joyce8/EMBER2024-capa huggingface dataset:
Function at 0x462aa4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
and dword [ebp - 0x2c], 0
push edi
push 7
xor eax, eax
test edx, edx
pop ecx
lea edi, [ebp - 0x28]
rep stosd dword es:[edi], eax
jne 0x462ac2
jmp 0x462c33
push ebx
push esi
lea eax, [edx + 0x20]
mov esi, eax
push 8
pop ebx
mov ecx, ebx
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [edx + 0x40]
mov ecx, 0x4d34d34d
add esi, ecx
add dword [eax], esi
mov eax, dword [eax]
cmp eax, dword [ebp - 0x4c]
mov eax, 0x2cb2cb2d
sbb esi, esi
neg esi
sub esi, eax
add dword [edx + 0x24], esi
mov esi, dword [edx + 0x24]
cmp esi, dword [ebp - 0x48]
mov esi, 0x34d34d34
sbb edi, edi
neg edi
add edi, esi
add dword [edx + 0x28], edi
mov edi, dword [edx + 0x28]
cmp edi, dword [ebp - 0x44]
mov dword [ebp - 0xc], ebx
sbb edi, edi
neg edi
add edi, ecx
add dword [edx + 0x2c], edi
mov edi, dword [edx + 0x2c]
cmp edi, dword [ebp - 0x40]
sbb edi, edi
neg edi
sub edi, eax
add dword [edx + 0x30], edi
mov edi, dword [edx + 0x30]
cmp edi, dword [ebp - 0x3c]
sbb edi, edi
neg edi
add edi, esi
add dword [edx + 0x34], edi
mov esi, dword [edx + 0x34]
cmp esi, dword [ebp - 0x38]
sbb esi, esi
neg esi
add esi, ecx
add dword [edx + 0x38], esi
mov ecx, dword [edx + 0x38]
cmp ecx, dword [ebp - 0x34]
mov esi, edx
sbb ecx, ecx
neg ecx
sub ecx, eax
add dword [edx + 0x3c], ecx
mov eax, dword [edx + 0x3c]
cmp eax, dword [ebp - 0x30]
mov dword [ebp - 8], esi
sbb eax, eax
neg eax
mov dword [edx + 0x40], eax
lea eax, [ebp - 0x2c]
sub eax, edx
mov ecx, dword [esi + 0x20]
add ecx, dword [esi]
movzx edi, cx
mov esi, ecx
shr esi, 0x10
mov dword [ebp - 4], esi
imul esi, edi
mov ebx, edi
imul ebx, edi
shr ebx, 0x11
add ebx, esi
mov esi, dword [ebp - 4]
imul esi, esi
shr ebx, 0xf
add ebx, esi
mov esi, ecx
imul esi, ecx
xor ebx, esi
mov esi, dword [ebp - 8]
mov dword [eax + esi], ebx
add esi, 4
dec dword [ebp - 0xc]
mov dword [ebp - 8], esi
jne 0x462b6b
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x2c]
mov edi, dword [ebp - 0x10]
mov esi, eax
rol esi, 0x10
add esi, ecx
rol edi, 0x10
add edi, esi
mov esi, ecx
rol esi, 8
add esi, dword [ebp - 0x28]
mov dword [edx], edi
add esi, dword [ebp - 0x10]
mov edi, dword [ebp - 0x28]
mov dword [edx + 4], esi
mov esi, dword [ebp - 0x24]
rol edi, 0x10
add edi, esi
rol ecx, 0x10
add ecx, edi
mov edi, dword [ebp - 0x20]
mov dword [edx + 8], ecx
mov ecx, esi
rol ecx, 8
add ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0x28]
rol edi, 0x10
rol esi, 0x10
mov dword [edx + 0xc], ecx
mov ecx, dword [ebp - 0x1c]
add edi, ecx
add esi, edi
mov dword [edx + 0x10], esi
mov esi, ecx
rol esi, 8
add esi, dword [ebp - 0x18]
add esi, dword [ebp - 0x20]
mov dword [edx + 0x14], esi
mov esi, dword [ebp - 0x18]
rol esi, 0x10
add esi, eax
rol ecx, 0x10
add ecx, esi
rol eax, 8
add eax, dword [ebp - 0x18]
pop esi
add eax, dword [ebp - 0x10]
mov dword [edx + 0x18], ecx
mov dword [edx + 0x1c], eax
xor eax, eax
inc eax
pop ebx
pop edi
leave
ret
Function at 0x462c7b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
test esi, esi
jne 0x462c88
xor eax, eax
leave
ret
push ebx
push edi
push 0xc
mov edi, str.QQPCMgrLibrary_s
pop ecx
mov eax, edi
call fcn.00462c36
mov ebx, eax
push 8
pop ecx
mov eax, edi
call fcn.00462c36
mov dword [ebp - 8], eax
push 4
pop ecx
mov eax, edi
call fcn.00462c36
mov dword [ebp - 4], eax
xor ecx, ecx
mov eax, edi
call fcn.00462c36
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [esi + 0x10], ecx
shr ecx, 0x10
mov edi, eax
shl edi, 0x10
or edi, ecx
mov dword [esi + 4], edi
mov ecx, eax
shr ecx, 0x10
mov edi, ebx
shl edi, 0x10
or ecx, edi
mov dword [esi + 0xc], ecx
mov ecx, edx
shl ecx, 0x10
mov edi, ebx
shr edi, 0x10
or ecx, edi
mov dword [esi + 0x14], ecx
mov ecx, dword [ebp - 4]
shl ecx, 0x10
mov edi, edx
shr edi, 0x10
or ecx, edi
mov dword [esi + 0x1c], ecx
mov ecx, dword [ebp - 4]
rol ecx, 0x10
mov dword [esi + 0x20], ecx
mov ecx, eax
rol ecx, 0x10
mov dword [esi + 0x28], ecx
mov ecx, ebx
rol ecx, 0x10
mov edi, edx
mov dword [esi + 0x30], ecx
mov ecx, edx
xor edi, ebx
rol ecx, 0x10
mov dword [esi + 0x38], ecx
mov ecx, 0xffff
and edi, ecx
xor edi, ebx
mov dword [esi + 0x24], edi
mov edi, dword [ebp - 4]
xor edi, edx
mov dword [esi + 8], edx
and edi, ecx
xor edi, edx
mov edx, eax
xor edx, dword [ebp - 4]
mov dword [esi], ebx
and edx, ecx
xor edx, dword [ebp - 4]
mov dword [esi + 0x18], eax
mov dword [esi + 0x34], edx
mov edx, eax
xor edx, ebx
mov dword [esi + 0x2c], edi
and edx, ecx
xor edx, eax
and dword [esi + 0x40], 0
push 4
mov dword [esi + 0x3c], edx
pop edi
mov edx, esi
call fcn.00462aa4
dec edi
jne 0x462d66
push 0xfffffffffffffffc
pop edx
push 8
mov ecx, esi
pop edi
mov ebx, dword [ecx]
mov eax, edx
and eax, 7
lea eax, [esi + eax*4 + 0x20]
xor dword [eax], ebx
add ecx, 4
inc edx
dec edi
jne 0x462d78
xor eax, eax
pop edi
inc eax
pop ebx
leave
ret
Function at 0x463522
Capabilities:
Create directory
Get file attributes

Disassembly:
push 0x14
mov eax, 0x4a309e
call fcn.00476f82
mov edi, ecx
and dword [ebp - 0x18], 0
lea esi, [ebp - 0x10]
call fcn.00463025
and dword [ebp - 4], 0
mov eax, dword [0x4d4a50]
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 1
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0x10
je 0x463664
mov edi, dword [ebp - 0x10]
mov eax, dword [edi - 8]
movzx eax, word [edi + eax*2 - 2]
cmp ax, 0x5c
mov esi, 0x4bef20
je 0x463586
push esi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [ebp - 0x10]
call fcn.00463376
mov edi, dword [ebp - 0x10]
mov eax, dword [edi - 8]
test eax, eax
jl 0x46359a
push esi
push edi
call sub.MSVCR80.dll_wcsstr
test eax, eax
pop ecx
pop ecx
jne 0x46359f
or eax, 0xffffffff
jmp 0x4635a3
sub eax, edi
sar eax, 1
cmp eax, 0xffffffff
je 0x463664
lea ecx, [eax + 1]
lea eax, [ebp - 0x1c]
push eax
lea ebx, [ebp - 0x10]
mov dword [ebp - 0x20], ecx
call fcn.004630b1
mov byte [ebp - 4], 2
mov eax, dword [eax]
push eax
mov eax, dword [eax - 8]
lea ecx, [ebp - 0x14]
call fcn.00463376
lea esi, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.0046327b
mov ebx, dword [ebp - 0x20]
test ebx, ebx
mov esi, dword [edi - 8]
jle 0x46361e
test esi, esi
jle 0x46361e
cmp ebx, esi
jle 0x4635f0
mov ebx, esi
lea eax, [ebp - 0x10]
call fcn.004633fd
mov edi, dword [ebp - 0x10]
mov eax, esi
sub eax, ebx
lea eax, [eax + eax + 2]
push eax
lea eax, [edi + ebx*2]
push eax
mov eax, dword [edi - 4]
lea eax, [eax + eax + 2]
push eax
push edi
call fcn.004068ff
add esp, 0x10
sub esi, ebx
mov dword [edi - 8], esi
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or esi, 0xffffffff
cmp eax, esi
jne 0x46363d
push 0
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x46366b
cmp dword [edi - 8], 0
jl 0x463654
push 0x4bef20
push edi
call sub.MSVCR80.dll_wcsstr
test eax, eax
pop ecx
pop ecx
jne 0x463658
mov eax, esi
jmp 0x46365c
sub eax, edi
sar eax, 1
cmp eax, esi
jne 0x4635ac
mov dword [ebp - 0x18], 1
lea esi, [ebp - 0x14]
call fcn.0046327b
lea esi, [ebp - 0x10]
call fcn.0046327b
mov eax, dword [ebp - 0x18]
call fcn.00477021
ret
Function at 0x463a9e
Capabilities:
Check if file exists
Extract resource via kernel32 functions
Get file attributes

Disassembly:
push 0x60
mov eax, 0x4a5221
call fcn.00476feb
mov esi, ecx
lea ebx, [ebp - 0x48]
mov dword [ebp - 0x50], esi
mov byte [ebp - 0x49], 0
call fcn.0046c9a2
and dword [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.00402f21
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.00435a77
test al, al
je 0x463afc
mov eax, ebx
push eax
lea ecx, [ebp - 0x6c]
call fcn.0046c6ed
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 2
call fcn.00428493
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 1
call fcn.00402f4a
jmp 0x463b05
push esi
lea ecx, [ebp - 0x2c]
call fcn.00428493
lea esi, [ebp - 0x2c]
call fcn.0046c79b
push 0x4bef24
lea ecx, [ebp - 0x6c]
call fcn.00406f58
lea ebx, [ebp - 0x6c]
mov edi, esi
mov byte [ebp - 4], 3
call fcn.0046c8ae
mov ecx, ebx
mov byte [ebp - 4], 1
call fcn.00402f4a
mov ecx, esi
call fcn.0041478d
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push eax
call ebx
cmp eax, 0xffffffff
mov eax, dword [ebp - 0x50]
je 0x463b54
and dword [eax + 0x1c], 0
jmp 0x463c15
lea esi, [ebp - 0x48]
mov dword [eax + 0x1c], 1
call fcn.0046c603
push 0x4bef3c
lea ecx, [ebp - 0x6c]
call fcn.00406f58
lea esi, [ebp - 0x6c]
lea edi, [ebp - 0x48]
mov byte [ebp - 4], 4
call fcn.0046c83a
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.00402f4a
mov ecx, edi
call fcn.0041478d
push eax
call ebx
cmp eax, 0xffffffff
je 0x463bac
mov ecx, dword [ebp - 0x50]
mov eax, edi
push eax
add ecx, 0x80
call fcn.00428493
jmp 0x463c11
push str.SKIN
push str.QMUIRES.dat
push dword [0x4d67c4]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x463c15
push esi
push dword [0x4d67c4]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x463c15
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x463c15
push esi
push dword [0x4d67c4]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, dword [ebp - 0x50]
mov edi, eax
add esi, 0xb0
mov eax, esi
call fcn.00466fee
push edi
push ebx
push dword [esi]
call sub.MSVCR80.dll_memcpy
add esp, 0xc
mov byte [ebp - 0x49], 1
lea ecx, [ebp - 0x2c]
call fcn.00402f4a
lea ecx, [ebp - 0x48]
call fcn.00402f4a
mov al, byte [ebp - 0x49]
call fcn.00477035
ret
Function at 0x463d5b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x1ec
mov eax, 0x4a3a5d
call fcn.00476feb
lea ecx, [ebp - 0x134]
call fcn.00406b70
and dword [ebp - 4], 0
lea eax, [ebp - 0x158]
push eax
call fcn.00488b7b
pop ecx
lea edx, [esi + 0x80]
lea ecx, [ebp - 0x174]
call fcn.0046a06a
push eax
lea ecx, [ebp - 0x134]
mov byte [ebp - 4], 1
call fcn.00427b22
lea ecx, [ebp - 0x174]
mov byte [ebp - 4], 0
call fcn.00406b99
lea eax, [ebp - 0x158]
push eax
lea ecx, [ebp - 0x134]
call fcn.00406b11
push eax
call fcn.004885d8
test eax, eax
pop ecx
pop ecx
mov dword [esi + 0xa8], eax
jne 0x463ecb
lea ebx, [esi + 0xb0]
push ebx
call sub.MSVCR80.dll_strlen
test eax, eax
pop ecx
jne 0x463e61
push str.SKIN
push str.QMUIRES.dat
push dword [0x4d67c4]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x463f99
push edi
push dword [0x4d67c4]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x463f99
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
mov dword [ebp - 0x138], eax
je 0x463f99
push edi
push dword [0x4d67c4]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov eax, ebx
call fcn.00466fee
mov eax, dword [ebx]
push edi
push dword [ebp - 0x138]
push eax
call sub.MSVCR80.dll_memcpy
add esp, 0xc
and dword [ebp - 0x13c], 0
lea eax, [ebp - 0x158]
push eax
push ebx
mov dword [ebp - 0x158], 0x463469
mov dword [ebp - 0x154], 0x46346e
mov dword [ebp - 0x150], 0x463494
mov dword [ebp - 0x14c], 0x463500
mov dword [ebp - 0x148], 0x4634dd
mov dword [ebp - 0x144], 0x463515
mov dword [ebp - 0x140], method.TiXmlNode.virtual_12
call fcn.004885d8
test eax, eax
pop ecx
pop ecx
mov dword [esi + 0xa8], eax
je 0x463f99
push dword [esi + 0xa8]
call fcn.00487e7e
jmp 0x463f90
xor edi, edi
push edi
push edi
push edi
push edi
push 0x104
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x1f8]
push eax
push dword [esi + 0xa8]
call fcn.00487ef9
add esp, 0x20
cmp eax, edi
jne 0x463f99
push dword [esi + 0xa8]
call fcn.004863e0
mov edi, dword [ebp - 0x1dc]
pop ecx
mov ebx, eax
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x174]
call fcn.00406abb
lea eax, [ebp - 0x174]
push eax
lea ecx, [ebp - 0x198]
mov byte [ebp - 4], 2
call fcn.00406b22
mov dword [ebp - 0x17c], ebx
mov dword [ebp - 0x178], edi
lea eax, [ebp - 0x198]
push eax
lea eax, [esi + 0x20]
lea ebx, [ebp - 0x1a4]
mov byte [ebp - 4], 3
call fcn.004653fa
lea ecx, [ebp - 0x198]
call fcn.00406b99
lea ecx, [ebp - 0x174]
mov byte [ebp - 4], 0
call fcn.00406b99
push dword [esi + 0xa8]
call fcn.00487d63
test eax, eax
pop ecx
je 0x463edb
lea ecx, [ebp - 0x134]
call fcn.00406b99
xor al, al
call fcn.00477035
ret
Function at 0x463fc7
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0x50
mov eax, 0x4a499e
call fcn.00476feb
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0xc]
mov esi, ecx
mov edi, edx
mov dword [ebp - 0x40], eax
mov byte [ebp - 0x2d], 0
call fcn.00435a77
test al, al
jne 0x4640e9
push esi
lea ecx, [ebp - 0x2c]
call fcn.0042845b
and dword [ebp - 4], 0
lea esi, [ebp - 0x2c]
call fcn.0046c79b
call fcn.00408054
mov ecx, edi
mov ebx, eax
call fcn.00406b11
mov edi, eax
test edi, edi
je 0x46402f
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
inc esi
cmp esi, 0x3fffffff
jle 0x464033
xor eax, eax
jmp 0x464046
lea eax, [esi + esi]
call fcn.0049ea40
mov eax, esp
push ebx
push esi
push edi
push eax
call fcn.0043e152
push eax
lea ecx, [ebp - 0x5c]
call fcn.00406f58
lea ebx, [ebp - 0x5c]
lea edi, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.0046c8ae
xor ebx, ebx
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], bl
call fcn.00402f4a
mov ecx, edi
call fcn.0041478d
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x38], eax
je 0x4640e1
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, ebx
je 0x4640d8
lea eax, [esi + 1]
push eax
mov dword [ebp - 0x34], ebx
call fcn.00474ca1
mov edi, dword [ebp - 0x3c]
pop ecx
push ebx
lea ecx, [ebp - 0x34]
push ecx
push esi
push eax
push dword [ebp - 0x38]
mov dword [edi], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4640d8
cmp dword [ebp - 0x34], esi
jne 0x4640d8
mov eax, dword [ebp - 0x40]
mov dword [eax], esi
mov eax, dword [edi]
mov byte [esi + eax], bl
mov byte [ebp - 0x2d], 1
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x2c]
call fcn.00402f4a
mov al, byte [ebp - 0x2d]
lea esp, [ebp - 0x6c]
call fcn.00477035
ret 8
Function at 0x464fc2
Capabilities:
Delete file
Get common file path
Write file on windows

Disassembly:
push ebp
sub esp, 0x410
lea ebp, [esp - 4]
mov eax, dword [0x4d2a20]
xor eax, ebp
mov dword [ebp + 0x410], eax
push 8
mov eax, 0x4a3a09
call fcn.00476f82
mov eax, dword [ebp + 0x41c]
mov esi, 0x206
xor edi, edi
push esi
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x20a]
push edi
push eax
mov word [ebp + 0x208], di
call sub.MSVCR80.dll_memset
push esi
lea eax, [ebp + 2]
push edi
push eax
mov word [ebp], di
call sub.MSVCR80.dll_memset
add esp, 0x18
push edi
push 0x1a
lea eax, [ebp + 0x208]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.kingsoftkclear_temp
lea eax, [ebp + 0x208]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov eax, dword [0x4d4a50]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x208]
shr eax, 0x10
test ax, ax
lea eax, [ebp + 0x208]
jne 0x46506a
movzx eax, ax
push eax
lea ecx, [ebp - 0x10]
call fcn.00463123
jmp 0x46509f
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
cmp esi, edi
je 0x46509f
push esi
lea eax, [ebp - 0x10]
push eax
call fcn.004632a3
test eax, eax
je 0x46509f
lea eax, [esi + esi]
push eax
lea ecx, [ebp + 0x208]
push ecx
add eax, 2
push eax
push dword [ebp - 0x10]
call fcn.004131c7
add esp, 0x10
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], edi
call fcn.00463522
lea esi, [ebp - 0x10]
mov ebx, eax
call fcn.0046327b
cmp ebx, edi
je 0x465114
lea eax, [ebp]
push eax
push edi
push 0x4bf03c
lea eax, [ebp + 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea eax, [ebp]
push 0x4bf044
push eax
call sub.MSVCR80.dll__wfopen
mov esi, eax
cmp esi, edi
pop ecx
pop ecx
je 0x465114
push esi
push dword [ebp + 0x420]
push 1
push dword [ebp - 0x14]
call sub.MSVCR80.dll_fwrite
push esi
call sub.MSVCR80.dll_fclose
add esp, 0x14
push 0x10
push 0x20
push 0x20
push 1
lea eax, [ebp]
push eax
push edi
call dword [sym.imp.USER32.dll_LoadImageW]
mov edi, eax
lea eax, [ebp]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x410]
xor ecx, ebp
call fcn.0047676d
add ebp, 0x414
leave
ret
Function at 0x46bb66
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [esi + 0x2c]
push edi
mov edi, dword [esi + 0x3c]
sub edi, dword [esi + 0x74]
mov eax, dword [esi + 0x6c]
mov ecx, dword [esi + 0x2c]
sub edi, eax
lea ecx, [ebx + ecx - 0x106]
cmp eax, ecx
mov dword [ebp - 8], edi
jb 0x46bbf3
mov eax, dword [esi + 0x38]
push ebx
lea ecx, [eax + ebx]
push ecx
push eax
call sub.MSVCR80.dll_memcpy
mov eax, dword [esi + 0x4c]
mov ecx, dword [esi + 0x44]
sub dword [esi + 0x70], ebx
sub dword [esi + 0x6c], ebx
add esp, 0xc
sub dword [esi + 0x5c], ebx
mov dword [ebp - 4], eax
lea eax, [ecx + eax*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x46bbb3
mov eax, dword [esi + 0x40]
mov dword [ebp - 4], ebx
lea eax, [eax + ebx*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x46bbd5
add edi, ebx
mov dword [ebp - 8], edi
mov edi, dword [esi]
cmp dword [edi + 4], 0
je 0x46bcb0
mov eax, dword [esi + 0x74]
add eax, dword [esi + 0x6c]
mov ecx, dword [edi + 4]
add eax, dword [esi + 0x38]
mov edx, dword [ebp - 8]
cmp ecx, edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], ecx
jbe 0x46bc1b
mov dword [ebp - 4], edx
mov edx, dword [ebp - 4]
test edx, edx
jne 0x46bc26
xor eax, eax
jmp 0x46bc71
sub ecx, edx
mov dword [edi + 4], ecx
mov ecx, dword [edi + 0x1c]
mov ecx, dword [ecx + 0x18]
cmp ecx, 1
jne 0x46bc43
mov ecx, dword [edi]
mov eax, dword [edi + 0x30]
push edx
call fcn.0046ceae
jmp 0x46bc54
cmp ecx, 2
jne 0x46bc5b
push edx
push dword [edi + 0x30]
mov edx, dword [edi]
call fcn.0046a2e2
pop ecx
mov dword [edi + 0x30], eax
mov eax, dword [ebp - 0xc]
pop ecx
push dword [ebp - 4]
push dword [edi]
push eax
call sub.MSVCR80.dll_memcpy
mov eax, dword [ebp - 4]
add dword [edi], eax
add esp, 0xc
add dword [edi + 8], eax
add dword [esi + 0x74], eax
mov edi, dword [esi + 0x74]
cmp edi, 3
jb 0x46bc9c
mov eax, dword [esi + 0x6c]
mov ecx, dword [esi + 0x38]
lea edx, [eax + ecx]
movzx eax, byte [edx]
mov ecx, dword [esi + 0x58]
mov dword [esi + 0x48], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [esi + 0x54]
mov dword [esi + 0x48], eax
cmp edi, 0x106
jae 0x46bcb0
mov eax, dword [esi]
cmp dword [eax + 4], 0
jne 0x46bb71
pop edi
pop ebx
leave
ret
Function at 0x46ed20
Capabilities:
Copy file
Delete file
Get file size
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4a4838
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x4d2a20]
xor eax, esp
mov dword [esp + 0x44], eax
push ebx
push esi
push edi
mov eax, dword [0x4d2a20]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
xor bl, bl
lea ecx, [esp + 0x38]
mov byte [esp + 0x17], 0
call fcn.0046eff0
push 0
push 0
push 3
push 0
mov ebx, 1
push ebx
push SysReAllocString
lea ecx, [esp + 0x50]
mov dword [esp + 0x78], 0
call fcn.0041478d
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push eax
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x46ee12
lea ecx, [esp + 0x1c]
call fcn.0046eff0
lea ecx, [esp + 0x38]
call fcn.0046f570
test al, al
jne 0x46ede8
lea ecx, [esp + 0x1c]
call fcn.0046f570
test al, al
je 0x46ede8
push 0
lea ecx, [esp + 0x3c]
call fcn.0041478d
push eax
lea ecx, [esp + 0x24]
call fcn.0041478d
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x46ede8
lea ecx, [esp + 0x1c]
call fcn.0041478d
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push 0
push 3
push 0
push ebx
push SysReAllocString
lea ecx, [esp + 0x34]
call fcn.0041478d
push eax
call edi
lea ecx, [esp + 0x1c]
mov esi, eax
call fcn.00402f4a
cmp esi, 0xffffffff
je 0x46ee50
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0x10
jb 0x46ee49
cmp edi, 0xffffffff
je 0x46ee49
push 0
lea eax, [esp + 0x1c]
push eax
push edi
push 0x4d78cc
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x46ee49
cmp dword [esp + 0x18], edi
jne 0x46ee49
mov byte [esp + 0x17], bl
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x38]
call fcn.00402f4a
mov al, byte [esp + 0x17]
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.0047676d
add esp, 0x54
ret
Function at 0x46ee80
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4a4838
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x4d2a20]
xor eax, esp
mov dword [esp + 0x44], eax
push ebx
push esi
push edi
mov eax, dword [0x4d2a20]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
xor bl, bl
lea ecx, [esp + 0x38]
mov byte [esp + 0x17], 0
call fcn.0046eff0
push 0
push 0
push 2
push 0
mov ebx, 1
push ebx
push 0x40000000
lea ecx, [esp + 0x50]
mov dword [esp + 0x78], 0
call fcn.0041478d
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push eax
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x46ef28
lea ecx, [esp + 0x1c]
call fcn.0046eff0
push 0
push 0
push 2
push 0
push ebx
push 0x40000000
lea ecx, [esp + 0x34]
call fcn.0041478d
push eax
call edi
lea ecx, [esp + 0x1c]
mov esi, eax
call fcn.00402f4a
cmp esi, 0xffffffff
je 0x46ef53
push 0
lea eax, [esp + 0x1c]
push eax
push 0x10
push 0x4d78cc
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x46ef4c
cmp dword [esp + 0x18], 0x10
jne 0x46ef4c
mov byte [esp + 0x17], bl
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x38]
call fcn.00402f4a
mov al, byte [esp + 0x17]
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.0047676d
add esp, 0x54
ret

Function at 0x46eff0
Capabilities:
Access peb ldr_data
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4a47fd
mov eax, dword fs:[0]
push eax
sub esp, 0x230
mov eax, dword [0x4d2a20]
xor eax, esp
mov dword [esp + 0x22c], eax
push esi
mov eax, dword [0x4d2a20]
xor eax, esp
push eax
lea eax, [esp + 0x238]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0
call fcn.00402f21
push 0x208
lea eax, [esp + 0x30]
push 0
mov dword [esp + 0x248], 0
push eax
mov dword [esp + 0x14], 1
call sub.MSVCR80.dll_memset
add esp, 0xc
mov cl, bl
neg cl
push 1
lea edx, [esp + 0x30]
sbb ecx, ecx
and ecx, 0xfffffff7
add ecx, 0x23
push ecx
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x46f0e7
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x14]
call fcn.00406f58
push eax
mov ecx, esi
mov dword [esp + 0x244], 1
call fcn.004284a9
lea ecx, [esp + 0x10]
mov byte [esp + 0x240], 0
call fcn.00402f4a
test bl, bl
mov ecx, esi
je 0x46f0c1
push str.TencentDeskUpdate
jmp 0x46f0c6
push str.TencentDesktop
call fcn.004284bf
call fcn.0046f110
test al, al
jne 0x46f0db
mov ecx, esi
call fcn.0046f240
push str.Global.db
mov ecx, esi
call fcn.004284bf
mov eax, esi
mov ecx, dword [esp + 0x238]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x22c]
xor ecx, esp
call fcn.0047676d
add esp, 0x23c
ret