joyce8/EMBER2024-capa huggingface dataset:
Function at 0x446000
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47a8f8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x49f008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x24]
mov dword [ebp - 0x24], eax
lea ecx, [ebp + 0xc]
mov dword [ebp - 4], 0
cmp eax, ecx
je 0x44604f
push 0xffffffffffffffff
push 0
push ecx
mov ecx, eax
call fcn.00407ed0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov byte [ebp - 4], 1
cmp dword [edi + 0x14], 8
jb 0x446070
mov edi, dword [edi]
push dword [ebp + 0x28]
lea ecx, [ebp - 0x30]
push edi
push ebx
call fcn.00428c30
mov ebx, dword [ebp - 0x30]
test eax, eax
jne 0x446140
cmp dword [esi + 0x14], 8
jb 0x446092
mov eax, dword [esi]
jmp 0x446094
mov eax, esi
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push ecx
push 0
lea ecx, [ebp - 0x14]
push ecx
push 0
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x446140
mov eax, dword [ebp - 0x14]
cmp eax, 1
je 0x4460c4
cmp eax, 2
jne 0x446140
mov eax, dword [ebp - 0x10]
shr eax, 1
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
push ecx
inc eax
mov dword [ebp - 0x14], 0
push eax
lea ecx, [ebp - 0x20]
call fcn.00446760
cmp dword [esi + 0x14], 8
jb 0x446102
mov esi, dword [esi]
mov edi, dword [ebp - 0x20]
lea eax, [ebp - 0x10]
push eax
push edi
push esi
lea ecx, [ebp - 0x30]
call fcn.00428ce0
test eax, eax
je 0x44611b
xor esi, esi
jmp 0x446129
mov ecx, dword [ebp - 0x24]
push edi
call fcn.0042daa0
mov esi, 1
test edi, edi
je 0x446142
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x20]
sub eax, edi
sar eax, 1
push eax
push edi
call fcn.00407760
jmp 0x446142
xor esi, esi
test ebx, ebx
je 0x44614d
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0x20]
cmp ecx, 8
jb 0x446162
inc ecx
push ecx
push dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
call fcn.00407760
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x446180
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [ecx + 0x14], 8
mov eax, dword [ebp + 0x20]
push esi
mov esi, edx
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
jb 0x4461a9
mov ecx, dword [ecx]
push edi
sub esp, 8
push dword [ebp + 0x24]
sub esp, 8
push ecx
push eax
lea ecx, [ebp - 0xc]
call fcn.00446960
mov edi, dword [ebp - 0xc]
test eax, eax
jne 0x44620f
cmp dword [ebp + 0x1c], 8
lea edx, [ebp + 8]
cmovae edx, dword [ebp + 8]
cmp dword [esi + 0x14], 8
jb 0x4461d7
mov esi, dword [esi]
test edx, edx
je 0x44620f
mov ecx, edx
push ebx
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4461e1
sub ecx, ebx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push 0
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop ebx
test eax, eax
jne 0x44620f
lea esi, [eax + 1]
jmp 0x446211
xor esi, esi
test edi, edi
je 0x44621c
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0x1c]
pop edi
cmp ecx, 8
jb 0x446232
inc ecx
push ecx
push dword [ebp + 8]
lea ecx, [ebp + 8]
call fcn.00407760
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x449520
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47adab
mov eax, dword fs:[0]
push eax
sub esp, 0x244
mov eax, dword [0x49f008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov esi, ecx
mov dword [ebp - 0x24c], esi
mov dword [ebp - 0x250], 0
mov dword [ebp - 0x248], 0
mov dword [ebp - 0x244], 0
mov dword [ebp - 0x240], 0
push 0
push 2
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4495b1
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
jmp 0x449646
push 0x228
lea eax, [ebp - 0x238]
push 0
push eax
call fcn.00451eb0
add esp, 0xc
mov dword [ebp - 0x23c], 0x22c
lea eax, [ebp - 0x23c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x449625
push dword [ebx + 0x10]
lea eax, [ebp - 0x218]
mov ecx, ebx
push eax
call fcn.00407470
push eax
call fcn.004630ac
add esp, 0xc
test eax, eax
jne 0x449613
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x248]
call fcn.0042f790
lea eax, [ebp - 0x23c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x4495e3
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x248]
mov dword [esi], eax
mov eax, dword [ebp - 0x244]
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x240]
mov dword [esi + 8], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044df7a
mov esp, ebp
pop ebp
ret

Function at 0x449990
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x40
mov eax, dword [0x49f008]
xor eax, esp
mov dword [esp + 0x3c], eax
mov eax, dword [0x4a2130]
test eax, eax
jne 0x449a74
lea eax, [esp]
mov dword [esp + 4], 0x10
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x4499fd
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x449a6f
mov dword [0x4a2130], 1
mov eax, 1
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.0044df7a
mov esp, ebp
pop ebp
ret
lea eax, [esp + 8]
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x449a66
mov eax, dword [esp + 8]
xorps xmm0, xmm0
movaps xmmword [esp + 0x10], xmm0
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x18], eax
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x30]
mov dword [esp + 0x14], 1
push eax
push 0x10
lea eax, [esp + 0x1c]
mov dword [esp + 0x28], reloc.OLEAUT32.dll_VariantInit
push eax
push 0
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x449a66
mov dword [0x4a2130], 1
push dword [esp]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x4a2130]
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.0044df7a
mov esp, ebp
pop ebp
ret
Function at 0x449daf
Capabilities:
Check if file exists
Get file version info

Disassembly:
push 0x280
mov eax, 0x47aedd
call fcn.00476020
mov dword [ebp - 0x284], edx
mov esi, ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x288], eax
test esi, esi
je 0x449fd2
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x449fd2
lea eax, [ebp - 0x268]
xor ebx, ebx
push eax
push esi
mov dword [ebp - 0x268], ebx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov edi, eax
test edi, edi
je 0x449fd2
mov dword [ebp - 0x278], ebx
mov dword [ebp - 0x274], ebx
mov dword [ebp - 0x270], ebx
lea eax, [ebp - 0x25d]
mov dword [ebp - 4], ebx
push eax
lea eax, [edi + 1]
mov byte [ebp - 0x25d], bl
push eax
lea ecx, [ebp - 0x278]
call fcn.00447e00
push dword [ebp - 0x278]
push edi
push dword [ebp - 0x268]
push esi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x449fc3
mov esi, dword [sym.imp.VERSION.dll_VerQueryValueW]
lea eax, [ebp - 0x27c]
push eax
lea eax, [ebp - 0x26c]
mov dword [ebp - 0x26c], ebx
push eax
push str.VarFileInfoTranslation
push dword [ebp - 0x278]
mov dword [ebp - 0x27c], ebx
call esi
test eax, eax
je 0x449fc3
mov ecx, dword [ebp - 0x26c]
push str.ProductVersion
movzx eax, word [ecx + 2]
push eax
movzx eax, word [ecx]
push eax
push str.StringFileInfo_04x_04x_ls
mov eax, 0x104
push eax
push eax
lea eax, [ebp - 0x22c]
push eax
call fcn.0044a51b
add esp, 0x1c
mov dword [ebp - 0x264], ebx
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x264]
push eax
lea eax, [ebp - 0x22c]
push eax
push dword [ebp - 0x278]
call esi
test eax, eax
je 0x449fc3
cmp dword [ebp - 0x264], ebx
je 0x449fc3
push dword [ebp - 0x264]
lea ecx, [ebp - 0x244]
call fcn.004074c0
inc ebx
lea ecx, [ebp - 0x244]
push 0x490e58
mov byte [ebp - 4], bl
call fcn.00415540
xor eax, eax
mov word [ebp - 0x20], ax
mov esi, eax
mov dword [ebp - 0x1e], eax
mov edi, eax
mov word [ebp - 0x1a], ax
push 0x490e58
call fcn.004069b0
pop ecx
push eax
push esi
push ecx
lea ecx, [ebp - 0x244]
call fcn.0044a484
mov dword [ebp - 0x280], eax
cmp eax, 0xffffffff
je 0x449fb6
sub eax, esi
lea ecx, [ebp - 0x244]
push eax
push esi
lea eax, [ebp - 0x25c]
push eax
call fcn.00420980
cmp dword [eax + 0x14], 8
jb 0x449f66
mov eax, dword [eax]
push eax
call fcn.004621c7
pop ecx
lea ecx, [ebp - 0x25c]
mov word [ebp + edi*2 - 0x20], ax
call fcn.00407480
mov esi, dword [ebp - 0x280]
inc esi
inc edi
cmp edi, 4
jl 0x449f24
movzx ecx, word [ebp - 0x20]
movzx eax, word [ebp - 0x1e]
shl ecx, 0x10
or ecx, eax
mov eax, dword [ebp - 0x284]
mov dword [eax], ecx
movzx ecx, word [ebp - 0x1a]
movzx eax, word [ebp - 0x18]
shl ecx, 0x10
or ecx, eax
mov eax, dword [ebp - 0x288]
mov dword [eax], ecx
jmp 0x449fb8
xor ebx, ebx
lea ecx, [ebp - 0x244]
call fcn.00407480
lea ecx, [ebp - 0x278]
call fcn.0043dfa0
mov eax, ebx
jmp 0x449fd4
xor eax, eax
call fcn.00475fdb
ret
Function at 0x449fda
Capabilities:
Check os version
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x330
mov eax, dword [0x49f008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x4a03d8]
push esi
xor esi, esi
push edi
mov edi, 0xfffffc18
cmp eax, 0xffffffff
jne 0x44a155
push 0x110
lea eax, [ebp - 0x324]
mov dword [0x4a03d8], edi
push esi
push eax
mov dword [ebp - 0x328], 0x114
call fcn.00451eb0
add esp, 0xc
lea eax, [ebp - 0x328]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x44a14b
cmp dword [ebp - 0x318], 2
jne 0x44a14b
cmp dword [ebp - 0x324], 5
jne 0x44a0e0
mov eax, dword [ebp - 0x320]
test eax, eax
jne 0x44a06d
inc eax
mov dword [0x4a03d8], eax
jmp 0x44a1fc
cmp eax, 1
jne 0x44a0d1
push 0x7f
lea eax, [ebp - 0x314]
push eax
push str.Service_Pack_1
call fcn.004630ac
add esp, 0xc
test eax, eax
jne 0x44a091
push 3
pop eax
jmp 0x44a063
push 0x7f
lea eax, [ebp - 0x314]
push eax
push str.Service_Pack_2
call fcn.004630ac
add esp, 0xc
test eax, eax
jne 0x44a0af
push 4
jmp 0x44a08e
push 0x7f
lea eax, [ebp - 0x314]
push eax
push str.Service_Pack_3
call fcn.004630ac
add esp, 0xc
neg eax
sbb eax, eax
and eax, 0xfffffffd
add eax, 5
jmp 0x44a063
cmp eax, 2
jne 0x44a14b
push 6
pop eax
mov dword [0x4a03d8], eax
jmp 0x44a150
cmp dword [ebp - 0x324], 6
jne 0x44a14b
cmp dword [ebp - 0x320], esi
jne 0x44a137
push 0x7f
lea eax, [ebp - 0x314]
push eax
push str.Service_Pack_1
call fcn.004630ac
add esp, 0xc
test eax, eax
jne 0x44a112
push 8
jmp 0x44a08e
push 0x7f
lea eax, [ebp - 0x314]
push eax
push str.Service_Pack_2
call fcn.004630ac
add esp, 0xc
neg eax
sbb eax, eax
and eax, 0xfffffffe
add eax, 9
jmp 0x44a063
cmp dword [ebp - 0x320], 1
mov eax, dword [0x4a03d8]
push 0xa
pop ecx
cmove eax, ecx
jmp 0x44a0d9
mov eax, dword [0x4a03d8]
cmp eax, 0xffffffff
je 0x44a15d
cmp eax, edi
jne 0x44a1fc
push 0x208
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.00451eb0
add esp, 0xc
lea eax, [ebp - 0x210]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str.kernel32.dll
lea eax, [ebp - 0x210]
push eax
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x330]
mov dword [ebp - 0x32c], esi
push eax
lea edx, [ebp - 0x32c]
mov dword [ebp - 0x330], esi
lea ecx, [ebp - 0x210]
call fcn.00449daf
pop ecx
test eax, eax
je 0x44a1f7
mov eax, dword [ebp - 0x32c]
cmp eax, 0x60002
jne 0x44a1d4
push 0xb
jmp 0x44a08e
cmp eax, 0x60003
jne 0x44a1e2
push 0xc
jmp 0x44a08e
cmp eax, 0xa0000
je 0x44a1f0
cmp eax, 0x60004
jne 0x44a1f7
push 0xd
jmp 0x44a08e
mov eax, dword [0x4a03d8]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0044df7a
mov esp, ebp
pop ebp
ret
Function at 0x44a20c
Capabilities:
Check os version

Disassembly:
push 0x12c
mov eax, 0x47af32
call fcn.00476020
mov esi, ecx
mov dword [ebp - 0x12c], esi
xor edi, edi
mov dword [ebp - 0x134], esi
mov dword [ebp - 0x130], edi
mov dword [esi + 0x10], edi
push edi
mov dword [esi + 0x14], 7
call fcn.004078d0
xor ebx, ebx
mov dword [ebp - 4], edi
lea eax, [ebp - 0x128]
mov dword [ebp - 0x128], 0x114
inc ebx
push eax
mov dword [ebp - 0x130], ebx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [ebp - 0x118]
sub eax, edi
je 0x44a400
sub eax, ebx
je 0x44a3a6
sub eax, ebx
je 0x44a288
push str.Unknown
jmp 0x44a405
mov eax, dword [ebp - 0x124]
cmp eax, 5
jne 0x44a2f6
mov eax, dword [ebp - 0x120]
cmp eax, 2
jne 0x44a2bb
push str.Windows_2003
mov ecx, esi
call fcn.0042daa0
mov eax, dword [ebp - 0x124]
cmp eax, 5
jne 0x44a2f6
mov eax, dword [ebp - 0x120]
cmp eax, ebx
jne 0x44a2dc
push str.Windows_XP
mov ecx, esi
call fcn.0042daa0
mov eax, dword [ebp - 0x124]
cmp eax, 5
jne 0x44a2f6
mov eax, dword [ebp - 0x120]
test eax, eax
jne 0x44a40c
push str.Windows_2000
mov ecx, esi
call fcn.0042daa0
mov eax, dword [ebp - 0x124]
cmp eax, 4
ja 0x44a30d
push str.Windows_NT
mov ecx, esi
call fcn.0042daa0
mov eax, dword [ebp - 0x124]
push 6
pop edi
cmp eax, edi
jne 0x44a39a
mov eax, dword [ebp - 0x120]
test eax, eax
jne 0x44a33e
push str.Windows_Vista
mov ecx, esi
call fcn.0042daa0
mov eax, dword [ebp - 0x124]
cmp eax, edi
jne 0x44a39a
mov eax, dword [ebp - 0x120]
cmp eax, ebx
jne 0x44a35e
push str.Windows_7
mov ecx, esi
call fcn.0042daa0
mov eax, dword [ebp - 0x124]
cmp eax, edi
jne 0x44a39a
mov eax, dword [ebp - 0x120]
cmp eax, 2
jne 0x44a37f
push str.Windows_8
mov ecx, esi
call fcn.0042daa0
mov eax, dword [ebp - 0x124]
cmp eax, edi
jne 0x44a39a
mov eax, dword [ebp - 0x120]
cmp eax, 3
jne 0x44a40c
push str.Windows_8.1
mov ecx, esi
call fcn.0042daa0
mov eax, dword [ebp - 0x124]
cmp eax, 0xa
jne 0x44a40c
push str.Windows_10
jmp 0x44a405
cmp dword [ebp - 0x124], 4
jne 0x44a40c
mov eax, dword [ebp - 0x120]
test eax, eax
jne 0x44a3d4
push str.Windows_95
mov ecx, esi
call fcn.0042daa0
cmp dword [ebp - 0x124], 4
jne 0x44a40c
mov eax, dword [ebp - 0x120]
cmp eax, 0xa
jne 0x44a3f4
push str.Windows_98
mov ecx, esi
call fcn.0042daa0
cmp dword [ebp - 0x124], 4
jne 0x44a40c
mov eax, dword [ebp - 0x120]
cmp eax, 0x5a
jne 0x44a40c
push str.Windows_ME
jmp 0x44a405
push str.Windows_Win32s
mov ecx, esi
call fcn.0042daa0
lea ecx, [ebp - 0x12c]
call fcn.00408df0
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x12c]
push dword [ebp - 0x11c]
push dword [ebp - 0x120]
push dword [ebp - 0x124]
push str.__build_d._d._d_
push eax
call fcn.00415030
add esp, 0x14
cmp word [ebp - 0x114], 0
je 0x44a464
push 0x48f814
mov ecx, esi
call fcn.00415540
lea eax, [ebp - 0x114]
mov ecx, esi
push eax
call fcn.00415540
push dword [ebp - 0x12c]
mov ecx, esi
call fcn.00415540
lea ecx, [ebp - 0x12c]
call fcn.00407520
mov eax, esi
call fcn.00475fdb
ret
Function at 0x44a872
Capabilities:
Copy file
Delete file
Get file size
Read file on windows

Disassembly:
push 0x3c
mov eax, 0x47b00b
call fcn.00476020
mov edi, ecx
xor dl, dl
lea ecx, [ebp - 0x44]
xor ebx, ebx
call fcn.0044aa9c
push ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x44]
cmp dword [ebp - 0x30], 8
push ebx
cmovae eax, dword [ebp - 0x44]
xor ecx, ecx
push 3
push ebx
inc ecx
push ecx
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x44a941
xor eax, eax
lea ecx, [ebp - 0x2c]
lea edx, [eax + 1]
call fcn.0044aa9c
lea ecx, [ebp - 0x44]
call fcn.0044aeeb
test al, al
jne 0x44a914
lea ecx, [ebp - 0x2c]
call fcn.0044aeeb
test al, al
je 0x44a914
cmp dword [ebp - 0x30], 8
lea ecx, [ebp - 0x44]
push ebx
cmovae ecx, dword [ebp - 0x44]
lea eax, [ebp - 0x2c]
cmp dword [ebp - 0x18], 8
push ecx
cmovae eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x44a914
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
push ebx
cmovae eax, dword [ebp - 0x2c]
push ebx
push 3
push ebx
push 1
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
lea ecx, [ebp - 0x2c]
mov esi, eax
call fcn.00407480
cmp esi, 0xffffffff
je 0x44a978
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x10
jb 0x44a971
push ebx
lea eax, [ebp - 0x48]
mov dword [ebp - 0x48], ebx
push eax
push 0x10
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x44a971
cmp dword [ebp - 0x48], 0x10
push 1
movzx ebx, bl
pop ecx
cmove ebx, ecx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x44]
call fcn.00407480
mov al, bl
call fcn.00475fdb
ret

Function at 0x44a988
Capabilities:
Write file on windows

Disassembly:
push 0x3c
mov eax, 0x47b00b
call fcn.00476020
mov edi, ecx
xor dl, dl
lea ecx, [ebp - 0x44]
xor ebx, ebx
call fcn.0044aa9c
push ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x44]
cmp dword [ebp - 0x30], 8
push ebx
cmovae eax, dword [ebp - 0x44]
xor ecx, ecx
push 2
push ebx
inc ecx
push ecx
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x44aa06
xor eax, eax
lea ecx, [ebp - 0x2c]
lea edx, [eax + 1]
call fcn.0044aa9c
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
push ebx
cmovae eax, dword [ebp - 0x2c]
push ebx
push 2
push ebx
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
lea ecx, [ebp - 0x2c]
mov esi, eax
call fcn.00407480
cmp esi, 0xffffffff
je 0x44aa2d
push ebx
lea eax, [ebp - 0x48]
push eax
push 0x10
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x44aa26
cmp dword [ebp - 0x48], 0x10
push 1
movzx ebx, bl
pop ecx
cmove ebx, ecx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x44]
call fcn.00407480
mov al, bl
call fcn.00475fdb
ret
Function at 0x44aa9c
Capabilities:
Get common file path
Get startup folder

Disassembly:
push 0x234
mov eax, 0x47b05d
call fcn.00476020
mov bl, dl
mov esi, ecx
mov dword [ebp - 0x23c], esi
xor eax, eax
mov dword [ebp - 0x240], esi
mov dword [ebp - 0x238], eax
mov dword [esi + 0x10], eax
push eax
mov dword [esi + 0x14], 7
call fcn.004078d0
and dword [ebp - 4], 0
lea eax, [ebp - 0x21c]
push 0x208
xor edi, edi
push 0
inc edi
push eax
mov dword [ebp - 0x238], edi
call fcn.00451eb0
add esp, 0xc
test bl, bl
push edi
push 0x23
pop eax
push 0x1a
pop ecx
cmovne eax, ecx
push eax
lea eax, [ebp - 0x21c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x44ab7b
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x234]
call fcn.004074c0
push 0xffffffffffffffff
push 0
push eax
mov ecx, esi
mov dword [ebp - 4], edi
call fcn.00412f40
lea ecx, [ebp - 0x234]
mov byte [ebp - 4], 0
call fcn.00407480
mov ecx, esi
test bl, bl
je 0x44ab53
push str.TencentDeskUpdate
jmp 0x44ab58
push str.TencentDesktop
call fcn.00415540
mov ecx, esi
call fcn.0044ab83
test al, al
jne 0x44ab6f
mov ecx, esi
call fcn.0044ac43
push str.Global.db
mov ecx, esi
call fcn.00415540
mov eax, esi
call fcn.00475fdb
ret
Function at 0x44ac43
Capabilities:
Create directory

Disassembly:
push 0x69c
mov eax, 0x47b115
call fcn.00476020
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x10], ebx
jne 0x44ac62
xor al, al
jmp 0x44aed8
push esi
lea ecx, [ebp - 0x678]
call fcn.00411b10
mov dword [ebp - 4], ebx
cmp dword [esi + 0x14], 8
mov eax, dword [esi + 0x10]
jb 0x44ac7c
mov esi, dword [esi]
push 0x5c
pop ecx
cmp word [esi + eax*2 - 2], cx
je 0x44acb7
push 0x48edf8
lea ecx, [ebp - 0x660]
call fcn.004074c0
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x678]
mov byte [ebp - 4], 1
call fcn.00412f40
lea ecx, [ebp - 0x660]
mov byte [ebp - 4], bl
call fcn.00407480
cmp dword [ebp - 0x664], 8
lea ecx, [ebp - 0x418]
mov edx, 0x100
lea eax, [ebp - 0x678]
cmovae eax, dword [ebp - 0x678]
push edx
push ecx
push edx
lea ecx, [ebp - 0x618]
push ecx
push edx
lea ecx, [ebp - 0x218]
push ecx
push 3
lea ecx, [ebp - 0x18]
push ecx
push eax
call fcn.0046349a
add esp, 0x24
lea ecx, [ebp - 0x690]
push 0x48edf8
call fcn.004074c0
mov esi, eax
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x660]
call fcn.004074c0
push esi
mov edx, eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x648]
call fcn.0044a590
pop ecx
lea ecx, [ebp - 0x660]
call fcn.00407480
lea ecx, [ebp - 0x690]
mov byte [ebp - 4], 6
call fcn.00407480
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x630]
call fcn.004074c0
lea ecx, [ebp - 0x648]
mov byte [ebp - 4], 7
call fcn.0044ab83
test al, al
je 0x44aeb5
cmp dword [ebp - 0x620], 0
je 0x44aeb5
cmp dword [ebp - 0x61c], 8
lea eax, [ebp - 0x630]
push 0x5c
cmovae eax, dword [ebp - 0x630]
pop ecx
cmp word [eax], cx
jne 0x44adce
cmp dword [ebp - 0x61c], 8
lea ecx, [ebp - 0x630]
lea eax, [ebp - 0x630]
cmovae ecx, dword [ebp - 0x630]
cmovae eax, dword [ebp - 0x630]
sub ecx, eax
sar ecx, 1
push 1
push ecx
lea ecx, [ebp - 0x630]
call fcn.004083f0
push ecx
push ecx
lea ecx, [ebp - 0x630]
call fcn.0044af41
mov esi, eax
jmp 0x44aeaa
push esi
push ebx
lea eax, [ebp - 0x660]
push eax
lea ecx, [ebp - 0x630]
call fcn.00420980
lea eax, [esi + 1]
mov byte [ebp - 4], 8
push eax
push ebx
lea ecx, [ebp - 0x630]
call fcn.004083f0
push 0x48edf8
lea ecx, [ebp - 0x6a8]
call fcn.004074c0
push eax
lea edx, [ebp - 0x660]
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x690]
call fcn.0044a540
pop ecx
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x648]
mov byte [ebp - 4], 0xa
call fcn.00412f40
lea ecx, [ebp - 0x690]
call fcn.00407480
lea ecx, [ebp - 0x6a8]
mov byte [ebp - 4], 8
call fcn.00407480
lea ecx, [ebp - 0x648]
call fcn.0044ab83
test al, al
jne 0x44ae8c
cmp dword [ebp - 0x634], 8
lea eax, [ebp - 0x648]
cmovae eax, dword [ebp - 0x648]
push eax
call fcn.00463c70
pop ecx
test eax, eax
jne 0x44aede
push ecx
push ecx
lea ecx, [ebp - 0x630]
call fcn.0044af41
lea ecx, [ebp - 0x660]
mov byte [ebp - 4], 7
mov esi, eax
call fcn.00407480
cmp esi, 0xffffffff
jne 0x44ade2
mov bl, 1
lea ecx, [ebp - 0x630]
call fcn.00407480
lea ecx, [ebp - 0x648]
call fcn.00407480
lea ecx, [ebp - 0x678]
call fcn.00407480
mov al, bl
call fcn.00475fdb
ret
lea ecx, [ebp - 0x660]
call fcn.00407480
jmp 0x44aeb5