joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45f820
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d8348
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x511070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push 0x20019
push 0
push str.SOFTWARETencentQQPCMgr
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x45f8a5
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], 4
test eax, eax
je 0x45f8b3
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0x18]
push ecx
push 0
push 0x4f338c
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x45f8a5
cmp dword [ebp - 0x18], 4
jne 0x45f8a5
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x1c]
mov dword [ecx], eax
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x45f8b3
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 8

Function at 0x45f8d0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d8378
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x511070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWARETencentQQPCMgr
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x45f942
mov eax, dword [ebp + 0xc]
mov dword [ebp + 0xc], eax
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x45f950
push 4
lea ecx, [ebp + 0xc]
push ecx
push 4
push 0
push dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x45f950
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 8

Function at 0x45f970
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d6138
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x511070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor esi, esi
push esi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], esi
push eax
push esi
push 0xf003f
push esi
push esi
push esi
push str.SOFTWARETencentQQPCMgr
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
mov eax, dword [ebp - 0x10]
jne 0x45fa05
test eax, eax
je 0x45fa10
mov edx, dword [ebp + 0xc]
lea ebx, [edx + 2]
nop dword [eax]
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x45f9d0
sub edx, ebx
sar edx, 1
lea ecx, [edx*2 + 2]
push ecx
push dword [ebp + 0xc]
push 1
push 0
push dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
mov ecx, 1
mov eax, dword [ebp - 0x10]
cmove esi, ecx
test eax, eax
je 0x45fa10
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x45fd80
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d83f0
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x511070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x1c], edi
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx]
sub ecx, 0x10
call fcn.0041c670
lea esi, [eax + 0x10]
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
or ebx, 0xffffffff
cmp dword [esi - 0xc], 3
jle 0x45fe0c
push 3
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
call fcn.00421e80
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.0041c6d0
mov byte [ebp - 4], 0
mov eax, ebx
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x45fe09
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x10]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x24]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
jne 0x45fe33
xorps xmm0, xmm0
movlpd qword [ebp - 0x18], xmm0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
jmp 0x45fe39
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
shrd ecx, eax, 0x14
shr eax, 0x14
cmp ecx, 0x1f4
jge 0x45fe4f
mov edi, 1
jmp 0x45fe80
cmp dword [edi + 0x3c], 0
jne 0x45fe7e
mov eax, dword [ebp + 8]
push ecx
mov edi, esp
mov dword [ebp - 0x14], edi
mov ecx, dword [eax]
sub ecx, 0x10
call fcn.0041c670
mov ecx, dword [ebp - 0x1c]
add eax, 0x10
mov dword [edi], eax
call fcn.00464eb0
test eax, eax
jne 0x45fe7e
lea edi, [eax + 2]
jmp 0x45fe80
xor edi, edi
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x45fe9c
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x45fec0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d841b
mov eax, dword fs:[0]
push eax
sub esp, 0xec
mov eax, dword [0x511070]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov ecx, dword [esi + 0x58]
sub ecx, 0x10
mov dword [ebp - 0xf4], esi
call fcn.0041c670
add eax, 0x10
mov dword [ebp - 0xe4], eax
mov dword [ebp - 4], 0
lea ecx, [ebp - 0xe4]
mov eax, dword [esi]
push ecx
mov ecx, esi
call dword [eax + 4]
mov dword [ebp - 0xe8], eax
test eax, eax
je 0x46005c
cmp dword [esi + 0x3c], 0
jne 0x45ff9d
push dword [esi + 0x58]
push 0x4f5f58
push 0x515488
call fcn.0048d4b0
add esp, 0xc
mov byte [ebp - 4], 1
xor ebx, ebx
lea eax, [ebp - 0xe0]
mov dword [ebp - 0xec], ebx
push 0xc8
push ebx
push eax
call fcn.004a8960
add esp, 0xc
lea eax, [ebp - 0xe0]
push eax
push 0x64
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
nop dword [eax + eax]
lea edi, [ebp - 0xe0]
cmp word [edi + ebx*2], 0
lea edi, [edi + ebx*2]
jne 0x45ffb9
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0xe8]
cmp eax, 1
jne 0x4600b4
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax + 0x1c]
push 0x4f5fb0
jmp 0x4600c7
push edi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x4600a6
movzx eax, word [edi]
mov dword [ebp - 0xf0], eax
mov eax, dword [ebp - 0xe4]
mov ebx, dword [eax - 0xc]
test ebx, ebx
jg 0x45ffe9
push 0x80070057
call fcn.0041cdf0
cmp dword [eax - 4], 1
jle 0x460001
push ebx
lea ecx, [ebp - 0xe4]
call fcn.0041ca90
mov eax, dword [ebp - 0xe4]
mov ecx, dword [ebp - 0xf0]
mov word [eax], cx
test ebx, ebx
js 0x45ffdf
mov eax, dword [ebp - 0xe4]
cmp ebx, dword [eax - 8]
jg 0x45ffdf
mov dword [eax - 0xc], ebx
xor ecx, ecx
mov eax, dword [ebp - 0xe4]
mov word [eax + ebx*2], cx
lea ecx, [ebp - 0xe4]
mov eax, dword [esi]
push ecx
mov ecx, esi
call dword [eax + 4]
test eax, eax
jne 0x4600a0
movzx eax, word [edi]
push eax
push ecx
lea ecx, [esi + 0x58]
call fcn.00466190
push dword [esi + 0x58]
push 0x4f5f84
push 0x515488
call fcn.0048d4b0
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov edx, dword [ebp - 0xe4]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x460081
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, 1
jmp 0x4600fb
mov ebx, dword [ebp - 0xec]
add ebx, 4
mov dword [ebp - 0xec], ebx
jmp 0x45ff80
cmp eax, 2
jne 0x4600d4
mov eax, dword [esi]
mov ecx, esi
push 0x13
call dword [eax + 0x1c]
push 0x4f5fcc
push 0x515488
call fcn.0048d4b0
add esp, 8
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov edx, dword [ebp - 0xe4]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4600f9
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004a5d13
mov esp, ebp
pop ebp
ret
Function at 0x460d30
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x511070]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x208
lea eax, [ebp - 0x210]
mov edi, ecx
push 0
push eax
call fcn.004a8960
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x460d83
mov esi, dword [edi]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x64
jmp 0x460e16
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea esi, [edi + 0x60]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push str.TencentQQPCMgr_
lea eax, [ebp - 0x210]
push eax
push str._s_s_x_
push esi
call fcn.00421db0
mov ecx, dword [esi]
add esp, 0x14
call fcn.0048a400
test eax, eax
jne 0x460e50
push eax
push 0x23
lea eax, [ebp - 0x210]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x460e50
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
push str.TencentQQPCMgrSetupTemp_
lea eax, [ebp - 0x210]
push eax
push 0x4ed424
push esi
call fcn.00421db0
mov ecx, dword [esi]
add esp, 0x10
call fcn.0048a400
test eax, eax
jne 0x460e50
mov esi, dword [edi]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x65
mov ecx, edi
call dword [esi + 0x20]
push str.Failed_to_InitTempPath
push 0x515488
call fcn.0048d4b0
add esp, 8
lea ecx, [edi + 0x60]
call fcn.0041ca30
mov edx, dword [edi]
mov ecx, edi
push 0x16
call dword [edx + 0x1c]
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a5d13
mov esp, ebp
pop ebp
ret
push dword [esi]
push str.temp_:__ws
push 0x515488
call fcn.0048d4b0
add esp, 0xc
push dword [esi]
call fcn.004205d0
mov ecx, eax
call fcn.004202d0
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
xor ecx, ebp
pop esi
call fcn.004a5d13
mov esp, ebp
pop ebp
ret
Function at 0x4628b0
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d87c1
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x511070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [ebp + 8], 0
je 0x462adb
cmp dword [edi + 0x10c], 0
jne 0x46292f
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x46292f
push esi
push str.Setup.xml_supply_is__d.
push 0x515488
call fcn.0048d4b0
add esp, 0xc
mov dword [edi + 0x10c], esi
call fcn.0047f030
mov ecx, dword [edi + 0x10c]
test ecx, ecx
je 0x46292f
mov dword [eax + 0x18], ecx
mov eax, dword [eax + 0x28]
test eax, eax
je 0x46292f
mov dword [eax + 0x20], ecx
push str.C0F87C1E_7FD0_4b43_99BD_C6386C56F41E
push 0
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov ebx, eax
test ebx, ebx
je 0x462aaf
push 4
push 0
push 0
push 4
push ebx
mov dword [edi + 0x10c], 0x2714
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
mov dword [ebp - 0x228], esi
test esi, esi
je 0x462aa8
push 0x20a
lea eax, [ebp - 0x21c]
push 0
push eax
call fcn.004a8960
push 0xffffffffffffffff
push esi
lea eax, [ebp - 0x21c]
push 0x105
push eax
call fcn.004b6dbc
add esp, 0x1c
lea eax, [ebp - 0x21c]
lea ecx, [ebp - 0x220]
push eax
call fcn.0041c970
push 0x4f6850
push 0x4f5928
lea ecx, [ebp - 0x220]
mov dword [ebp - 4], 0
call fcn.00420700
push dword [ebp - 0x220]
lea ecx, [ebp - 0x234]
call fcn.00457440
mov byte [ebp - 4], 1
call fcn.0041bed0
mov ecx, eax
test ecx, ecx
jne 0x4629f3
push 0x80004005
call fcn.0041cdf0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x224], eax
lea eax, [ebp - 0x224]
mov byte [ebp - 4], 2
push eax
push 0x4f6854
lea ecx, [ebp - 0x234]
call fcn.00457670
mov esi, dword [ebp - 0x224]
test eax, eax
je 0x462a51
push esi
call fcn.004b11f4
add esp, 4
mov dword [edi + 0x10c], eax
call fcn.0047f030
mov ecx, dword [edi + 0x10c]
test ecx, ecx
je 0x462a51
mov dword [eax + 0x18], ecx
mov eax, dword [eax + 0x28]
test eax, eax
je 0x462a51
mov dword [eax + 0x20], ecx
push dword [ebp - 0x228]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
lea edx, [esi - 0x10]
mov byte [ebp - 4], 1
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x462a7b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x234]
call fcn.0045a190
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x220]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x462aa8
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [edi + 0x10c]
test eax, eax
je 0x462ae4
push eax
push str.Write_the_NewSupplyID:__d
push 0x515488
call fcn.0048d4b0
add esp, 0xc
mov ecx, edi
push dword [edi + 0x10c]
call fcn.004650b0
jmp 0x462ae4
mov eax, dword [ebp + 0xc]
mov dword [edi + 0x10c], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a5d13
mov esp, ebp
pop ebp
ret 8
Function at 0x462c00
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d8840
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x511070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x14], eax
mov ecx, dword [eax + 0x4c]
xor ebx, ebx
sub ecx, 0x10
call fcn.0041c670
add eax, 0x10
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], ebx
call fcn.00489040
lea ecx, [ebp - 0x10]
call fcn.004890f0
mov esi, dword [ebp - 0x10]
mov ecx, dword [esi - 0xc]
test ecx, ecx
je 0x462c8e
lea eax, [ecx - 1]
test eax, eax
js 0x462d28
cmp eax, ecx
jg 0x462d28
movzx eax, word [esi + eax*2]
cmp eax, 0x5c
je 0x462c8e
cmp eax, 0x2f
je 0x462c8e
push str.0s
lea ecx, [ebp - 0x10]
call fcn.0041c190
mov esi, dword [ebp - 0x10]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
or edi, 0xffffffff
test eax, eax
je 0x462cf6
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
push str.0s
add edx, 0x5c
call fcn.0041c010
add esp, 4
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
call fcn.0041c490
mov byte [ebp - 4], 0
mov eax, edi
mov edx, dword [ebp - 0x18]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x462ce2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.0041c6d0
mov esi, dword [ebp - 0x10]
mov ebx, 1
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], edi
dec edi
test edi, edi
jg 0x462d12
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.0041cdf0
int3
Function at 0x462d40
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d8876
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x511070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x228], edi
mov eax, dword [ebp + 0xc]
push 0x208
mov dword [ebp - 0x220], eax
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004a8960
add esp, 0xc
call fcn.0041bed0
mov ecx, eax
test ecx, ecx
jne 0x462daa
push 0x80004005
call fcn.0041cdf0
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x21c], esi
or ebx, 0xffffffff
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
je 0x462de1
push dword [ebp - 0x220]
mov ecx, edi
call fcn.00462c00
test eax, eax
je 0x462de1
lea edi, [ebx + 2]
jmp 0x462e98
push 0
push 0x26
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov edi, eax
test edi, edi
je 0x462e98
lea eax, [ebp - 0x224]
push eax
call fcn.00462b30
push eax
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 1
call fcn.0041c6d0
mov byte [ebp - 4], 0
mov eax, ebx
mov edx, dword [ebp - 0x224]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x462e3b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x21c]
mov eax, dword [esi - 0xc]
test eax, eax
je 0x462e5e
jns 0x462e54
push 0x80070057
call fcn.0041cdf0
mov ax, word [esi]
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
mov eax, dword [ebp - 0x228]
push str.0s
push dword [eax + 0x5c]
lea eax, [ebp - 0x218]
push str.TencentQQPCMgr_
push eax
push str._s_s_s_s
push dword [ebp - 0x220]
call fcn.00421db0
add esp, 0x18
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x462eb4
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a5d13
mov esp, ebp
pop ebp
ret 8
Function at 0x463140
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d88e0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x511070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0
call fcn.0041bed0
mov ecx, eax
test ecx, ecx
jne 0x46318d
push 0x80004005
call fcn.0041cdf0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x4631aa
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push 0x20019
push 0
push str.SOFTWARETencentQQPCMgr
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x14]
push eax
push str.InstallDir
lea ecx, [ebp - 0x10]
call fcn.00440780
mov esi, dword [ebp - 0x14]
cmp dword [esi - 0xc], 0
jne 0x4631fb
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00463010
mov edi, eax
neg edi
sbb edi, edi
neg edi
jmp 0x46323a
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x46320a
xor edi, edi
jmp 0x46323a
push dword [ebp + 0xc]
lea ecx, [ebp - 0x10]
push str.Version
call fcn.00440780
mov edi, eax
test edi, edi
je 0x46323a
lea ecx, [ebp - 0x14]
call fcn.00489000
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
push eax
lea ecx, [ecx + 0x4c]
call fcn.0041c6d0
mov esi, dword [ebp - 0x14]
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x463256
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x463264
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x463280
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d8910
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x511070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
call fcn.004634c0
test eax, eax
je 0x463354
cmp eax, 2
jne 0x46330b
push 0x4f690c
push 0x515488
call fcn.0048d4b0
add esp, 8
cmp dword [esi + 0x38], 0
je 0x4632da
cmp dword [esi + 4], 2
jne 0x4632ee
push 0
push 0x4f6930
push 0x4f6944
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, dword [esi]
mov ecx, esi
push 0x1d
call dword [eax + 0x1c]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x4f696c
push 0x515488
call fcn.0048d4b0
add esp, 8
cmp dword [esi + 0x38], 0
jne 0x463337
push 0
push 0x4f6930
push 0x4f698c
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, dword [esi]
mov ecx, esi
push 0x12
call dword [eax + 0x1c]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, esi
call fcn.00462f10
cmp dword [esi + 0x38], 0
jne 0x46347f
mov ecx, esi
test eax, eax
je 0x463372
push str._uid
jmp 0x463377
push 0x4f69d0
call fcn.00465c30
test eax, eax
jne 0x4633af
push str.failed_to_close_rtp
push 0x515488
call fcn.0048d4b0
mov eax, dword [esi]
add esp, 8
mov ecx, esi
push 4
call dword [eax + 0x1c]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ebx, [esi + 0x4c]
push str.QQRepair.exe
mov edx, ebx
lea ecx, [ebp - 0x10]
call fcn.0041c010
add esp, 4
mov dword [ebp - 4], 0
mov ecx, dword [eax]
call fcn.0045b410
mov dword [ebp - 4], 0xffffffff
or edi, 0xffffffff
mov edx, dword [ebp - 0x10]
mov eax, edi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4633f6
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push str.QQRepair.exetmp
mov edx, ebx
lea ecx, [ebp - 0x18]
call fcn.0041c010
add esp, 4
mov esi, eax
push str.QQRepair.exe
mov edx, ebx
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.0041c010
add esp, 4
push dword [esi]
push dword [eax]
call fcn.004af8ea
mov edx, dword [ebp - 0x14]
add esp, 8
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x463449
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x18]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x463468
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test eax, eax
je 0x463468
mov ecx, esi
call fcn.00463590
test eax, eax
jne 0x463468
mov eax, dword [esi]
mov ecx, esi
push 7
call dword [eax + 0x1c]
push 0x4f6a0c
push 0x515488
call fcn.0048d4b0
add esp, 8
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret