joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42e9f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5bab9d
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x6441a4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x1c], esi
mov ebx, dword [sym.imp.USERENV.dll_GetAllUsersProfileDirectoryW]
lea eax, [ebp - 0x14]
push eax
push 0
mov dword [ebp - 0x14], 0
call ebx
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x42ea5b
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004ce3fc
mov cl, byte [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x10]
mov byte [ebp - 0x10], cl
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 1
push 0x10
mov dword [ebp - 4], 0
call fcn.004ce3cc
mov ecx, dword [ebp - 0x18]
mov edi, eax
xorps xmm0, xmm0
mov dword [ebp - 0x20], edi
movq qword [edi], xmm0
mov dword [edi + 8], 0
mov dword [edi + 4], 1
mov dword [edi + 8], 1
mov dword [edi], vtable.._AV___Ref_count_resource_PA_WU__default_delete___BY0A__W_std___std__.0
mov dword [edi + 0xc], ecx
mov eax, dword [ebp - 0x14]
add eax, eax
push eax
push 0
push ecx
call fcn.004d00d0
add esp, 0x14
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x18]
call ebx
test eax, eax
jne 0x42eaf0
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
jmp 0x42eb58
push 0xffffffffffffffff
push dword [ebp - 0x18]
xorps xmm0, xmm0
mov dword [ebp - 0x24], 0
lea ecx, [ebp - 0x34]
movups xmmword [ebp - 0x34], xmm0
call fcn.00406c40
push str.Tencent
lea ecx, [ebp - 0x34]
call fcn.00406cf0
push str.WeChat_
lea ecx, [ebp - 0x34]
call fcn.00406cf0
lea ecx, [ebp - 0x34]
call fcn.0042f0c0
lea eax, [ebp - 0x34]
mov ecx, esi
push eax
call fcn.00406930
mov eax, dword [ebp - 0x34]
test eax, eax
je 0x42eb48
push eax
call fcn.004d2e13
add esp, 4
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x42eb58
push eax
call fcn.004d2e13
add esp, 4
or ebx, 0xffffffff
lea ecx, [edi + 4]
mov eax, ebx
lock xadd dword [ecx], eax
jne 0x42eb7d
mov eax, dword [edi]
mov ecx, edi
call dword [eax]
lea eax, [edi + 8]
lock xadd dword [eax], ebx
dec ebx
jne 0x42eb7d
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42f0c0
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x6441a4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 4], 0
jle 0x42f2bb
push 0x200
lea eax, [ebp - 0x204]
push 0
push eax
call fcn.004d00d0
mov edi, dword [edi]
add esp, 0xc
test edi, edi
je 0x42f108
movzx eax, word [edi]
mov ecx, eax
test ax, ax
jne 0x42f122
movzx eax, word [0x628fa4]
mov ebx, 1
mov edi, 0x628fa4
test ax, ax
je 0x42f207
movzx ecx, ax
mov ebx, 1
lea eax, [ebp - 0x204]
mov edx, 0x5c
sub eax, edi
mov dword [ebp - 0x21c], eax
lea esi, [ebx + 0x2e]
mov eax, 0x3a
cmp dx, cx
je 0x42f153
cmp si, cx
jne 0x42f1e9
cmp ax, word [edi - 2]
je 0x42f1e9
push 0xffffffffffffffff
lea eax, [ebp - 0x204]
mov dword [ebp - 0x208], 0
xorps xmm0, xmm0
lea ecx, [ebp - 0x218]
push eax
movups xmmword [ebp - 0x218], xmm0
call fcn.00406c40
mov esi, dword [ebp - 0x218]
test esi, esi
je 0x42f197
cmp word [esi], 0
mov eax, esi
jne 0x42f19c
mov eax, 0x628fa4
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
je 0x42f1c1
push 0
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebx, eax
test ebx, ebx
je 0x42f29b
test esi, esi
je 0x42f1ce
push esi
call fcn.004d2e13
add esp, 4
mov eax, dword [ebp - 0x20c]
test eax, eax
je 0x42f1e1
push eax
call fcn.004d2e13
add esp, 4
mov esi, 0x2f
lea edx, [esi + 0x2d]
mov ecx, dword [ebp - 0x21c]
mov ax, word [edi]
mov word [ecx + edi], ax
add edi, 2
movzx eax, word [edi]
mov ecx, eax
test ax, ax
jne 0x42f140
push 0xffffffffffffffff
lea eax, [ebp - 0x204]
mov dword [ebp - 0x208], 0
xorps xmm0, xmm0
lea ecx, [ebp - 0x218]
push eax
movups xmmword [ebp - 0x218], xmm0
call fcn.00406c40
mov esi, dword [ebp - 0x218]
test esi, esi
je 0x42f241
cmp word [esi], 0
mov eax, esi
jne 0x42f246
mov eax, 0x628fa4
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
je 0x42f263
push 0
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebx, eax
test ebx, ebx
setne bl
test esi, esi
je 0x42f275
push esi
call fcn.004d2e13
add esp, 4
mov ecx, dword [ebp - 0x20c]
test ecx, ecx
je 0x42f288
push ecx
call fcn.004d2e13
add esp, 4
pop edi
pop esi
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004cdf2e
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x42f2a8
push esi
call fcn.004d2e13
add esp, 4
mov eax, dword [ebp - 0x20c]
test eax, eax
je 0x42f2bb
push eax
call fcn.004d2e13
add esp, 4
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004cdf2e
mov esp, ebp
pop ebp
ret
Function at 0x42fba0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 8], ebx
test edi, edi
je 0x42fbf2
push 0xffffffffffffffff
xorps xmm0, xmm0
mov dword [ebp - 0xc], ebx
push edi
lea ecx, [ebp - 0x1c]
movups xmmword [ebp - 0x1c], xmm0
call fcn.00406c40
mov esi, dword [ebp - 0x1c]
test esi, esi
je 0x42fbd7
mov eax, esi
cmp word [esi], bx
jne 0x42fbdc
mov eax, 0x628fa4
push eax
mov ebx, 1
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, ebx
jne 0x42fbf5
mov byte [ebp - 1], 0
jmp 0x42fbf9
mov esi, dword [ebp - 0x1c]
mov byte [ebp - 1], 1
test bl, 1
je 0x42fc1b
test esi, esi
je 0x42fc0b
push esi
call fcn.004d2e13
add esp, 4
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x42fc1b
push eax
call fcn.004d2e13
add esp, 4
cmp byte [ebp - 1], 0
je 0x42fc2a
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push 0x62c5b8
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push edi
push eax
call fcn.004dc146
mov edi, dword [ebp - 8]
add esp, 0xc
xor ebx, ebx
test edi, edi
je 0x42fc7d
test eax, eax
jne 0x42fc7d
push edi
call fcn.004dba5d
push 2
push ebx
push edi
mov esi, eax
call fcn.004dbf88
push edi
call fcn.004dba5d
push 0
push esi
push edi
mov ebx, eax
call fcn.004dbf88
push dword [ebp - 8]
call fcn.004d8756
add esp, 0x24
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42fd50
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
mov eax, dword [ecx]
mov dword [esp + 4], 0
cmp eax, 0xffffffff
je 0x42fd86
push 0
lea ecx, [esp + 8]
push ecx
push dword [ebp + 8]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x42fd86
mov eax, dword [esp + 4]
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
movups xmm0, xmmword [0x628d68]
sub esp, 0x10
mov edx, eax
mov ecx, esp
sub esp, 0x10
movups xmmword [ecx], xmm0
mov ecx, esp
sub esp, 0x10
mov eax, esp
sub esp, 0x10
movups xmmword [ecx], xmm0
movups xmmword [eax], xmm0
mov eax, esp
sub esp, 0x10
movups xmmword [eax], xmm0
mov eax, esp
sub esp, 0x10
mov ecx, esp
movups xmmword [eax], xmm0
push str.writeFile_erro___d
mov eax, edx
mov byte [ecx], 0
cdq
push str.Utils
mov dword [ecx + 0xc], edx
mov edx, str.D:Tools_agentworkspaceWeChatUpdateWechatUpdateutilsUtils.cpp
mov dword [ecx + 8], eax
mov ecx, 4
push str.Utils::writeFile
push 0x337
call fcn.00403890
add esp, 0x70
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x42fe00
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, edx
test ecx, ecx
je 0x42fec5
cmp word [ecx], 0
je 0x42fec5
push 0
push 0
push 3
push 0
push 1
push closesocket
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x42fec5
push edi
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
test edi, edi
jg 0x42fe5b
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi]
cmp dword [esi + 4], edi
jne 0x42fe74
test eax, eax
je 0x42fe8e
push edi
push 0
push eax
call fcn.004d00d0
add esp, 0xc
jmp 0x42fe9e
test eax, eax
je 0x42fe8e
push eax
call fcn.004d2e13
add esp, 4
mov dword [esi], 0
mov dword [esi + 4], 0
push 1
push edi
call fcn.004d8c1a
add esp, 8
mov dword [esi], eax
mov dword [esi + 4], edi
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push edi
push dword [esi]
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42fed0
Capabilities:
Check if file exists
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
mov edi, dword [edx]
test edi, edi
je 0x42fee4
cmp word [edi], 0
jne 0x42fee9
mov edi, 0x628fa4
mov esi, dword [ecx]
test esi, esi
je 0x42fef5
cmp word [esi], 0
jne 0x42fefa
mov esi, 0x628fa4
test edi, edi
je 0x42ff73
push ebx
push 0xffffffffffffffff
xorps xmm0, xmm0
mov dword [ebp - 8], 0
push esi
lea ecx, [ebp - 0x18]
movups xmmword [ebp - 0x18], xmm0
call fcn.00406c40
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x42ff27
cmp word [ebx], 0
mov eax, ebx
jne 0x42ff2c
mov eax, 0x628fa4
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
setne byte [ebp - 1]
test ebx, ebx
je 0x42ff47
push ebx
call fcn.004d2e13
add esp, 4
mov eax, dword [ebp - 0xc]
pop ebx
test eax, eax
je 0x42ff58
push eax
call fcn.004d2e13
add esp, 4
cmp byte [ebp - 1], 0
jne 0x42ff73
push edi
push esi
call fcn.004e1e66
add esp, 8
test eax, eax
sete al
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4318e0
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x158
mov eax, dword [0x6441a4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, edx
lea eax, [ebp - 0x158]
push edi
push eax
mov edi, ecx
mov dword [esi], 0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea eax, [ebp - 0x120]
mov dword [ebp - 0x120], 0x11c
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x431b1a
mov eax, dword [ebp - 0x11c]
xorps xmm0, xmm0
mov dword [ebp - 0x124], 0
movups xmmword [ebp - 0x134], xmm0
sub eax, 4
je 0x431a7e
sub eax, 1
je 0x4319e5
sub eax, 1
jne 0x431a92
mov eax, dword [ebp - 0x118]
lea ecx, [ebp - 0x134]
mov dword [esi], 3
sub eax, 0
je 0x4319cb
sub eax, 1
je 0x4319a6
sub eax, 1
je 0x431991
mov dword [esi], 0
push str.Windows_unknow
jmp 0x431acf
push str.Windows_8
call fcn.00406d80
mov dword [esi], 5
jmp 0x431ad4
cmp byte [ebp - 6], 1
jne 0x4319c1
push str.Windows_7
call fcn.00406d80
mov dword [esi], 4
jmp 0x431ad4
push str.Windows_Server_2008_R2
jmp 0x431acf
cmp byte [ebp - 6], 1
jne 0x4319db
push str.Windows_Vista
jmp 0x431acf
push str.Windows_Server_2008
jmp 0x431acf
mov eax, dword [ebp - 0x118]
sub eax, 0
je 0x431a66
sub eax, 1
je 0x431a5f
sub eax, 1
je 0x431a15
push str.Windows_unknow
lea ecx, [ebp - 0x134]
call fcn.00406d80
mov dword [esi], 0
jmp 0x431ad4
cmp byte [ebp - 6], 1
jne 0x431a30
cmp word [ebp - 0x158], 9
jne 0x431a30
mov ecx, str.Windows_XP_Professional_x64_Edition
push ecx
jmp 0x431ac9
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x59
call esi
test eax, eax
jne 0x431a49
mov ecx, str.Windows_Server_2003
push ecx
jmp 0x431ac9
push 0x59
call esi
test eax, eax
mov ecx, str.Windows_Server_2003_R2
mov edx, str.Windows_Server
cmove ecx, edx
push ecx
jmp 0x431ac9
push str.Windows_XP
jmp 0x431ac9
push str.Windows_2000
lea ecx, [ebp - 0x134]
call fcn.00406d80
mov dword [esi], 2
jmp 0x431ad4
mov eax, dword [ebp - 0x118]
test eax, eax
je 0x431aad
cmp eax, 0xa
je 0x431aa6
cmp eax, 0x5a
je 0x431a9f
mov dword [esi], 0
push str.Windows_UnKnow
jmp 0x431ac9
push str.Windows_Me
jmp 0x431ac9
push str.Windows_98
jmp 0x431ac9
mov eax, dword [ebp - 0x110]
cmp eax, 2
jne 0x431abf
push str.Windows_NT_4.0
jmp 0x431ac9
cmp eax, 1
jne 0x431ad4
push str.Windows_95
lea ecx, [ebp - 0x134]
call fcn.00406d80
lea eax, [ebp - 0x134]
mov ecx, edi
push eax
call fcn.00406930
mov eax, dword [ebp - 0x134]
test eax, eax
je 0x431af5
push eax
call fcn.004d2e13
add esp, 4
mov eax, dword [ebp - 0x128]
test eax, eax
je 0x431b50
push eax
call fcn.004d2e13
add esp, 4
mov eax, edi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004cdf2e
mov esp, ebp
pop ebp
ret
mov dword [esi], 0
mov ecx, edi
push 0xffffffffffffffff
push str.Windows_UnKnow
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
call fcn.00406c40
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.004cdf2e
mov esp, ebp
pop ebp
ret
Function at 0x4324b0
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5bafb0
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x60
mov eax, dword [0x6441a4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0x62cb0c
mov dword [ebp - 4], 0
call fcn.00406d80
lea ecx, [ebp - 0x6c]
call fcn.0042e900
mov byte [ebp - 4], 1
mov edx, dword [eax]
test edx, edx
je 0x432519
cmp word [edx], 0
jne 0x43251e
mov edx, 0x628fa4
mov ecx, edx
mov dword [ebp - 0x54], 0
xor eax, eax
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 7
mov word [ebp - 0x54], ax
lea esi, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x432540
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x54]
call fcn.00402460
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x6c]
test eax, eax
je 0x432574
push eax
call fcn.004d2e13
add esp, 4
mov dword [ebp - 0x6c], 0
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x68], 0
test eax, eax
je 0x4325a0
push eax
call fcn.004d2e13
add esp, 4
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 0
push 9
push str.All_Users
lea ecx, [ebp - 0x54]
call fcn.00403e30
push 8
push str.config_
lea ecx, [ebp - 0x54]
call fcn.00403e30
push 0xc
push str.configEx.ini
lea ecx, [ebp - 0x54]
call fcn.00403e30
cmp dword [ebp - 0x40], 8
lea eax, [ebp - 0x54]
cmovae eax, dword [ebp - 0x54]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4325e8
mov byte [ebp - 0x55], al
jmp 0x43263f
cmp dword [ebp - 0x40], 8
lea ecx, [ebp - 0x54]
mov eax, dword [ebx + 8]
xorps xmm0, xmm0
cmovae ecx, dword [ebp - 0x54]
movq qword [ebp - 0x1c], xmm0
movups xmmword [ebp - 0x3c], xmm0
movups xmmword [ebp - 0x2c], xmm0
test eax, eax
je 0x432610
cmp word [eax], 0
jne 0x432615
mov eax, 0x628fa4
push ecx
push 0x100
lea ecx, [ebp - 0x3c]
push ecx
push 0x62cb50
push eax
push 0x62cba8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x3c]
mov ecx, edi
push eax
call fcn.00406d80
mov byte [ebp - 0x55], 1
mov edx, dword [ebp - 0x40]
cmp edx, 8
jb 0x432675
mov ecx, dword [ebp - 0x54]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x43266b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4326df
push edx
push ecx
call fcn.004ce396
add esp, 8
xor eax, eax
mov dword [ebp - 0x44], 0
mov word [ebp - 0x54], ax
mov eax, dword [ebx + 8]
mov dword [ebp - 0x40], 7
test eax, eax
je 0x4326a0
push eax
call fcn.004d2e13
add esp, 4
mov dword [ebx + 8], 0
mov ecx, dword [ebx + 0x14]
mov dword [ebx + 0x10], 0
mov dword [ebx + 0xc], 0
test ecx, ecx
je 0x4326be
push ecx
call fcn.004d2e13
add esp, 4
mov al, byte [ebp - 0x55]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004cdf2e
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.004d85d5
int3
Function at 0x4326f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5baffd
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x6441a4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
sub esp, 0x14
mov dword [ebp - 4], 0
lea eax, [ebp + 8]
mov ecx, esp
push eax
call fcn.00406930
mov ecx, esi
call fcn.00432c50
add esp, 0x14
lea eax, [ebp - 0x30]
push 0xa
push 0x19
push eax
push esi
call fcn.004daa47
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x48], 0
add esp, 0x10
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0xf
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x432768
sub ecx, edx
lea eax, [ebp - 0x30]
push ecx
push eax
lea ecx, [ebp - 0x48]
call fcn.00402570
push ecx
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00406ae0
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x34]
cmp edx, 0x10
jb 0x4327c3
mov ecx, dword [ebp - 0x48]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4327b9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x432904
push edx
push ecx
call fcn.004ce396
add esp, 8
lea ecx, [ebp - 0x44]
call fcn.0042e900
push str.All_Users
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 2
call fcn.00406cf0
push str.config_
lea ecx, [ebp - 0x44]
call fcn.00406cf0
mov eax, dword [ebp - 0x44]
mov edi, dword [ebp - 0x2c]
test eax, eax
je 0x43280c
cmp word [eax], 0
je 0x43280c
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x43280c
shr eax, 4
and al, 1
jne 0x432818
lea ecx, [ebp - 0x44]
call fcn.00432d00
test al, al
je 0x432872
push str.configEx.ini
lea ecx, [ebp - 0x44]
call fcn.00406cf0
mov esi, dword [ebp - 0x44]
test esi, esi
je 0x432834
cmp word [esi], 0
mov ecx, esi
jne 0x432839
mov ecx, 0x628fa4
test edi, edi
je 0x432845
cmp word [edi], 0
mov edx, edi
jne 0x43284a
mov edx, 0x628fa4
mov eax, dword [ebp + 8]
test eax, eax
je 0x432857
cmp word [eax], 0
jne 0x43285c
mov eax, 0x628fa4
push ecx
push edx
push eax
push 0x62cba8
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
test eax, eax
je 0x432875
mov bl, 1
jmp 0x432877
mov esi, dword [ebp - 0x44]
xor bl, bl
test esi, esi
je 0x432884
push esi
call fcn.004d2e13
add esp, 4
mov eax, dword [ebp - 0x38]
test eax, eax
je 0x432894
push eax
call fcn.004d2e13
add esp, 4
test edi, edi
je 0x4328a1
push edi
call fcn.004d2e13
add esp, 4
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x4328b1
push eax
call fcn.004d2e13
add esp, 4
mov eax, dword [ebp + 8]
test eax, eax
je 0x4328c8
push eax
call fcn.004d2e13
add esp, 4
mov dword [ebp + 8], 0
mov ecx, dword [ebp + 0x14]
mov dword [ebp + 0x10], 0
mov dword [ebp + 0xc], 0
test ecx, ecx
je 0x4328e6
push ecx
call fcn.004d2e13
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004cdf2e
mov esp, ebp
pop ebp
ret
call fcn.004d85d5
int3
Function at 0x432ba0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
lea eax, [ebp - 4]
mov dword [ebp - 8], 0x400
push eax
push 0xf003f
push 0
push str.SoftwareTencentWeChat
push closesocket
mov esi, ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x432c06
mov eax, dword [ebp + 8]
test eax, eax
je 0x432bdd
cmp word [eax], 0
jne 0x432be2
mov eax, 0x628fa4
lea ecx, [ebp - 8]
push ecx
push esi
push 0
push 0
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x432c06
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov bl, 1
jmp 0x432c11
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor bl, bl
mov eax, dword [ebp + 8]
test eax, eax
je 0x432c28
push eax
call fcn.004d2e13
add esp, 4
mov dword [ebp + 8], 0
mov eax, dword [ebp + 0x14]
mov dword [ebp + 0x10], 0
mov dword [ebp + 0xc], 0
test eax, eax
je 0x432c46
push eax
call fcn.004d2e13
add esp, 4
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x432c50
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
lea eax, [ebp - 4]
mov dword [ebp - 8], ecx
push eax
push 0xf003f
push 0
push str.SoftwareTencentWeChat
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x432cac
mov eax, dword [ebp + 8]
test eax, eax
je 0x432c86
cmp word [eax], 0
jne 0x432c8b
mov eax, 0x628fa4
push 4
lea ecx, [ebp - 8]
push ecx
push 4
push 0
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
test eax, eax
je 0x432cea
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor bl, bl
mov eax, dword [ebp + 8]
test eax, eax
je 0x432cc5
push eax
call fcn.004d2e13
add esp, 4
mov dword [ebp + 8], 0
mov eax, dword [ebp + 0x14]
mov dword [ebp + 0x10], 0
mov dword [ebp + 0xc], 0
test eax, eax
je 0x432ce3
push eax
call fcn.004d2e13
add esp, 4
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov bl, 1
jmp 0x432cae
Function at 0x432d00
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push esi
mov esi, ecx
mov ecx, dword [esi + 4]
test ecx, ecx
jg 0x432d75
movups xmm0, xmmword [0x628d68]
sub esp, 0x10
mov edx, str.D:Tools_agentworkspaceWeChatUpdateWechatUpdateutilsUtils.cpp
mov eax, esp
mov ecx, 4
sub esp, 0x10
movups xmmword [eax], xmm0
mov eax, esp
sub esp, 0x10
movups xmmword [eax], xmm0
mov eax, esp
sub esp, 0x10
movups xmmword [eax], xmm0
mov eax, esp
sub esp, 0x10
movups xmmword [eax], xmm0
mov eax, esp
sub esp, 0x10
movups xmmword [eax], xmm0
mov eax, esp
push str.create_dir_is_empty
push str.Utils
push str.Utils::mkDirEx
push 0x6ad
movups xmmword [eax], xmm0
call fcn.00403890
add esp, 0x70
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
cmp ecx, 1
jl 0x432d96
mov eax, dword [esi]
push 1
push 0x6294f0
lea eax, [eax + ecx*2]
add eax, 0xfffffffe
push eax
call fcn.004d9229
add esp, 0xc
test eax, eax
je 0x432dc6
mov ecx, dword [esi + 4]
cmp ecx, 1
jl 0x432dba
mov eax, dword [esi]
push 1
push 0x6294f8
lea eax, [eax + ecx*2]
add eax, 0xfffffffe
push eax
call fcn.004d9229
add esp, 0xc
test eax, eax
je 0x432dc6
push 0x6294f0
mov ecx, esi
call fcn.00406cf0
mov eax, dword [esi]
test eax, eax
je 0x432dd2
cmp word [eax], 0
jne 0x432dd7
mov eax, 0x628fa4
push 0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret