joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407390
Capabilities:
Check if file exists
Get file attributes
Hash data with md5
Read file on windows

Disassembly:
mov eax, 0x10f8
call fcn.00416a30
mov eax, dword [0x42202c]
xor eax, esp
mov dword [esp + 0x10f4], eax
mov eax, dword [esp + 0x10fc]
push ebx
push esi
mov esi, ecx
mov ebx, 8
cmp dword [esi + 0x18], ebx
push edi
mov dword [esp + 0xc], eax
lea edi, [esi + 4]
jb 0x4073c9
mov eax, dword [edi]
jmp 0x4073cb
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4073db
test al, 0x10
je 0x4073f5
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x10f4]
xor ecx, esp
call fcn.004158da
add esp, 0x10f8
ret
cmp dword [esi + 0x18], ebx
jb 0x4073fc
mov edi, dword [edi]
xor ebx, ebx
push ebx
push ebx
push 3
push ebx
push 1
push closesocket
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x407532
push ebp
push 0xfff
lea ecx, [esp + 0x109]
push ebx
push ecx
mov dword [esp + 0x24], 0x67452301
mov dword [esp + 0x28], 0xefcdab89
mov dword [esp + 0x2c], 0x98badcfe
mov dword [esp + 0x30], 0x10325476
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov byte [esp + 0x110], bl
call sub.MSVCR80.dll_memset
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
add esp, 0xc
lea esp, [esp]
push ebx
lea edx, [esp + 0x18]
push edx
push 0x1000
lea eax, [esp + 0x110]
push eax
push esi
call ebp
cmp eax, ebx
je 0x4074ad
mov eax, dword [esp + 0x14]
cmp eax, ebx
jbe 0x4074ad
push eax
lea ecx, [esp + 0x108]
push ecx
lea edi, [esp + 0x20]
call fcn.00409860
add esp, 8
cmp dword [esp + 0x14], ebx
ja 0x407470
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
lea edx, [esp + 0xb4]
push edx
lea esi, [esp + 0x1c]
mov byte [esp + 0xb8], bl
mov dword [esp + 0xb9], eax
mov dword [esp + 0xbd], eax
mov dword [esp + 0xc1], eax
mov word [esp + 0xc5], ax
mov byte [esp + 0xc7], al
call fcn.00409920
push 0x3f
lea eax, [esp + 0xcd]
push ebx
push eax
mov byte [esp + 0xd4], bl
call sub.MSVCR80.dll_memset
add esp, 0x10
lea ecx, [esp + 0xc4]
lea eax, [esp + 0xb4]
call fcn.004099d0
lea ecx, [esp + 0xc4]
push ecx
mov ecx, dword [esp + 0x14]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_char_const__]
pop ebp
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x1100]
xor eax, eax
cmp dword [edx + 0x14], ebx
pop edi
pop esi
setne al
pop ebx
xor ecx, esp
call fcn.004158da
add esp, 0x10f8
ret
Function at 0x407560
Capabilities:
Get common file path

Disassembly:
sub esp, 0x210
mov eax, dword [0x42202c]
xor eax, esp
mov dword [esp + 0x20c], eax
push 0x208
lea eax, [esp + 6]
push 0
push eax
mov word [esp + 0xc], 0
call sub.MSVCR80.dll_memset
add esp, 0xc
lea ecx, [esp]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, 0x104
jae 0x4075cb
lea edx, [esp]
push edx
mov ecx, esi
call dword [0x4191dc]
mov eax, 1
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.004158da
add esp, 0x210
ret
mov ecx, dword [esp + 0x20c]
xor ecx, esp
xor eax, eax
call fcn.004158da
add esp, 0x210
ret
Function at 0x4082e0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 0xffffffffffffffff
push 0x417e98
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x42202c]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
call fcn.0040aad0
cmp byte [eax + 0x39], 0
je 0x408337
call fcn.0040aad0
call fcn.0040a090
test al, al
je 0x408337
push str.OnTimer__OnDelayTaskTimer
mov ecx, 2
mov edx, str..TaskMgr.cpp
call fcn.0040a820
add esp, 4
mov edi, dword [esp + 0x34]
lea esi, [edi + 0x2c]
push esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], 1
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
add edi, 0x1c
mov dword [esp + 0x2c], 0
mov eax, dword [edi + 4]
test eax, eax
je 0x40836d
mov ecx, dword [edi + 8]
sub ecx, eax
sar ecx, 2
jne 0x408373
push esi
jmp 0x408495
mov esi, dword [edi + 8]
cmp eax, esi
mov ebp, dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
jbe 0x408382
call ebp
mov ebx, dword [edi + 4]
cmp ebx, dword [edi + 8]
jbe 0x40838c
call ebp
cmp edi, edi
je 0x408392
call ebp
mov edx, esi
sub edx, ebx
sar edx, 2
push edx
push esi
push ebx
call fcn.004086a0
mov eax, dword [edi + 4]
add esp, 0xc
test eax, eax
je 0x4083b5
mov ecx, dword [edi + 8]
sub ecx, eax
sar ecx, 2
jne 0x4083b7
call ebp
mov edx, dword [edi + 4]
mov eax, dword [edx]
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword [eax + 8]
call ebp
cmp eax, esi
jb 0x408410
mov eax, dword [edi + 4]
test eax, eax
je 0x4083dc
mov ecx, dword [edi + 8]
sub ecx, eax
sar ecx, 2
jne 0x4083e2
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov edx, dword [edi + 4]
mov eax, dword [edx]
mov ebx, dword [eax + 8]
mov eax, edx
test eax, eax
je 0x4083fa
mov ecx, dword [edi + 8]
sub ecx, eax
sar ecx, 2
jne 0x408400
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov edx, dword [edi + 4]
mov eax, dword [edx]
mov esi, dword [eax + 4]
call ebp
sub eax, ebx
cmp eax, esi
jbe 0x408468
mov eax, dword [edi + 4]
test eax, eax
je 0x408421
mov ecx, dword [edi + 8]
sub ecx, eax
sar ecx, 2
jne 0x408427
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov edx, dword [edi + 4]
mov eax, dword [esp + 0x34]
mov esi, dword [edx]
push eax
call fcn.00408240
mov esi, dword [edi + 4]
cmp esi, dword [edi + 8]
jbe 0x408444
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov eax, dword [edi + 8]
lea ecx, [esi + 4]
sub eax, ecx
sar eax, 2
test eax, eax
jle 0x408464
add eax, eax
add eax, eax
push eax
push ecx
push eax
push esi
call dword [sym.imp.MSVCR80.dll_memmove_s]
add esp, 0x10
add dword [edi + 8], 0xfffffffc
mov eax, dword [edi + 4]
test eax, eax
je 0x408490
mov ecx, dword [edi + 8]
sub ecx, eax
sar ecx, 2
je 0x408490
mov edx, dword [esp + 0x34]
mov eax, dword [edx + 0xc]
push 0
push 0
push 0x7e9
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [esp + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 4
Function at 0x408b40
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x4174e9
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x42202c]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
push edi
mov eax, dword [0x42202c]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x18], 8
mov edi, edx
jb 0x408b7f
mov eax, dword [esi + 4]
jmp 0x408b82
lea eax, [esi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x408b92
test al, 0x10
je 0x408b96
xor eax, eax
jmp 0x408c02
cmp dword [edi + 0x14], 0x20
jne 0x408b92
lea ecx, [esp + 0xc]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_void_]
lea eax, [esp + 0xc]
push eax
mov ecx, esi
mov dword [esp + 0x38], 0
call fcn.00407390
add esp, 4
cmp dword [edi + 0x18], 0x10
jb 0x408bc8
mov edi, dword [edi + 4]
jmp 0x408bcb
add edi, 4
cmp dword [esp + 0x24], 0x10
mov eax, dword [esp + 0x10]
jae 0x408bda
lea eax, [esp + 0x10]
push edi
push eax
call dword [sym.imp.MSVCR80.dll__stricmp]
add esp, 8
mov esi, eax
neg esi
sbb esi, esi
lea ecx, [esp + 0xc]
add esi, 1
mov dword [esp + 0x34], 0xffffffff
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov eax, esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.004158da
add esp, 0x2c
ret

Function at 0x408e30
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x42202c]
xor eax, esp
mov dword [esp + 0x114], eax
mov eax, dword [0x424174]
test eax, eax
jne 0x408f44
push 0x114
push eax
lea eax, [esp + 8]
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
lea ecx, [esp]
push ecx
mov dword [esp + 4], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [esp + 0x10]
cmp eax, 2
jne 0x408f1d
call fcn.00408f60
test eax, eax
je 0x408e9b
mov dword [0x424174], 9
jmp 0x408f3f
mov eax, dword [esp + 4]
cmp eax, 5
jne 0x408edd
mov eax, dword [esp + 8]
test eax, eax
jne 0x408ebb
mov dword [0x424174], 2
jmp 0x408f3f
cmp eax, 1
jne 0x408ecc
mov dword [0x424174], 3
jmp 0x408f3f
cmp eax, 2
jne 0x408f35
mov dword [0x424174], 4
jmp 0x408f3f
cmp eax, 6
jne 0x408f35
mov eax, dword [esp + 8]
test eax, eax
jne 0x408ef6
mov dword [0x424174], 5
jmp 0x408f3f
cmp eax, 1
jne 0x408f07
mov dword [0x424174], 6
jmp 0x408f3f
cmp eax, 2
je 0x408f11
cmp eax, 3
jne 0x408f35
mov dword [0x424174], 7
jmp 0x408f3f
cmp eax, 1
jne 0x408f3f
cmp dword [esp + 4], 4
jne 0x408f35
cmp dword [esp + 8], 0
mov dword [0x424174], eax
je 0x408f3f
mov dword [0x424174], 0x14
mov eax, dword [0x424174]
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.004158da
add esp, 0x118
ret
Function at 0x409030
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x3c
test esi, esi
je 0x4090a0
cmp word [esi], 0
je 0x4090a0
push 0x38
lea eax, [esp + 8]
push 0
push eax
call sub.MSVCR80.dll_memset
mov ecx, dword [esp + 0x50]
mov edx, dword [esp + 0x4c]
add esp, 0xc
lea eax, [esp]
push eax
mov dword [esp + 4], 0x3c
mov dword [esp + 8], 0x140
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 1
mov dword [esp + 0x24], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
add esp, 0x3c
ret
xor eax, eax
add esp, 0x3c
ret

Function at 0x4090b0
Capabilities:
Create thread
Resume thread

Disassembly:
push ecx
push esi
mov esi, eax
mov eax, dword [esi + 4]
test eax, eax
je 0x4090f2
lea ecx, [esp + 4]
push ecx
push eax
mov dword [esp + 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x4090dd
cmp dword [esp + 4], 0x103
jne 0x4090f2
mov edx, dword [esi + 4]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4090f2
xor eax, eax
pop esi
pop ecx
ret
lea eax, [esi + 8]
push eax
push 4
push esi
push 0x409130
push 0
push 0
call dword [sym.imp.MSVCR80.dll__beginthreadex]
xor ecx, ecx
add esp, 0x18
test eax, eax
setne cl
mov dword [esi + 4], eax
mov esi, ecx
test esi, esi
je 0x409122
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, esi
pop esi
pop ecx
ret
Function at 0x409f70
Capabilities:
Read file via mapping

Disassembly:
push str.GlobalFA6FBBB1_8C8E_43b1_B8EC_35573A94C231
push 0
push 6
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
test eax, eax
mov dword [esi], eax
je 0x409faa
push 0
push 0
push 0
push 6
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
mov dword [esi + 4], eax
jne 0x409fad
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0
xor eax, eax
ret
mov dword [esi + 8], eax
mov eax, 1
ret

Function at 0x40a0f0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push ebx
lea eax, [esp + 4]
push eax
xor ebx, ebx
push 0x20019
push ebx
push str.SOFTWARETencentQQPCMgr
push closesocket
mov dword [esp + 0x18], ebx
mov byte [esi + 0x30], bl
mov byte [esi + 0x31], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40a16a
mov eax, dword [esp + 4]
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0xc]
push edx
push ebx
push ebx
push str.EnableLogToView
push eax
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40a15f
mov al, byte [esp + 8]
mov cl, 1
test cl, al
je 0x40a158
mov byte [esi + 0x30], cl
test al, 2
je 0x40a15f
mov byte [esi + 0x31], cl
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
add esp, 0xc
ret

Function at 0x40a5c0
Capabilities:
Check if file exists
Query environment variable

Disassembly:
sub esp, 0x20c
mov eax, dword [0x42202c]
xor eax, esp
mov dword [esp + 0x208], eax
push 0x206
lea eax, [esp + 6]
push 0
push eax
mov dword [esi], 0
mov word [esp + 0xc], 0
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x103
lea ecx, [esp + 4]
push ecx
push str._APPDATA_TencentQQPCMgr_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x40a65f
lea edx, [esp]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40a65f
push edi
lea eax, [esp + 4]
push eax
lea edi, [esi + 4]
push 0x103
push edi
call dword [sym.imp.MSVCR80.dll_wcscpy_s]
push 0xffffffffffffffff
push str.ErrLogFile.log
push 0x104
push edi
call dword [sym.imp.MSVCR80.dll_wcsncat_s]
add esp, 0x1c
pop edi
mov eax, esi
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.004158da
add esp, 0x20c
ret
push 0x103
push str.C:ErrLogFile.log
lea ecx, [esi + 4]
push 0x103
push ecx
call dword [sym.imp.MSVCR80.dll_wcsncpy_s]
mov ecx, dword [esp + 0x218]
add esp, 0x10
xor ecx, esp
mov eax, esi
call fcn.004158da
add esp, 0x20c
ret
Function at 0x40a6a0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x3c
mov eax, dword [0x42202c]
xor eax, esp
mov dword [esp + 0x34], eax
xor eax, eax
mov dword [esp + 0x15], eax
mov dword [esp + 0x19], eax
mov dword [esp + 0x1d], eax
mov dword [esp + 0x21], eax
mov dword [esp + 0x25], eax
mov dword [esp + 0x29], eax
mov dword [esp + 0x2d], eax
mov word [esp + 0x31], ax
mov byte [esp + 0x33], al
lea eax, [esp + 4]
push eax
mov dword [esp + 4], 0
mov byte [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [esp + 0x12]
movzx edx, word [esp + 0x10]
movzx eax, word [esp + 0xe]
push ecx
movzx ecx, word [esp + 0x10]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push str.__4d___02d:_02d:_02d._03d_
push 0xffffffffffffffff
lea edx, [esp + 0x30]
push 0x20
push edx
call dword [sym.imp.MSVCR80.dll__snprintf_s]
add esp, 0x24
push 0
lea ecx, [esp + 4]
push ecx
push eax
mov eax, dword [esi]
lea edx, [esp + 0x20]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.004158da
add esp, 0x3c
ret

Function at 0x40a750
Capabilities:
Get file size
Write file on windows

Disassembly:
sub esp, 0xc
push esi
push edi
mov edi, eax
test edi, edi
mov esi, ecx
je 0x40a817
cmp dword [esi], 0
jne 0x40a789
push 0
push 0x20
push 4
push 0
push 3
push 0xc0000000
lea eax, [esi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
test eax, eax
mov dword [esi], eax
je 0x40a817
mov ecx, dword [esi]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
je 0x40a817
cmp eax, 0x2000000
ja 0x40a817
mov eax, dword [esi]
push 2
lea edx, [esp + 0x14]
push edx
push 0
push eax
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
call fcn.0040a6a0
mov eax, edi
mov dword [esp + 0xc], 0
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x40a7d0
push 0
lea ecx, [esp + 0x10]
push ecx
sub eax, edx
mov edx, dword [esi]
push eax
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push edx
call edi
mov ax, word [0x41b6a4]
mov cl, byte [0x41b6a6]
push 0
lea edx, [esp + 0x10]
push edx
mov word [esp + 0x10], ax
push 2
lea eax, [esp + 0x14]
mov byte [esp + 0x16], cl
mov ecx, dword [esi]
push eax
push ecx
call edi
pop edi
pop esi
add esp, 0xc
ret

Function at 0x40b3e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov eax, dword [esi]
add eax, eax
lea ecx, [esp]
push ecx
mov ecx, dword [esp + 0xc]
push edx
mov dword [esp + 8], eax
lea eax, [esp + 0x10]
push eax
push 0
mov dword [esi], 0
mov edx, dword [ecx]
push str.AutoConfigURL
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40b431
mov eax, dword [esp + 8]
cmp eax, 1
je 0x40b428
cmp eax, 2
je 0x40b428
mov eax, 0xd
pop ecx
ret 4
mov eax, dword [esp]
shr eax, 1
mov dword [esi], eax
xor eax, eax
pop ecx
ret 4
Function at 0x40b440
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x218
mov eax, dword [0x42202c]
xor eax, esp
mov dword [esp + 0x214], eax
push ebp
mov ebp, dword [esp + 0x220]
push esi
push edi
xor esi, esi
push 0x20a
lea eax, [esp + 0x1a]
push esi
push eax
mov dword [esp + 0x1c], esi
mov word [esp + 0x20], si
call sub.MSVCR80.dll_memset
mov eax, 1
add esp, 0xc
test byte [0x424384], al
mov edi, 0x20019
jne 0x40b4c5
or dword [0x424384], eax
push 0x4184c0
mov dword [0x424390], esi
mov dword [0x424388], esi
mov dword [0x42438c], esi
mov dword [0x424394], esi
mov dword [0x424398], esi
mov dword [0x42439c], esi
call fcn.004159f1
add esp, 4
push ebx
call fcn.00408d60
push str.IsWow64Process
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
cmp ebx, esi
mov dword [esp + 0x10], esi
je 0x40b509
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call ebx
test eax, eax
je 0x40b509
cmp dword [esp + 0x10], esi
je 0x40b509
mov edi, 0x20219
lea edx, [esp + 0x14]
push edx
push edi
push esi
push str.SoftwareTencentQMStart
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
pop ebx
jne 0x40b565
mov edx, dword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x18]
push ecx
push esi
push esi
push str.Version
push edx
mov dword [esp + 0x24], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40b55a
lea eax, [esp + 0x14]
push eax
mov ecx, ebp
call dword [0x4191dc]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x220]
xor eax, eax
cmp dword [ebp + 0x14], esi
pop edi
pop esi
setne al
pop ebp
xor ecx, esp
call fcn.004158da
add esp, 0x218
ret
Function at 0x40b690
Capabilities:
Get common file path

Disassembly:
sub esp, 0x628
mov eax, dword [0x42202c]
xor eax, esp
mov dword [esp + 0x624], eax
mov eax, 0x6e
push esi
mov word [esp + 0xc], ax
mov word [esp + 0x12], ax
mov eax, 0x74
xor esi, esi
push 0x1e6
mov word [esp + 0x18], ax
mov word [esp + 0x22], ax
mov word [esp + 0x28], ax
mov ecx, 0x65
lea eax, [esp + 0x30]
push esi
push eax
mov word [esp + 0x14], 0x54
mov word [esp + 0x16], cx
mov word [esp + 0x1a], 0x63
mov word [esp + 0x1c], cx
mov word [esp + 0x22], 0x5c
mov word [esp + 0x24], 0x51
mov word [esp + 0x26], 0x4d
mov word [esp + 0x28], 0x53
mov word [esp + 0x2c], 0x61
mov word [esp + 0x2e], 0x72
mov word [esp + 0x32], si
mov word [esp + 0x34], si
mov word [esp + 0x36], si
call sub.MSVCR80.dll_memset
push 0x410
lea ecx, [esp + 0x226]
push esi
push ecx
mov word [esp + 0x22c], si
call sub.MSVCR80.dll_memset
add esp, 0x18
lea edx, [esp + 4]
push edx
push 0x1a
push esi
mov dword [esp + 0x10], esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jl 0x40b786
mov eax, dword [esp + 4]
cmp eax, esi
je 0x40b786
lea ecx, [esp + 0x214]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x218]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea edx, [esp + 0x214]
push edx
mov ecx, edi
call dword [0x4191dc]
mov ecx, dword [esp + 0x628]
pop esi
xor ecx, esp
mov eax, 1
call fcn.004158da
add esp, 0x628
ret
Function at 0x40b7d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x10
push edi
mov edi, eax
call fcn.0040b690
cmp dword [edi + 0x14], 0
je 0x40b81e
lea eax, [esp + 8]
push eax
mov ecx, edi
call dword [sym.imp.MSVCP80.dll_public:_class_std::reverse_iterator_class_std::_String_iterator_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::rbegin_void_]
call fcn.004077f0
cmp word [eax], 0x5c
je 0x40b81e
lea ecx, [esp + 8]
push ecx
mov ecx, edi
call dword [sym.imp.MSVCP80.dll_public:_class_std::reverse_iterator_class_std::_String_iterator_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::rbegin_void_]
call fcn.004077f0
cmp word [eax], 0x2f
je 0x40b81e
push 0x419e10
mov ecx, edi
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::append_wchar_t_const__]
push 0x4220c4
mov ecx, edi
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::append_wchar_t_const__]
cmp dword [edi + 0x18], 8
jb 0x40b836
mov edi, dword [edi + 4]
jmp 0x40b839
add edi, 4
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40b853
test al, 0x10
jne 0x40b853
mov eax, 1
pop edi
add esp, 0x10
ret
xor eax, eax
pop edi
add esp, 0x10
ret
Function at 0x40b860
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x417488
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x42202c]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
xor esi, esi
xor edi, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], edi
mov eax, 1
mov dword [esp + 0x28], esi
test byte [0x424384], al
mov ebx, 0x20019
jne 0x40b8e0
or dword [0x424384], eax
push 0x4184c0
mov dword [0x424390], esi
mov dword [0x424388], esi
mov dword [0x42438c], esi
mov dword [0x424394], esi
mov dword [0x424398], esi
mov dword [0x42439c], esi
call fcn.004159f1
add esp, 4
call fcn.00408d60
push str.IsWow64Process
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebp, eax
cmp ebp, esi
mov dword [esp + 0x14], esi
je 0x40b923
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call ebp
test eax, eax
je 0x40b923
cmp dword [esp + 0x14], esi
je 0x40b923
mov ebx, 0x20219
lea ecx, [esp + 0x14]
push ecx
push ebx
push esi
push str.SOFTWARETencentQQPCMgr
push closesocket
mov dword [esp + 0x28], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x40b96a
mov edi, dword [esp + 0x14]
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x24]
push ecx
push esi
push str.SupplyID
push edi
mov dword [esp + 0x2c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp edi, esi
mov ebx, dword [esp + 0x18]
je 0x40b979
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret