joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d2650
Capabilities:
Check if file exists

Disassembly:
push 0xc
mov eax, 0x533fa9
call fcn.004f1d7f
mov edi, ecx
mov eax, dword [edi]
push 0x601
call dword [eax + 4]
mov eax, dword [edi + 8]
sub eax, 0x10
push eax
call fcn.0043c35e
add eax, 0x10
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
call fcn.004cf906
mov esi, str.Module_thunderdownloadMiniThunderPlatform.exe
push esi
call fcn.0043a8c3
add esp, 0xc
lea ecx, [ebp - 0x10]
push eax
push esi
call fcn.004516f5
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4d26dc
lea ecx, [ebp - 0x14]
call fcn.004cc62f
push 0x53fdc0
push dword [ebp - 0x10]
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.004d0766
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0
call fcn.004cc6e6
mov eax, dword [ebp - 0x18]
jmp 0x4d26f3
push dword [ebp - 0x10]
push str.no_exists__ws
push 0x5aca00
call fcn.004dddd9
add esp, 0xc
xor eax, eax
mov esi, dword [edi]
xor ebx, ebx
test eax, eax
setns bl
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
push 0x601
mov ecx, edi
call dword [esi + 8]
test ebx, ebx
jne 0x4d271c
mov dword [edi + 0x150], 0xe
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00436fdb
mov eax, ebx
call fcn.004f1d4d
ret
Function at 0x4d2c6c
Capabilities:
Check if file exists
Copy file

Disassembly:
push 0xc
mov eax, 0x53405e
call fcn.004f1d7f
mov edi, ecx
mov dword [ebp - 0x18], edi
push str.CopyDatFileForLego_Begin_r_n
push 0x5aca00
call fcn.004dddd9
mov eax, dword [edi + 0x20]
sub eax, 0x10
push eax
call fcn.0043c35e
add eax, 0x10
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
call fcn.004cf906
mov esi, dword [0x5ac9b4]
push esi
call fcn.0043a8c3
add esp, 0x14
lea ecx, [ebp - 0x10]
push eax
push esi
call fcn.004516f5
lea eax, [ebp - 0x10]
push eax
call fcn.004cf906
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4d2d11
push eax
push dword [ebp - 0x10]
call fcn.004cf647
mov esi, dword [ebp - 0x10]
mov edi, eax
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push esi
push str.Create_Directory__s__bRet_d_error_d__r_n
push 0x5aca00
call fcn.004dddd9
add esp, 0x14
test edi, edi
je 0x4d2ddf
mov edi, dword [ebp - 0x18]
mov esi, dword [0x5ac9a4]
push esi
call fcn.0043a8c3
pop ecx
push eax
push esi
lea ecx, [ebp - 0x10]
call fcn.004516f5
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4d2d52
push dword [ebp - 0x10]
push str._s_File_Exists__r_n
push 0x5aca00
call fcn.004dddd9
xor edi, edi
add esp, 0xc
inc edi
jmp 0x4d2ddf
mov eax, dword [edi + 8]
sub eax, 0x10
push eax
call fcn.0043c35e
add eax, 0x10
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 1
push eax
call fcn.004cf906
mov esi, str.Data_
push esi
call fcn.0043a8c3
add esp, 0xc
lea ecx, [ebp - 0x14]
push eax
push esi
call fcn.004516f5
mov esi, dword [0x5ac9a4]
push esi
call fcn.0043a8c3
pop ecx
push eax
push esi
lea ecx, [ebp - 0x14]
call fcn.004516f5
push 1
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push str.Copy_lego.dat_src_ws_dst_ws_CopyFile_bRet_d_error_d
push 0x5aca00
call fcn.004dddd9
mov ecx, dword [ebp - 0x14]
add esp, 0x18
mov byte [ebp - 4], 0
lea ecx, [ecx - 0x10]
call fcn.00436fdb
push str.CopyDatFileForLego_End_r_n
push 0x5aca00
call fcn.004dddd9
pop ecx
pop ecx
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00436fdb
mov eax, edi
call fcn.004f1d4d
ret
Function at 0x4d2e03
Capabilities:
Delete file

Disassembly:
push 0x60
mov eax, 0x534099
call fcn.004f1db2
mov esi, dword [ebp + 8]
push ecx
push ecx
mov edi, esp
mov dword [edi], esi
test esi, esi
jne 0x4d2e20
xor eax, eax
jmp 0x4d2e27
push esi
call fcn.00416680
pop ecx
lea ecx, [ebp - 0x60]
mov dword [edi + 4], eax
call fcn.004195a0
and dword [ebp - 4], 0
push eax
call fcn.0041bae0
or dword [ebp - 4], 0xffffffff
mov bl, al
pop ecx
lea ecx, [ebp - 0x60]
call fcn.00419620
test bl, bl
je 0x4d2f4f
push esi
lea ecx, [ebp - 0x64]
call fcn.0043c206
lea eax, [ebp - 0x64]
mov dword [ebp - 4], 1
push eax
call fcn.004cf906
mov edi, str.test_access
push edi
call fcn.0043a8c3
pop ecx
pop ecx
push eax
push edi
lea ecx, [ebp - 0x64]
call fcn.004516f5
push 7
xor eax, eax
mov byte [ebp - 0x30], 0
pop ecx
lea edi, [ebp - 0x2f]
rep stosd dword es:[edi], eax
push ecx
push ecx
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp - 0x64]
mov edi, esp
mov dword [edi], eax
test eax, eax
je 0x4d2ea8
push eax
call fcn.00416680
pop ecx
lea ecx, [ebp - 0x60]
mov dword [edi + 4], eax
call fcn.004195a0
push 0x1e
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 2
push ecx
push eax
call fcn.0041bf40
add esp, 0xc
mov byte [ebp - 4], 1
cmp eax, 0xffffffff
lea ecx, [ebp - 0x60]
setne bl
call fcn.00419620
test bl, bl
je 0x4d2ee7
push dword [ebp - 0x64]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x4d2f44
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.WriteFile_testfile_fail_errcode_d__r_n
push 0x5aca00
call fcn.004dddd9
add esp, 0xc
lea ecx, [ebp - 0x65]
push 1
push 0x1f01ff
push esi
call fcn.00448f7b
xor ebx, ebx
mov dword [ebp - 0x34], 0xf
mov dword [ebp - 0x38], ebx
mov byte [ebp - 0x48], bl
lea eax, [ebp - 0x48]
mov byte [ebp - 4], 3
push eax
push ebx
push 1
push 2
push str.execptiondirectory_permissions_problems
push ebx
push 0x6e
call fcn.004e8730
push ebx
push 1
lea ecx, [ebp - 0x48]
call fcn.004178d0
mov ecx, dword [ebp - 0x64]
lea ecx, [ecx - 0x10]
call fcn.00436fdb
xor eax, eax
call fcn.004f1d61
ret 4
Function at 0x4d39e0
Capabilities:
Check if file exists
Create directory
Get common file path

Disassembly:
push 0x23c
mov eax, 0x53420c
call fcn.004f1db2
mov esi, ecx
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x248]
mov edi, dword [ebp + 0xc]
push eax
call fcn.00417260
lea eax, [ebp - 0x248]
xor ebx, ebx
push eax
lea eax, [ebp - 0x230]
mov dword [ebp - 4], ebx
push eax
mov ecx, esi
call fcn.004d25dc
push ebx
push 1
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], 2
call fcn.00417d20
push ebx
push 0x1c
lea eax, [ebp - 0x218]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov ebx, eax
lea eax, [ebp - 0x218]
push eax
call fcn.00416680
pop ecx
push eax
lea eax, [ebp - 0x218]
mov ecx, edi
push eax
call fcn.00417b50
mov esi, str.liebaoUser_Data
push esi
call fcn.00416680
pop ecx
push eax
push esi
mov ecx, edi
call fcn.00418190
mov esi, 0x559c0c
push esi
call fcn.00416680
pop ecx
push eax
push esi
mov ecx, edi
call fcn.00418190
cmp dword [ebp - 0x21c], 8
lea esi, [ebp - 0x230]
cmovae esi, dword [ebp - 0x230]
push esi
call fcn.00416680
pop ecx
push eax
push esi
mov ecx, edi
call fcn.00418190
cmp dword [edi + 0x14], 8
jb 0x4d3ab6
mov eax, dword [edi]
jmp 0x4d3ab8
mov eax, edi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4d3ad9
cmp dword [ebp + 0x10], eax
je 0x4d3ad9
cmp dword [edi + 0x14], 8
jb 0x4d3ad0
mov edi, dword [edi]
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0
push 1
lea ecx, [ebp - 0x230]
call fcn.00417d20
mov eax, ebx
call fcn.004f1d61
ret 0xc
Function at 0x4d4186
Capabilities:
Check if file exists

Disassembly:
push 8
mov eax, 0x5342bf
call fcn.004f1d7f
lea eax, [ebp - 0x10]
push eax
call fcn.00494777
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
mov dword [esp], str.liebao.exe
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0045922d
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0xc
push dword [eax]
call esi
mov ecx, dword [ebp - 0x14]
neg eax
sbb edi, edi
neg edi
lea ecx, [ecx - 0x10]
call fcn.00436fdb
push str.knbcenter.exe
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0045922d
add esp, 0xc
push dword [eax]
call esi
mov ecx, dword [ebp - 0x14]
neg eax
sbb eax, eax
and eax, 2
lea ecx, [ecx - 0x10]
or edi, eax
call fcn.00436fdb
push str.liebao.dll
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0045922d
add esp, 0xc
push dword [eax]
call esi
mov ecx, dword [ebp - 0x14]
neg eax
sbb eax, eax
and eax, 4
lea ecx, [ecx - 0x10]
or edi, eax
call fcn.00436fdb
push str.chrome.dll
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0045922d
add esp, 0xc
push dword [eax]
call esi
mov ecx, dword [ebp - 0x14]
neg eax
sbb eax, eax
and eax, 8
lea ecx, [ecx - 0x10]
or edi, eax
call fcn.00436fdb
push str.chrome_child.dll
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0045922d
add esp, 0xc
push dword [eax]
call esi
neg eax
sbb eax, eax
and eax, 0x10
mov ecx, dword [ebp - 0x14]
or edi, eax
lea ecx, [ecx - 0x10]
call fcn.00436fdb
push str.uplive.dll
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0045922d
add esp, 0xc
push dword [eax]
call esi
mov ecx, dword [ebp - 0x14]
neg eax
sbb eax, eax
and eax, 0x20
lea ecx, [ecx - 0x10]
or edi, eax
call fcn.00436fdb
push str.uninst.exe
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0045922d
add esp, 0xc
push dword [eax]
call esi
mov ecx, dword [ebp - 0x14]
neg eax
sbb eax, eax
and eax, 0x40
lea ecx, [ecx - 0x10]
or edi, eax
call fcn.00436fdb
push str.Module_securityknbpolicy.dll
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0045922d
add esp, 0xc
push dword [eax]
call esi
mov ecx, dword [ebp - 0x14]
neg eax
sbb eax, eax
add ecx, 0xfffffff0
and eax, 0x80
or edi, eax
call fcn.00436fdb
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00436fdb
mov eax, edi
call fcn.004f1d4d
ret
Function at 0x4d442a
Capabilities:
Check if file exists

Disassembly:
push 0x28
mov eax, 0x5342f2
call fcn.004f1db2
mov ebx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 4], eax
call fcn.00437474
push eax
lea ecx, [ebp - 0x2c]
call fcn.0043a4ef
push 1
push str.Softwareliebao
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 1
call fcn.00497f06
test eax, eax
je 0x4d44f6
lea eax, [ebp - 0x2c]
push eax
push str.ProgramPath
lea ecx, [ebp - 0x34]
call fcn.00497f58
test eax, eax
je 0x4d44f6
mov esi, dword [ebp - 0x2c]
lea ecx, [ebp - 0x28]
push esi
call fcn.00417260
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 2
push eax
call fcn.004cf946
mov edi, str.liebao.exe
push edi
call fcn.00416680
pop ecx
pop ecx
push eax
push edi
lea ecx, [ebp - 0x28]
call fcn.00418190
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4d44e8
cmp dword [ebp - 0x14], 8
lea edi, [ebp - 0x28]
cmovae edi, dword [ebp - 0x28]
push edi
call fcn.0043a8c3
pop ecx
push eax
push edi
mov ecx, ebx
call fcn.0043a84a
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.00417d20
jmp 0x4d44f9
mov esi, dword [ebp - 0x2c]
lea ecx, [esi - 0x10]
call fcn.00436fdb
cmp dword [ebp - 0x34], 0
je 0x4d4510
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.004f1d61
ret 4
Function at 0x4d4708
Capabilities:
Check if file exists

Disassembly:
push 0x2c
mov eax, 0x5343f6
call fcn.004f1d7f
mov edi, ecx
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 4], eax
call fcn.00437474
push eax
lea ecx, [ebp - 0x1c]
call fcn.0043a4ef
xor ebx, ebx
lea ecx, [ebp - 0x38]
inc ebx
push ebx
push str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionUninstallWeChat
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [ebp - 4], bl
call fcn.00497f06
test eax, eax
je 0x4d476e
lea eax, [ebp - 0x1c]
push eax
push str.DisplayIcon
lea ecx, [ebp - 0x38]
call fcn.00497f58
test eax, eax
je 0x4d476e
mov eax, dword [ebp + 0xc]
mov dword [eax], ebx
jmp 0x4d48d6
and dword [ebp - 0x30], 0
and dword [ebp - 0x2c], 0
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallWeChat
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 2
call fcn.00497f06
test eax, eax
je 0x4d47b0
lea eax, [ebp - 0x1c]
push eax
push str.DisplayIcon
lea ecx, [ebp - 0x30]
call fcn.00497f58
test eax, eax
je 0x4d47b0
mov eax, dword [ebp + 0xc]
mov dword [eax], ebx
jmp 0x4d48c3
call fcn.00437474
push eax
lea ecx, [ebp - 0x18]
call fcn.0043a4ef
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 3
push eax
mov ecx, edi
call fcn.004d3e59
lea eax, [ebp - 0x18]
push eax
call fcn.004cf906
pop ecx
call fcn.00437474
push eax
lea ecx, [ebp - 0x14]
call fcn.0043a4ef
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 4
push eax
mov ecx, edi
call fcn.004d4ced
lea eax, [ebp - 0x14]
push eax
call fcn.004cf906
lea eax, [ebp - 0x18]
mov dword [esp], 0x53ec80
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.0045922d
add esp, 0xc
push dword [eax]
mov ecx, ebx
mov byte [ebp - 4], 5
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x20], ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4d4855
push 0x53ec80
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.0045922d
add esp, 0xc
push 3
pop ecx
push dword [eax]
mov dword [ebp - 0x10], ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4d4855
xor bl, bl
mov eax, dword [ebp - 0x10]
test al, 2
je 0x4d4870
mov ecx, dword [ebp - 0x24]
and eax, 0xfffffffd
mov dword [ebp - 0x10], eax
lea ecx, [ecx - 0x10]
call fcn.00436fdb
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], 4
test al, 1
je 0x4d4886
mov ecx, dword [ebp - 0x28]
lea ecx, [ecx - 0x10]
call fcn.00436fdb
test bl, bl
je 0x4d4895
mov eax, dword [ebp + 0xc]
mov dword [eax], 2
jmp 0x4d48ad
push dword [edi + 4]
call fcn.004ce386
neg eax
pop ecx
mov ecx, dword [ebp + 0xc]
sbb eax, eax
and eax, 0xfffffffd
add eax, 3
mov dword [ecx], eax
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00436fdb
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.00436fdb
cmp dword [ebp - 0x30], 0
je 0x4d48d2
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0x30], 0
mov ecx, dword [ebp - 0x1c]
lea ecx, [ecx - 0x10]
call fcn.00436fdb
cmp dword [ebp - 0x38], 0
je 0x4d48f0
push dword [ebp - 0x38]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.004f1d4d
ret 8
Function at 0x4d4ecb
Capabilities:
Check if file exists

Disassembly:
push 4
mov eax, 0x5344af
call fcn.004f1d7f
lea esi, [ecx + 8]
mov eax, dword [esi]
sub eax, 0x10
push eax
call fcn.0043c35e
add eax, 0x10
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
call fcn.004cf906
pop ecx
pop ecx
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
call fcn.0043c2e8
push esi
call fcn.004cf906
mov edi, str.skinupdater.exe
push edi
call fcn.0043a8c3
pop ecx
pop ecx
push eax
push edi
lea ecx, [ebp - 0x10]
call fcn.004516f5
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4d4f34
mov edi, 0x540d88
push edi
call fcn.0043a8c3
pop ecx
push eax
push edi
mov ecx, esi
call fcn.004516f5
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00436fdb
xor eax, eax
inc eax
call fcn.004f1d4d
ret 4
Function at 0x4d506f
Capabilities:
Check if file exists

Disassembly:
push 0x40
mov eax, 0x534505
call fcn.004f1db2
mov ebx, ecx
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x44]
xor esi, esi
push esi
push eax
call fcn.004cd975
push dword [ebp - 0x44]
mov dword [ebp - 4], esi
push str.Init_localpath___ws_r_n
push 0x5aca00
call fcn.004dddd9
xor eax, eax
add esp, 0x14
test edi, edi
setne al
mov dword [ebx + 0x28], eax
test eax, eax
je 0x4d50e2
push edi
call fcn.0043a8c3
pop ecx
push eax
push edi
lea ecx, [ebx + 0x2c]
call fcn.0043a84a
push edi
push str.Init_7zFilePath___ws_r_n
push 0x5aca00
call fcn.004dddd9
add esp, 0xc
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov dword [ebp - 0x48], eax
jmp 0x4d510a
push 0x559c78
push esi
push 4
call fcn.004dab8e
add esp, 0xc
lea ecx, [ebx + 0x80]
call fcn.004dd8de
mov esi, eax
mov dword [ebp - 0x48], esi
test esi, esi
je 0x4d525f
lea esi, [ebx + 4]
push esi
call fcn.004cd721
pop ecx
test eax, eax
je 0x4d5121
mov dword [ebx + 0x70], 1
jmp 0x4d5129
push esi
mov ecx, ebx
call fcn.004d3d06
push esi
call fcn.004cf906
push dword [ebx + 0x70]
push dword [esi]
push str.Init_InstallPath_ws_m_bInstalled_d_r_n
push 0x5aca00
call fcn.004dddd9
and dword [ebp - 0x18], 0
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
call fcn.004cd52c
lea eax, [ebp - 0x28]
push eax
call fcn.004cf946
mov esi, str.liebao
push esi
call fcn.00416680
add esp, 0x20
lea ecx, [ebp - 0x28]
push eax
push esi
call fcn.00418190
lea eax, [ebp - 0x28]
push eax
call fcn.004cf946
cmp dword [ebp - 0x14], 8
lea edi, [ebp - 0x28]
cmovae edi, dword [ebp - 0x28]
push edi
call fcn.0043a8c3
pop ecx
pop ecx
push eax
push edi
lea ecx, [ebx + 0x24]
call fcn.0043a84a
mov esi, 0x53f34c
push esi
call fcn.00416680
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00418190
push ecx
push ecx
lea eax, [ebp - 0x28]
mov ecx, esp
push eax
call fcn.0041a660
lea ecx, [ebp - 0x40]
call fcn.004195a0
push eax
mov byte [ebp - 4], 2
call fcn.004216b0
pop ecx
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 1
call fcn.00419620
lea eax, [ebp - 0x28]
push eax
call fcn.004cf946
cmp dword [ebp - 0x14], 8
lea esi, [ebp - 0x28]
cmovae esi, dword [ebp - 0x28]
push esi
call fcn.0043a8c3
pop ecx
pop ecx
push eax
push esi
lea ecx, [ebx + 0x20]
call fcn.0043a84a
mov ecx, ebx
call fcn.004d7e55
mov ecx, ebx
call fcn.004d7fe9
xor esi, esi
cmp dword [ebx + 0x70], esi
je 0x4d522c
mov ecx, ebx
call fcn.004d8067
mov ecx, ebx
call fcn.004d657f
mov ecx, ebx
call fcn.004dbe2c
push 0x559c78
push esi
push 5
call fcn.004dab8e
add esp, 0xc
mov ecx, ebx
call fcn.004da531
push esi
push 1
lea ecx, [ebp - 0x28]
call fcn.00417d20
mov esi, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x44]
lea ecx, [ecx - 0x10]
call fcn.00436fdb
mov eax, esi
call fcn.004f1d61
ret 4
Function at 0x4d600b
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push 0x8d0
mov eax, 0x53472f
call fcn.004f1db2
mov edi, ecx
mov dword [ebp - 0x8d8], edi
mov ebx, dword [ebp + 8]
xor eax, eax
mov ecx, ebx
mov dword [ebp - 0x8dc], ebx
mov esi, eax
push dword [ebx + 4]
push dword [ebx]
call fcn.004dcd0a
mov eax, dword [ebx]
mov dword [ebx + 4], eax
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x814], 7
mov dword [ebp - 0x818], ebx
mov word [ebp - 0x828], ax
lea eax, [ebp - 0x828]
mov dword [ebp - 4], ebx
push eax
mov ecx, edi
call fcn.004d3af2
cmp dword [ebp - 0x814], 8
lea eax, [ebp - 0x828]
cmovae eax, dword [ebp - 0x828]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4d6092
mov esi, ebx
jmp 0x4d61b5
xor eax, eax
push 0x7fe
mov word [ebp - 0x810], ax
lea eax, [ebp - 0x80e]
push ebx
push eax
call fcn.004f28b0
add esp, 0xc
lea eax, [ebp - 0x828]
cmp dword [ebp - 0x814], 8
cmovae eax, dword [ebp - 0x828]
push eax
push 0x400
lea eax, [ebp - 0x810]
push eax
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov edi, eax
test edi, edi
je 0x4d61b5
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004f046c
mov ebx, eax
xor eax, eax
push edi
push eax
push ebx
call fcn.004f28b0
xor edx, edx
add esp, 0x10
mov ecx, edx
mov esi, edx
test edi, edi
je 0x4d61a9
mov ax, word [ebp + esi*2 - 0x810]
mov word [ebx + ecx*2], ax
inc ecx
cmp word [ebp + esi*2 - 0x810], dx
jne 0x4d61a0
lea ecx, [ebp - 0x8d0]
call fcn.004d1d53
cmp dword [ebp - 0x814], 8
lea eax, [ebp - 0x828]
mov ecx, dword [ebp - 0x8d8]
cmovae eax, dword [ebp - 0x828]
push eax
push ebx
lea eax, [ebp - 0x8d0]
mov byte [ebp - 4], 1
push eax
call fcn.004d61cd
mov ecx, dword [ebp - 0x8dc]
lea eax, [ebp - 0x8d0]
push eax
call fcn.004dd300
push edi
xor eax, eax
push eax
push ebx
call fcn.004f28b0
add esp, 0xc
lea ecx, [ebp - 0x8d0]
xor eax, eax
mov dword [ebp - 0x8d4], eax
mov byte [ebp - 4], al
call fcn.004d21f4
mov ecx, dword [ebp - 0x8d4]
xor edx, edx
inc esi
cmp esi, edi
jb 0x4d6115
push ebx
call fcn.004f2acf
xor esi, esi
inc esi
xor ebx, ebx
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x828]
call fcn.00417d20
mov eax, esi
call fcn.004f1d61
ret 4
Function at 0x4d61cd
Capabilities:
Read .ini file

Disassembly:
push 0xac8
mov eax, 0x534762
call fcn.004f1db2
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
push ebx
mov dword [ebp - 0xac4], esi
call fcn.00416680
pop ecx
push eax
push ebx
mov ecx, esi
call fcn.00417b50
xor eax, eax
push 0x800
push eax
mov word [ebp - 0xaa8], ax
lea eax, [ebp - 0xaa6]
push eax
call fcn.004f28b0
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0xaa8]
add esp, 0xc
push edi
push 0x400
push eax
push 0x559c78
push str.passport
push ebx
call esi
lea eax, [ebp - 0xaa8]
push eax
call fcn.00416680
pop ecx
mov ecx, dword [ebp - 0xac4]
push eax
lea eax, [ebp - 0xaa8]
add ecx, 0x30
push eax
call fcn.00417b50
xor eax, eax
push 0x80
push eax
mov word [ebp - 0x94], ax
lea eax, [ebp - 0x92]
push eax
call fcn.004f28b0
add esp, 0xc
lea eax, [ebp - 0x94]
push edi
push 0x40
push eax
push 0x55c6dc
push str.autologin
push ebx
call esi
lea eax, [ebp - 0x94]
push eax
mov dword [ebp - 0xacc], eax
call fcn.00416680
mov dword [ebp - 0xac8], eax
mov eax, dword [ebp - 0xac4]
add eax, 0x18
push eax
lea eax, [ebp - 0xacc]
push eax
call fcn.00426970
xor eax, eax
push 0x80
push eax
mov word [ebp - 0x118], ax
lea eax, [ebp - 0x116]
push eax
call fcn.004f28b0
add esp, 0x18
lea eax, [ebp - 0x118]
push edi
push 0x40
push eax
push 0x55c6dc
push str.savepassword
push ebx
call esi
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0xacc], eax
call fcn.00416680
mov dword [ebp - 0xac8], eax
mov eax, dword [ebp - 0xac4]
add eax, 0x1c
push eax
lea eax, [ebp - 0xacc]
push eax
call fcn.00426970
xor eax, eax
push 0x80
push eax
mov word [ebp - 0x2a4], ax
lea eax, [ebp - 0x2a2]
push eax
call fcn.004f28b0
add esp, 0x18
lea eax, [ebp - 0x2a4]
push edi
push 0x40
push eax
push 0x55c6dc
push str.time
push ebx
call esi
lea eax, [ebp - 0x2a4]
push eax
lea ecx, [ebp - 0xac0]
call fcn.00417260
and dword [ebp - 4], 0
lea eax, [ebp - 0xac0]
cmp dword [ebp - 0xaac], 8
cmovae eax, dword [ebp - 0xac0]
mov dword [ebp - 0xad4], eax
mov eax, dword [ebp - 0xab0]
mov dword [ebp - 0xad0], eax
mov eax, dword [ebp - 0xac4]
add eax, 0x28
push eax
lea eax, [ebp - 0xad4]
push eax
call fcn.00426990
xor eax, eax
push 0x80
push eax
mov word [ebp - 0x19c], ax
lea eax, [ebp - 0x19a]
push eax
call fcn.004f28b0
add esp, 0x14
lea eax, [ebp - 0x19c]
push edi
push 0x40
push eax
push 0x559c78
push str.priaccount
push ebx
call esi
lea eax, [ebp - 0x19c]
push eax
call fcn.00416680
pop ecx
mov ecx, dword [ebp - 0xac4]
push eax
lea eax, [ebp - 0x19c]
push eax
lea ecx, [ecx + 0x60]
call fcn.00417b50
xor eax, eax
push 0x80
push eax
mov word [ebp - 0x220], ax
lea eax, [ebp - 0x21e]
push eax
call fcn.004f28b0
add esp, 0xc
push edi
push 0x40
lea eax, [ebp - 0x220]
push eax
push 0x559c78
push 0x55db74
push ebx
call esi
lea eax, [ebp - 0x220]
push eax
call fcn.00416680
pop ecx
mov ecx, dword [ebp - 0xac4]
push eax
lea eax, [ebp - 0x220]
push eax
lea ecx, [ecx + 0x78]
call fcn.00417b50
push 0
push 1
lea ecx, [ebp - 0xac0]
call fcn.00417d20
xor eax, eax
inc eax
call fcn.004f1d61
ret 0xc