword fs:[0]
push eax
sub esp, 0x2a0
mov eax, dword [0x430080]
xor eax, esp
mov dword [esp + 0x298], eax
push ebx
push esi
push edi
mov eax, dword [0x430080]
xor eax, esp
push eax
lea eax, [esp + 0x2b0]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
push ebx
lea ecx, [esp + 0x3c]
mov dword [esp + 0x1c], eax
mov byte [esp + 0x17], bl
call fcn.00406ce0
add esp, 4
mov dword [esp + 0x2b8], ebx
cmp dword [esp + 0x4c], 8
mov eax, dword [esp + 0x38]
jae 0x4069c0
lea eax, [esp + 0x38]
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push ebx
push ebx
push 3
push ebx
push 1
push 0x80000000
push eax
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x406a6f
push 1
lea ecx, [esp + 0x20]
call fcn.00406ce0
mov eax, dword [esp + 0x3c]
add esp, 4
cmp dword [esp + 0x4c], 8
jae 0x4069fd
lea eax, [esp + 0x38]
mov esi, dword [sym.imp.KERNEL32.dll_FindFirstFileW]
lea ecx, [esp + 0x54]
push ecx
push eax
call esi
cmp eax, 0xffffffff
je 0x406aaa
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov esi, 8
mov eax, dword [esp + 0x1c]
cmp dword [esp + 0x30], esi
jae 0x406a2e
lea eax, [esp + 0x1c]
push ebx
push ebx
push 3
push ebx
push 1
push 0x80000000
push eax
call edi
cmp dword [esp + 0x30], 8
mov esi, eax
jb 0x406a53
mov eax, dword [esp + 0x1c]
push eax
call fcn.0040e7fb
add esp, 4
xor ecx, ecx
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], ebx
mov word [esp + 0x1c], cx
cmp esi, 0xffffffff
je 0x406b1d
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0x10
jb 0x406a9d
mov eax, dword [esp + 0x18]
push ebx
lea edx, [esp + 0x18]
push edx
push edi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x406a9d
mov bl, 1
cmp dword [esp + 0x14], edi
je 0x406aa1
mov bl, byte [esp + 0x13]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x406b1f
cmp dword [esp + 0x30], 8
mov eax, dword [esp + 0x1c]
jae 0x406ab9
lea eax, [esp + 0x1c]
lea edx, [esp + 0x54]
push edx
push eax
call esi
cmp eax, 0xffffffff
je 0x406a1b
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x38]
mov esi, 8
cmp dword [esp + 0x4c], esi
jae 0x406ae4
lea ecx, [esp + 0x38]
mov eax, dword [esp + 0x1c]
cmp dword [esp + 0x30], esi
jae 0x406af2
lea eax, [esp + 0x1c]
push ebx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x406a20
mov eax, dword [esp + 0x1c]
cmp dword [esp + 0x30], esi
jae 0x406b11
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x406a20
mov bl, cl
cmp dword [esp + 0x4c], 8
jb 0x406b33
mov ecx, dword [esp + 0x38]
push ecx
call fcn.0040e7fb
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x2b0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x298]
xor ecx, esp
call fcn.0040e806
mov esp, ebp
pop ebp
ret 4
Function at 0x406b60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x428778
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x430080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
push ebx
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x50], eax
call fcn.00406ce0
add esp, 4
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x34], 8
mov eax, dword [ebp - 0x48]
jae 0x406bae
lea eax, [ebp - 0x48]
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push ebx
push ebx
push 2
push ebx
push 1
push 0x40000000
push eax
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x406c1b
push 1
lea ecx, [ebp - 0x2c]
call fcn.00406ce0
mov eax, dword [ebp - 0x2c]
add esp, 4
cmp dword [ebp - 0x18], 8
jae 0x406be3
lea eax, [ebp - 0x2c]
push ebx
push ebx
push 2
push ebx
push 1
push 0x40000000
push eax
call edi
cmp dword [ebp - 0x18], 8
mov esi, eax
jb 0x406c06
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.0040e7fb
add esp, 4
xor edx, edx
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], ebx
mov word [ebp - 0x2c], dx
cmp esi, 0xffffffff
je 0x406c40
mov ecx, dword [ebp - 0x50]
push ebx
lea eax, [ebp - 0x4c]
push eax
push 0x10
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x406c39
cmp dword [ebp - 0x4c], 0x10
jne 0x406c39
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x34], 8
jb 0x406c52
mov edx, dword [ebp - 0x48]
push edx
call fcn.0040e7fb
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040e806
mov esp, ebp
pop ebp
ret 4
Function at 0x406ce0
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42873d
mov eax, dword fs:[0]
push eax
sub esp, 0x234
mov eax, dword [0x430080]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x23c], ebx
xor eax, eax
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], ebx
mov dword [ebp - 0x240], edi
mov word [edi], ax
push 0x208
lea ecx, [ebp - 0x21c]
push ebx
mov dword [ebp - 4], ebx
push ecx
mov dword [ebp - 0x23c], 1
call fcn.0040edd0
movzx edx, byte [ebp + 8]
add esp, 0xc
neg edx
sbb edx, edx
push 1
and edx, 0xfffffff7
add edx, 0x23
push edx
lea eax, [ebp - 0x21c]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x406e26
xor ecx, ecx
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x224], 7
mov dword [ebp - 0x228], ebx
mov word [ebp - 0x238], cx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x406d97
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x21c]
lea ecx, [ebp - 0x238]
call fcn.004094a0
push ebx
lea edx, [ebp - 0x238]
push edx
or eax, 0xffffffff
mov dword [ebp - 4], 1
call fcn.00409310
mov byte [ebp - 4], bl
cmp dword [ebp - 0x224], 8
jb 0x406dea
mov eax, dword [ebp - 0x238]
push eax
call fcn.0040e7fb
add esp, 4
mov ecx, edi
cmp byte [ebp + 8], bl
je 0x406dfa
push 0x13
mov eax, str.TencentDeskUpdate
jmp 0x406e01
push 0x10
mov eax, str.TencentDesktop
call fcn.004093c0
mov ecx, edi
call fcn.00406e50
test al, al
jne 0x406e18
mov ecx, edi
call fcn.00406fa0
push 0xa
mov eax, str.Global.db
mov ecx, edi
call fcn.004093c0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0040e806
mov esp, ebp
pop ebp
ret
Function at 0x409220
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x427eeb
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x430080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0041c6a6
push 4
mov dword [ebp - 4], 0
call fcn.0040eb17
mov edi, eax
add esp, 4
test edi, edi
je 0x40929c
call fcn.0041c57e
mov dword [edi], eax
call fcn.0041c33d
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.0041c667
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x409292
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.0041c68f
jmp 0x40929e
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4