joyce8/EMBER2024-capa huggingface dataset:
Function at 0x489ca3
Capabilities:
Check if file exists
Create directory

Disassembly:
push 0x34
mov eax, 0x5da632
call fcn.00593b07
mov esi, dword [ebp + 8]
xor eax, eax
and dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
and dword [ebp - 4], eax
mov edx, str.Software360360huabao
lea eax, [ebp - 0x28]
mov ecx, reloc.WS2_32.dll_accept
push eax
push str.InstallPath
call fcn.00425d08
cmp dword [ebp - 0x18], 0
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
pop ecx
pop ecx
push 8
pop ebx
je 0x489d46
cmp dword [ebp - 0x14], ebx
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call edi
test eax, eax
je 0x489d46
push 0x64f148
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x40]
call fcn.0041154e
pop ecx
push eax
lea ecx, [ebp - 0x28]
call fcn.0040b0ac
lea ecx, [ebp - 0x40]
call fcn.0040b67e
cmp dword [ebp - 0x14], ebx
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call edi
test eax, eax
jne 0x489d46
cmp dword [ebp - 0x14], ebx
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x208
push 0
push 0x6d8e20
call fcn.005aa3d0
add esp, 0xc
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], ebx
cmovae eax, dword [ebp - 0x28]
push eax
call edi
test eax, eax
je 0x489d97
cmp dword [esi + 0x14], ebx
jb 0x489d72
mov esi, dword [esi]
cmp dword [ebp - 0x14], ebx
lea eax, [ebp - 0x28]
push esi
cmovae eax, dword [ebp - 0x28]
push eax
push str._schromeshell_s
push 0x103
push 0x6d8e20
call fcn.00412a08
add esp, 0x14
jmp 0x489dce
lea ecx, [ebp - 0x40]
call fcn.004250d6
cmp dword [esi + 0x14], ebx
jb 0x489da6
mov esi, dword [esi]
cmp dword [eax + 0x14], ebx
jb 0x489dad
mov eax, dword [eax]
push esi
push eax
push str._schromeshell_s
push 0x103
push 0x6d8e20
call fcn.00412a08
add esp, 0x14
lea ecx, [ebp - 0x40]
call fcn.0040b67e
lea ecx, [ebp - 0x28]
call fcn.0040b67e
call fcn.00593ab1
ret 4

Function at 0x489ef4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx + 0x81c]
test eax, eax
je 0x489f09
mov ecx, eax
pop ebp
jmp fcn.0049603a
mov eax, dword [ecx + 0x820]
test eax, eax
je 0x489f1b
mov ecx, eax
pop ebp
jmp fcn.0049dc06
mov eax, dword [ecx + 0x828]
test eax, eax
je 0x489f2d
mov ecx, eax
pop ebp
jmp fcn.00483ac5
mov eax, dword [ecx + 0x824]
test eax, eax
jne 0x489f25
mov eax, dword [ecx + 0x830]
test eax, eax
je 0x489f49
mov ecx, eax
pop ebp
jmp fcn.00463f68
mov eax, dword [ecx + 0x82c]
test eax, eax
je 0x489f5b
mov ecx, eax
pop ebp
jmp fcn.0048c5f7
mov ecx, dword [ecx + 0x838]
test ecx, ecx
jne 0x489f27
pop ebp
ret 0x10
Function at 0x48a567
Capabilities:
Check if file exists
Delete file

Disassembly:
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x28], 0
mov dword [esi], vtable.HuabaoActivateMainWnd.1.0
mov dword [esi + 4], vtable.HuabaoActivateMainWnd.0
je 0x48a582
and dword [esi + 0x28], 0
lea edi, [esi + 0x1a8]
cmp dword [edi + 0x14], 8
mov eax, edi
jb 0x48a592
mov eax, dword [edi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x48a5ae
cmp dword [edi + 0x14], 8
mov eax, edi
jb 0x48a5a7
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [esi + 0x1dc]
call fcn.00404812
lea ecx, [esi + 0x1c4]
call fcn.0040b67e
mov ecx, edi
call fcn.0040b67e
lea ecx, [esi + 0x190]
call fcn.0040b67e
pop edi
mov ecx, esi
pop esi
jmp fcn.0048392f
Function at 0x48ca8d
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x30]
test ecx, ecx
je 0x48cab4
mov eax, dword [ecx]
push 0
call dword [eax + 4]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0
push 0x10
push dword [esi + 8]
call dword [sym.imp.USER32.dll_PostMessageW]
pop esi
ret

Function at 0x48d5a4
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0
call fcn.005bb4fa
pop ecx
mov dword [ebp - 0xc], eax
lea eax, [ebp - 4]
push eax
push 0x20006
push 0
push 0x62a4dc
push reloc.WS2_32.dll_accept
mov dword [ebp - 8], edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x48d5f8
push 8
lea eax, [ebp - 0xc]
push eax
push 0xb
push 0
push str.rd_popup_time
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
leave
ret

Function at 0x48d5fa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push edi
xor ebx, ebx
push ebx
call fcn.005bb4fa
pop ecx
push 4
mov edi, eax
mov dword [ebp - 0x1c], edx
pop eax
mov dword [ebp - 0x14], eax
xorps xmm0, xmm0
mov dword [ebp - 0x18], eax
lea eax, [ebp - 4]
push eax
push 0x20019
push ebx
push 0x62a4dc
push reloc.WS2_32.dll_accept
movlpd qword [ebp - 0x24], xmm0
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], 8
mov dword [ebp - 0x10], 0xb
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x48d654
mov al, 1
jmp 0x48d6ae
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push str.rd_popup_time
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
push str.total_duration
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
imul ecx, dword [ebp - 8], 0x3c
xor eax, eax
add ecx, dword [ebp - 0x24]
adc eax, dword [ebp - 0x20]
cmp dword [ebp - 0x1c], eax
jl 0x48d6ac
jg 0x48d6aa
cmp edi, ecx
jbe 0x48d6ac
mov bl, 1
mov al, bl
pop edi
pop ebx
leave
ret

Function at 0x48d6b2
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
and dword [ebp - 8], 0
mov esi, eax
push 4
pop eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x62a4dc
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x48d6f1
mov al, 1
jmp 0x48d722
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push str.boot_duration
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
imul eax, dword [ebp - 8], 0xea60
cmp esi, eax
seta al
pop esi
leave
ret
Function at 0x48d725
Capabilities:
Check mutex on windows

Disassembly:
push ebx
push esi
push edi
mov ebx, str.Q360_SE_SAFE_PopupWindowMutex
xor edi, edi
push ebx
push edi
push 0x1f0001
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [esi + 0x64], eax
test eax, eax
je 0x48d753
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x64], edi
xor al, al
jmp 0x48d777
push ebx
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 0x64], eax
test eax, eax
je 0x48d74f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x48d775
push dword [esi + 0x64]
jmp 0x48d746
mov al, 1
pop edi
pop esi
pop ebx
ret
Function at 0x497628
Capabilities:
Get common file path
Get disk size

Disassembly:
push 0x260
mov eax, 0x5e69a6
call fcn.00593b07
mov edi, ecx
call fcn.00427405
test eax, eax
jne 0x497844
push 0x208
xor ebx, ebx
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.005aa3d0
add esp, 0xc
lea eax, [ebp - 0x218]
push 1
push 0x1a
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp word [ebp - 0x218], bx
je 0x497844
cmp word [ebp - 0x216], bx
je 0x497844
xor eax, eax
mov word [ebp - 0x214], ax
lea eax, [ebp - 0x26c]
push eax
push ebx
push ebx
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x497844
mov esi, dword [ebp - 0x26c]
lea ecx, [ebp - 0x230]
mov eax, dword [ebp - 0x268]
shrd esi, eax, 0x14
push 0x62a4ac
call fcn.0040b0d5
mov dword [ebp - 4], ebx
test esi, esi
jle 0x4976e6
cmp esi, 0x1f4
jg 0x4976ee
mov esi, 0x62ad24
jmp 0x497721
cmp esi, 0x1f4
jle 0x4976fd
cmp esi, 0x400
jg 0x497705
mov esi, 0x63cab4
jmp 0x497721
cmp esi, 0x400
jle 0x497714
cmp esi, 0x2000
jg 0x49771c
mov esi, 0x643dc0
jmp 0x497721
cmp esi, 0x2000
jle 0x497735
mov esi, 0x643dc4
push esi
call fcn.005baec0
pop ecx
push eax
push esi
lea ecx, [ebp - 0x230]
call fcn.0040b566
mov eax, dword [0x6c7fd4]
mov dword [ebp - 0x264], eax
push ebx
mov byte [ebp - 4], 1
call fcn.005bb4fa
push edx
push eax
lea eax, [ebp - 0x264]
push 0x6311c8
push eax
call fcn.00414048
add esp, 0x14
lea ecx, [ebp - 0x264]
push ebx
call fcn.00413c42
push eax
lea ecx, [ebp - 0x260]
call fcn.0040b0d5
push eax
push str.ReqDate
mov edx, str.Software360360huabaohuabao
call fcn.00425fc2
pop ecx
pop ecx
lea ecx, [ebp - 0x260]
call fcn.0040b67e
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x248]
push str.https:__dd.browser.360.cn_static_a_1287.6321.gif__referer
push eax
call fcn.00440e2c
add esp, 0xc
mov byte [ebp - 4], 2
mov eax, dword [edi + 0x154]
cmp eax, 2
jne 0x4977f3
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x260]
push str.https:__dd.browser.360.cn_static_a_1317.1463.gif__referer
push eax
call fcn.00440e2c
add esp, 0xc
lea ecx, [ebp - 0x248]
push eax
call fcn.0040b0ac
lea ecx, [ebp - 0x260]
call fcn.0040b67e
jmp 0x497811
cmp eax, 5
jne 0x497811
mov esi, str.pid360hb_core_safe
push esi
call fcn.005baec0
pop ecx
push eax
push esi
lea ecx, [ebp - 0x248]
call fcn.0040b220
push 1
push ebx
mov dl, 1
lea ecx, [ebp - 0x248]
call fcn.004c6673
pop ecx
pop ecx
lea ecx, [ebp - 0x248]
call fcn.0040b67e
lea ecx, [ebp - 0x264]
call fcn.0040a4ed
lea ecx, [ebp - 0x230]
call fcn.0040b67e
call fcn.00593ab1
ret
Function at 0x49a114
Capabilities:
Check if file exists

Disassembly:
push 0x5c
mov eax, 0x5e6e50
call fcn.00593b07
mov esi, ecx
and dword [ebp - 0x68], 0
lea ecx, [ebp - 0x2c]
call fcn.004cc41b
cmp dword [eax + 0x14], 8
jb 0x49a136
mov eax, dword [eax]
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push eax
call edi
xor ebx, ebx
inc ebx
test eax, eax
jne 0x49a152
call fcn.004cbf3a
mov byte [ebp - 0x5d], bl
test eax, eax
je 0x49a156
mov byte [ebp - 0x5d], 0
lea ecx, [ebp - 0x2c]
call fcn.0040b67e
cmp byte [ebp - 0x5d], 0
je 0x49a186
push 0xd19
push str.ScreenSaverFrame::Init360inidll
push str.__s__d___Init360inidll_retry
mov byte [esi + 0x148], bl
call fcn.0040a649
add esp, 0xc
jmp 0x49a277
push 0x3f1
push dword [esi + 0xc]
mov byte [esi + 0x148], 0
call dword [sym.imp.USER32.dll_KillTimer]
lea ecx, [ebp - 0x44]
call fcn.004cc41b
and dword [ebp - 4], 0
cmp dword [eax + 0x14], 8
push 2
pop ecx
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0x68], ecx
jb 0x49a1b8
mov eax, dword [eax]
push eax
call edi
test eax, eax
je 0x49a1e1
lea ecx, [ebp - 0x2c]
call fcn.004cc41b
mov dword [ebp - 0x64], 6
cmp dword [eax + 0x14], 8
jb 0x49a1d6
mov eax, dword [eax]
push eax
call fcn.004302c7
pop ecx
test eax, eax
jne 0x49a1e3
xor bl, bl
test byte [ebp - 0x64], 4
je 0x49a1f1
lea ecx, [ebp - 0x2c]
call fcn.0040b67e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x44]
call fcn.0040b67e
test bl, bl
je 0x49a277
push 0xd21
mov edi, str.ScreenSaverFrame::Init360inidll
push edi
push str.__s__d___start_LoadLibraryExW_ini
call fcn.0040a649
add esp, 0xc
lea ecx, [ebp - 0x5c]
call fcn.004cc41b
cmp dword [eax + 0x14], 8
jb 0x49a229
mov eax, dword [eax]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
lea ecx, [ebp - 0x5c]
mov dword [esi + 0x108], eax
call fcn.0040b67e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xd24
push edi
push str.__s__d___LoadLibraryExW_status_d
call fcn.0040a649
mov eax, dword [esi + 0x108]
add esp, 0x10
test eax, eax
je 0x49a277
push str.IsSafeExist
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x6e4dbc], eax
call fcn.00593ab1
ret

Function at 0x49a3ac
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ecx
push esi
push edi
mov esi, ecx
call fcn.004cc45b
xor edi, edi
lea eax, [esp + 0xc]
push eax
push edi
push edi
push 0x49a2ed
push edi
push edi
mov dword [esp + 0x24], edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xd53
push str.ScreenSaverFrame::DownLoadAndInstall
push str.__s__d___DownLoadAndInstall_onclose
mov dword [esi + 0x14c], eax
call fcn.0040a649
add esp, 0xc
mov ecx, esi
push edi
call fcn.0049be04
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x49a9f8
Capabilities:
Terminate process

Disassembly:
mov ecx, dword [ecx + 0x4c]
push esi
test ecx, ecx
je 0x49aa99
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, eax
test esi, esi
je 0x49aa46
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x49aa46
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x49aa46
push 0xe4e
mov esi, str.ScreenSaverFrame::ReCheckProcess
push esi
push str.__s__d___ReCheckProcess_wnd_ok
call fcn.0040a649
add esp, 0xc
xor eax, eax
mov dword [0x6e5618], eax
jmp 0x49aa6f
mov eax, dword [0x6e5618]
mov esi, str.ScreenSaverFrame::ReCheckProcess
inc eax
push eax
push 0xe4a
push esi
push str.__s__d___ReCheckProcess_wnd_error_count_d
mov dword [0x6e5618], eax
call fcn.0040a649
mov eax, dword [0x6e5618]
add esp, 0x10
cmp eax, 5
jne 0x49aa99
push 0xe53
push esi
push str.__s__d___exit_process
call fcn.0040a649
add esp, 0xc
push 0x29a
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret
Function at 0x49c00f
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
mov esi, ecx
push 3
push ebx
push ebx
push ebx
push ebx
cmp dword [0x6d2c58], ebx
je 0x49c030
push 1
jmp 0x49c032
push 0xffffffffffffffff
push edi
call dword [sym.imp.USER32.dll_SetWindowPos]
cmp dword [esi + 0x5c], 0
je 0x49c053
cmp dword [esi + 0x5c], 1
je 0x49c053
call fcn.00426bbc
cmp eax, 7
je 0x49c0e1
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push ebx
push esi
mov dword [ebp + 8], eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov esi, eax
mov dword [ebp - 8], esi
test esi, esi
je 0x49c0cc
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x49c0cc
cmp ecx, edi
je 0x49c0cc
mov eax, dword [ebp + 8]
cmp eax, esi
je 0x49c0cc
push esi
push eax
push edi
push ecx
push 0x10cb
push str.ScreenSaverFrame::SetForegroundWindowInternal
push str._wndtop:_s__d__SetForegroundWindowInternal_hCurWnd__0x_x_hWnd_0x_x_dwMyID_d_dwCurID_d_
call fcn.0040a649
add esp, 0x1c
push 1
push esi
push dword [ebp + 8]
mov esi, dword [sym.imp.USER32.dll_AttachThreadInput]
call esi
push edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push edi
call dword [sym.imp.USER32.dll_SetFocus]
push ebx
push dword [ebp - 8]
push dword [ebp + 8]
call esi
jmp 0x49c0e1
push edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push edi
call dword [sym.imp.USER32.dll_SetActiveWindow]
push edi
call dword [sym.imp.USER32.dll_SetFocus]
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x49c1e5
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0x111a
push str.MayBeShowExitPopupAsnc
push str.__s__d__ExitPreviewAsnc
mov esi, ecx
call fcn.0040a649
push 4
call fcn.005926f7
xor edx, edx
lea ecx, [ebp - 4]
push ecx
push edx
push eax
push 0x49c194
push edx
mov dword [eax], esi
push edx
mov dword [ebp - 4], edx
call fcn.005bb02f
add esp, 0x28
pop esi
leave
ret

Function at 0x49dff9
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x48]
test ecx, ecx
je 0x49e020
mov eax, dword [ecx]
push 0
call dword [eax + 4]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0
push 0x10
push dword [esi + 8]
call dword [sym.imp.USER32.dll_PostMessageW]
pop esi
ret
Function at 0x49fe87
Capabilities:
Delete file

Disassembly:
push 0x54
mov eax, 0x5e779e
call fcn.00593b07
mov esi, dword [ebp + 8]
mov eax, esi
mov edi, dword [ebp + 0xc]
mov byte [ebp - 0x48], 0
mov dword [ebp - 0x50], 0x226
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x4c], 0x136
jb 0x49feb5
mov eax, dword [esi]
push eax
push 0x1ba
push str.HuabaoMainFrame::GenVideoImg
push str.__s__d___GenVideoImg_strSrc___s
call fcn.0040a649
add esp, 0x10
cmp dword [esi + 0x14], 8
jb 0x49fed5
mov esi, dword [esi]
lea eax, [ebp - 0x50]
push eax
push esi
call fcn.0049fdd3
mov ebx, eax
mov dword [ebp - 0x4c], ebx
test ebx, ebx
je 0x4a0033
push 0x1bd
push str.HuabaoMainFrame::GenVideoImg
push str.__s__d___GenVideoImg_ok
call fcn.0040a649
and dword [ebp - 0x44], 0
lea eax, [ebp - 0x44]
add esp, 0xc
mov dword [ebp - 0x60], vtable.Gdiplus::Bitmap.0
push eax
push 0
push ebx
call dword [sym.imp.gdiplus.dll_GdipCreateBitmapFromHBITMAP]
mov esi, dword [ebp - 0x44]
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x5c], esi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x40], ecx
xor edx, edx
lea eax, [ebp - 0x40]
inc edx
push eax
push edx
push ecx
mov byte [ebp - 4], dl
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
lea edx, [ebp - 0x38]
call fcn.004cd87b
test al, al
je 0x4a0012
push 0
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 0x40]
push esi
call dword [sym.imp.gdiplus.dll_GdipSaveImageToStream]
test eax, eax
je 0x49ff67
mov dword [ebp - 0x58], eax
jmp 0x49ff69
xor eax, eax
test eax, eax
jne 0x4a0012
and dword [ebp - 0x3c], eax
lea eax, [ebp - 0x3c]
push eax
push dword [ebp - 0x40]
call dword [sym.imp.ole32.dll_GetHGlobalFromStream]
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push 0x659b5c
mov edx, edi
lea ecx, [ebp - 0x28]
mov ebx, eax
call fcn.0041154e
pop ecx
mov byte [ebp - 4], 2
lea esi, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
push dword [ebp - 0x3c]
cmovae esi, dword [ebp - 0x28]
mov edi, dword [sym.imp.KERNEL32.dll_GlobalSize]
call edi
push eax
push esi
push 0x1cc
push str.HuabaoMainFrame::GenVideoImg
push str.__s__d___GenVideoImg_getEncoderClsid__s_GlobalSize_d
call fcn.0040a649
add esp, 0x14
lea esi, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
cmovae esi, dword [ebp - 0x28]
push dword [ebp - 0x3c]
call edi
push eax
mov edx, ebx
mov ecx, esi
call fcn.0041e2eb
pop ecx
mov ecx, dword [ebp - 0x48]
test eax, eax
push 1
pop eax
push dword [ebp - 0x3c]
movzx ecx, cl
cmovne ecx, eax
mov dword [ebp - 0x48], ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea ecx, [ebp - 0x28]
call fcn.0040b67e
mov ebx, dword [ebp - 0x4c]
mov esi, dword [ebp - 0x44]
push ebx
call dword [sym.imp.GDI32.dll_DeleteObject]
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x40]
test eax, eax
je 0x4a002a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push esi
call dword [sym.imp.gdiplus.dll_GdipDisposeImage]
jmp 0x4a0042
cmp dword [edi + 0x14], 8
jb 0x4a003b
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov al, byte [ebp - 0x48]
call fcn.00593ab1
ret 8
Function at 0x4ae431
Capabilities:
Check if file exists
Copy file

Disassembly:
push 0x50
mov eax, 0x5e9295
call fcn.00593b07
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x5c]
xor ebx, ebx
call fcn.004251b3
push 0x65e348
mov edx, eax
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x2c]
call fcn.0041151f
pop ecx
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 2
call fcn.0040b67e
push 8
pop edi
cmp dword [ebp - 0x18], edi
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4ae4d9
cmp dword [ebp - 0x18], edi
lea edx, [ebp - 0x2c]
lea ecx, [ebp - 0x44]
cmovae edx, dword [ebp - 0x2c]
call fcn.00423490
push str.5c5e3afd499e5146fef1da5ef8a23205
lea ecx, [ebp - 0x44]
call fcn.004115b9
test al, al
je 0x4ae4d1
mov ecx, esi
cmp dword [esi + 0x14], edi
jb 0x4ae4ad
mov ecx, dword [esi]
call fcn.0041e4f4
cmp dword [esi + 0x14], edi
jb 0x4ae4b9
mov esi, dword [esi]
cmp dword [ebp - 0x18], edi
lea eax, [ebp - 0x2c]
push ebx
cmovae eax, dword [ebp - 0x2c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
setne bl
lea ecx, [ebp - 0x44]
call fcn.00404812
lea ecx, [ebp - 0x2c]
call fcn.0040b67e
mov al, bl
call fcn.00593ab1
ret 4

Function at 0x4ae4eb
Capabilities:
Check if file exists
Get common file path

Disassembly:
push 0x460
mov eax, 0x5e92fd
call fcn.00593b07
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 4], eax
mov edi, 0x20a
push edi
mov dword [ebp - 0x46c], esi
push eax
mov dword [ebp - 0x468], eax
lea eax, [ebp - 0x434]
push eax
call fcn.005aa3d0
add esp, 0xc
lea eax, [ebp - 0x434]
mov ebx, 0x104
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push edi
xor edi, edi
lea eax, [ebp - 0x224]
push edi
push eax
call fcn.005aa3d0
add esp, 0xc
lea eax, [ebp - 0x434]
push 0xffffffffffffffff
push 0x62a4b0
push eax
push str._s_s
lea eax, [ebp - 0x224]
push ebx
push eax
call fcn.004aeab4
add esp, 0x18
lea eax, [ebp - 0x224]
mov ecx, esi
push eax
call fcn.0040b0d5
xor ebx, ebx
mov dword [ebp - 0x43c], edi
inc ebx
mov dword [ebp - 0x438], 7
xor eax, eax
mov dword [ebp - 0x468], ebx
mov word [ebp - 0x44c], ax
lea eax, [ebp - 0x224]
mov dword [ebp - 4], ebx
push eax
lea ecx, [ebp - 0x464]
call fcn.0040b0d5
lea edx, [ebp - 0x44c]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x464]
call fcn.00426e0a
lea ecx, [ebp - 0x464]
mov byte [ebp - 4], bl
call fcn.0040b67e
cmp dword [0x6d2a24], edi
jne 0x4ae663
cmp dword [ebp - 0x438], 8
lea ecx, [ebp - 0x44c]
mov edx, str.6.11.0.0
cmovae ecx, dword [ebp - 0x44c]
call fcn.004270e4
test eax, eax
jg 0x4ae663
mov dword [ebp - 0x454], edi
lea ecx, [ebp - 0x464]
mov dword [ebp - 0x450], edi
mov edi, 0x6dd218
push edi
call fcn.0040b155
mov byte [ebp - 4], 3
mov eax, edi
cmp dword [0x6dd22c], 8
cmovae eax, dword [0x6dd218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4ae652
call fcn.004ae7d8
test al, al
je 0x4ae652
push edi
mov ecx, esi
call fcn.00413220
jmp 0x4ae658
mov byte [0x6dd278], bl
lea ecx, [ebp - 0x464]
call fcn.0040b67e
lea ecx, [ebp - 0x44c]
call fcn.0040b67e
mov eax, esi
call fcn.00593ab1
ret 4