joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bcce9
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
push edi
xor edi, edi
push 0x9c
lea eax, [ebp - 0x9c]
push edi
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x9c]
mov dword [ebp - 0x9c], 0x9c
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
movzx eax, word [ebp - 8]
xor ecx, ecx
cmp dword [ebp - 0x98], 5
jne 0x4bcd8c
cmp dword [ebp - 0x94], edi
jne 0x4bcd5c
sub eax, edi
je 0x4bcd58
dec eax
je 0x4bcd54
dec eax
je 0x4bcd50
dec eax
je 0x4bcd4c
dec eax
jne 0x4bcdaa
push 0x13
jmp 0x4bcd97
push 0x12
jmp 0x4bcd97
push 0x11
jmp 0x4bcd97
push 0x10
jmp 0x4bcd97
push 0xf
jmp 0x4bcd97
cmp dword [ebp - 0x94], 1
jne 0x4bcd7b
sub eax, edi
je 0x4bcd77
dec eax
je 0x4bcd73
dec eax
jne 0x4bcdaa
push 0xe
jmp 0x4bcd97
push 0xd
jmp 0x4bcd97
push 0xc
jmp 0x4bcd97
cmp dword [ebp - 0x94], 2
jne 0x4bcd98
cmp eax, edi
jne 0x4bcd98
push 0x14
jmp 0x4bcd97
cmp dword [ebp - 0x98], 6
jne 0x4bcdaa
push 0x15
pop ecx
push edi
push edi
push 1
push ecx
push 4
call dword [sym.imp.QQHelperDll.dll_int___cdecl_AddReportData_unsigned_char__unsigned_short_int__unsigned_short_int__unsigned_short_int__unsigned_short_int_]
add esp, 0x14
jmp 0x4bcdac
xor eax, eax
pop edi
leave
ret
Function at 0x4bfd12
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x511ce8
call fcn.00484660
sub esp, 0x18
push esi
xor esi, esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], esi
call sub.MFC42.DLL_AfxGetAppModuleState
mov eax, dword [eax + 4]
lea edx, [ebp - 0x1c]
push edx
push 0x51ac28
mov eax, dword [eax + 0xd4]
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
test eax, eax
jne 0x4bfe65
push ebx
push edi
push str.SETUP_OPTION
lea ecx, [ebp - 0x14]
call sub.MFC42.DLL_CString::CString_3
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 1
push eax
call dword [sym.imp.BasicCtrlDll.dll_class_CString___cdecl_GetExeFolder_void_]
mov dword [esp], str.SetupInfo.ini
push eax
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 2
push eax
call sub.MFC42.DLL_operator_3
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 4
call sub.MFC42.DLL_CString::CString
push dword [ebp - 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ebx, str.SETUP_TYPE
push esi
push ebx
push dword [ebp - 0x14]
call edi
cmp eax, 1
mov dword [ebp - 0x24], eax
je 0x4bfdb1
cmp eax, 2
jne 0x4bfe4b
call sub.MFC42.DLL_AfxGetAppModuleState
mov eax, dword [eax + 4]
movzx esi, byte [eax + 0xce]
call sub.MFC42.DLL_AfxGetAppModuleState
imul esi, esi, 0x64
mov eax, dword [eax + 4]
push dword [ebp - 0x10]
movzx eax, byte [eax + 0xcf]
add esi, eax
push 0
mov dword [ebp - 0x20], esi
mov esi, str.SETUP_VERSION
push esi
push dword [ebp - 0x14]
call edi
test eax, eax
jle 0x4bfdff
push dword [ebp - 0x24]
mov ecx, dword [ebp - 0x1c]
push dword [ebp - 0x20]
mov edx, dword [ecx]
push eax
push 1
push 7
push ecx
call dword [edx + 0x1c]
push dword [ebp - 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push 0x56f7c0
push ebx
push dword [ebp - 0x14]
call edi
lea ecx, [ebp - 0x18]
call sub.MFC42.DLL_CString::CString_5
push dword [ebp - 0x20]
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 5
push 0x5712cc
push eax
call sub.MFC42.DLL_CString::Format
add esp, 0xc
push dword [ebp - 0x10]
push dword [ebp - 0x18]
push esi
push dword [ebp - 0x14]
call edi
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 4
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call sub.MFC42.DLL_CString::CString
and byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call sub.MFC42.DLL_CString::CString
pop edi
pop ebx
mov eax, dword [ebp - 0x1c]
or dword [ebp - 4], 0xffffffff
test eax, eax
pop esi
je 0x4bfe77
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret
Function at 0x4c0b43
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push esi
test edx, edx
je 0x4c0c66
mov esi, dword [ebp + 0x10]
test esi, esi
jle 0x4c0c66
mov eax, dword [ebp + 8]
push ebx
cmp esi, 8
push edi
not eax
mov ecx, 0xff
jl 0x4c0c43
mov edi, esi
shr edi, 3
mov ebx, edi
neg ebx
lea esi, [esi + ebx*8]
mov dword [ebp + 0x10], esi
movzx ebx, byte [edx]
mov esi, eax
and esi, ecx
xor esi, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [esi*4 + 0x52e5f0]
xor eax, ebx
inc edx
mov esi, eax
movzx ebx, byte [edx]
and esi, ecx
xor esi, ebx
movzx ebx, byte [edx + 1]
mov esi, dword [esi*4 + 0x52e5f0]
shr eax, 8
xor esi, eax
inc edx
mov eax, esi
and eax, ecx
xor eax, ebx
movzx ebx, byte [edx + 1]
mov eax, dword [eax*4 + 0x52e5f0]
shr esi, 8
xor eax, esi
inc edx
mov esi, eax
and esi, ecx
xor esi, ebx
movzx ebx, byte [edx + 1]
mov esi, dword [esi*4 + 0x52e5f0]
shr eax, 8
xor esi, eax
inc edx
mov eax, esi
and eax, ecx
xor eax, ebx
movzx ebx, byte [edx + 1]
mov eax, dword [eax*4 + 0x52e5f0]
shr esi, 8
xor eax, esi
inc edx
mov esi, eax
and esi, ecx
xor esi, ebx
movzx ebx, byte [edx + 1]
mov esi, dword [esi*4 + 0x52e5f0]
shr eax, 8
xor esi, eax
inc edx
mov eax, esi
and eax, ecx
xor eax, ebx
movzx ebx, byte [edx + 1]
mov eax, dword [eax*4 + 0x52e5f0]
shr esi, 8
xor eax, esi
inc edx
mov esi, eax
and esi, ecx
xor esi, ebx
shr eax, 8
mov esi, dword [esi*4 + 0x52e5f0]
xor eax, esi
inc edx
dec edi
jne 0x4c0b81
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x4c0c60
movzx ebx, byte [edx]
mov edi, eax
and edi, ecx
xor edi, ebx
shr eax, 8
mov edi, dword [edi*4 + 0x52e5f0]
xor eax, edi
inc edx
dec esi
jne 0x4c0c47
pop edi
pop ebx
not eax
jmp 0x4c0c69
mov eax, dword [ebp + 8]
pop esi
pop ebp
ret 0xc
Function at 0x4c68e4
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
xor edi, edi
mov esi, ecx
cmp dword [ebp + 8], edi
je 0x4c6928
cmp dword [esi + 0x4c], edi
je 0x4c68fb
xor eax, eax
jmp 0x4c6945
push dword [esi + 0x48]
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
cmp eax, edi
mov dword [esi + 0x4c], eax
je 0x4c68f7
push edi
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4c6942
push dword [esi + 0x4c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x4c], edi
jmp 0x4c68f7
mov eax, dword [esi + 0x4c]
cmp eax, edi
je 0x4c6942
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [esi + 0x4c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x4c], edi
push 1
pop eax
pop edi
pop esi
pop ebp
ret 4

Function at 0x4c6ad7
Capabilities:
Check if file exists
Get file attributes
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1060
call fcn.004846a0
push ebx
push esi
push edi
xor edi, edi
push 0x10
push edi
push dword [ebp + 0xc]
call sub.MSVCRT.dll_memset
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
add esp, 0xc
push dword [ebp + 8]
call esi
cmp eax, 0xffffffff
jne 0x4c6b19
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [ebp + 8]
call esi
cmp eax, 0xffffffff
je 0x4c6b35
push edi
push eax
push 3
push edi
push 1
push SysReAllocStringLen
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4c6b39
xor eax, eax
jmp 0x4c6ba6
lea eax, [ebp - 0x60]
push eax
call fcn.0044caac
pop ecx
lea eax, [ebp - 4]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
push eax
mov esi, 0x1000
lea eax, [ebp - 0x1060]
push esi
push eax
push ebx
call edi
test eax, eax
je 0x4c6b8e
push dword [ebp - 4]
lea eax, [ebp - 0x1060]
push eax
lea eax, [ebp - 0x60]
push eax
call fcn.0044caea
add esp, 0xc
cmp dword [ebp - 4], esi
jne 0x4c6b8e
lea eax, [ebp - 4]
push 0
push eax
lea eax, [ebp - 0x1060]
push esi
push eax
push ebx
jmp 0x4c6b5c
lea eax, [ebp - 0x60]
push eax
push dword [ebp + 0xc]
call fcn.0044d63e
pop ecx
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x4c72e5
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
xor edi, edi
mov esi, ecx
cmp dword [ebp + 8], edi
je 0x4c7329
cmp dword [esi + 0x3c], edi
je 0x4c72fc
xor eax, eax
jmp 0x4c7346
push dword [esi + 0x40]
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
cmp eax, edi
mov dword [esi + 0x3c], eax
je 0x4c72f8
push edi
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4c7343
push dword [esi + 0x3c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x3c], edi
jmp 0x4c72f8
mov eax, dword [esi + 0x3c]
cmp eax, edi
je 0x4c7343
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [esi + 0x3c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x3c], edi
push 1
pop eax
pop edi
pop esi
pop ebp
ret 4
Function at 0x4c734c
Capabilities:
Get file version info

Disassembly:
mov eax, 0x512a48
call fcn.00484660
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
xor esi, esi
lea ecx, [ebp + 8]
mov dword [ebp - 4], esi
push dword [eax - 8]
call sub.MFC42.DLL_CString::GetBuffer
push esi
push eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], esi
xor ebx, ebx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
cmp edi, esi
jbe 0x4c739f
push edi
call sub.MFC42.DLL_operatornew
mov ebx, eax
pop ecx
cmp ebx, esi
je 0x4c739f
push ebx
push edi
push esi
push dword [ebp - 0x14]
call sub.VERSION.dll_GetFileVersionInfoA
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp + 8]
push dword [eax - 8]
call sub.MFC42.DLL_CString::ReleaseBuffer
cmp dword [ebp - 0x10], esi
je 0x4c73f0
lea eax, [ebp - 0x18]
mov dword [ebp - 0x10], esi
push eax
lea eax, [ebp - 0x14]
push eax
push 0x570c4c
push ebx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x4c73f0
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x10], 1
mov ecx, dword [eax + 8]
shr ecx, 0x10
mov dword [edx], ecx
mov ecx, dword [ebp + 0x10]
movzx eax, word [eax + 8]
mov dword [ecx], eax
cmp ebx, esi
je 0x4c73fb
push ebx
call sub.MFC42.DLL_operatordelete
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc

Function at 0x4c741b
Capabilities:
Check if file exists
Get file attributes
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1060
call fcn.004846a0
push ebx
push esi
push edi
xor edi, edi
push 0x10
push edi
push dword [ebp + 0xc]
call sub.MSVCRT.dll_memset
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
add esp, 0xc
push dword [ebp + 8]
call esi
cmp eax, 0xffffffff
jne 0x4c7460
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [ebp + 8]
call esi
cmp eax, 0xffffffff
je 0x4c747c
push edi
push eax
push 3
push edi
push 1
push SysReAllocStringLen
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4c7480
xor eax, eax
jmp 0x4c74ed
lea eax, [ebp - 0x60]
push eax
call fcn.0044caac
pop ecx
lea eax, [ebp - 4]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
push eax
mov esi, 0x1000
lea eax, [ebp - 0x1060]
push esi
push eax
push ebx
call edi
test eax, eax
je 0x4c74d5
push dword [ebp - 4]
lea eax, [ebp - 0x1060]
push eax
lea eax, [ebp - 0x60]
push eax
call fcn.0044caea
add esp, 0xc
cmp dword [ebp - 4], esi
jne 0x4c74d5
lea eax, [ebp - 4]
push 0
push eax
lea eax, [ebp - 0x1060]
push esi
push eax
push ebx
jmp 0x4c74a3
lea eax, [ebp - 0x60]
push eax
push dword [ebp + 0xc]
call fcn.0044d63e
pop ecx
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4ca980
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x513204
call fcn.00484660
sub esp, 0x30
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [ebp - 0x20]
call sub.MFC42.DLL_CString::CString_5
push dword [esi + 0x60]
and dword [ebp - 4], 0
call dword [sym.imp.BasicCtrlDll.dll_unsigned_long_int___cdecl_GetCurrentUin_struct_IQQCore__]
pop ecx
mov edi, 0x57089c
push eax
lea eax, [ebp - 0x20]
push edi
push eax
call sub.MFC42.DLL_CString::Format
push 0x10
lea eax, [ebp - 0x3c]
push 0x30
push eax
call sub.MSVCRT.dll_memset
add esp, 0x18
lea ecx, [ebp - 0x1c]
call sub.MFC42.DLL_CString::CString_5
push dword [esi + 0x20]
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 1
push edi
push eax
call sub.MFC42.DLL_CString::Format
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ecx - 8]
push eax
push ecx
lea ecx, [ebp - 0x2c]
sub ecx, eax
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0x18
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString_5
mov eax, dword [ebp - 0x20]
mov byte [ebp - 4], 2
mov dword [ebp - 0x28], eax
mov ecx, dword [eax - 8]
lea edi, [ecx + 0x20]
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x14], edi
mov ebx, dword [eax - 8]
lea eax, [ebp - 0x14]
push eax
push edi
call sub.MFC42.DLL_CString::GetBuffer
push eax
lea eax, [ebp - 0x3c]
push eax
push ebx
push dword [ebp - 0x28]
call fcn.0044c556
add esp, 0x14
lea ecx, [ebp - 0x10]
push edi
call sub.MFC42.DLL_CString::ReleaseBuffer
push dword [ebp - 0x14]
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::GetBufferSetLength
push dword [ebp - 0x14]
lea eax, [ebp - 0x24]
push dword [ebp - 0x10]
push eax
call dword [sym.imp.BasicCtrlDll.dll_class_CString___cdecl_Base64Encode_char_const___int_]
add esp, 0xc
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 3
call sub.MFC42.DLL_CString::CString_5
mov byte [ebp - 4], 4
push dword [esi + 0x20]
lea eax, [ebp - 0x18]
push dword [ebp + 8]
push dword [ebp - 0x24]
push str._s__d__d_0_1
push eax
call sub.MFC42.DLL_CString::Format
add esp, 0x14
lea eax, [ebp - 0x2c]
mov ecx, esi
push eax
call fcn.004ca913
lea eax, [ebp + 8]
mov ecx, esi
push eax
mov byte [ebp - 4], 5
call fcn.004ca913
mov eax, dword [eax]
push 5
push 0
mov byte [ebp - 4], 6
push dword [ebp - 0x18]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [ebp + 8]
mov byte [ebp - 4], 5
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 4
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 3
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call sub.MFC42.DLL_CString::CString
and byte [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call sub.MFC42.DLL_CString::CString
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x4cc4d3
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
mov eax, 0x51359a
call fcn.00484660
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.004840d6
xor ebx, ebx
lea ecx, [esi + 0x20]
mov dword [ebp - 4], ebx
call fcn.004fbc24
lea ecx, [esi + 0x28]
mov byte [ebp - 4], 1
call fcn.004fbc24
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call fcn.004fbc24
lea ecx, [esi + 0x38]
mov byte [ebp - 4], 3
call fcn.004fbc24
lea ecx, [esi + 0x40]
mov byte [ebp - 4], 4
call fcn.004fbc24
lea ecx, [esi + 0x48]
mov byte [ebp - 4], 5
call fcn.004fbc24
lea ecx, [esi + 0x50]
mov byte [ebp - 4], 6
call fcn.004fbc24
lea ecx, [esi + 0x58]
mov byte [ebp - 4], 7
call fcn.004fbc24
lea ecx, [esi + 0x60]
mov byte [ebp - 4], 8
call fcn.004fbc24
lea ecx, [esi + 0x68]
mov byte [ebp - 4], 9
call fcn.004fbc24
lea ecx, [esi + 0x70]
mov byte [ebp - 4], 0xa
call fcn.004fbc24
mov edi, dword [sym.imp.QQBaseClassInDll.dll_public:_void___thiscall_CbmpImageList::constructor_void_]
lea ecx, [esi + 0x78]
mov byte [ebp - 4], 0xb
call edi
lea ecx, [esi + 0xac]
mov byte [ebp - 4], 0xc
call edi
lea ecx, [esi + 0xe0]
mov byte [ebp - 4], 0xd
call edi
lea ecx, [esi + 0x114]
mov byte [ebp - 4], 0xe
call edi
lea ecx, [esi + 0x148]
mov byte [ebp - 4], 0xf
call dword [sym.imp.QQBaseClassInDll.dll_public:_void___thiscall_CbmpImageListEx::constructor_void_]
lea ecx, [esi + 0x17c]
mov byte [ebp - 4], 0x10
call edi
lea ecx, [esi + 0x1b0]
mov byte [ebp - 4], 0x11
call fcn.004fbc24
mov ecx, dword [ebp - 0xc]
mov byte [ebp - 4], 0x12
or dword [ebp - 4], 0xffffffff
mov dword [esi + 0x1f8], 0x5310f0
mov dword [esi], 0x531090
mov dword [esi + 0x1f4], ebx
mov dword [esi + 0x1d0], ebx
mov dword [esi + 0x1bc], ebx
mov dword [esi + 0x1c4], ebx
mov dword [esi + 0x1c0], ebx
mov dword [esi + 0x1c8], ebx
mov dword [esi + 0x1cc], ebx
mov dword [esi + 0x1e4], 1
mov dword [esi + 0x1e8], ebx
mov dword [esi + 0x1d4], ebx
mov dword [esi + 0x1d8], ebx
mov dword [esi + 0x1dc], ebx
mov dword [esi + 0x1e0], ebx
mov dword [esi + 0x1ec], ebx
mov dword [esi + 0x1f0], ebx
mov dword [esi + 0x1b8], ebx
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x4cc66e
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
mov eax, 0x51368a
call fcn.00484660
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
mov dword [esi], 0x531090
lea ebx, [esi + 0x20]
mov dword [ebp - 4], 0x12
mov ecx, ebx
call sub.MFC42.DLL_CImageList::DeleteImageList
lea ecx, [esi + 0x30]
call sub.MFC42.DLL_CImageList::DeleteImageList
lea ecx, [esi + 0x38]
call sub.MFC42.DLL_CImageList::DeleteImageList
lea ecx, [esi + 0x40]
call sub.MFC42.DLL_CImageList::DeleteImageList
lea ecx, [esi + 0x48]
call sub.MFC42.DLL_CImageList::DeleteImageList
mov edi, dword [sym.imp.QQBaseClassInDll.dll_public:_void___thiscall_CbmpImageList::DeleteAllBitmaps_void_]
lea ecx, [esi + 0x78]
call edi
lea ecx, [esi + 0xac]
call edi
lea ecx, [esi + 0xe0]
call edi
lea ecx, [esi + 0x114]
call edi
lea ecx, [esi + 0x68]
call sub.MFC42.DLL_CImageList::DeleteImageList
lea ecx, [esi + 0x70]
call sub.MFC42.DLL_CImageList::DeleteImageList
lea edi, [esi + 0x1b0]
mov ecx, edi
call sub.MFC42.DLL_CImageList::DeleteImageList
mov ecx, edi
mov byte [ebp - 4], 0x11
call sub.MFC42.DLL_CImageList::CImageList
mov edi, dword [sym.imp.QQBaseClassInDll.dll_public:_void___thiscall_CbmpImageList::destructor_void_]
lea ecx, [esi + 0x17c]
mov byte [ebp - 4], 0x10
call edi
lea ecx, [esi + 0x148]
mov byte [ebp - 4], 0xf
call dword [sym.imp.QQBaseClassInDll.dll_public_virtual:_void___thiscall_CbmpImageListEx::destructor_void_]
lea ecx, [esi + 0x114]
mov byte [ebp - 4], 0xe
call edi
lea ecx, [esi + 0xe0]
mov byte [ebp - 4], 0xd
call edi
lea ecx, [esi + 0xac]
mov byte [ebp - 4], 0xc
call edi
lea ecx, [esi + 0x78]
mov byte [ebp - 4], 0xb
call edi
lea ecx, [esi + 0x70]
mov byte [ebp - 4], 0xa
call sub.MFC42.DLL_CImageList::CImageList
lea ecx, [esi + 0x68]
mov byte [ebp - 4], 9
call sub.MFC42.DLL_CImageList::CImageList
lea ecx, [esi + 0x60]
mov byte [ebp - 4], 8
call sub.MFC42.DLL_CImageList::CImageList
lea ecx, [esi + 0x58]
mov byte [ebp - 4], 7
call sub.MFC42.DLL_CImageList::CImageList
lea ecx, [esi + 0x50]
mov byte [ebp - 4], 6
call sub.MFC42.DLL_CImageList::CImageList
lea ecx, [esi + 0x48]
mov byte [ebp - 4], 5
call sub.MFC42.DLL_CImageList::CImageList
lea ecx, [esi + 0x40]
mov byte [ebp - 4], 4
call sub.MFC42.DLL_CImageList::CImageList
lea ecx, [esi + 0x38]
mov byte [ebp - 4], 3
call sub.MFC42.DLL_CImageList::CImageList
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call sub.MFC42.DLL_CImageList::CImageList
lea ecx, [esi + 0x28]
mov byte [ebp - 4], 1
call sub.MFC42.DLL_CImageList::CImageList
and byte [ebp - 4], 0
mov ecx, ebx
call sub.MFC42.DLL_CImageList::CImageList
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call sub.MFC42.DLL_CCmdTarget::CCmdTarget
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x4ce8ff
Capabilities:
Resume thread

Disassembly:
mov eax, 0x513a93
call fcn.00484660
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
lea edi, [esi + 0x20]
mov dword [esi], 0x5311c0
mov dword [edi], 0x53124c
xor ebx, ebx
mov dword [ebp - 4], 4
cmp dword [esi + 0x24], ebx
je 0x4ce938
push dword [esi + 0x24]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, edi
call dword [sym.imp.QQBaseClassInDll.dll_public:_void___thiscall_CThreadModel::StopThread_void_]
mov eax, dword [esi + 0x120]
cmp eax, ebx
je 0x4ce988
xor edi, edi
cmp dword [eax], ebx
jle 0x4ce967
mov eax, dword [eax + 4]
push dword [eax + edi*4]
call dword [sym.imp.USER32.dll_DestroyIcon]
mov eax, dword [esi + 0x120]
inc edi
cmp edi, dword [eax]
jl 0x4ce950
mov eax, dword [esi + 0x120]
push dword [eax + 4]
call sub.MFC42.DLL_operatordelete
push dword [esi + 0x120]
call sub.MFC42.DLL_operatordelete
pop ecx
mov dword [esi + 0x120], ebx
pop ecx
push esi
call fcn.004ced25
push dword [esi + 0xc8]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4ce9ad
mov eax, dword [esi + 0xa8]
lea ecx, [esi + 0xa8]
call dword [eax + 0x60]
mov eax, dword [esi + 0xf8]
cmp eax, ebx
je 0x4ce9be
push eax
call dword [sym.imp.USER32.dll_DestroyIcon]
cmp dword [esi + 0x118], ebx
je 0x4ce9f5
cmp dword [esi + 0x114], 0
lea edi, [esi + 0x114]
jle 0x4ce9e9
mov eax, dword [esi + 0x118]
push dword [eax + ebx*4]
call dword [sym.imp.USER32.dll_DestroyIcon]
inc ebx
cmp ebx, dword [edi]
jl 0x4ce9d5
push dword [esi + 0x118]
call sub.MFC42.DLL_operatordelete
pop ecx
mov ebx, dword [esi + 0x104]
xor edi, edi
test ebx, ebx
jle 0x4cea27
mov eax, dword [esi + 0x100]
mov eax, dword [eax + edi*4]
mov eax, dword [eax + 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esi + 0x100]
push dword [eax + edi*4]
call sub.MFC42.DLL_operatordelete
inc edi
pop ecx
cmp edi, ebx
jl 0x4cea01
lea ebx, [esi + 0xfc]
push 0xffffffffffffffff
push 0
mov ecx, ebx
call fcn.0047f0d9
lea edi, [esi + 0x138]
push 0
mov ecx, edi
call fcn.004cf7f7
mov edi, dword [edi]
mov byte [ebp - 4], 3
test edi, edi
je 0x4cea57
mov eax, dword [edi]
push edi
call dword [eax + 8]
mov ecx, ebx
mov byte [ebp - 4], 2
call fcn.004cf85e
lea ecx, [esi + 0xa8]
mov byte [ebp - 4], 1
call fcn.004e2124
and byte [ebp - 4], 0
mov ecx, esi
neg ecx
sbb ecx, ecx
lea eax, [esi + 0x20]
and ecx, eax
call dword [sym.imp.QQBaseClassInDll.dll_protected_virtual:_void___thiscall_CThreadModel::destructor_void_]
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call sub.MFC42.DLL_CCmdTarget::CCmdTarget
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x4cfaef
Capabilities:
Get common file path

Disassembly:
mov eax, 0x513d00
call fcn.00484660
sub esp, 0x20c
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.004840d6
lea edi, [esi + 0x20]
xor ebx, ebx
mov ecx, edi
mov dword [ebp - 4], ebx
call dword [sym.imp.QQBaseClassInDll.dll_protected:_void___thiscall_CHttpDownloadUIInterface::constructor_void_]
lea eax, [esi + 0x24]
push 0x10
push 0x23
push eax
mov byte [ebp - 4], 1
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [esi + 0x34], 0x24
mov byte [ebp - 4], 2
mov dword [esi + 0x38], 0x532838
lea ecx, [esi + 0x40]
mov dword [esi + 0x3c], 0x532824
call fcn.004d23d0
lea ecx, [esi + 0x54]
mov byte [ebp - 4], 3
call fcn.004d23d0
lea ecx, [esi + 0x80]
mov byte [ebp - 4], 4
call dword [sym.imp.QQBaseClassInDll.dll_public:_void___thiscall_CHttpDownload::constructor_void_]
mov eax, esi
mov byte [ebp - 4], 5
neg eax
sbb eax, eax
mov dword [edi], 0x532800
and eax, edi
lea edi, [esi + 0x80]
push eax
mov ecx, edi
mov dword [esi], 0x5327a0
mov dword [esi + 0x68], ebx
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x78], ebx
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x70], ebx
mov dword [esi + 0x74], ebx
call dword [sym.imp.QQBaseClassInDll.dll_public:_void___thiscall_CHttpDownload::SetUIInterface_class_CHttpDownloadUIInterface__]
lea eax, [ebp - 0x114]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x218]
push eax
push ebx
lea eax, [ebp - 0x114]
push str.tempswf
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
lea eax, [ebp - 0x114]
mov ecx, edi
push eax
call dword [sym.imp.QQBaseClassInDll.dll_public:_void___thiscall_CHttpDownload::SetDownloadTempDir_char_const__]
mov ecx, dword [ebp - 0xc]
or dword [ebp - 4], 0xffffffff
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret