joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d6eff
Capabilities:
Check if file exists

Disassembly:
push 0xc4
mov eax, 0x5f5ba1
call fcn.0059bbd7
mov edi, edx
mov esi, ecx
lea ecx, [ebp - 0x28]
call fcn.004d6c63
and dword [ebp - 4], 0
mov ebx, str._bkinfo
push ebx
call fcn.005c2f90
pop ecx
push eax
push ebx
lea ecx, [ebp - 0x28]
call fcn.0040b220
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4d7095
mov ebx, str._settingconfig
push ebx
call fcn.005c2f90
pop ecx
push eax
push ebx
lea ecx, [ebp - 0x28]
call fcn.0040b220
xor eax, eax
mov dword [ebp - 0xc0], vtable.CxAutoArray_unsigned_char_.0
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0xb8], eax
xor ebx, ebx
lea ecx, [ebp - 0x28]
inc ebx
lea edx, [ebp - 0xbc]
mov byte [ebp - 4], bl
cmp dword [ebp - 0x14], 8
mov dword [ebp - 0xb4], eax
lea eax, [ebp - 0xb4]
cmovae ecx, dword [ebp - 0x28]
push eax
call fcn.0041e461
pop ecx
test eax, eax
jne 0x4d6fb6
cmp dword [ebp - 0xb4], eax
jne 0x4d708a
push dword [ebp - 0xb4]
and dword [ebp - 0x30], 0
lea ecx, [ebp - 0x40]
push dword [ebp - 0xbc]
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
call fcn.0040464f
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 2
call fcn.00401c84
push 0
lea ecx, [ebp - 0xd0]
mov byte [ebp - 4], 3
call fcn.00404ba6
push ebx
lea eax, [ebp - 0xd0]
mov byte [ebp - 4], 4
push eax
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0xb0]
call fcn.00401d1d
test al, al
je 0x4d70a7
lea ecx, [ebp - 0xd0]
call fcn.00405673
test al, al
jne 0x4d70a7
call fcn.004056d7
test al, al
je 0x4d70a7
push esi
call fcn.004055ae
test al, al
je 0x4d706c
push esi
lea ecx, [ebp - 0xd0]
call fcn.0040553e
mov ecx, eax
call fcn.00405683
test al, al
je 0x4d706c
push esi
lea ecx, [ebp - 0xd0]
call fcn.0040553e
mov ecx, eax
call fcn.00405002
mov dword [edi], eax
jmp 0x4d70a9
lea ecx, [ebp - 0xd0]
call fcn.00404dbc
lea ecx, [ebp - 0xb0]
call fcn.00402bc3
lea ecx, [ebp - 0x40]
call fcn.00404812
lea ecx, [ebp - 0xc0]
call fcn.0041e5e6
xor bl, bl
lea ecx, [ebp - 0x28]
call fcn.0040b67e
mov al, bl
call fcn.0059bb81
ret
xor bl, bl
lea ecx, [ebp - 0xd0]
call fcn.00404dbc
lea ecx, [ebp - 0xb0]
call fcn.00402bc3
lea ecx, [ebp - 0x40]
call fcn.00404812
lea ecx, [ebp - 0xc0]
call fcn.0041e5e6
jmp 0x4d7097

Function at 0x4d70d4
Capabilities:
Check if file exists

Disassembly:
push 0x34
mov eax, 0x5e58d6
call fcn.0059bbd7
push 0x640f58
lea ecx, [ebp - 0x40]
call fcn.0040b0d5
xor ebx, ebx
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], ebx
call fcn.004d5054
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 2
call fcn.0040b67e
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4d7123
mov bl, 1
jmp 0x4d7146
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push 0x18ca
push str.CheckHuabaoVersionDir
push str.__s__d___strInstallPath:__s__r_n
call fcn.0040a649
add esp, 0x10
lea ecx, [ebp - 0x28]
call fcn.0040b67e
mov al, bl
call fcn.0059bb81
ret
Function at 0x4d7560
Capabilities:
Check if file exists

Disassembly:
push 0xb4
mov eax, 0x5f5c8b
call fcn.0059bbd7
xor ecx, ecx
mov dword [ebp - 0x78], 7
xor eax, eax
mov dword [ebp - 0xc0], ecx
mov bl, cl
mov dword [ebp - 0x7c], ecx
mov word [ebp - 0x8c], ax
lea eax, [ebp - 0x8c]
mov dword [ebp - 4], ecx
push eax
push str.Path
mov edx, 0x632b08
mov ecx, reloc.WS2_32.dll_bind
call fcn.004261ea
pop ecx
pop ecx
test eax, eax
je 0x4d7753
push str._safemon_saasver.dll
lea edx, [ebp - 0x8c]
lea ecx, [ebp - 0x44]
call fcn.00411559
mov byte [ebp - 4], 1
lea edx, [ebp - 0x8c]
lea ecx, [ebp - 0x74]
mov dword [esp], str._safemonFreeSaaS.tpi
call fcn.00411559
mov byte [ebp - 4], 2
lea edx, [ebp - 0x8c]
lea ecx, [ebp - 0x2c]
mov dword [esp], str._safemonSystemInfo.dll
call fcn.00411559
pop ecx
push 8
mov byte [ebp - 4], 3
lea eax, [ebp - 0x44]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
pop edi
cmp dword [ebp - 0x30], edi
cmovae eax, dword [ebp - 0x44]
push eax
call esi
test eax, eax
je 0x4d76ea
cmp dword [ebp - 0x60], edi
lea eax, [ebp - 0x74]
cmovae eax, dword [ebp - 0x74]
push eax
call esi
test eax, eax
je 0x4d76ea
cmp dword [ebp - 0x18], edi
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push eax
call esi
test eax, eax
je 0x4d76ea
and dword [ebp - 0x4c], 0
xor eax, eax
mov dword [ebp - 0x48], 7
mov word [ebp - 0x5c], ax
lea edx, [ebp - 0x5c]
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x44]
call fcn.004272ec
push str.4.0.0.1121
lea ecx, [ebp - 0xa4]
call fcn.0040b0d5
mov byte [ebp - 4], 5
lea edx, [ebp - 0xa4]
cmp dword [ebp - 0x90], edi
lea ecx, [ebp - 0x5c]
cmovae edx, dword [ebp - 0xa4]
cmp dword [ebp - 0x48], edi
cmovae ecx, dword [ebp - 0x5c]
call fcn.004275c6
test eax, eax
js 0x4d76bb
lea edx, [ebp - 0x2c]
lea ecx, [ebp - 0xbc]
call fcn.004d7492
xor ecx, ecx
inc ecx
cmp dword [eax + 0x10], 0
je 0x4d76c1
mov bl, cl
jmp 0x4d76c3
mov ecx, dword [ebp - 0xc0]
xor bl, bl
test cl, 1
je 0x4d76d3
lea ecx, [ebp - 0xbc]
call fcn.00404812
lea ecx, [ebp - 0xa4]
call fcn.0040b67e
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 3
call fcn.0040b67e
cmp dword [ebp - 0x18], edi
lea eax, [ebp - 0x2c]
lea edi, [ebp - 0x74]
cmovae eax, dword [ebp - 0x2c]
lea esi, [ebp - 0x44]
cmp dword [ebp - 0x60], 8
push eax
cmovae edi, dword [ebp - 0x74]
cmp dword [ebp - 0x30], 8
cmovae esi, dword [ebp - 0x44]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push eax
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
call edi
push eax
push esi
call edi
push eax
push 0x1959
push str.IsEnterpriseStatus
push str.__s__d____d___d___d
call fcn.0040a649
add esp, 0x18
lea ecx, [ebp - 0x2c]
call fcn.0040b67e
lea ecx, [ebp - 0x74]
call fcn.0040b67e
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0
call fcn.0040b67e
movzx ecx, bl
push ecx
push 0x195c
push str.IsEnterpriseStatus
push str.__s__d___IsEnterpriseStatus_return_value:__d
call fcn.0040a649
add esp, 0x10
lea ecx, [ebp - 0x8c]
call fcn.0040b67e
mov al, bl
call fcn.0059bb81
ret
Function at 0x4d7861
Capabilities:
Check if file exists
Read file on windows

Disassembly:
push 0x100
mov eax, 0x5f5d31
call fcn.0059bbd7
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x2c], 0xf
mov dword [ebp - 0xe8], ebx
mov dword [ebp - 0x30], ebx
mov byte [ebp - 0x40], bl
mov dword [ebp - 4], ebx
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x4d7894
mov eax, dword [esi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4d7a77
cmp dword [esi + 0x14], 8
jb 0x4d78ab
mov esi, dword [esi]
push 0x633b20
push esi
call fcn.005c2b8a
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x4d7a77
push 2
push ebx
push esi
call fcn.005c3a4b
push esi
call fcn.005c4044
push ebx
mov edi, eax
push ebx
push esi
mov dword [ebp - 0xec], edi
call fcn.005c3a4b
lea eax, [edi + 2]
push eax
mov dword [ebp - 0xe4], eax
call fcn.0059af42
mov edi, eax
add esp, 0x20
test edi, edi
je 0x4d7a70
push dword [ebp - 0xe4]
push ebx
push edi
call fcn.005b24a0
push ebx
push ebx
push esi
call fcn.005c3a4b
push esi
push 1
push dword [ebp - 0xec]
push edi
call fcn.005c421b
add esp, 0x28
lea ecx, [ebp - 0x70]
push edi
call fcn.004045aa
lea ecx, [ebp - 0xe4]
mov byte [ebp - 4], 1
call fcn.00401c60
mov eax, ecx
lea ecx, [ebp - 0xe0]
push eax
call fcn.00401cd1
push ebx
lea ecx, [ebp - 0x10c]
mov byte [ebp - 4], 2
call fcn.00404ba6
push edi
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 3
call fcn.004045aa
push 1
lea eax, [ebp - 0x10c]
mov byte [ebp - 4], 4
push eax
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0xe0]
call fcn.00401d1d
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 3
mov bl, al
call fcn.00404812
test bl, bl
je 0x4d7a45
push str.sync_login_info
lea ecx, [ebp - 0x10c]
call fcn.00405401
push eax
lea ecx, [ebp - 0x20]
call fcn.00404cc0
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 5
call fcn.004056d7
test al, al
je 0x4d7a3d
push str.filepath
call fcn.00405401
push eax
lea ecx, [ebp - 0xfc]
call fcn.00404cc0
lea ecx, [ebp - 0xfc]
mov byte [ebp - 4], 6
call fcn.004056be
test al, al
je 0x4d7a32
lea eax, [ebp - 0x58]
push eax
call fcn.00404f93
push eax
lea ecx, [ebp - 0x40]
call fcn.00409145
lea ecx, [ebp - 0x58]
call fcn.00404812
mov ecx, dword [ebp - 0x30]
test ecx, ecx
setne al
mov byte [ebp - 0xe8], al
xor eax, eax
test ecx, ecx
setne al
push eax
push 0x1994
push str.IsFixedFieldExist
push str.__s__d___strUserName_is_exst_d_
call fcn.0040a649
add esp, 0x10
lea ecx, [ebp - 0xfc]
call fcn.00404dbc
lea ecx, [ebp - 0x20]
call fcn.00404dbc
push edi
call fcn.0059aa0f
pop ecx
lea ecx, [ebp - 0x10c]
call fcn.00404dbc
lea ecx, [ebp - 0xe0]
call fcn.00402bc3
lea ecx, [ebp - 0x70]
call fcn.00404812
mov ebx, dword [ebp - 0xe8]
push esi
call fcn.005c2c80
pop ecx
lea ecx, [ebp - 0x40]
call fcn.00404812
mov al, bl
call fcn.0059bb81
ret
Function at 0x4d8e85
Capabilities:
Check if file exists

Disassembly:
push 0x44
mov eax, 0x5f612c
call fcn.0059bbd7
mov edi, edx
mov esi, ecx
mov dword [ebp - 0x44], esi
push 0x627e3e
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x44], esi
call fcn.004045aa
and dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.004d6c63
push eax
mov ecx, edi
call fcn.0040b0ac
lea ecx, [ebp - 0x28]
call fcn.0040b67e
mov ebx, str._bkinfo
push ebx
call fcn.005c2f90
pop ecx
push eax
push ebx
mov ecx, edi
call fcn.0040b220
cmp dword [edi + 0x14], 8
mov eax, edi
jb 0x4d8ee3
mov eax, dword [edi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4d8f23
push 0x1ad5
push str.GetPushMsgConfig
push str.__s__d___RecordPopMsgInfo_path_not_exist_s
call fcn.0040a649
add esp, 0xc
xor eax, eax
mov byte [ebp - 0x44], al
mov ecx, esi
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
lea eax, [ebp - 0x40]
push dword [ebp - 0x44]
push eax
call fcn.004046c1
jmp 0x4d8fc0
mov ebx, str.pushmsgconfig
push ebx
call fcn.005c2f90
pop ecx
push eax
push ebx
mov ecx, edi
call fcn.0040b220
xor ebx, ebx
mov dword [ebp - 0x50], vtable.CxAutoArray_unsigned_char_.0
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], ebx
mov byte [ebp - 4], 1
cmp dword [edi + 0x14], 8
mov dword [ebp - 0x44], ebx
jb 0x4d8f56
mov edi, dword [edi]
lea eax, [ebp - 0x44]
mov ecx, edi
push eax
lea edx, [ebp - 0x4c]
call fcn.0041e461
pop ecx
test eax, eax
jne 0x4d8f6e
cmp dword [ebp - 0x44], eax
jne 0x4d8fa1
push dword [ebp - 0x44]
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
push dword [ebp - 0x4c]
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
call fcn.0040464f
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x40]
call fcn.00404698
lea ecx, [ebp - 0x28]
call fcn.00404812
mov byte [ebp - 0x44], bl
lea eax, [ebp - 0x40]
push dword [ebp - 0x44]
mov ecx, esi
mov dword [esi + 0x10], ebx
push eax
mov dword [esi + 0x14], ebx
call fcn.004046c1
lea ecx, [ebp - 0x50]
call fcn.0041e5e6
lea ecx, [ebp - 0x40]
call fcn.00404812
mov eax, esi
call fcn.0059bb81
ret
Function at 0x4d97cb
Capabilities:
Check if file exists

Disassembly:
push 0x7c
mov eax, 0x5f6302
call fcn.0059bbd7
mov edi, edx
mov esi, ecx
lea ecx, [ebp - 0x84]
call fcn.0040ba47
and dword [ebp - 4], 0
push 0x170
call fcn.0059a7c1
pop ecx
mov dword [ebp - 0x88], eax
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.0040b6b1
sub esp, 0x18
mov ebx, eax
mov ecx, esp
xor eax, eax
mov byte [ebp - 4], al
push esi
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
call fcn.0040b155
lea ecx, [ebp - 0x2c]
call fcn.00435a2c
add esp, 0x18
push eax
mov ecx, ebx
mov byte [ebp - 4], 2
call fcn.0040b8cb
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0
call fcn.00404812
sub esp, 0x18
mov ecx, esp
push edi
and dword [ecx + 0x10], 0
and dword [ecx + 0x14], 0
call fcn.0040b155
lea ecx, [ebp - 0x2c]
call fcn.00435a2c
add esp, 0x18
push eax
mov ecx, ebx
mov byte [ebp - 4], 3
call fcn.0040b9f4
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0
call fcn.00404812
push 0x12c
mov ecx, ebx
call fcn.0040b8d4
cmp byte [ebp + 8], 0
je 0x4d988f
push ecx
call fcn.0040ba13
push ebx
call fcn.0040bde3
cmp dword [edi + 0x14], 8
mov esi, eax
mov ecx, edi
jb 0x4d98a1
mov ecx, dword [edi]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
setne al
test esi, esi
jne 0x4d9945
test al, al
je 0x4d9945
and dword [ebp - 0x1c], esi
lea ecx, [ebp - 0x2c]
and dword [ebp - 0x18], esi
push edi
call fcn.0040b155
cmp byte [ebp + 0xc], 0
mov byte [ebp - 4], 4
je 0x4d9921
lea edx, [ebp - 0x2c]
lea ecx, [ebp - 0x44]
call fcn.004257c4
lea eax, [ebp - 0x44]
mov byte [ebp - 4], 5
push eax
mov edx, eax
mov ecx, str.0aa4efce
call fcn.00416a1a
cmp dword [ebp - 0x30], 0x10
lea edx, [ebp - 0x44]
pop ecx
cmovae edx, dword [ebp - 0x44]
lea ecx, [ebp - 0x2c]
cmp dword [ebp - 0x18], 8
push dword [ebp - 0x34]
cmovae ecx, dword [ebp - 0x2c]
call fcn.0041e514
pop ecx
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 4
call fcn.00404812
push 0x1b5b
push str.RealDownloadInspire
push str.__s__d___download_inspire_video_success
call fcn.0040a649
add esp, 0xc
lea ecx, [ebp - 0x2c]
call fcn.0040b67e
xor ebx, ebx
inc ebx
jmp 0x4d9947
xor bl, bl
lea ecx, [ebp - 0x84]
call fcn.0040ba62
mov al, bl
call fcn.0059bb81
ret

Function at 0x4d9fa8
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
xor ecx, ecx
lea eax, [ebp - 4]
push eax
push ecx
push ecx
push 0x4d9fcf
push ecx
push ecx
mov dword [ebp - 4], ecx
call fcn.005c30ff
add esp, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
leave
ret
Function at 0x4da735
Capabilities:
Check if file exists

Disassembly:
push 0xa4
mov eax, 0x5f647d
call fcn.0059bbd7
mov esi, edx
mov dword [ebp - 0xac], esi
mov edi, ecx
mov dword [ebp - 0xa8], edi
push ecx
push 0x647544
mov ecx, esi
mov dword [ebp - 0xa8], edi
call fcn.0040aff3
xor ebx, ebx
cmp eax, 0xffffffff
je 0x4da781
push esi
mov ecx, edi
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
call fcn.0040b155
jmp 0x4da8e7
xor eax, eax
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], 7
mov word [ebp - 0x44], ax
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], ebx
call fcn.004d6c63
push str.bkinfomouse_set_config
mov byte [ebp - 4], 1
call fcn.005c2f90
pop ecx
push eax
push str.bkinfomouse_set_config
lea ecx, [ebp - 0x2c]
call fcn.0040b220
lea eax, [ebp - 0xa8]
mov dword [ebp - 0xa8], ebx
push eax
push str.beautify_need_engine
mov edx, str.Software360360huabaohuabao
mov ecx, reloc.WS2_32.dll_accept
call fcn.004261bf
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
pop ecx
cmovae eax, dword [ebp - 0x2c]
pop ecx
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4da8b1
push 0x627e3e
lea ecx, [ebp - 0x5c]
call fcn.004045aa
push 0xfde9
lea edx, [ebp - 0x2c]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x74]
call fcn.00426d6b
pop ecx
lea edx, [ebp - 0x5c]
mov byte [ebp - 4], 3
mov ecx, eax
call fcn.004168cd
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 2
call fcn.00404812
sub esp, 0x18
lea eax, [ebp - 0x5c]
mov ecx, esp
push eax
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], ebx
call fcn.00404267
lea ecx, [ebp - 0xa4]
call fcn.00435b82
mov esi, eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x8c]
mov edx, dword [ebp - 0xac]
push str.___engine
call fcn.00411559
add esp, 0x1c
push esi
mov edx, eax
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x74]
call fcn.00420d7e
pop ecx
push eax
lea ecx, [ebp - 0x44]
call fcn.0040b0ac
lea ecx, [ebp - 0x74]
call fcn.0040b67e
lea ecx, [ebp - 0x8c]
call fcn.0040b67e
lea ecx, [ebp - 0xa4]
call fcn.0040b67e
lea ecx, [ebp - 0x5c]
call fcn.00404812
jmp 0x4da8ba
push esi
lea ecx, [ebp - 0x44]
call fcn.0041322b
mov byte [ebp - 0xac], bl
lea eax, [ebp - 0x44]
push dword [ebp - 0xac]
mov ecx, edi
mov dword [edi + 0x10], ebx
push eax
mov dword [edi + 0x14], ebx
call fcn.0040b632
lea ecx, [ebp - 0x2c]
call fcn.0040b67e
lea ecx, [ebp - 0x44]
call fcn.0040b67e
mov eax, edi
call fcn.0059bb81
ret
Function at 0x4de2dc
Capabilities:
Check if file exists

Disassembly:
push 0x5c
mov eax, 0x5f6cd6
call fcn.0059bbd7
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x5c], edi
mov dword [ebp - 0x5c], edi
xor ebx, ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], bl
lea ecx, [ebp - 0x58]
mov dword [ebp - 4], ebx
call fcn.004d6c63
push 0x63c668
mov edx, eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.0041152a
pop ecx
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 3
call fcn.0040b67e
cmp esi, 1
jne 0x4de338
mov esi, str.mouse_preview_config
jmp 0x4de38a
cmp esi, 2
jne 0x4de344
mov esi, str.mouse_set_config
jmp 0x4de38a
cmp esi, 3
jne 0x4de350
mov esi, str.taskbar_preview_config
jmp 0x4de38a
cmp esi, 4
jne 0x4de35c
mov esi, 0x63d024
jmp 0x4de38a
cmp esi, 5
jne 0x4de368
mov esi, str.taskbar_setting_config
jmp 0x4de38a
cmp esi, 6
jne 0x4de374
mov esi, str.startmenu_set_config
jmp 0x4de38a
cmp esi, 7
jne 0x4de380
mov esi, str.startmenu_preview_config
jmp 0x4de38a
cmp esi, 8
jne 0x4de39b
mov esi, str.video_config
push esi
call fcn.005c2f90
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.0040b220
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4de3cd
mov byte [ebp - 0x5c], bl
lea eax, [ebp - 0x40]
push dword [ebp - 0x5c]
mov ecx, edi
mov dword [edi + 0x10], ebx
push eax
mov dword [edi + 0x14], ebx
call fcn.004046c1
jmp 0x4de450
mov dword [ebp - 0x68], vtable.CxAutoArray_unsigned_char_.0
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], ebx
mov byte [ebp - 4], 4
lea eax, [ebp - 0x5c]
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
push eax
cmovae ecx, dword [ebp - 0x28]
lea edx, [ebp - 0x64]
mov dword [ebp - 0x5c], ebx
call fcn.0041e461
pop ecx
test eax, eax
jne 0x4de402
cmp dword [ebp - 0x5c], eax
jne 0x4de431
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x48], ebx
push dword [ebp - 0x64]
mov dword [ebp - 0x44], 0xf
mov byte [ebp - 0x58], bl
call fcn.0040464f
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x40]
call fcn.00409145
lea ecx, [ebp - 0x58]
call fcn.00404812
mov byte [ebp - 0x5c], bl
lea eax, [ebp - 0x40]
push dword [ebp - 0x5c]
mov ecx, edi
mov dword [edi + 0x10], ebx
push eax
mov dword [edi + 0x14], ebx
call fcn.004046c1
lea ecx, [ebp - 0x68]
call fcn.0041e5e6
lea ecx, [ebp - 0x28]
call fcn.0040b67e
lea ecx, [ebp - 0x40]
call fcn.00404812
mov eax, edi
call fcn.0059bb81
ret
Function at 0x4de59d
Capabilities:
Check if file exists

Disassembly:
push 0x6c
mov eax, 0x5f6d76
call fcn.0059bbd7
mov edi, edx
mov esi, ecx
mov ebx, 0x627e3e
push ebx
call fcn.005b69b0
pop ecx
push eax
push ebx
mov ecx, edi
call fcn.0040464f
lea ecx, [ebp - 0x74]
call fcn.004d6c63
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x64], ebx
je 0x4de6d4
push 0x633b6c
lea edx, [ebp - 0x74]
lea ecx, [ebp - 0x44]
call fcn.00411559
pop ecx
push esi
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.00411504
mov byte [ebp - 0x78], bl
lea ecx, [ebp - 0x2c]
push dword [ebp - 0x78]
mov dword [ebp - 0x1c], ebx
push eax
mov dword [ebp - 0x18], ebx
call fcn.0040b632
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 3
call fcn.0040b67e
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4de6cc
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push eax
call fcn.004352fd
pop ecx
test eax, eax
je 0x4de6cc
xor eax, eax
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], 7
mov word [ebp - 0x5c], ax
mov byte [ebp - 4], 4
lea eax, [ebp - 0x2c]
cmp dword [ebp - 0x18], 8
lea ecx, [ebp - 0x44]
cmovae eax, dword [ebp - 0x2c]
push eax
call fcn.0040b0d5
lea edx, [ebp - 0x5c]
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x44]
call fcn.004272ec
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 4
mov esi, eax
call fcn.0040b67e
test esi, esi
je 0x4de6c4
sub esp, 0x18
lea eax, [ebp - 0x5c]
mov ecx, esp
push eax
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], ebx
call fcn.0040b155
lea ecx, [ebp - 0x44]
call fcn.00435a2c
add esp, 0x18
mov ecx, edi
push eax
call fcn.00409145
lea ecx, [ebp - 0x44]
call fcn.00404812
mov bl, 1
lea ecx, [ebp - 0x5c]
call fcn.0040b67e
lea ecx, [ebp - 0x2c]
call fcn.0040b67e
lea ecx, [ebp - 0x74]
call fcn.0040b67e
mov al, bl
call fcn.0059bb81
ret
Function at 0x4df872
Capabilities:
Check if file exists

Disassembly:
push 0x84
mov eax, 0x5f70da
call fcn.0059bbd7
mov esi, ecx
push str.143359e8_f4b9_4010_a5e5_789147203fa5
xor ebx, ebx
push ebx
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
test eax, eax
je 0x4df8a6
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4df9f7
cmp dword [0x6decc0], 1
jne 0x4df9f0
lea ecx, [ebp - 0x2c]
call fcn.004c9d5f
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x1c], 0
je 0x4df8da
mov edi, 0x63424c
push edi
call fcn.005c2f90
pop ecx
push eax
push edi
lea ecx, [ebp - 0x2c]
call fcn.0040b220
lea eax, [ebp - 0x2c]
mov edi, 0x6360f8
push eax
lea eax, [ebp - 0x8c]
push edi
push eax
call fcn.00445efc
add esp, 0xc
push edi
mov edx, eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x74]
call fcn.0041152a
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x5c]
mov edx, eax
mov dword [esp], 0x63438c
call fcn.0041152a
pop ecx
push esi
mov ecx, eax
mov byte [ebp - 4], 3
call fcn.00411504
mov byte [ebp - 0x90], bl
lea ecx, [ebp - 0x44]
push dword [ebp - 0x90]
mov dword [ebp - 0x34], ebx
push eax
mov dword [ebp - 0x30], ebx
call fcn.0040b632
lea ecx, [ebp - 0x5c]
call fcn.0040b67e
lea ecx, [ebp - 0x74]
call fcn.0040b67e
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 7
call fcn.0040b67e
push 8
pop esi
cmp dword [ebp - 0x30], esi
lea ecx, [ebp - 0x44]
lea eax, [ebp - 0x2c]
mov edi, str.LaunchHbProcess
cmovae ecx, dword [ebp - 0x44]
cmp dword [ebp - 0x18], esi
push ecx
cmovae eax, dword [ebp - 0x2c]
push eax
push 0x21b2
push edi
push str.__s__d__szExePath:_s__strCmdLine:_s
call fcn.0040a649
add esp, 0x14
lea eax, [ebp - 0x2c]
cmp dword [ebp - 0x18], esi
cmovae eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4df9de
cmp dword [ebp - 0x18], esi
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push eax
call fcn.004352fd
pop ecx
test eax, eax
je 0x4df9de
lea edx, [ebp - 0x90]
lea ecx, [ebp - 0x44]
call fcn.0043d474
test al, al
jne 0x4df9de
push 0x21b6
push edi
push str.__s__d___WmiLaunchProcess_excute_failed
call fcn.0040a649
add esp, 0xc
lea ecx, [ebp - 0x44]
call fcn.0040b67e
lea ecx, [ebp - 0x2c]
call fcn.0040b67e
jmp 0x4df9f7
mov ecx, esi
call fcn.00482756
call fcn.0059bb81
ret

Function at 0x4dfd68
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x6d35ac]
xor eax, ebp
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x1c]
call fcn.004dfc5a
cmp dword [eax + 0x14], 8
jb 0x4dfd88
mov eax, dword [eax]
push ebx
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
lea ecx, [ebp - 0x1c]
setne bl
call fcn.0040b67e
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.0059a7a2
leave
ret
Function at 0x4e0aa0
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa08
mov eax, dword [0x6d35ac]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
lea eax, [ebp - 0xa08]
mov dword [ebp - 0xa08], 0x100
push eax
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
xor ebx, ebx
mov dword [ebp - 0xa08], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_GetThreadDesktop]
mov edi, eax
lea eax, [ebp - 0xa08]
push eax
push ebx
push ebx
push 2
push edi
call dword [sym.imp.USER32.dll_GetUserObjectInformationW]
push dword [ebp - 0xa08]
call fcn.005c13f2
pop ecx
mov ebx, eax
lea eax, [ebp - 0xa08]
push eax
push dword [ebp - 0xa08]
push ebx
push 2
push edi
call dword [sym.imp.USER32.dll_GetUserObjectInformationW]
push str.Default
push ebx
call fcn.005c42cb
push ebx
lea eax, [ebp - 0x204]
push eax
push str.360ThemeMenu.Mutex._s._s
lea eax, [ebp - 0xa04]
push 0x400
push eax
call fcn.0042a7f9
push ebx
call fcn.005c13b1
add esp, 0x20
lea eax, [ebp - 0xa04]
push eax
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
pop edi
pop ebx
test eax, eax
je 0x4e0b78
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x4e0b7a
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0059a7a2
leave
ret