joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10036863
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0x10
mov eax, 0x10073928
call fcn.1005886f
mov dword [ebp - 0x10], ecx
mov edi, dword [ebp + 8]
cmp dword [edi + 0x1c], 8
jb 0x10036880
mov eax, dword [edi + 8]
jmp 0x10036883
lea eax, [edi + 8]
movzx ecx, word [edi + 0x20]
push ecx
push eax
push dword [edi]
push str.CDownload::SetProxy__._nstProxyInfo.eProxyType___d_nstProxyInfo.strProxyIP___s_nstProxyInfo.usProxyPort___d
push 3
call fcn.10038753
push 0x78
call fcn.100515d4
xor esi, esi
add esp, 0x18
cmp eax, esi
je 0x100368da
mov dword [eax], esi
mov dword [eax + 0x18], esi
push 7
pop ecx
mov dword [eax + 0x1c], ecx
mov word [eax + 8], si
mov word [eax + 0x20], si
mov dword [eax + 0x38], esi
mov dword [eax + 0x3c], ecx
mov word [eax + 0x28], si
mov dword [eax + 0x54], esi
mov dword [eax + 0x58], ecx
mov word [eax + 0x44], si
mov dword [eax + 0x70], esi
mov dword [eax + 0x74], ecx
mov word [eax + 0x60], si
mov esi, eax
mov eax, dword [edi]
mov dword [esi], eax
push 0xffffffffffffffff
lea eax, [esi + 4]
push eax
xor ebx, ebx
lea eax, [edi + 4]
call fcn.10001d68
mov ax, word [edi + 0x20]
push 0xffffffffffffffff
lea ecx, [esi + 0x24]
mov word [esi + 0x20], ax
lea eax, [edi + 0x24]
push ecx
call fcn.10001d68
push 0xffffffffffffffff
lea ecx, [esi + 0x40]
lea eax, [edi + 0x40]
push ecx
call fcn.10001d68
push 0xffffffffffffffff
lea ecx, [esi + 0x5c]
lea eax, [edi + 0x5c]
push ecx
call fcn.10001d68
mov edi, dword [ebp - 0x10]
lea eax, [edi + 0x8c]
mov dword [ebp - 0x18], eax
add eax, 4
push eax
mov dword [ebp - 0x1c], vtable.QQDectector::fund::lock::scoped_lock_class_QQDectector::fund::lock::critical_section_.0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
and dword [ebp - 4], ebx
lea eax, [ebp - 0x14]
push eax
lea eax, [edi + 0x78]
mov dword [ebp - 0x14], 9
mov dword [ebp - 0x10], esi
call fcn.10037a69
push dword [edi + 0x70]
call dword [sym.imp.KERNEL32.dll_SetEvent]
lea esi, [ebp - 0x1c]
call fcn.10037f3b
xor eax, eax
inc eax
call fcn.10058947
ret 4
Function at 0x10037705
Capabilities:
Check if file exists

Disassembly:
push 0x264
mov eax, 0x10075c1b
call fcn.100588d8
and word [ebp - 0x224], 0
push 0x208
lea eax, [ebp - 0x222]
push 0
push eax
call fcn.10051de0
add esp, 0xc
lea eax, [ebp - 0x250]
push eax
push str.DownloadProxy.Downloader.1
call dword [sym.imp.ole32.dll_CLSIDFromProgID]
sub esp, 0x10
lea esi, [ebp - 0x250]
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea ebx, [ebp - 0x224]
movsd dword es:[edi], dword [esi]
call fcn.1003cb67
add esp, 0x10
test eax, eax
je 0x10037964
xor edi, edi
mov dword [ebp - 0x228], 7
mov dword [ebp - 0x22c], edi
mov word [ebp - 0x23c], di
lea eax, [ebp - 0x224]
push eax
mov dword [ebp - 4], edi
call fcn.1005184b
pop ecx
lea ecx, [ebp - 0x224]
lea esi, [ebp - 0x240]
call fcn.100022cf
mov ebx, 0x1008279c
push ebx
call fcn.1005184b
mov edx, dword [ebp - 0x22c]
cmp edx, edi
pop ecx
mov dword [ebp - 0x254], eax
jbe 0x10037817
cmp dword [ebp - 0x228], 8
mov ecx, dword [ebp - 0x23c]
jae 0x100377d4
lea ecx, [ebp - 0x23c]
cmp dword [ebp - 0x228], 8
lea edi, [ecx + edx*2]
mov ecx, dword [ebp - 0x23c]
jae 0x10037813
lea ecx, [ebp - 0x23c]
jmp 0x10037813
mov eax, dword [ebp - 0x254]
test eax, eax
mov edx, ebx
jbe 0x10037807
movzx esi, word [ecx]
cmp word [edx], si
je 0x10037809
inc edx
inc edx
dec eax
jne 0x100377fd
xor edx, edx
test edx, edx
je 0x10037897
inc ecx
inc ecx
cmp ecx, edi
jb 0x100377ee
or ecx, 0xffffffff
push ecx
xor edi, edi
lea esi, [ebp - 0x240]
call fcn.100018fa
push ebx
call fcn.1005184b
pop ecx
mov ecx, dword [ebp - 0x22c]
test ecx, ecx
jbe 0x100378d2
or edx, 0xffffffff
cmp ecx, edx
ja 0x10037847
lea edx, [ecx - 1]
cmp dword [ebp - 0x228], 8
mov ecx, dword [ebp - 0x23c]
jae 0x1003785c
lea ecx, [ebp - 0x23c]
lea ecx, [ecx + edx*2]
test eax, eax
mov edi, eax
mov edx, ebx
jbe 0x10037874
movzx esi, word [ecx]
cmp word [edx], si
je 0x10037876
inc edx
inc edx
dec edi
jne 0x1003786a
xor edx, edx
test edx, edx
je 0x100378b5
cmp dword [ebp - 0x228], 8
mov edx, dword [ebp - 0x23c]
jae 0x1003788f
lea edx, [ebp - 0x23c]
cmp ecx, edx
je 0x100378d2
dec ecx
dec ecx
jmp 0x1003785f
cmp dword [ebp - 0x228], 8
mov eax, dword [ebp - 0x23c]
jae 0x100378ac
lea eax, [ebp - 0x23c]
sub ecx, eax
sar ecx, 1
jmp 0x1003781a
cmp dword [ebp - 0x228], 8
mov eax, dword [ebp - 0x23c]
jae 0x100378ca
lea eax, [ebp - 0x23c]
sub ecx, eax
sar ecx, 1
mov eax, ecx
jmp 0x100378d5
or eax, 0xffffffff
push 0xffffffffffffffff
lea edi, [eax + 1]
lea esi, [ebp - 0x240]
call fcn.100018fa
lea eax, [ebp - 0x258]
mov ecx, esi
call fcn.10001968
mov esi, eax
lea eax, [ebp - 0x268]
lea ecx, [ebp - 0x240]
call fcn.10001988
mov edi, eax
lea eax, [ebp - 0x270]
lea ecx, [ebp - 0x240]
call fcn.10001968
push dword [esi + 4]
push dword [esi]
push dword [edi + 4]
push dword [edi]
push dword [eax + 4]
push dword [eax]
lea eax, [ebp - 0x260]
call fcn.1003856e
mov eax, dword [ebp - 0x23c]
add esp, 0x18
cmp dword [ebp - 0x228], 8
jae 0x1003794a
lea eax, [ebp - 0x23c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push 0
push 1
lea esi, [ebp - 0x240]
mov edi, eax
call fcn.10001f1e
mov eax, edi
call fcn.1005895b
ret
Function at 0x10038899
Capabilities:
Check if file exists
Get file attributes

Disassembly:
test eax, eax
je 0x100388b7
cmp word [eax], 0
je 0x100388b7
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x100388b7
and al, 0x10
cmp al, 0x10
setne al
ret
xor al, al
ret

Function at 0x100388ba
Capabilities:
Get file version info

Disassembly:
push 0x280
mov eax, 0x100738bc
call fcn.100588d8
mov eax, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x22c], eax
mov esi, ecx
mov dword [ebp - 0x240], edi
mov dword [ebp - 0x250], edi
mov dword [ebp - 0x24c], edi
mov dword [ebp - 0x248], edi
push 0x20a
lea eax, [ebp - 0x224]
push edi
push eax
mov dword [ebp - 4], edi
call fcn.10051de0
add esp, 0xc
lea eax, [ebp - 0x224]
push esi
push eax
call fcn.100559b9
pop ecx
pop ecx
push edi
lea eax, [ebp - 0x224]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
cmp esi, edi
jne 0x1003899f
mov dword [ebp - 0x238], edi
mov dword [ebp - 0x234], edi
mov dword [ebp - 0x230], edi
mov byte [ebp - 4], 1
lea ebx, [ebp - 0x228]
lea esi, [ebp - 0x23c]
mov dword [ebp - 0x228], edi
call fcn.1003b952
lea ebx, [ebp - 0x228]
mov dword [ebp - 0x228], edi
call fcn.1003b952
lea ebx, [ebp - 0x228]
mov dword [ebp - 0x228], edi
call fcn.1003b952
lea ebx, [ebp - 0x228]
mov dword [ebp - 0x228], edi
call fcn.1003b952
mov eax, dword [ebp - 0x22c]
mov ebx, esi
call fcn.1003b8bd
call fcn.10029bf1
jmp 0x10038ac5
push esi
call fcn.10050eaa
pop ecx
push esi
mov ebx, eax
push edi
push ebx
mov dword [ebp - 0x240], ebx
call fcn.10051de0
add esp, 0xc
push ebx
push esi
push edi
lea eax, [ebp - 0x224]
push eax
call sub.VERSION.dll_GetFileVersionInfoW
cmp eax, edi
jne 0x100389e7
mov dword [ebp - 0x238], edi
mov dword [ebp - 0x234], edi
mov dword [ebp - 0x230], edi
mov byte [ebp - 4], 2
jmp 0x1003893e
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x244]
push eax
push 0x1007bf70
push ebx
mov dword [ebp - 0x244], edi
mov dword [ebp - 0x258], edi
call sub.VERSION.dll_VerQueryValueW
cmp eax, edi
jne 0x10038a2b
mov dword [ebp - 0x238], edi
mov dword [ebp - 0x234], edi
mov dword [ebp - 0x230], edi
mov byte [ebp - 4], 3
jmp 0x1003893e
push 0x34
push dword [ebp - 0x244]
lea eax, [ebp - 0x28c]
push eax
call fcn.10051e60
mov eax, dword [ebp - 0x284]
shr eax, 0x10
add esp, 0xc
lea ebx, [ebp - 0x228]
lea esi, [ebp - 0x254]
mov dword [ebp - 0x228], eax
call fcn.1003b952
movzx eax, word [ebp - 0x284]
lea ebx, [ebp - 0x228]
mov dword [ebp - 0x228], eax
call fcn.1003b952
mov eax, dword [ebp - 0x280]
shr eax, 0x10
lea ebx, [ebp - 0x228]
mov dword [ebp - 0x228], eax
call fcn.1003b952
movzx eax, word [ebp - 0x280]
lea ebx, [ebp - 0x228]
mov dword [ebp - 0x228], eax
call fcn.1003b952
push dword [ebp - 0x240]
call fcn.10053d61
mov eax, dword [ebp - 0x22c]
pop ecx
mov ebx, esi
call fcn.1003b8bd
lea esi, [ebp - 0x254]
call fcn.10029bf1
mov eax, dword [ebp - 0x22c]
call fcn.1005895b
ret
Function at 0x1003a213
Capabilities:
Print debug messages

Disassembly:
push 0x50
mov eax, 0x10076528
call fcn.1005886f
xor esi, esi
cmp dword [ebx + 0x70], esi
je 0x1003a22d
xor eax, eax
jmp 0x1003a361
mov eax, ebx
call fcn.10039052
cmp byte [ebp + 8], 0
jne 0x1003a253
lea eax, [ebx + 0x84]
mov ecx, dword [eax]
cmp ecx, 1
ja 0x1003a253
inc ecx
mov dword [eax], ecx
mov ecx, ebx
call fcn.10038e62
jmp 0x1003a260
mov edi, ebx
call fcn.1003ab6e
mov dword [ebx + 0x70], eax
mov dword [ebx + 0x18], eax
push dword [ebx + 0x88]
mov eax, ebx
call fcn.10039eda
push dword [ebx + 0x8c]
mov eax, ebx
call fcn.10039f97
cmp dword [ebx + 0x98], esi
je 0x1003a290
lea eax, [ebx + 0x9c]
push eax
mov eax, ebx
call fcn.1003a121
cmp dword [ebx + 0x90], esi
je 0x1003a2a5
push dword [ebx + 0x94]
mov eax, ebx
call fcn.1003a055
push 0x100859e4
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea eax, [ebp - 0x24]
lea ecx, [ebx + 0x11e8]
push eax
call fcn.1003b264
lea edi, [ebx + 0x11f4]
mov dword [ebp - 4], esi
call fcn.10029bcd
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
mov esi, dword [ebp - 0x20]
je 0x1003a2ec
lea eax, [ebp - 0x24]
cmp dword [ebp - 0x18], eax
je 0x1003a2f1
call fcn.10051768
cmp dword [ebp - 0x14], esi
je 0x1003a347
lea esi, [ebp - 0x18]
call fcn.1003b9a8
push dword [eax]
push 0
call fcn.1003b9a8
add eax, 4
push eax
push ebx
call fcn.1003910e
test eax, eax
jne 0x1003a33d
push 0x38
push eax
lea eax, [ebp - 0x5c]
push eax
call fcn.10051de0
or dword [ebp - 0x5c], 0xffffffff
add esp, 0xc
call fcn.1003b9a8
lea ecx, [ebp - 0x5c]
push ecx
push dword [eax]
mov ecx, dword [ebx + 0x7c]
push 0x59
call fcn.10036c38
lea esi, [ebp - 0x18]
call fcn.1003beee
jmp 0x1003a2db
push str.ReloadDownloadtask_end
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x24]
call fcn.1003bdb8
xor eax, eax
inc eax
call fcn.10058947
ret 4
Function at 0x1003cb67
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x68]
sub esp, 0x2f0
mov eax, dword [0x10095428]
xor eax, ebp
mov dword [ebp + 0x64], eax
push esi
push edi
lea esi, [ebp + 0x70]
lea edi, [ebp - 0x27c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0x64
xor edi, edi
lea eax, [ebp - 0x64]
push edi
push eax
call fcn.10051de0
movzx eax, byte [ebp - 0x270]
movzx ecx, byte [ebp - 0x26f]
shl eax, 8
or eax, ecx
movzx ecx, byte [ebp - 0x26e]
shl eax, 8
or eax, ecx
movzx ecx, byte [ebp - 0x26d]
shl eax, 8
or eax, ecx
movzx ecx, byte [ebp - 0x271]
push eax
movzx eax, byte [ebp - 0x272]
shl eax, 8
or eax, ecx
movzx ecx, byte [ebp - 0x273]
push eax
movzx eax, byte [ebp - 0x274]
shl eax, 8
or eax, ecx
push eax
movzx eax, word [ebp - 0x276]
push eax
movzx eax, word [ebp - 0x278]
push eax
push dword [ebp - 0x27c]
lea eax, [ebp - 0x64]
push str._X__X__X__X__X_X
push eax
call fcn.100559d5
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x26c]
push str.CLSID_sLocalServer32
push eax
call fcn.100559d5
add esp, 0x38
lea eax, [ebp - 0x280]
push eax
lea eax, [ebp - 0x26c]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x1003cc4a
xor eax, eax
jmp 0x1003cc8e
lea eax, [ebp - 0x288]
push eax
push ebx
lea eax, [ebp - 0x284]
push eax
push edi
push edi
push dword [ebp - 0x280]
xor esi, esi
inc esi
mov dword [ebp - 0x284], esi
mov dword [ebp - 0x288], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1003cc80
xor esi, esi
push dword [ebp - 0x280]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp + 0x64]
pop edi
xor ecx, ebp
pop esi
call fcn.10051861
add ebp, 0x68
leave
ret
Function at 0x1003d0c0
Capabilities:
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x10074853
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10095428]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov edi, 0x10096714
mov ebp, 0x1009a3f0
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], 3
lea ecx, [ecx]
push 0x44
call fcn.100515d4
add esp, 4
mov dword [esp + 0x20], eax
xor ebx, ebx
cmp eax, ebx
mov dword [esp + 0x40], ebx
je 0x1003d12c
mov ecx, dword [edi + 4]
mov edx, dword [edi - 4]
push ecx
mov ecx, dword [edi]
push edx
push eax
call fcn.1003dae0
mov esi, eax
jmp 0x1003d12e
xor esi, esi
mov dword [esp + 0x40], 0xffffffff
mov ecx, dword [ebp]
cmp esi, ecx
je 0x1003d14c
cmp ecx, ebx
je 0x1003d149
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
mov dword [ebp], esi
mov ecx, dword [ebp]
xor eax, eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x24], ebx
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
lea edx, [esp + 0x24]
push edx
call eax
test al, al
je 0x1003d205
mov eax, dword [ebp]
lea ecx, [esp + 0x1c]
call fcn.1003cdd0
mov dword [esp + 0x40], 1
mov esi, dword [eax]
cmp esi, ebx
je 0x1003d19d
lea ecx, [esi + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov eax, dword [ebp + 0x10]
cmp eax, ebx
je 0x1003d1c8
lea edi, [eax + 4]
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x1003d1c4
test edi, edi
je 0x1003d1bb
lea ecx, [edi - 4]
jmp 0x1003d1bd
xor ecx, ecx
mov edx, dword [ecx]
mov eax, dword [edx + 0x18]
call eax
mov edi, dword [esp + 0x14]
mov dword [ebp + 0x10], esi
mov dword [esp + 0x40], 0xffffffff
mov esi, dword [esp + 0x1c]
test esi, esi
je 0x1003d236
add esi, 4
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x1003d236
test esi, esi
je 0x1003d1fa
mov edx, dword [esi - 4]
mov eax, dword [edx + 0x18]
lea ecx, [esi - 4]
call eax
jmp 0x1003d236
xor ecx, ecx
mov edx, dword [ecx]
mov eax, dword [edx + 0x18]
call eax
jmp 0x1003d236
call fcn.100419fb
test al, al
je 0x1003d227
mov ecx, dword [esp + 0x30]
push ecx
push str.CreateThread_Failed__last_error_d
push 2
mov ebx, str.D:jenkins_TrunkworkspaceCEN_Hive_QQPCDownload_ForTestqqpcmgr_projAsyncFrame_asyncframertapi.cpp
call fcn.100417cb
add esp, 0xc
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
add edi, 0xc
add ebp, 4
sub dword [esp + 0x18], 1
mov dword [esp + 0x14], edi
jne 0x1003d100
mov eax, 1
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret
Function at 0x1003e130
Capabilities:
Allocate thread local storage
Get thread local storage value

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push esi
push edi
mov edi, 0x1009a198
push 0x1009a40c
call ebx
mov esi, dword [edi]
test esi, esi
je 0x1003e168
cmp dword [esi + 0x14], 0
je 0x1003e168
push 0x1009a40c
call ebp
mov eax, dword [esi]
mov edx, dword [eax + 0x10]
mov ecx, esi
call edx
sub edi, 4
cmp edi, 0x1009a18c
jne 0x1003e145
mov eax, dword [0x1009a284]
test eax, eax
jne 0x1003e1ca
call fcn.100419fb
test al, al
je 0x1003e199
push str.Create_Thread_LocalPoint
push 0xb
push str.D:jenkins_TrunkworkspaceCEN_Hive_QQPCDownload_ForTestqqpcmgr_projincludeAsyncFrame_MessageLoop.h
call fcn.1004188a
add esp, 0xc
push 8
call fcn.100515d4
mov esi, eax
add esp, 4
test esi, esi
je 0x1003e1c3
mov dword [esi], 0
mov dword [esi + 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [esi + 4], eax
mov eax, esi
jmp 0x1003e1c5
xor eax, eax
mov dword [0x1009a284], eax
mov eax, dword [eax + 4]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
pop edi
pop esi
pop ebp
pop ebx
je 0x1003e1e3
mov dword [eax + 0x68], 1
mov al, 1
ret

Function at 0x1003e200
Capabilities:
Allocate thread local storage

Disassembly:
mov eax, dword [0x1009a284]
test eax, eax
jne 0x1003e260
call fcn.100419fb
test al, al
je 0x1003e226
push str.Create_Thread_LocalPoint
push 0xb
push str.D:jenkins_TrunkworkspaceCEN_Hive_QQPCDownload_ForTestqqpcmgr_projincludeAsyncFrame_MessageLoop.h
call fcn.1004188a
add esp, 0xc
push esi
push 8
call fcn.100515d4
mov esi, eax
add esp, 4
test esi, esi
je 0x1003e256
mov dword [esi], 0
mov dword [esi + 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [esi + 4], eax
mov eax, esi
mov dword [0x1009a284], eax
pop esi
ret
xor esi, esi
mov eax, esi
mov dword [0x1009a284], eax
pop esi
ret
Function at 0x1003e300
Capabilities:
Set thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x100764cd
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10095428]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, dword [esp + 0x28]
xor edi, edi
mov dword [esi], vtable.qmbase::MessageLoop.0
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esp + 0x20], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
lea eax, [esi + 0x2c]
push 0x7d0
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x68], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x78], edi
mov dword [esi + 0x7c], edi
mov dword [esi + 0x80], edi
mov dword [esi + 0x84], edi
mov byte [esp + 0x20], 5
mov dword [esi + 0x88], edi
call fcn.1003e200
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
push eax
call ebx
call fcn.1003e200
mov eax, dword [eax + 4]
cmp eax, 0xffffffff
je 0x1003e3b7
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 0x24
call fcn.100515d4
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, edi
mov byte [esp + 0x20], 6
je 0x1003e3d8
push eax
call fcn.10040cf0
mov ebp, eax
jmp 0x1003e3da
xor ebp, ebp
cmp ebp, edi
mov byte [esp + 0x20], 5
je 0x1003e3e9
lea eax, [ebp + 4]
push eax
call ebx
mov eax, dword [esi + 0x70]
cmp eax, edi
je 0x1003e410
lea ebx, [eax + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x1003e410
cmp ebx, edi
je 0x1003e407
lea ecx, [ebx - 4]
jmp 0x1003e409
xor ecx, ecx
mov edx, dword [ecx]
mov eax, dword [edx + 0x18]
call eax
mov dword [esi + 0x70], ebp
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 4
Function at 0x10040b40
Capabilities:
Get thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x100763f8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x10095428]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
lea edi, [esi + 8]
push edi
mov dword [esp + 0x14], edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor ebx, ebx
mov dword [esp + 0x1c], ebx
cmp dword [esi + 0x20], ebx
je 0x10040b95
call fcn.1003e200
mov eax, dword [eax + 4]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, dword [esi + 0x20]
jne 0x10040b95
mov bl, 1
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, bl
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x10040be0
Capabilities:
Get thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x10077120
mov eax, dword fs:[0]
push eax
sub esp, 0x40
push ebx
push esi
push edi
mov eax, dword [0x10095428]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov esi, ecx
lea edi, [esi + 8]
push edi
xor bl, bl
mov dword [esp + 0x14], edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [esp + 0x58], 0
cmp dword [esi + 0x20], 0
je 0x10040cb5
call fcn.1003e200
mov eax, dword [eax + 4]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, dword [esi + 0x20]
je 0x10040cb5
push 0x38
push str.D:jenkins_TrunkworkspaceCEN_Hive_QQPCDownload_ForTestqqpcmgr_projAsyncFrameMessageLoopProxyImpl.cpp
push str.qmbase::MessageLoopProxyImpl::OnDestruct
lea ecx, [esp + 0x20]
push ecx
call fcn.10020689
push esi
mov byte [esp + 0x5c], 1
mov edx, dword [esi + 0x20]
push eax
push edx
call fcn.10040e10
cmp dword [esp + 0x48], 0x10
jb 0x10040c78
mov eax, dword [esp + 0x34]
push eax
call fcn.10051870
add esp, 4
cmp dword [esp + 0x2c], 0x10
mov ebx, 0xf
mov dword [esp + 0x48], ebx
mov dword [esp + 0x44], 0
mov byte [esp + 0x34], 0
jb 0x10040ca2
mov ecx, dword [esp + 0x18]
push ecx
call fcn.10051870
add esp, 4
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], 0
mov byte [esp + 0x18], 0
mov bl, 1
push edi
mov dword [esp + 0x5c], 0xffffffff
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test bl, bl
jne 0x10040cd3
mov edx, dword [esi]
mov eax, dword [edx + 0x14]
push 1
mov ecx, esi
call eax
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x4c
ret
Function at 0x10040cf0
Capabilities:
Get thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x100763d3
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x10095428]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
mov esi, dword [esp + 0x18]
xor eax, eax
mov dword [esi + 4], eax
mov dword [esp + 0x10], eax
lea eax, [esi + 8]
push 0x7d0
push eax
mov dword [esi], vtable.qmbase::MessageLoopProxyImpl.0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
mov byte [esp + 0x10], 1
call fcn.1003e200
mov eax, dword [eax + 4]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [esi + 0x20], eax
mov eax, esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0xc
ret 4

Function at 0x100412c5
Capabilities:
Read file via mapping

Disassembly:
push edi
push str.GlobalFA6FBBB1_8C8E_43b1_B8EC_35573A94C231
xor edi, edi
push edi
push 6
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
cmp eax, edi
mov dword [esi], eax
jne 0x100412e0
xor eax, eax
pop edi
ret
push edi
push edi
push edi
push 6
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp eax, edi
mov dword [esi + 4], eax
jne 0x100412ff
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], edi
jmp 0x100412dc
mov dword [esi + 8], eax
xor eax, eax
inc eax
pop edi
ret

Function at 0x10041397
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
lea eax, [ebp - 4]
push eax
push 0x20019
xor ebx, ebx
push ebx
push str.SOFTWARETencentQQPCMgr
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], ebx
mov byte [0x1009a508], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10041403
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push str.EnableLogToView
push dword [ebp - 4]
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100413fa
cmp dword [ebp - 8], 1
jne 0x100413fa
mov byte [0x1009a508], 1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
leave
ret

Function at 0x100416ac
Capabilities:
Check if file exists
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x10095428]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
push 0x206
lea eax, [ebp - 0x20a]
push ebx
push eax
mov dword [edi], ebx
mov word [ebp - 0x20c], bx
call fcn.10051de0
add esp, 0xc
mov esi, 0x103
push esi
lea eax, [ebp - 0x20c]
push eax
push str._APPDATA_TencentQQPCMgr_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x10041736
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, ebx
je 0x10041736
lea eax, [ebp - 0x20c]
push eax
lea ebx, [edi + 4]
push esi
push ebx
call fcn.10056543
push 0xffffffffffffffff
push str.ErrLogFile.log
push 0x104
push ebx
call fcn.10057d42
add esp, 0x1c
jmp 0x10041749
push esi
push str.C:ErrLogFile.log
lea eax, [edi + 4]
push esi
push eax
call fcn.10054d6e
add esp, 0x10
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
mov eax, edi
pop ebx
call fcn.10051861
leave
ret