joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42b7fe
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 4], ebx
je 0x42b812
xor eax, eax
jmp 0x42b873
push edi
push dword [esi + 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_ResetEvent]
call edi
push dword [esi + 0xc]
call edi
lea eax, [ebp - 4]
push eax
push ebx
push esi
push 0x42b7d5
push ebx
push ebx
mov dword [ebp - 4], ebx
call fcn.00457d2b
add esp, 0x18
cmp eax, ebx
ja 0x42b843
xor eax, eax
jmp 0x42b872
mov dword [esi + 4], eax
cmp dword [esi + 0x18], ebx
je 0x42b854
push 0xfffffffffffffff1
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push 0xffffffffffffffff
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esi + 8]
mov dword [ebp - 8], eax
call edi
xor eax, eax
cmp dword [ebp - 8], ebx
jne 0x42b872
mov dword [esi + 0x14], ebx
inc eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x42bb23
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x3e8]
sub esp, 0x468
mov eax, dword [0x4b4970]
xor eax, ebp
mov dword [ebp + 0x3e4], eax
push esi
push edi
xor eax, eax
mov edi, 0x206
push edi
mov word [ebp + 0x1dc], ax
xor esi, esi
lea eax, [ebp + 0x1de]
push esi
push eax
call fcn.00454800
xor eax, eax
push edi
mov word [ebp - 0x2c], ax
lea eax, [ebp - 0x2a]
push esi
push eax
call fcn.00454800
add esp, 0x18
push 0x104
lea eax, [ebp + 0x1dc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp + 0x1dc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp + 0x1dc]
push eax
lea eax, [ebp - 0x2c]
push str._s_bdutil.exe___checkbrowser__makediff
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
push 0x40
lea eax, [ebp - 0x7c]
push esi
push eax
call fcn.00454800
xor eax, eax
mov dword [ebp - 0x3c], esi
lea edi, [ebp - 0x38]
stosd dword es:[edi], eax
add esp, 0x18
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x2c]
push eax
push esi
mov dword [ebp - 0x80], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push 0xffffffffffffffff
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp + 0x3e4]
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.0045466b
add ebp, 0x3e8
leave
ret

Function at 0x42bc06
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push dword [ebp + 0xc]
mov dword [ebp - 4], esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42bc62
cmp dword [ebp - 4], esi
je 0x42bc62
push edi
push dword [ebp + 0x14]
lea eax, [ebp - 8]
push eax
push esi
push dword [ebp + 0x10]
mov dword [ebp - 8], esi
push dword [ebp - 4]
mov dword [edi], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x42bc5d
push dword [ebp - 4]
call esi
push dword [ebp - 4]
call esi
pop esi
leave
ret
Function at 0x42c8c8
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x4b4970]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0x24
mov eax, 0x48a7d9
call fcn.00454dca
xor ebx, ebx
push 0x208
lea eax, [ebp]
push ebx
push eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], ebx
call fcn.00454800
add esp, 0xc
lea eax, [ebp]
push eax
push ebx
push ebx
push 0x23
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [ebp]
push eax
mov ecx, edi
call fcn.004040f0
push str.Baidu_
mov ecx, edi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], 1
call fcn.00405810
lea esi, [ebp - 0x30]
call fcn.0042c503
push 0xffffffffffffffff
xor esi, esi
push ebx
inc esi
push eax
mov ecx, edi
mov dword [ebp - 4], esi
call fcn.004050e0
push ebx
push esi
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], bl
call fcn.00401850
push 0x496540
mov ecx, edi
call fcn.00405810
cmp dword [edi + 0x18], 8
jb 0x42c976
mov eax, dword [edi + 4]
jmp 0x42c979
lea eax, [edi + 4]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.0045466b
add ebp, 0x20c
leave
ret
Function at 0x42c9a6
Capabilities:
Get file version info

Disassembly:
push 0x18
mov eax, 0x48a829
call fcn.00454dca
xor ebx, ebx
push ebx
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
cmp esi, ebx
jne 0x42c9ce
mov eax, 0x80004005
call fcn.00454ea2
ret
push esi
call fcn.00454507
pop ecx
mov edi, eax
push edi
push esi
push ebx
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x42c9c3
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x14]
push eax
push str.VarFileInfoTranslation
push edi
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x20], ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x42c9c3
mov esi, 0x4b6d04
push esi
lea ecx, [ebp - 0x18]
call fcn.0041acdf
push esi
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], ebx
call fcn.0041acdf
push esi
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.0041acdf
mov eax, dword [ebp - 0x14]
movzx eax, word [eax]
push eax
mov esi, str.000_x
lea eax, [ebp - 0x10]
push esi
push eax
mov byte [ebp - 4], 2
call fcn.0041b07c
add esp, 0xc
push 4
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x10]
call fcn.0042bf3f
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 3
call fcn.0041c246
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
mov byte [ebp - 4], 2
call fcn.0041a963
mov eax, dword [ebp - 0x14]
movzx eax, word [eax + 2]
push eax
lea eax, [ebp - 0x10]
push esi
push eax
call fcn.0041b07c
add esp, 0xc
push 4
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x10]
call fcn.0042bf3f
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 4
call fcn.0042c25c
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
mov byte [ebp - 4], 2
call fcn.0041a963
mov esi, dword [ebp - 0x1c]
push esi
lea eax, [ebp - 0x18]
push str.StringFileInfo_sProductVersion
push eax
call fcn.0041b07c
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x100
lea ecx, [ebp - 0x18]
call fcn.00421f0d
push eax
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x42cb0f
mov ebx, 0x80004005
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0041a963
lea ecx, [esi - 0x10]
call fcn.0041a963
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.0041a963
mov eax, ebx
jmp 0x42c9c8
push 0xffffffffffffffff
lea ecx, [ebp - 0x18]
call fcn.00421409
push dword [ebp - 0x14]
push 0x496568
push dword [ebp + 0xc]
call fcn.0041b07c
push edi
call fcn.00454315
add esp, 0x10
jmp 0x42caea
Function at 0x42e75c
Capabilities:
Query environment variable

Disassembly:
push 0x210
push 0x4a7510
call fcn.0045954c
mov dword [ebp - 0x21c], 0x30
push 0x1fc
xor ebx, ebx
push ebx
lea eax, [ebp - 0x218]
push eax
call fcn.00454800
add esp, 0xc
push 0x100
lea eax, [ebp - 0x21c]
push eax
push str.BUGREPORT_HANDLER_ADDR
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jbe 0x42e814
mov dword [ebp - 0x220], ebx
lea eax, [ebp - 0x220]
push eax
push 0x496eb0
lea eax, [ebp - 0x21c]
push eax
call fcn.00459529
add esp, 0xc
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x220]
cmp byte [eax + 0x5c44], bl
je 0x42e80d
cmp byte [eax + 0x5c45], bl
jne 0x42e80d
cmp dword [eax + 0x5c60], 0x5e640
jne 0x42e80d
mov dword [ebp - 4], 0xfffffffe
jmp 0x42e816
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
call fcn.00459594
ret

Function at 0x42e892
Capabilities:
Enumerate threads
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push edi
push 0
push 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
jne 0x42e8b0
xor eax, eax
jmp 0x42e937
push esi
push 0x1c
pop esi
push esi
lea eax, [ebp - 0x1c]
push 0
push eax
call fcn.00454800
add esp, 0xc
lea eax, [ebp - 0x1c]
push eax
push edi
mov dword [ebp - 0x1c], esi
call sub.KERNEL32.dll_Thread32First
test eax, eax
jne 0x42e8df
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x42e936
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x10], eax
jne 0x42e927
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp - 0x14], eax
je 0x42e927
push dword [ebp - 0x14]
push 0
push 0x1f03ff
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov esi, eax
test esi, esi
je 0x42e8db
cmp dword [ebp + 8], 0
push esi
je 0x42e91a
call dword [sym.imp.KERNEL32.dll_SuspendThread]
jmp 0x42e920
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x1c]
push eax
push edi
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x42e8df
inc eax
pop esi
pop edi
leave
ret 4

Function at 0x42e9d9
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
ret

Function at 0x42ed9a
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
mov eax, dword [0x4b4970]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x4b6a34]
test eax, eax
jne 0x42ee15
call fcn.0042e75c
mov dword [0x4b6a34], eax
test eax, eax
jne 0x42ee10
push 0x5c64
call fcn.004543be
pop ecx
test eax, eax
je 0x42eddc
mov ecx, eax
call fcn.0042e711
jmp 0x42edde
xor eax, eax
push 0x4b6a34
push 0x496eb0
mov dword [0x4b6a34], eax
lea eax, [ebp - 0x204]
push 0xffffffffffffffff
push eax
call fcn.0042eb2e
add esp, 0x10
lea eax, [ebp - 0x204]
push eax
push str.BUGREPORT_HANDLER_ADDR
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov eax, dword [0x4b6a34]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045466b
leave
ret
Function at 0x42ee21
Capabilities:
Create directory
Extract resource via kernel32 functions
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x4b4970]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push dword [esi]
call fcn.0042e9d9
xor edi, edi
pop ecx
test eax, eax
jne 0x42ee52
push edi
push dword [esi]
push edi
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push 0x496f58
push 0x3e7
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push eax
push ebx
call fcn.00419b78
mov esi, eax
lea eax, [ebp - 0x234]
push eax
push 0xffffffffffffffff
push esi
call fcn.00417fe2
mov ebx, dword [ebp - 0x234]
add esp, 0x18
cmp ebx, edi
jle 0x42eed0
lea eax, [ebp - 0x234]
push eax
push edi
push esi
call fcn.00417fe2
lea eax, [ebp - 0x230]
push eax
push edi
push esi
call fcn.00419bc9
add esp, 0x18
inc edi
cmp edi, ebx
jl 0x42eeac
push esi
call fcn.00419be2
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045466b
leave
ret
Function at 0x42ef31
Capabilities:
Delete file

Disassembly:
push 0x6c
mov eax, 0x48abfa
call fcn.00454dfd
push str.autoupdate
mov ecx, 0x4b6af8
call fcn.0044ea50
mov edi, eax
xor ebx, ebx
mov dword [ebp - 0x18], edi
cmp edi, ebx
je 0x42f0c1
push 0x49700c
call fcn.0044841f
pop ecx
cmp dword [edi + 0x40], ebx
je 0x42efa4
cmp dword [0x4b6c90], ebx
jne 0x42efa4
cmp dword [0x4b6c54], ebx
jne 0x42efa4
push 0x496fd8
call fcn.0044841f
push 1
call fcn.004410a9
pop ecx
pop ecx
test eax, eax
jl 0x42efa4
push 0x210
call fcn.00440b62
pop ecx
xor eax, eax
jmp 0x42f0c4
lea esi, [edi + 0xd8]
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x1c], esi
call fcn.0043eb7c
mov eax, dword [esi + 4]
mov ecx, dword [esi + 8]
mov edx, dword [esi]
push ebx
push eax
push 0x4a1d5c
push ebx
push ecx
push edx
lea ecx, [ebp - 0x78]
mov dword [ebp - 4], ebx
call fcn.0043f44e
test eax, eax
jl 0x42f0b5
lea ecx, [ebp - 0x44]
call fcn.00443e87
mov eax, dword [esi + 8]
mov ecx, dword [edi]
push ebx
push ebx
push eax
push esi
push ecx
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 2
call fcn.004468fc
mov byte [ebp - 0x14], al
mov dword [ebp - 4], 1
jmp 0x42f01d
push ebx
push dword [edi + 0x14]
push dword [edi + 0x10]
push dword [0x4b6c5c]
push dword [0x4b6c58]
push ebx
push 1
push ebx
push dword [ebp - 0x14]
push str.updater
push 0x496fb8
call fcn.004425c8
add esp, 0x2c
cmp byte [ebp - 0x14], bl
je 0x42f098
push 0x496f94
call fcn.0044841f
pop ecx
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
call fcn.004410a9
mov dword [0x4b6c6c], ebx
mov dword [esp], 0x22e
call fcn.00440b62
xor esi, esi
pop ecx
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], bl
call fcn.00443ebd
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x78]
call fcn.0043ebe6
mov eax, esi
jmp 0x42f0c4
push 0x496f74
call fcn.0044841f
mov dword [esp], 0x234
call fcn.00440b62
mov esi, 0x80004005
jmp 0x42f07c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x78]
call fcn.0043ebe6
xor eax, eax
inc eax
call fcn.00454ea2
ret

Function at 0x42f0ca
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 8], 0
push esi
mov esi, ecx
jne 0x42f0dd
xor eax, eax
jmp 0x42f140
push edi
call fcn.0042ea41
lea ecx, [ebp - 0x14]
call fcn.0042e650
push dword [ebp + 8]
mov edi, 0x5834
push edi
push 0
push 4
add eax, 4
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
lea ecx, [ebp - 0x14]
mov dword [esi + 4], eax
call fcn.0042e6f9
mov eax, dword [esi + 4]
test eax, eax
je 0x42f135
push edi
push 0
push 0
push 6
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 8], eax
test eax, eax
jne 0x42f139
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x42f13f
xor eax, eax
inc eax
mov dword [esi + 0xc], eax
pop edi
pop esi
leave
ret 8
Function at 0x430211
Capabilities:
Check mutex on windows

Disassembly:
push 0x810
mov eax, 0x48ad5e
call fcn.00454dca
xor edi, edi
push 0x4b6d04
cmp dword [0x4b6c98], edi
je 0x43028f
lea ecx, [ebp - 0x10]
call fcn.0041acdf
push dword [0x4b6be0]
lea eax, [ebp - 0x10]
push str.baidu__s_autoupdate_mutexshowresult
push eax
mov dword [ebp - 4], edi
call fcn.0041b07c
mov esi, dword [ebp - 0x10]
add esp, 0xc
push esi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x430287
push str._tgvQ
call fcn.0044841f
pop ecx
lea ecx, [esi - 0x10]
call fcn.0041a963
mov eax, 0x80004005
jmp 0x4303b8
lea ecx, [esi - 0x10]
jmp 0x4303b1
lea ecx, [ebp - 0x14]
call fcn.0041acdf
push dword [0x4b6be0]
lea eax, [ebp - 0x14]
push str.baidu__s_autoupdate_mutex
push eax
mov dword [ebp - 4], 1
call fcn.0041b07c
add esp, 0xc
push dword [ebp - 0x14]
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
call esi
call esi
cmp eax, 0xb7
jne 0x430349
cmp dword [0x4b6c90], edi
jne 0x430349
push 0x4971dc
call fcn.0044841f
mov eax, dword [0x4b6c8c]
pop ecx
mov ecx, dword [0x4b6c9c]
cmp eax, edi
je 0x4302fa
cmp ecx, edi
jne 0x430302
cmp dword [0x4b6c80], edi
je 0x430341
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_AllowSetForegroundWindow]
push dword [0x4b6c1c]
lea ecx, [ebp - 0x10]
push edi
push 1
push edi
mov dword [ebp - 0x10], edi
call fcn.0042bcd1
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_SetEvent]
cmp dword [ebp - 0x10], edi
je 0x430336
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
jmp 0x430278
cmp eax, edi
je 0x430349
cmp ecx, edi
je 0x430336
push dword [ebp - 0x10]
lea eax, [ebp - 0x81c]
push 0x4971c8
push eax
call fcn.0041e3bc
push dword [eax]
mov byte [ebp - 4], 2
call fcn.0044841f
lea eax, [ebp - 0x814]
add esp, 0x10
mov byte [ebp - 4], 1
cmp dword [ebp - 0x81c], eax
je 0x430389
push dword [ebp - 0x81c]
call fcn.0045471c
pop ecx
push 0x1388
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x4303ab
push 0x4971b8
call fcn.0044841f
pop ecx
jmp 0x430336
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.0041a963
xor eax, eax
call fcn.00454ea2
ret

Function at 0x4308cb
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x4b4970]
xor eax, ebp
mov dword [ebp - 4], eax
push dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x20]
call fcn.00415390
cmp dword [ebp - 8], 8
mov eax, dword [ebp - 0x1c]
jae 0x4308f6
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0
push 1
lea ecx, [ebp - 0x20]
call fcn.00401850
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
xor ecx, ebp
call fcn.0045466b
leave
ret 0xc
Function at 0x43108e
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x4b4970]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0x810
mov eax, 0x48aebe
call fcn.00454dca
push 0x497404
call fcn.0044841f
push 4
pop esi
push esi
mov dword [ebp - 0x14], esi
call fcn.0041e0d6
pop ecx
pop ecx
xor ebx, ebx
push 2
push ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.ole32.dll_CoInitializeEx]
call fcn.0042b5b9
lea eax, [ebp]
push eax
mov edi, 0x104
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jbe 0x43113c
push dword [0x4b6be0]
lea eax, [ebp]
push eax
push str._sBaidu_s_autoupdate
mov esi, 0x4b6bfc
push esi
call fcn.0041b07c
push 0x4a1f38
lea eax, [ebp - 0x10]
push esi
push eax
call fcn.004223c1
push dword [eax]
mov byte [ebp - 4], 1
call fcn.004417c1
mov ecx, dword [ebp - 0x10]
add esp, 0x20
add ecx, 0xfffffff0
mov byte [ebp - 4], bl
call fcn.0041a963
push 4
pop esi
lea eax, [ebp]
push edi
push eax
call fcn.0043b1e9
pop ecx
pop ecx
lea eax, [ebp]
push eax
mov ecx, 0x4b6c00
call fcn.0041c293
call fcn.0043b254
push eax
mov dword [0x4b6c74], eax
lea eax, [ebp - 0x81c]
push str._g0WR
push eax
call fcn.0041e3bc
push dword [eax]
mov byte [ebp - 4], 2
call fcn.0044841f
lea eax, [ebp - 0x814]
add esp, 0x10
mov byte [ebp - 4], bl
cmp dword [ebp - 0x81c], eax
je 0x43119d
push dword [ebp - 0x81c]
call fcn.0045471c
pop ecx
cmp dword [0x4b6c80], ebx
je 0x4311eb
lea eax, [ebp - 0x81c]
push 0x49737c
push eax
mov dword [0x4b6c74], 1
call fcn.0041e3bc
push dword [eax]
mov byte [ebp - 4], 3
call fcn.0044841f
lea eax, [ebp - 0x814]
add esp, 0xc
mov byte [ebp - 4], bl
cmp dword [ebp - 0x81c], eax
je 0x4311eb
push dword [ebp - 0x81c]
call fcn.0045471c
pop ecx
push 0x497354
call fcn.0044841f
push esi
mov dword [ebp - 0x10], esi
call fcn.0041e0d6
push 0x49676c
push dword [0x4b6bf4]
mov byte [ebp - 4], 4
call fcn.00441abd
push 0xfffffffffffffffc
mov byte [ebp - 4], bl
call fcn.0041e0d6
add esp, 0x14
mov ecx, 0x4b6a40
call fcn.0042092e
push 0xfffffffffffffffc
call fcn.0041e0d6
pop ecx
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.0045466b
add ebp, 0x20c
leave
ret
Function at 0x431ac6
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
lea eax, [esi + 0x5c48]
push edi
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [esi + 0x5c44]
cmp byte [eax], 0
je 0x431aff
mov esi, 0x810a0001
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov eax, esi
pop esi
leave
ret 0x10
mov byte [eax], 1
mov eax, dword [ebp + 0x10]
xor ecx, ecx
mov dword [esi + 4], eax
mov eax, 0x4a1d5c
cmp dword [ebp + 8], ecx
jne 0x431b17
mov dword [ebp + 8], eax
cmp dword [ebp + 0xc], ecx
jne 0x431b1f
mov dword [ebp + 0xc], eax
cmp dword [ebp + 0x14], ecx
je 0x431b3a
push 0xffffffffffffffff
push dword [ebp + 0x14]
lea eax, [esi + 0x583c]
push eax
call fcn.0042eb4d
add esp, 0xc
jmp 0x431b85
push ebx
mov edi, 0x104
push edi
lea ebx, [esi + 0x583c]
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x5c
push ebx
call fcn.0045621c
pop ecx
pop ecx
pop ebx
test eax, eax
jne 0x431b66
mov esi, 0x810a0002
jmp 0x431aee
mov ecx, eax
sub ecx, esi
sub ecx, 0x583c
push 0xffffffffffffffff
sar ecx, 1
push str._bdcrashreport.exe
sub edi, ecx
push edi
push eax
call fcn.0045487a
add esp, 0x10
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea eax, [esi + 0x2ec]
push eax
call fcn.0042eb67
push 0xffffffffffffffff
push dword [ebp + 8]
lea eax, [esi + 0x573c]
push 0x40
push eax
call fcn.0045487a
push 0xffffffffffffffff
push dword [ebp + 0xc]
lea eax, [esi + 0x57bc]
push 0x40
push eax
call fcn.0045487a
add esp, 0x2c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.bdbugreport__u
lea eax, [esi + 0x5a44]
push 0xffffffffffffffff
push eax
call fcn.0042eb2e
add esp, 0x10
mov edi, 0x42ff70
push edi
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov dword [esi], eax
cmp eax, edi
jne 0x431bf5
and dword [esi], 0
push 0x430fff
call fcn.00455496
mov dword [esp], 0x431056
call fcn.00457c03
pop ecx
xor esi, esi
jmp 0x431aee
Function at 0x4333a4
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x4b4970]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0x10
mov eax, 0x48b0f2
call fcn.00454dca
xor eax, eax
push 0x206
mov word [ebp], ax
xor esi, esi
lea eax, [ebp + 2]
push esi
push eax
call fcn.00454800
add esp, 0xc
lea eax, [ebp]
push eax
push esi
push esi
push 0x1a
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x10]
call fcn.0041ed69
push str._baidu_bdupdateSkin_
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], esi
call fcn.00421f76
lea eax, [ebp - 0x10]
push eax
call fcn.0042ee21
call fcn.00484f40
lea eax, [ebp - 0x10]
mov dword [esp], 0x497460
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.004223c1
lea eax, [ebp - 0x18]
push eax
lea ebx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.00432d30
add esp, 0x10
push esi
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 2
call fcn.0041afe8
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x1c], esp
push eax
call fcn.00403a90
mov byte [ebp - 4], 3
call fcn.00484de0
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.00485430
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.0041a963
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.0041a963
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0041a963
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.0045466b
add ebp, 0x20c
leave
ret