joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4db406
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004ccc61
and dword [ebp - 4], 0
cmp dword [0x556bb4], 0
mov ebx, eax
jne 0x4db4b7
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4db568
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4db568
push eax
call fcn.004ccbef
mov dword [esp], 0x519fa8
push edi
mov dword [0x556bb4], eax
call esi
push eax
call fcn.004ccbef
mov dword [esp], 0x519f94
push edi
mov dword [0x556bb8], eax
call esi
push eax
call fcn.004ccbef
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x556bbc], eax
call esi
push eax
call fcn.004ccbef
pop ecx
mov dword [0x556bc4], eax
test eax, eax
je 0x4db4b7
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004ccbef
pop ecx
mov dword [0x556bc0], eax
mov eax, dword [0x556bc0]
cmp eax, ebx
je 0x4db50f
cmp dword [0x556bc4], ebx
je 0x4db50f
push eax
call fcn.004ccc6a
push dword [0x556bc4]
mov esi, eax
call fcn.004ccc6a
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4db50f
test edi, edi
je 0x4db50f
call esi
test eax, eax
je 0x4db506
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4db506
test byte [ebp - 0xc], 1
jne 0x4db50f
or dword [ebp + 0x10], 0x200000
jmp 0x4db548
mov eax, dword [0x556bb8]
cmp eax, ebx
je 0x4db548
push eax
call fcn.004ccc6a
pop ecx
test eax, eax
je 0x4db548
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4db548
mov eax, dword [0x556bbc]
cmp eax, ebx
je 0x4db548
push eax
call fcn.004ccc6a
pop ecx
test eax, eax
je 0x4db548
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x556bb4]
call fcn.004ccc6a
pop ecx
test eax, eax
je 0x4db568
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4db56a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4e1d60
Capabilities:
Get session information
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 8]
push ecx
push 5
push 0xffffffffffffffff
push 0
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
test eax, eax
je 0x4e1daa
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004c4fe1
add esp, 0xc
mov edx, dword [ebp - 8]
push edx
call sub.WTSAPI32.dll_WTSFreeMemory
jmp 0x4e1db8
lea eax, [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x4e2370
Capabilities:
Check if file exists
Create process on windows
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x504ff6
mov eax, dword fs:[0]
push eax
sub esp, 0xfc
mov eax, dword [0x551bd0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xf0], ecx
lea ecx, [ebp - 0x10]
call fcn.00402e30
mov dword [ebp - 4], 0
push str.AUTOFORCE_QiyiClient
lea eax, [ebp - 0x10]
push eax
call fcn.00405f70
add esp, 8
push 0x51be08
push 0x556fac
lea ecx, [ebp - 0xd4]
push ecx
call fcn.004041d0
add esp, 0xc
mov dword [ebp - 0xf4], eax
mov ecx, dword [ebp - 0xf4]
call sym.QiyiInstaller.exe_public:_enum_eScriptType___thiscall_CScriptModule::Type_void_
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov dword [ebp - 0xd0], eax
lea ecx, [ebp - 0xd4]
call fcn.00407160
cmp dword [ebp - 0xd0], 0
je 0x4e259b
push ecx
mov ecx, esp
mov dword [ebp - 0xd8], esp
push str.Run_Force_Update...
call fcn.004037d0
mov dword [ebp - 0xf8], eax
mov ecx, 0x556f08
call fcn.004f68e0
push 0x51be50
push 0x556fac
lea edx, [ebp - 0xe0]
push edx
call fcn.004041d0
add esp, 0xc
mov dword [ebp - 0xfc], eax
mov ecx, dword [ebp - 0xfc]
call sym.QiyiInstaller.exe_public:_enum_eScriptType___thiscall_CScriptModule::Type_void_
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov dword [ebp - 0xdc], eax
lea ecx, [ebp - 0xe0]
call fcn.00407160
cmp dword [ebp - 0xdc], 0
je 0x4e24c6
push str.local.inf
push 0x556fac
lea eax, [ebp - 0xe4]
push eax
call fcn.004041d0
add esp, 0xc
mov dword [ebp - 0x100], eax
mov ecx, dword [ebp - 0x100]
call sym.QiyiInstaller.exe_public:_enum_eScriptType___thiscall_CScriptModule::Type_void_
push eax
push 0x51be80
push 0x51be84
push str.ForceVersion
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea ecx, [ebp - 0xe4]
call fcn.00407160
push str.QiyiUpdate.exe
push 0x556fac
lea ecx, [ebp - 0xe8]
push ecx
call fcn.004041d0
add esp, 0xc
mov dword [ebp - 0x104], eax
push 5
push 0
lea ecx, [ebp - 0x10]
call sym.QiyiInstaller.exe_public:_enum_eScriptType___thiscall_CScriptModule::Type_void_
push eax
mov ecx, dword [ebp - 0x104]
call sym.QiyiInstaller.exe_public:_enum_eScriptType___thiscall_CScriptModule::Type_void_
push eax
push 0x51becc
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0xe8]
call fcn.00407160
mov dword [0x557018], 1
push 0
mov edx, dword [ebp - 0xf0]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
lea ecx, [ebp - 0xcc]
call fcn.004fead0
mov byte [ebp - 4], 1
push ecx
mov ecx, esp
mov dword [ebp - 0xec], esp
push str.SendLog_7cancelsysbtn2
call fcn.004037d0
mov dword [ebp - 0x108], eax
lea ecx, [ebp - 0xcc]
call fcn.004fe9d0
push 0
push 0
push 0x464
mov ecx, dword [ebp - 0xf0]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xcc]
call fcn.004fe9b0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00407160
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x4e25c0
Capabilities:
Check if file exists
Create process on windows
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50501f
mov eax, dword fs:[0]
push eax
sub esp, 0xcc
mov eax, dword [0x551bd0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xd0], ecx
mov ecx, 0x556fdc
call sym.QiyiInstaller.exe_public:_enum_eScriptType___thiscall_CScriptModule::Type_void_
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4e26d6
push ecx
mov ecx, esp
mov dword [ebp - 0xc8], esp
push str.Run_QiyiInstaller_Repair...
call fcn.004037d0
mov dword [ebp - 0xd4], eax
mov ecx, 0x556f08
call fcn.004f68e0
push 5
push 0
push str._repair
mov ecx, 0x556fdc
call sym.QiyiInstaller.exe_public:_enum_eScriptType___thiscall_CScriptModule::Type_void_
push eax
push 0x51bd98
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [0x557018], 1
push 0
mov eax, dword [ebp - 0xd0]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
lea ecx, [ebp - 0xc4]
call fcn.004fead0
mov dword [ebp - 4], 0
push ecx
mov ecx, esp
mov dword [ebp - 0xcc], esp
push str.SendLog_7cancelsysbtn3
call fcn.004037d0
mov dword [ebp - 0xd8], eax
lea ecx, [ebp - 0xc4]
call fcn.004fe9d0
push 0
push 0
push 0x464
mov edx, dword [ebp - 0xd0]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc4]
call fcn.004fe9b0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x4e26f0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x505048
mov eax, dword fs:[0]
push eax
sub esp, 0xd4
mov eax, dword [0x551bd0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xd4], ecx
cmp dword [0x557018], 0
jne 0x4e27f6
push 0
mov eax, dword [ebp - 0xd4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
lea ecx, [ebp - 0xc4]
call fcn.004fead0
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0xd4]
cmp dword [edx + 0x3bc], 0
je 0x4e278b
push ecx
mov ecx, esp
mov dword [ebp - 0xc8], esp
push str.OpenUrl_http:__app.iqiyi.com_pc_player_feedback_index.html_entryuninstallversion_realversionie
call fcn.004037d0
mov dword [ebp - 0xd8], eax
lea ecx, [ebp - 0xc4]
call fcn.004fe9d0
jmp 0x4e27e4
mov eax, dword [ebp - 0xd4]
cmp dword [eax + 0x3c0], 0
je 0x4e27c0
push ecx
mov ecx, esp
mov dword [ebp - 0xcc], esp
push str.SendLog_7cancelsysbtn0
call fcn.004037d0
mov dword [ebp - 0xdc], eax
lea ecx, [ebp - 0xc4]
call fcn.004fe9d0
jmp 0x4e27e4
push ecx
mov ecx, esp
mov dword [ebp - 0xd0], esp
push str.SendLog_7cancelsysbtn1
call fcn.004037d0
mov dword [ebp - 0xe0], eax
lea ecx, [ebp - 0xc4]
call fcn.004fe9d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc4]
call fcn.004fe9b0
push 0
push 0
push 0x464
mov ecx, dword [ebp - 0xd4]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x4e4380
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x551bd0]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
xor eax, eax
mov word [ebp - 0x218], ax
push 0x206
push 0
lea ecx, [ebp - 0x216]
push ecx
call fcn.004bff70
add esp, 0xc
cmp dword [ebp + 0xc], 0
je 0x4e4493
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x4e4493
lea eax, [ebp - 4]
push eax
push 0x10008
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0
jne 0x4e4491
cmp dword [ebp - 0x21c], 0
jne 0x4e4487
mov dword [ebp - 0x220], 0x104
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x218]
push ecx
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0x103
jne 0x4e4460
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov dword [ebp - 0x21c], eax
jmp 0x4e4487
cmp dword [ebp - 0x21c], 0
jne 0x4e4482
lea edx, [ebp - 0x218]
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.004e4380
add esp, 8
mov dword [ebp - 0x21c], eax
jmp 0x4e4401
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4e449d
mov dword [ebp - 0x21c], 0x3f2
mov eax, dword [ebp - 0x21c]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004bfe65
mov esp, ebp
pop ebp
ret
Function at 0x4e4770
Capabilities:
Check if file exists
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x551bd0]
xor eax, ebp
mov dword [ebp - 0x1c], eax
call fcn.004038a0
mov dword [ebp - 0xc], eax
cmp dword [0x557054], 6
jae 0x4e479e
lea ecx, [ebp + 8]
call fcn.00407160
jmp 0x4e487b
lea ecx, [ebp + 8]
call sym.QiyiInstaller.exe_public:_enum_eScriptType___thiscall_CScriptModule::Type_void_
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4e47be
lea ecx, [ebp + 8]
call fcn.00407160
jmp 0x4e487b
lea eax, [ebp - 0x10]
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsCompatibility_AssistantPersisted
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4e4873
mov dword [ebp - 0x18], 1
lea ecx, [ebp + 8]
call sym.QiyiInstaller.exe_public:_enum_eScriptType___thiscall_CScriptModule::Type_void_
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4e4802
mov dword [ebp - 0x20], 0
jmp 0x4e4851
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x3fffffff
jle 0x4e4824
mov dword [ebp - 0x24], 0
jmp 0x4e484b
mov eax, dword [ebp - 4]
shl eax, 1
call fcn.004c9ac0
mov dword [ebp - 0x28], esp
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 4]
shl eax, 1
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0x28]
push edx
call fcn.004077e0
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
push 4
lea ecx, [ebp - 0x18]
push ecx
push 4
push 0
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp + 8]
call fcn.00407160
lea esp, [ebp - 0x28]
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.004bfe65
mov esp, ebp
pop ebp
ret
Function at 0x4e4980
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea ecx, [ebp + 8]
call sym.QiyiInstaller.exe_public:_enum_eScriptType___thiscall_CScriptModule::Type_void_
push eax
call fcn.004c24a2
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xa
jae 0x4e49ad
lea ecx, [ebp + 8]
call fcn.00407160
jmp 0x4e4a6d
lea ecx, [ebp - 8]
call fcn.00402e30
cmp dword [0x557054], 6
jae 0x4e4a1b
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4e4a19
push 4
lea ecx, [ebp - 4]
push ecx
push 4
push 0
push str.MaxConnectionsPerServer
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea eax, [ebp - 4]
push eax
push 4
push 0
push str.MaxConnectionsPer1_0Server
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4e4a5d
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push 0
push str.SOFTWAREMicrosoftInternet_ExplorerMAINFeatureControlFEATURE_MAXCONNECTIONSPER1_0SERVER
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4e4a5d
push 4
lea ecx, [ebp - 4]
push ecx
push 4
push 0
push str.explorer.exe
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 8]
call fcn.00407160
lea ecx, [ebp + 8]
call fcn.00407160
mov esp, ebp
pop ebp
ret
Function at 0x4e4ba0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea ecx, [ebp + 8]
call fcn.004043d0
movzx eax, al
test eax, eax
je 0x4e4bc2
lea ecx, [ebp + 8]
call fcn.00407160
jmp 0x4e4cdd
lea ecx, [ebp - 4]
push ecx
push 0xf003f
push 0
push str.SOFTWAREMicrosoftInternet_Explorer_
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4e4cd5
mov dword [ebp - 0xc], 0x400
mov dword [ebp - 8], 1
lea ecx, [ebp - 0x10]
call fcn.00402e30
lea edx, [ebp - 0xc]
push edx
push 0x400
lea ecx, [ebp - 0x10]
call fcn.00403590
push eax
lea eax, [ebp - 8]
push eax
push 0
push str.Version
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.00405e70
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push 0x2e
lea ecx, [ebp - 0x10]
call fcn.004081c0
push eax
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
call fcn.00404150
lea ecx, [ebp - 0x14]
call fcn.004043d0
movzx ecx, al
test ecx, ecx
jne 0x4e4cc5
push 0x51fd3c
lea ecx, [ebp - 0x14]
call fcn.00403ce0
lea ecx, [ebp - 0x14]
call sym.QiyiInstaller.exe_public:_enum_eScriptType___thiscall_CScriptModule::Type_void_
push eax
call fcn.004c24a2
add esp, 4
mov dword [ebp - 0x18], eax
lea edx, [ebp - 4]
push edx
push 0xf003f
push 0
push str.SOFTWAREMicrosoftInternet_ExplorerMAINFeatureControlFEATURE_BROWSER_EMULATION
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4e4cc5
push 4
lea eax, [ebp - 0x18]
push eax
push 4
push 0
lea ecx, [ebp + 8]
call sym.QiyiInstaller.exe_public:_enum_eScriptType___thiscall_CScriptModule::Type_void_
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x14]
call fcn.00407160
lea ecx, [ebp - 0x10]
call fcn.00407160
lea ecx, [ebp + 8]
call fcn.00407160
mov esp, ebp
pop ebp
ret
Function at 0x4e55c0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x551bd0]
xor eax, ebp
mov dword [ebp - 0x28], eax
call fcn.004038a0
mov dword [ebp - 0xc], eax
lea ecx, [ebp + 8]
call sym.QiyiInstaller.exe_public:_enum_eScriptType___thiscall_CScriptModule::Type_void_
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4e5694
lea eax, [ebp + 8]
push eax
push str._RedirectSource__File_Not_Exists:
lea ecx, [ebp - 0x24]
push ecx
call fcn.00404280
add esp, 0xc
mov ecx, eax
call sym.QiyiInstaller.exe_public:_enum_eScriptType___thiscall_CScriptModule::Type_void_
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4e561d
mov dword [ebp - 0x2c], 0
jmp 0x4e566c
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x3fffffff
jle 0x4e563f
mov dword [ebp - 0x30], 0
jmp 0x4e5666
mov eax, dword [ebp - 4]
shl eax, 1
call fcn.004c9ac0
mov dword [ebp - 0x34], esp
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 4]
shl ecx, 1
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0x34]
push eax
call fcn.004077e0
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x20], edx
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x1c]
call fcn.004c04ac
push 0x530e84
lea ecx, [ebp - 0x1c]
push ecx
call fcn.004c9687
lea ecx, [ebp - 0x24]
call fcn.00407160
lea edx, [ebp + 8]
push edx
mov ecx, 0x557188
call fcn.00402e10
lea eax, [ebp + 8]
push eax
mov ecx, 0x556fdc
call fcn.00402e10
lea ecx, [ebp + 8]
call fcn.00407160
lea esp, [ebp - 0x34]
mov ecx, dword [ebp - 0x28]
xor ecx, ebp
call fcn.004bfe65
mov esp, ebp
pop ebp
ret
Function at 0x4e59f0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x551bd0]
xor eax, ebp
mov dword [ebp - 0x50], eax
call fcn.004038a0
mov dword [ebp - 0x2c], eax
push 0xa
lea ecx, [ebp - 0x28]
call fcn.004a2c06
lea eax, [ebp - 0x28]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x38], esp
lea edx, [ebp + 8]
push edx
call fcn.004020c0
call fcn.004e50d0
add esp, 8
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 1
je 0x4e5adf
lea eax, [ebp + 8]
push eax
push str._PrivilegePath__Invalid_arguments__nArg_1_:
lea ecx, [ebp - 0x4c]
push ecx
call fcn.00404280
add esp, 0xc
mov ecx, eax
call sym.QiyiInstaller.exe_public:_enum_eScriptType___thiscall_CScriptModule::Type_void_
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4e5a68
mov dword [ebp - 0x54], 0
jmp 0x4e5ab7
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x3fffffff
jle 0x4e5a8a
mov dword [ebp - 0x58], 0
jmp 0x4e5ab1
mov eax, dword [ebp - 4]
shl eax, 1
call fcn.004c9ac0
mov dword [ebp - 0x5c], esp
mov eax, dword [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 4]
shl ecx, 1
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0x5c]
push eax
call fcn.004077e0
mov dword [ebp - 0x58], eax
mov ecx, dword [ebp - 0x58]
mov dword [ebp - 0x54], ecx
mov edx, dword [ebp - 0x54]
mov dword [ebp - 0x48], edx
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x44]
call fcn.004c04ac
push 0x530e84
lea ecx, [ebp - 0x44]
push ecx
call fcn.004c9687
lea ecx, [ebp - 0x4c]
call fcn.00407160
push 0
lea ecx, [ebp - 0x28]
call fcn.004a2bdd
push eax
lea ecx, [ebp - 0x28]
call fcn.0040cf90
push eax
lea ecx, [ebp - 0xc]
call fcn.004020c0
lea ecx, [ebp - 0xc]
call sym.QiyiInstaller.exe_public:_enum_eScriptType___thiscall_CScriptModule::Type_void_
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4e5b28
lea ecx, [ebp - 0xc]
call fcn.00407160
lea ecx, [ebp - 0x28]
call fcn.004a2d30
lea ecx, [ebp + 8]
call fcn.00407160
jmp 0x4e5b51
lea ecx, [ebp - 0xc]
call fcn.00404390
push eax
call fcn.004e1dd0
add esp, 4
lea ecx, [ebp - 0xc]
call fcn.00407160
lea ecx, [ebp - 0x28]
call fcn.004a2d30
lea ecx, [ebp + 8]
call fcn.00407160
lea esp, [ebp - 0x5c]
mov ecx, dword [ebp - 0x50]
xor ecx, ebp
call fcn.004bfe65
mov esp, ebp
pop ebp
ret
Function at 0x4e7d30
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 4]
call fcn.004020c0
mov dword [ebp - 0xc], 0
lea ecx, [ebp - 8]
call fcn.00402e30
mov dword [ebp - 0x10], 0
jmp 0x4e7d63
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0xa
jge 0x4e7dab
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
push str._s.old_d
lea ecx, [ebp - 8]
push ecx
call fcn.00405f70
add esp, 0x10
push 3
lea ecx, [ebp - 8]
call sym.QiyiInstaller.exe_public:_enum_eScriptType___thiscall_CScriptModule::Type_void_
push eax
lea ecx, [ebp - 4]
call sym.QiyiInstaller.exe_public:_enum_eScriptType___thiscall_CScriptModule::Type_void_
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x4e7da9
mov dword [ebp - 0xc], 1
jmp 0x4e7dab
jmp 0x4e7d5a
cmp dword [ebp - 0xc], 0
je 0x4e7dc4
push 5
push 0
lea ecx, [ebp - 8]
call sym.QiyiInstaller.exe_public:_enum_eScriptType___thiscall_CScriptModule::Type_void_
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea ecx, [ebp - 8]
call fcn.00407160
lea ecx, [ebp - 4]
call fcn.00407160
lea ecx, [ebp + 8]
call fcn.00407160
mov esp, ebp
pop ebp
ret