joyce8/EMBER2024-capa huggingface dataset:
Function at 0x462630
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d81c1
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x511070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [ebp + 8], 0
je 0x46285b
cmp dword [edi + 0x10c], 0
jne 0x4626af
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x4626af
push esi
push str.Setup.xml_supply_is__d.
push 0x515488
call fcn.0048cf90
add esp, 0xc
mov dword [edi + 0x10c], esi
call fcn.0047eb10
mov ecx, dword [edi + 0x10c]
test ecx, ecx
je 0x4626af
mov dword [eax + 0x18], ecx
mov eax, dword [eax + 0x28]
test eax, eax
je 0x4626af
mov dword [eax + 0x20], ecx
push str.C0F87C1E_7FD0_4b43_99BD_C6386C56F41E
push 0
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov ebx, eax
test ebx, ebx
je 0x46282f
push 4
push 0
push 0
push 4
push ebx
mov dword [edi + 0x10c], 0x2714
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
mov dword [ebp - 0x228], esi
test esi, esi
je 0x462828
push 0x20a
lea eax, [ebp - 0x21c]
push 0
push eax
call fcn.004a83c0
push 0xffffffffffffffff
push esi
lea eax, [ebp - 0x21c]
push 0x105
push eax
call fcn.004b67be
add esp, 0x1c
lea eax, [ebp - 0x21c]
lea ecx, [ebp - 0x220]
push eax
call fcn.0041c970
push 0x4f6738
push 0x4f5870
lea ecx, [ebp - 0x220]
mov dword [ebp - 4], 0
call fcn.00420700
push dword [ebp - 0x220]
lea ecx, [ebp - 0x234]
call fcn.00457200
mov byte [ebp - 4], 1
call fcn.0041bed0
mov ecx, eax
test ecx, ecx
jne 0x462773
push 0x80004005
call fcn.0041cdf0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x224], eax
lea eax, [ebp - 0x224]
mov byte [ebp - 4], 2
push eax
push 0x4f673c
lea ecx, [ebp - 0x234]
call fcn.00457430
mov esi, dword [ebp - 0x224]
test eax, eax
je 0x4627d1
push esi
call fcn.004b0c83
add esp, 4
mov dword [edi + 0x10c], eax
call fcn.0047eb10
mov ecx, dword [edi + 0x10c]
test ecx, ecx
je 0x4627d1
mov dword [eax + 0x18], ecx
mov eax, dword [eax + 0x28]
test eax, eax
je 0x4627d1
mov dword [eax + 0x20], ecx
push dword [ebp - 0x228]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
lea edx, [esi - 0x10]
mov byte [ebp - 4], 1
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4627fb
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x234]
call fcn.00459f50
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x220]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x462828
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [edi + 0x10c]
test eax, eax
je 0x462864
push eax
push str.Write_the_NewSupplyID:__d
push 0x515488
call fcn.0048cf90
add esp, 0xc
mov ecx, edi
push dword [edi + 0x10c]
call fcn.00464dc0
jmp 0x462864
mov eax, dword [ebp + 0xc]
mov dword [edi + 0x10c], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a578d
mov esp, ebp
pop ebp
ret 8
Function at 0x462980
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d8240
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x511070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x14], eax
mov ecx, dword [eax + 0x4c]
xor ebx, ebx
sub ecx, 0x10
call fcn.0041c670
add eax, 0x10
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], ebx
call fcn.00488b20
lea ecx, [ebp - 0x10]
call fcn.00488bd0
mov esi, dword [ebp - 0x10]
mov ecx, dword [esi - 0xc]
test ecx, ecx
je 0x462a0e
lea eax, [ecx - 1]
test eax, eax
js 0x462aa8
cmp eax, ecx
jg 0x462aa8
movzx eax, word [esi + eax*2]
cmp eax, 0x5c
je 0x462a0e
cmp eax, 0x2f
je 0x462a0e
push str.0s
lea ecx, [ebp - 0x10]
call fcn.0041c190
mov esi, dword [ebp - 0x10]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
or edi, 0xffffffff
test eax, eax
je 0x462a76
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
push str.0s
add edx, 0x5c
call fcn.0041c010
add esp, 4
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
call fcn.0041c490
mov byte [ebp - 4], 0
mov eax, edi
mov edx, dword [ebp - 0x18]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x462a62
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.0041c6d0
mov esi, dword [ebp - 0x10]
mov ebx, 1
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], edi
dec edi
test edi, edi
jg 0x462a92
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.0041cdf0
int3
Function at 0x462ac0
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d8276
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x511070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x228], edi
mov eax, dword [ebp + 0xc]
push 0x208
mov dword [ebp - 0x220], eax
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004a83c0
add esp, 0xc
call fcn.0041bed0
mov ecx, eax
test ecx, ecx
jne 0x462b2a
push 0x80004005
call fcn.0041cdf0
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x21c], esi
or ebx, 0xffffffff
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
je 0x462b61
push dword [ebp - 0x220]
mov ecx, edi
call fcn.00462980
test eax, eax
je 0x462b61
lea edi, [ebx + 2]
jmp 0x462c18
push 0
push 0x26
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov edi, eax
test edi, edi
je 0x462c18
lea eax, [ebp - 0x224]
push eax
call fcn.004628b0
push eax
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 1
call fcn.0041c6d0
mov byte [ebp - 4], 0
mov eax, ebx
mov edx, dword [ebp - 0x224]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x462bbb
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x21c]
mov eax, dword [esi - 0xc]
test eax, eax
je 0x462bde
jns 0x462bd4
push 0x80070057
call fcn.0041cdf0
mov ax, word [esi]
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
mov eax, dword [ebp - 0x228]
push str.0s
push dword [eax + 0x5c]
lea eax, [ebp - 0x218]
push str.TencentQQPCMgr_
push eax
push str._s_s_s_s
push dword [ebp - 0x220]
call fcn.00421db0
add esp, 0x18
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x462c34
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a578d
mov esp, ebp
pop ebp
ret 8
Function at 0x462ec0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d82e0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x511070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0
call fcn.0041bed0
mov ecx, eax
test ecx, ecx
jne 0x462f0d
push 0x80004005
call fcn.0041cdf0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x462f2a
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push 0x20019
push 0
push str.SOFTWARETencentQQPCMgr
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x14]
push eax
push str.InstallDir
lea ecx, [ebp - 0x10]
call fcn.00440780
mov esi, dword [ebp - 0x14]
cmp dword [esi - 0xc], 0
jne 0x462f7b
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00462d90
mov edi, eax
neg edi
sbb edi, edi
neg edi
jmp 0x462fba
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x462f8a
xor edi, edi
jmp 0x462fba
push dword [ebp + 0xc]
lea ecx, [ebp - 0x10]
push str.Version
call fcn.00440780
mov edi, eax
test edi, edi
je 0x462fba
lea ecx, [ebp - 0x14]
call fcn.00488ae0
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
push eax
lea ecx, [ecx + 0x4c]
call fcn.0041c6d0
mov esi, dword [ebp - 0x14]
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x462fd6
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x462fe4
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x463000
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d8310
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x511070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
call fcn.004631f0
test eax, eax
je 0x46307c
push 0x4f67f4
push 0x515488
call fcn.0048cf90
add esp, 8
cmp dword [esi + 0x38], 0
jne 0x46305f
push 0
push 0x4f6814
push 0x4f6828
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, dword [esi]
mov ecx, esi
push 0x12
call dword [eax + 0x1c]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, esi
call fcn.00462c90
cmp dword [esi + 0x38], 0
jne 0x4631a7
mov ecx, esi
test eax, eax
je 0x46309a
push str._uid
jmp 0x46309f
push 0x4f686c
call fcn.00465940
test eax, eax
jne 0x4630d7
push str.failed_to_close_rtp
push 0x515488
call fcn.0048cf90
mov eax, dword [esi]
add esp, 8
mov ecx, esi
push 4
call dword [eax + 0x1c]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ebx, [esi + 0x4c]
push str.QQRepair.exe
mov edx, ebx
lea ecx, [ebp - 0x10]
call fcn.0041c010
add esp, 4
mov dword [ebp - 4], 0
mov ecx, dword [eax]
call fcn.0045b1d0
mov dword [ebp - 4], 0xffffffff
or edi, 0xffffffff
mov edx, dword [ebp - 0x10]
mov eax, edi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x46311e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push str.QQRepair.exetmp
mov edx, ebx
lea ecx, [ebp - 0x18]
call fcn.0041c010
add esp, 4
mov esi, eax
push str.QQRepair.exe
mov edx, ebx
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.0041c010
add esp, 4
push dword [esi]
push dword [eax]
call fcn.004af34f
mov edx, dword [ebp - 0x14]
add esp, 8
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x463171
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x18]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x463190
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test eax, eax
je 0x463190
mov ecx, esi
call fcn.004632a0
test eax, eax
jne 0x463190
mov eax, dword [esi]
mov ecx, esi
push 7
call dword [eax + 0x1c]
push 0x4f68a8
push 0x515488
call fcn.0048cf90
add esp, 8
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x463320
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d8376
mov eax, dword fs:[0]
push eax
mov eax, 0x1484
call fcn.004a6780
mov eax, dword [0x511070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0x1048
lea eax, [ebp - 0x1058]
mov dword [ebp - 0x1490], 1
push 0
push eax
mov dword [ebp - 0x148c], 0
call fcn.004a83c0
add esp, 0xc
mov dword [ebp - 0x1480], 0
lea eax, [ebp - 0x1478]
mov dword [ebp - 0x147c], 0
mov dword [ebp - 0x126c], 0
mov dword [ebp - 0x1488], str.8CEFC9E6_A2B4_4c2a_823C_6903A31139FA
push 0x20a
push 0
push eax
mov dword [ebp - 0x1484], 0x26
call fcn.004a83c0
add esp, 0xc
lea eax, [ebp - 0x1268]
push 0x20a
push 0
push eax
call fcn.004a83c0
add esp, 8
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1488]
call fcn.00497150
lea eax, [ebp - 0x148c]
push eax
push 4
lea eax, [ebp - 0x1490]
push eax
push str.IELockHomepage
lea ecx, [ebp - 0x1488]
call fcn.00497310
cmp dword [esi + 0x38], 0
lea eax, [ebp - 0x1058]
push 0xffffffffffffffff
je 0x463421
push str.http:__hao.qq.com__unco400493_1s2
jmp 0x463426
push str.http:__hao.qq.com__unco400493_1s1
push 0x824
push eax
call fcn.004b67be
add esp, 0x10
lea eax, [ebp - 0x148c]
lea ecx, [ebp - 0x1488]
push eax
push 0x1048
lea eax, [ebp - 0x1058]
push eax
push str.IEHomepage
call fcn.00497310
mov eax, dword [0x511ea4]
cmp eax, 0xffffffff
jne 0x46349d
push str.IsWow64Process
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x46355f
push 0x511ea4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
test eax, eax
je 0x46355f
mov eax, dword [0x511ea4]
test eax, eax
je 0x46352f
push 0
lea eax, [ebp - 0x148c]
mov dword [ebp - 0x148c], 0
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareMicrosoftInternet_ExplorerMain
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
mov eax, dword [ebp - 0x148c]
jne 0x463524
test eax, eax
je 0x46352f
lea edx, [ebp - 0x1058]
lea esi, [edx + 2]
nop dword [eax]
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x4634f0
sub edx, esi
sar edx, 1
lea ecx, [edx*2 + 2]
push ecx
lea ecx, [ebp - 0x1058]
push ecx
push 1
push 0
push str.Start_Page
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp - 0x148c]
test eax, eax
je 0x46352f
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x1480]
test eax, eax
je 0x463540
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a578d
mov esp, ebp
pop ebp
ret
mov dword [0x511ea4], 0
jmp 0x46352f
Function at 0x463990
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d8480
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x511070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edx, dword [esi + 0x58]
xor eax, eax
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], ax
cmp word [edx], ax
jne 0x4639dc
xor ecx, ecx
jmp 0x4639f0
mov ecx, edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4639e1
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x40]
call fcn.00439160
mov dword [ebp - 4], 0
xor eax, eax
mov edx, dword [esi + 0x58]
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
cmp word [edx], ax
jne 0x463a21
xor ecx, ecx
jmp 0x463a35
mov ecx, edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x463a26
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.00439160
push str.package.dat
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 1
call fcn.0048e980
push str.pkgdll.dat
lea ecx, [ebp - 0x28]
call fcn.0048e980
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
push 0
cmovae eax, dword [ebp - 0x40]
push 0x80
push 2
push 0
push 1
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x463aab
push dword [esi + 0x98]
mov edx, dword [esi + 0x9c]
mov ecx, edi
call fcn.0045b5e0
add esp, 4
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
jne 0x463abd
push 0x4f6ba4
push 0x515488
call fcn.0048cf90
add esp, 8
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x463ae4
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00433600
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x18], 0
cmp eax, 8
jb 0x463b0d
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.00433600
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a578d
mov esp, ebp
pop ebp
ret
Function at 0x463b30
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d50a8
mov eax, dword fs:[0]
push eax
mov eax, dword [0x511070]
push ecx
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebp + 8], 0
je 0x463b79
push str.Acl_Exist__RunMaster_By_Reg
push 0x515488
call fcn.0048cf90
add esp, 8
push 1
push str.QQPCMgr
call fcn.0045f660
jmp 0x463bea
lea edx, [ecx + 0x58]
push str.QQPCTray.exe
lea ecx, [ebp + 8]
call fcn.0041c010
add esp, 4
mov dword [ebp - 4], 0
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x463bc8
push str.Run_QQPCMgr__and_wait_500_ms
push 0x515488
call fcn.0048cf90
mov ecx, dword [ebp + 8]
mov edx, str._showui__setup
push 0
push 1
push 0x1f4
call fcn.0045aa40
add esp, 0x14
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x463bea
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x463c00
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d84c8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x511070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push str.UpdateTrayIcon.exe
lea edx, [edi + 0x60]
lea ecx, [ebp - 0x30]
call fcn.0041c010
add esp, 4
mov dword [ebp - 4], 0
mov edx, dword [eax]
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
cmp word [edx], ax
jne 0x463c65
xor ecx, ecx
jmp 0x463c7f
mov ecx, edx
lea esi, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x463c70
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.00439160
mov byte [ebp - 4], 2
or esi, 0xffffffff
mov edx, dword [ebp - 0x30]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x463caa
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x463d76
push str._t_QQPCTray.exe__c_1__p_1
lea ecx, [ebp - 0x2c]
call fcn.0041c970
cmp dword [ebp + 8], 0
mov byte [ebp - 4], 3
je 0x463cfc
push str.CheckRtp
push 0x515488
call fcn.0048cf90
add esp, 8
lea ecx, [ebp - 0x2c]
push 0xc
push str.__CheckRtp_1
call fcn.0041c490
push 5
push str.__d__
lea ecx, [ebp - 0x2c]
call fcn.0041c490
mov eax, dword [edi + 0x58]
lea ecx, [ebp - 0x2c]
push dword [eax - 0xc]
push eax
call fcn.0041c490
push 1
push 0x4eecc0
lea ecx, [ebp - 0x2c]
call fcn.0041c490
push dword [ebp - 0x2c]
push str.UpdateTrayIcon.exe__ws
push 0x515488
call fcn.0048cf90
mov edx, dword [ebp - 0x2c]
lea ecx, [ebp - 0x28]
add esp, 0xc
cmp dword [ebp - 0x14], 8
cmovae ecx, dword [ebp - 0x28]
push 0
push 0
push 0
call fcn.0045aa40
mov byte [ebp - 4], 2
add esp, 0xc
mov edx, dword [ebp - 0x2c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x463d76
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x463d8b
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00433600
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a578d
mov esp, ebp
pop ebp
ret 8
Function at 0x463db0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d38e8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x511070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea edx, [ecx + 0x58]
mov esi, 0xa
push str.QQPCTray.exe
lea ecx, [ebp - 0x10]
call fcn.0041c010
add esp, 4
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
call fcn.0045ac30
test eax, eax
jne 0x463e5d
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
nop dword [eax]
test esi, esi
jle 0x463e5d
push 0x3e8
call edi
dec esi
test esi, esi
jg 0x463e51
push 0x4f6c9c
push 0x515488
call fcn.0048cf90
add esp, 8
push dword [ebp - 0x10]
call ebx
test eax, eax
je 0x463e51
mov ecx, dword [ebp - 0x10]
mov edx, str._regrun
push 0
push 0
push 0
call fcn.0045aa40
add esp, 0xc
mov ecx, dword [ebp - 0x10]
call fcn.0045ac30
test eax, eax
je 0x463e10
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x463e7f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x464660
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d85e0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x511070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
xor edi, edi
call fcn.0041bed0
mov ecx, eax
test ecx, ecx
jne 0x4646a1
push 0x80004005
call fcn.0041cdf0
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0
mov byte [ebp - 4], 1
mov eax, dword [ebx + 0x104]
sub eax, 1
je 0x464735
sub eax, 1
jne 0x46479d
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0x20019
push 0
push str.SoftwareSogouExplorer
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x46479d
lea eax, [ebp - 0x10]
push eax
push 0x4ed230
lea ecx, [ebp - 0x14]
call fcn.00440780
test eax, eax
je 0x46479a
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x10]
push eax
call fcn.0041c6d0
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x10]
mov dword [eax], 0x32c8
call fcn.00488ae0
push str.SogouExplorer.exe
jmp 0x464792
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push 0x20019
push 0
push str.SOFTWARETencentQQBrowser
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x46479d
lea eax, [ebp - 0x10]
push eax
push str.InstallDir
lea ecx, [ebp - 0x14]
call fcn.00440780
test eax, eax
je 0x46479a
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x10]
push eax
call fcn.0041c6d0
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x10]
mov dword [eax], 0x2af8
call fcn.00488ae0
push str.QQBrowser.exe
lea ecx, [ebp - 0x10]
call fcn.0041c190
mov esi, dword [ebp - 0x10]
cmp dword [esi - 0xc], 0
je 0x4647bc
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4647ba
test al, 0x10
jne 0x4647ba
mov edi, 1
jmp 0x4647bc
xor edi, edi
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x4647ca
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x14], 0
add esi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4647f0
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc