joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43be22
Capabilities:
Encode data using xor

Disassembly:
push 8
mov eax, 0x66bcab
call fcn.006233a5
mov ebx, edx
mov edi, ecx
mov dword [ebp - 0x10], edi
xor esi, esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x14], esi
mov dword [edi], esi
mov ecx, dword [ebx]
sub ecx, 0x10
call fcn.00430beb
add eax, 0x10
mov dword [edi], eax
mov dword [ebp - 4], esi
xor ecx, ecx
mov eax, dword [ebx]
push 2
pop edx
mov dword [ebp - 0x14], 1
mov eax, dword [eax - 0xc]
inc eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00622271
mov edi, eax
pop ecx
test edi, edi
je 0x43bec3
mov ecx, dword [ebx]
mov ecx, dword [ecx - 0xc]
lea ecx, [ecx*2 + 2]
push ecx
push esi
push edi
call fcn.0063af90
mov eax, dword [ebx]
add esp, 0xc
cmp dword [eax - 0xc], esi
jle 0x43beaf
push esi
mov ecx, ebx
call fcn.00430a35
xor ax, 0x5a
mov word [edi + esi*2], ax
inc esi
mov eax, dword [ebx]
cmp esi, dword [eax - 0xc]
jl 0x43be97
mov esi, dword [ebp - 0x10]
mov ecx, esi
push edi
call fcn.00430d6d
push edi
call fcn.00622263
pop ecx
jmp 0x43bec6
mov esi, dword [ebp - 0x10]
mov eax, esi
call fcn.0062336e
ret

Function at 0x43bf13
Capabilities:
Query environment variable

Disassembly:
push 0x22c
mov eax, 0x66bcd1
call fcn.006233d9
mov esi, ecx
mov dword [ebp - 0x234], esi
xor ebx, ebx
lea eax, [ebp - 0x218]
push 0x208
push ebx
push eax
mov dword [ebp - 0x238], ebx
call fcn.0063af90
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push str.appdata
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
xor eax, eax
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], ebx
mov word [ebp - 0x230], ax
cmp word [ebp - 0x218], ax
je 0x43bf8d
lea eax, [ebp - 0x218]
push eax
call fcn.0063fd28
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.004284b9
mov edi, str.TencentMobileGamePCAppMarket3
mov dword [ebp - 4], ebx
push edi
call fcn.0063fd28
pop ecx
push eax
push edi
lea ecx, [ebp - 0x230]
call fcn.00425448
lea edx, [ebp - 0x230]
mov ecx, esi
call fcn.0043baba
push ebx
push 1
lea ecx, [ebp - 0x230]
call fcn.00428e8b
mov eax, esi
call fcn.00623383
ret
Function at 0x444b69
Capabilities:
Write file on windows

Disassembly:
push 0x34
mov eax, 0x66cb5f
call fcn.006233d9
mov esi, ecx
mov dword [ebp - 0x38], esi
mov ecx, dword [ebp + 8]
or ebx, 0xffffffff
cmp ecx, ebx
sete al
test al, al
je 0x444b95
xor eax, eax
cmp ecx, ebx
cmovne eax, ecx
jmp 0x444cf6
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x444bc3
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x444bc3
mov eax, dword [ebp + 8]
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], al
jmp 0x444cf6
cmp dword [esi + 0x4c], 0
je 0x444cf4
mov ecx, esi
call fcn.00444e9b
xor ecx, ecx
cmp dword [esi + 0x38], ecx
jne 0x444bf3
push dword [esi + 0x4c]
mov esi, dword [ebp + 8]
push esi
call fcn.00445dcf
test al, al
pop ecx
pop ecx
cmovne ebx, esi
jmp 0x444cf4
mov eax, dword [ebp + 8]
push ecx
mov dword [ebp - 0x1c], ecx
mov byte [ebp - 0x2c], cl
lea ecx, [ebp - 0x2c]
push 8
mov byte [ebp - 0x14], al
mov dword [ebp - 0x18], 0xf
call fcn.00421ae9
and dword [ebp - 4], 0
lea eax, [esi + 0x40]
mov dword [ebp - 0x3c], eax
mov edi, dword [ebp - 0x18]
mov esi, dword [esi + 0x38]
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x2c]
cmp edi, 0x10
lea edx, [ebp - 0x2c]
mov edi, dword [esi]
cmovae ecx, dword [ebp - 0x2c]
cmovae edx, dword [ebp - 0x2c]
add eax, ecx
push eax
push edx
lea eax, [ebp - 0x34]
mov ecx, esi
push eax
lea eax, [ebp - 0x13]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x3c]
call dword [edi + 0x1c]
test eax, eax
js 0x444ce8
cmp eax, 1
jg 0x444ccd
mov edi, dword [ebp - 0x18]
lea eax, [ebp - 0x2c]
mov ecx, dword [ebp - 0x2c]
cmp edi, 0x10
mov edx, dword [ebp - 0x30]
mov esi, dword [ebp - 0x38]
cmovae eax, ecx
sub edx, eax
mov dword [ebp - 0x40], edx
je 0x444c9e
push dword [esi + 0x4c]
cmp edi, 0x10
lea eax, [ebp - 0x2c]
push edx
cmovae eax, ecx
push 1
push eax
call fcn.0064dad4
mov edx, dword [ebp - 0x40]
add esp, 0x10
cmp edx, eax
jne 0x444ce8
mov edi, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x34], eax
jne 0x444cc8
test edx, edx
jne 0x444c1e
cmp dword [ebp - 0x1c], 0x20
jae 0x444ce8
push edx
push 8
lea ecx, [ebp - 0x2c]
call fcn.00421883
jmp 0x444c1b
mov ebx, dword [ebp + 8]
jmp 0x444ce8
cmp eax, 3
jne 0x444ce8
mov eax, dword [ebp - 0x38]
push dword [eax + 0x4c]
push dword [ebp - 0x14]
call fcn.00445dcf
test al, al
pop ecx
cmovne ebx, dword [ebp + 8]
pop ecx
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00429616
mov eax, ebx
call fcn.00623383
ret 4
Function at 0x444ee9
Capabilities:
Write file on windows

Disassembly:
push 0x24
mov eax, 0x66cb8c
call fcn.006233d9
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x444fe9
cmp byte [ebx + 0x3d], 0
je 0x444fe9
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
sete al
test al, al
je 0x444f23
xor al, al
jmp 0x444feb
xor eax, eax
mov dword [ebp - 0x18], 0xf
push eax
push 8
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x2c], al
call fcn.00421ae9
and dword [ebp - 4], 0
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x18]
cmp ecx, 0x10
lea eax, [ebp - 0x30]
mov ecx, dword [ebx + 0x38]
lea edi, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x1c]
lea esi, [ebp - 0x2c]
cmovae edi, edx
cmovae esi, edx
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x444f81
sub eax, 1
je 0x444f85
dec eax
sub eax, 1
je 0x444fd7
xor bl, bl
jmp 0x444fd9
mov byte [ebx + 0x3d], 0
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x2c]
mov edx, dword [ebp - 0x2c]
cmp ecx, 0x10
mov esi, dword [ebp - 0x30]
cmovae eax, edx
sub esi, eax
je 0x444fbd
push dword [ebx + 0x4c]
cmp ecx, 0x10
lea eax, [ebp - 0x2c]
push esi
cmovae eax, edx
push 1
push eax
call fcn.0064dad4
add esp, 0x10
cmp esi, eax
jne 0x444f7d
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x2c]
cmp byte [ebx + 0x3d], 0
je 0x444fd7
test esi, esi
jne 0x444f47
push esi
push 8
lea ecx, [ebp - 0x2c]
call fcn.00421883
jmp 0x444f41
mov bl, 1
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00429616
mov al, bl
jmp 0x444feb
mov al, 1
call fcn.00623383
ret

Function at 0x445ef4
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x224
mov eax, dword [0x706034]
xor eax, esp
mov dword [esp + 0x220], eax
push ebx
push esi
push edi
xor eax, eax
lea edi, [esp + 0x10]
stosd dword es:[edi], eax
mov ebx, ecx
mov ecx, dword [ebp + 8]
mov dword [esp + 0xc], ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebx + 4]
xor edi, edi
or eax, 0x2001f
mov dword [esp + 0x10], edi
push eax
push ecx
push dword [ebx]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], edi
call fcn.004247d0
mov esi, eax
test esi, esi
jne 0x445fb4
lea eax, [esp + 0x20]
push eax
push edi
push edi
push edi
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x3c]
push eax
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x445f8c
lea eax, [esp + 0x28]
push eax
call fcn.00445ef4
mov esi, eax
test esi, esi
jne 0x445fb4
lea eax, [esp + 0x20]
xor ecx, ecx
push eax
push ecx
push ecx
push ecx
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x3c]
push eax
push ecx
push dword [esp + 0x2c]
mov dword [esp + 0x3c], 0x100
call edi
lea ecx, [esp + 0x10]
test eax, eax
je 0x445f67
call fcn.00424849
push dword [esp + 0xc]
mov ecx, ebx
call fcn.00445e7b
mov esi, eax
lea ecx, [esp + 0x10]
call fcn.00424849
mov ecx, dword [esp + 0x22c]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.006221ee
mov esp, ebp
pop ebp
ret 4
Function at 0x446080
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x706034]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
xor ecx, ecx
cmp dword [esi + 0x80], ecx
je 0x4460f2
cmp dword [esi + 0x84], ecx
jbe 0x4460f2
cmp dword [eax + 0x14], 8
mov dword [ebp - 8], ecx
jb 0x4460b2
mov eax, dword [eax]
push 0x6d2094
push eax
lea eax, [ebp - 8]
push eax
call fcn.0064dcc5
add esp, 0xc
test eax, eax
jne 0x4460f2
cmp dword [ebp - 8], eax
je 0x4460f2
push dword [ebp - 8]
push 1
push dword [esi + 0x84]
push dword [esi + 0x80]
call fcn.0064dad4
push dword [ebp - 8]
call fcn.0064d81c
add esp, 0x14
mov al, 1
jmp 0x4460f4
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.006221ee
mov esp, ebp
pop ebp
ret 4

Function at 0x4462d8
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6694e0
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x706034]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor edi, edi
lea ecx, [esi + 0x18]
mov ebx, 0x6cfeaf
mov dword [esi], edi
push ebx
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
call fcn.0042928c
push ebx
lea ecx, [esi + 0x30]
call fcn.0042928c
push ebx
lea ecx, [esi + 0x98]
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x68], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x74], edi
mov dword [esi + 0x78], edi
mov dword [esi + 0x7c], edi
mov dword [esi + 0x80], edi
mov dword [esi + 0x84], edi
mov dword [esi + 0x88], edi
mov dword [esi + 0x8c], edi
mov dword [esi + 0x90], edi
mov dword [esi + 0x94], edi
call fcn.0042928c
push ebx
lea ecx, [esi + 0xb0]
call fcn.0042928c
push ebx
lea ecx, [esi + 0xc8]
call fcn.0042928c
push ebx
lea ecx, [esi + 0xe0]
call fcn.0042928c
push ebx
lea ecx, [esi + 0xf8]
call fcn.0042928c
push ebx
lea ecx, [esi + 0x110]
call fcn.0042928c
push ebx
lea ecx, [esi + 0x128]
call fcn.0042928c
push ebx
lea ecx, [esi + 0x140]
call fcn.0042928c
push ebx
lea ecx, [esi + 0x158]
call fcn.0042928c
push ebx
lea ecx, [esi + 0x170]
call fcn.0042928c
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4493be
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x14
mov eax, 0x66d273
call fcn.006233d9
mov dword [ebp - 0x1c], edx
push ecx
xor edi, edi
lea ecx, [ebp - 0x14]
and dword [ebp - 0x14], edi
call fcn.00437719
and dword [ebp - 4], edi
mov eax, dword [ebp - 0x14]
cmp dword [eax - 0xc], edi
jbe 0x44944f
push 0x6d0d48
lea ecx, [ebp - 0x20]
call fcn.00437719
mov esi, eax
push ecx
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x14]
call fcn.004494b9
cmp dword [esi], edi
jne 0x449414
push 0x80004005
call fcn.004297a0
push dword [esi]
push dword [eax]
call fcn.0063feb8
pop ecx
pop ecx
mov ecx, dword [ebp - 0x18]
test eax, eax
setne bl
lea ecx, [ecx - 0x10]
call fcn.004246cb
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x20]
lea ecx, [ecx - 0x10]
call fcn.004246cb
test bl, bl
je 0x44944f
push 0x6d0d48
lea ecx, [ebp - 0x14]
call fcn.0043750e
cmp dword [ebp + 8], 0
mov eax, dword [ebp - 0x1c]
mov esi, dword [eax]
mov esi, dword [esi]
jbe 0x44949e
cmp esi, dword [eax]
je 0x44949e
and dword [ebp - 0x18], 0
lea edx, [ebp - 0x14]
push dword [esi + 8]
lea ecx, [ebp - 0x18]
call fcn.004373be
pop ecx
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
cmp eax, 0xffffffff
je 0x449499
mov esi, dword [esi]
inc edi
call fcn.004246cb
mov eax, dword [ebp - 0x1c]
cmp edi, dword [ebp + 8]
jb 0x44945c
jmp 0x44949e
call fcn.004246cb
mov ecx, dword [ebp - 0x14]
xor ebx, ebx
cmp edi, dword [ebp + 8]
sete bl
add ecx, 0xfffffff0
call fcn.004246cb
mov eax, ebx
call fcn.00623383
ret
Function at 0x44a2b4
Capabilities:
Set registry value

Disassembly:
push 0x4c
mov eax, 0x66d4c3
call fcn.006233d9
mov ebx, ecx
xor eax, eax
lea edi, [ebp - 0x20]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
push 0x2001f
push str.SoftwareTencentMobileGamePC
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x20]
push closesocket
mov dword [ebp - 0x28], eax
call fcn.004247d0
mov edi, str.GlobalConfig::MarkSupplyid
mov esi, str.SupplyId
test eax, eax
jne 0x44a34e
lea eax, [ebp - 0x28]
push eax
push esi
lea ecx, [ebp - 0x20]
call fcn.004243d2
test eax, eax
jne 0x44a34e
push 0xc8
push edi
push str.GlobalConfig.cpp
push str.GConfig
push 1
lea ecx, [ebp - 0x58]
call fcn.00424945
mov esi, eax
push str.read_supplyid__
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.00424868
push dword [ebp - 0x28]
mov ecx, esi
call fcn.00445fd7
push str.__from_register
jmp 0x44a3c2
push 0
sub esp, 0x10
lea ecx, [ebp - 0x20]
push str.SoftwareTencentMobileGamePC
push closesocket
call fcn.004492d2
test eax, eax
jne 0x44a3d5
mov eax, dword [ebx + 0xc]
push 4
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push 4
push 0
push esi
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x44a3d5
push 0xd8
push edi
push str.GlobalConfig.cpp
push str.GConfig
push 1
lea ecx, [ebp - 0x58]
call fcn.00424945
mov esi, eax
push str.write_supplyid
mov ecx, esi
mov byte [ebp - 4], 2
call fcn.00424868
push dword [ebx + 0xc]
mov ecx, esi
call fcn.00445fd7
push str._to_register
mov ecx, esi
call fcn.00424868
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0
call fcn.00667b03
push 0xdc
push edi
push str.GlobalConfig.cpp
push str.GConfig
push 1
lea ecx, [ebp - 0x58]
call fcn.00424945
mov esi, eax
push str.runtime_supplyid__
mov ecx, esi
mov byte [ebp - 4], 3
call fcn.00424868
push dword [ebx + 0xc]
mov ecx, esi
call fcn.00445fd7
push 0x6d1bcc
mov ecx, esi
call fcn.00424868
lea ecx, [ebp - 0x58]
call fcn.00667b03
lea ecx, [ebp - 0x20]
call fcn.00424849
call fcn.00623383
ret
Function at 0x44ad55
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x23c
mov eax, 0x66d670
call fcn.006233d9
xor eax, eax
lea edi, [ebp - 0x224]
stosd dword es:[edi], eax
xor ebx, ebx
mov esi, ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x220], ebx
mov dword [ebp - 0x21c], ebx
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 4], ebx
push ebx
push eax
call fcn.0063af90
add esp, 0xc
mov dword [ebp - 0x228], 0x104
lea ecx, [ebp - 0x224]
push 0x2001f
push str.SoftwareTencentMobileGamePC
push closesocket
call fcn.004247d0
test eax, eax
jne 0x44ae85
lea eax, [ebp - 0x230]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x218]
push eax
push esi
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x44ae85
mov dword [ebp - 0x234], 7
mov dword [ebp - 0x238], ebx
mov word [ebp - 0x248], ax
cmp word [ebp - 0x218], ax
jne 0x44ae1a
mov eax, ebx
jmp 0x44ae27
lea eax, [ebp - 0x218]
push eax
call fcn.0063fd28
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x248]
call fcn.004284b9
lea eax, [ebp - 0x248]
mov byte [ebp - 4], 1
push eax
call fcn.0044aea1
push 0
push 1
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], 0
mov bl, al
call fcn.00428e8b
test bl, bl
jne 0x44ae6b
inc esi
xor ebx, ebx
jmp 0x44adc9
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push 3
push ecx
call fcn.004480f8
pop ecx
mov ecx, eax
call fcn.00448166
lea ecx, [ebp - 0x224]
call fcn.00424849
lea ecx, [ebp - 0x224]
call fcn.00424849
call fcn.00623383
ret
Function at 0x44aea1
Capabilities:
Check if file exists

Disassembly:
push 0x270
mov eax, 0x66d6b9
call fcn.006233d9
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x224]
push 0x20a
xor ebx, ebx
push ebx
push eax
call fcn.0063af90
xor eax, eax
lea edi, [ebp - 0x230]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x230], ebx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x228], ebx
mov dword [ebp - 4], ebx
xor eax, eax
and dword [ebp - 0x254], ebx
mov edi, str.SoftwareTencentMobileGamePC
push edi
mov dword [ebp - 0x24c], 0x105
mov dword [ebp - 0x250], 7
mov word [ebp - 0x264], ax
call fcn.0063fd28
add esp, 0x10
lea ecx, [ebp - 0x264]
push eax
push edi
call fcn.004284b9
push 0x6d0d48
lea edx, [ebp - 0x264]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x27c]
call fcn.00438ae4
push esi
mov edx, eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x248]
call fcn.0044916c
pop ecx
pop ecx
xor esi, esi
lea ecx, [ebp - 0x27c]
push esi
push 1
call fcn.00428e8b
push esi
push 1
lea ecx, [ebp - 0x264]
call fcn.00428e8b
cmp dword [ebp - 0x234], 8
lea eax, [ebp - 0x248]
push 0x2001f
cmovae eax, dword [ebp - 0x248]
lea ecx, [ebp - 0x230]
push eax
push closesocket
call fcn.004247d0
test eax, eax
jne 0x44afc8
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x224]
push eax
push str.InstallPath
lea ecx, [ebp - 0x230]
call fcn.004246e3
lea ecx, [ebp - 0x230]
call fcn.00424849
lea eax, [ebp - 0x224]
push eax
call fcn.0063fd28
pop ecx
test eax, eax
je 0x44affd
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x44affb
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x44affd
mov bl, 1
push esi
push 1
lea ecx, [ebp - 0x248]
call fcn.00428e8b
lea ecx, [ebp - 0x230]
call fcn.00424849
mov al, bl
call fcn.00623383
ret 4
Function at 0x44d47b
Capabilities:
Create process on windows

Disassembly:
push 0x31c
mov eax, 0x66da52
call fcn.006233d9
push 0x208
xor ebx, ebx
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.0063af90
xor eax, eax
mov dword [ebp - 0x268], 0x104
lea edi, [ebp - 0x228]
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x220], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x21c], ebx
call fcn.00424609
push eax
lea ecx, [ebp - 0x21c]
call fcn.0041b7d4
push 0x20119
push str.SOFTWARETencentAndrows
push closesocket
lea ecx, [ebp - 0x228]
mov byte [ebp - 4], 1
call fcn.004247d0
test eax, eax
jne 0x44d591
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x218]
push eax
push str.InstallPath
lea ecx, [ebp - 0x228]
call fcn.004246e3
test eax, eax
jne 0x44d591
lea eax, [ebp - 0x218]
push eax
call fcn.0063fd28
pop ecx
test eax, eax
je 0x44d591
lea eax, [ebp - 0x2f4]
mov dword [ebp - 0x2f8], eax
lea ecx, [ebp - 0x2f8]
push 0xfde9
lea eax, [ebp - 0x218]
push eax
call fcn.0041b7fd
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x21c]
push dword [ebp - 0x2f8]
call fcn.0041b489
lea eax, [ebp - 0x2f4]
mov byte [ebp - 4], 1
cmp dword [ebp - 0x2f8], eax
je 0x44d591
push dword [ebp - 0x2f8]
call fcn.0063fef8
pop ecx
lea ecx, [ebp - 0x228]
call fcn.00424849
mov esi, str.ApplicationAndrowsLauncher.exe
push esi
call fcn.0063e770
pop ecx
mov ecx, dword [ebp - 0x21c]
mov edi, esi
sub edi, ecx
mov ebx, dword [ecx - 0xc]
mov ecx, eax
not ecx
shr ecx, 0x1f
test ecx, ecx
jne 0x44d5ca
push 0x80070057
call fcn.004297a0
push eax
push esi
call fcn.0064844b
pop ecx
pop ecx
mov ecx, closesocket
mov dword [ebp - 0x268], eax
sub ecx, eax
cmp ecx, ebx
jl 0x44d5c0
add eax, ebx
lea ecx, [ebp - 0x21c]
push eax
mov dword [ebp - 0x26c], eax
call fcn.0041bedb
cmp edi, ebx
ja 0x44d5ff
lea esi, [eax + edi]
mov edx, dword [ebp - 0x268]
lea ecx, [eax + ebx]
push edx
push esi
call fcn.00426582
pop ecx
pop ecx
push dword [ebp - 0x26c]
lea ecx, [ebp - 0x21c]
call fcn.0041bf57
push 0x38
xor edi, edi
lea eax, [ebp - 0x260]
push edi
push eax
call fcn.0063af90
mov esi, dword [ebp - 0x21c]
lea eax, [ebp - 0x264]
add esp, 0xc
mov dword [ebp - 0x264], 0x3c
mov dword [ebp - 0x25c], edi
mov dword [ebp - 0x258], 0x6d2bb4
mov dword [ebp - 0x254], esi
push eax
mov dword [ebp - 0x250], str.__launch_proc_name__AndrowsStore.exe____silent
mov dword [ebp - 0x248], edi
mov dword [ebp - 0x260], 0x400
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x44d6ca
push 0x78
push str._anonymous_namespace::LaunchPcyybSilent
push str.MainWnd.cpp
push str.InstYYB
push 3
lea ecx, [ebp - 0x328]
call fcn.00424945
mov edi, eax
push str.ShellExecuteExA_failed__filepath:
mov ecx, edi
mov byte [ebp - 4], 3
call fcn.00424868
push esi
mov ecx, edi
call fcn.00424868
lea ecx, [ebp - 0x328]
call fcn.00667b03
lea ecx, [esi - 0x10]
call fcn.004246cb
lea ecx, [ebp - 0x228]
call fcn.00424849
call fcn.00623383
ret
Function at 0x44dfa6
Capabilities:
Accept command line arguments

Disassembly:
push 0x4c
mov eax, 0x66dbe5
call fcn.00623447
mov esi, ecx
mov dword [ebp - 0x1c], esi
xor edi, edi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], edi
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], edi
jb 0x44dfd3
mov eax, dword [esi]
jmp 0x44dfd5
mov eax, esi
xor ecx, ecx
mov word [eax], cx
xor eax, eax
inc eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [ebp - 0x1c]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ebx, eax
test ebx, ebx
je 0x44e02e
cmp edi, dword [ebp - 0x1c]
jge 0x44e025
push str._installfrom
push dword [ebx + edi*4]
call fcn.0063feb8
pop ecx
pop ecx
test eax, eax
jne 0x44e065
lea eax, [edi + 1]
cmp eax, dword [ebp - 0x1c]
jge 0x44e065
push dword [ebx + edi*4 + 4]
mov ecx, esi
call fcn.00428532
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor edi, edi
push 0x107
push str._anonymous_namespace::GetInstallFromInfo
push str.MainWnd.cpp
push str.GetInstallFromInfo:
push 1
lea ecx, [ebp - 0x58]
call fcn.00424945
push 0xffffffffffffffff
push edi
push esi
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.004253a9
lea ecx, [ebp - 0x58]
call fcn.00667b03
jmp 0x44e0ad
inc edi
jmp 0x44dffa
mov eax, esi
call fcn.00623394
ret