joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b0214
Capabilities:
Create thread

Disassembly:
push 0x288
mov eax, 0x5e77a1
call fcn.00592017
mov ebx, ecx
xor eax, eax
lea edi, [ebx + 4]
push eax
push eax
push eax
push eax
mov dword [ebx], eax
mov dword [edi], eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0x208
mov dword [0x6cfc48], eax
xor esi, esi
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.005a88e0
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea ecx, [ebp - 0x260]
call fcn.004c9fd4
push 0x628a24
mov edx, eax
mov dword [ebp - 4], esi
lea ecx, [ebp - 0x248]
call fcn.0041151c
pop ecx
mov esi, eax
mov byte [ebp - 4], 1
call fcn.004c1e8b
push eax
mov ecx, esi
call fcn.004114f6
xor ecx, ecx
mov byte [ebp - 0x294], cl
push dword [ebp - 0x294]
mov dword [ebp - 0x220], ecx
mov dword [ebp - 0x21c], ecx
lea ecx, [ebp - 0x230]
push eax
call fcn.0040b62f
lea eax, [ebp - 0x230]
push eax
lea ecx, [ebx + 0x20]
call fcn.0040b0ac
lea ecx, [ebp - 0x230]
call fcn.0040b67b
lea ecx, [ebp - 0x248]
call fcn.0040b67b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x260]
call fcn.0040b67b
lea ecx, [ebp - 0x290]
call fcn.004c1ef2
push str.pdown.dll
mov edx, eax
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x278]
call fcn.0041151c
pop ecx
push eax
lea ecx, [ebx + 0x38]
call fcn.0040b0ac
lea ecx, [ebp - 0x278]
call fcn.0040b67b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x290]
call fcn.0040b67b
mov eax, dword [ebp + 8]
mov dword [ebx + 0x50], eax
xor eax, eax
push edi
push eax
push eax
push 0x4af8d5
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebx + 0x50]
mov dword [ebx], eax
test ecx, ecx
je 0x4b0371
mov edx, dword [ecx]
push eax
call dword [edx + 4]
call fcn.00591fc1
ret 4
Function at 0x4b0a47
Capabilities:
Check if file exists

Disassembly:
push 0x38
mov eax, 0x5e7897
call fcn.00592017
mov esi, dword [ebp + 8]
push 0x2de
mov edi, str.P2PDownLoad::UnzipPackage
xor ebx, ebx
push edi
push str.__s__d___UnzipPackage
mov dword [ebp - 4], ebx
call fcn.0040a649
add esp, 0xc
mov dword [ebp - 0x34], ebx
lea eax, [esi + 0x64]
mov dword [ebp - 0x30], ebx
lea ecx, [ebp - 0x44]
push eax
call fcn.0040b155
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.004251b0
mov esi, str.360browser_bkinfo
mov byte [ebp - 4], 2
push esi
call fcn.005b93d0
pop ecx
push eax
push esi
lea ecx, [ebp - 0x2c]
call fcn.0040b220
push 0x2e2
push edi
push str.__s__d___UnzipPackage_begin
call fcn.0040a649
add esp, 0xc
lea eax, [ebp - 0x2c]
push 8
pop esi
cmp dword [ebp - 0x18], esi
cmovae eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4b0ae8
cmp dword [ebp - 0x18], esi
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
cmp dword [ebp - 0x18], esi
lea edx, [ebp - 0x2c]
lea ecx, [ebp - 0x44]
cmovae edx, dword [ebp - 0x2c]
cmp dword [ebp - 0x30], esi
cmovae ecx, dword [ebp - 0x44]
call fcn.004b1da1
test eax, eax
lea ecx, [ebp - 0x2c]
setne bl
call fcn.0040b67b
lea ecx, [ebp - 0x44]
call fcn.0040b67b
lea ecx, [ebp + 0xc]
call fcn.00404812
mov al, bl
call fcn.00591fc1
ret 0x1c
Function at 0x4b0b28
Capabilities:
Check if file exists
Create directory

Disassembly:
push 0x88
mov eax, 0x5e78e7
call fcn.00592017
mov ebx, ecx
mov edi, dword [ebp + 8]
push 0x2fd
push str.P2PDownLoad::AddDownTaskAsync
push str.__s__d___AddDownTaskAsync_start_to_run
mov dword [ebp - 0x90], edi
call fcn.0040a649
add esp, 0xc
cmp dword [ebx + 0xc], 0
je 0x4b0cfd
test edi, edi
je 0x4b0cfd
mov edx, dword [edi + 0x8c]
lea ecx, [ebp - 0x5c]
call fcn.00429b81
and dword [ebp - 4], 0
mov esi, str..zip
push esi
call fcn.005acdf0
pop ecx
push eax
push esi
lea ecx, [ebp - 0x5c]
call fcn.004043c3
lea ecx, [ebp - 0x2c]
call fcn.004251b0
mov esi, str.360browserdownload
mov byte [ebp - 4], 1
push esi
call fcn.005b93d0
pop ecx
push eax
push esi
lea ecx, [ebp - 0x2c]
call fcn.0040b220
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4b0bdf
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
push 0
cmovae eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
sub esp, 0x18
lea eax, [ebp - 0x5c]
mov ecx, esp
push eax
and dword [ecx + 0x10], 0
and dword [ecx + 0x14], 0
call fcn.00404267
lea ecx, [ebp - 0x8c]
call fcn.004b018b
mov esi, eax
push 0x628a24
lea edx, [ebp - 0x2c]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x74]
call fcn.0041154b
add esp, 0x1c
push esi
mov edx, eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x44]
call fcn.00420b19
pop ecx
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040b0ac
lea ecx, [ebp - 0x44]
call fcn.0040b67b
lea ecx, [ebp - 0x74]
call fcn.0040b67b
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 1
call fcn.0040b67b
lea eax, [ebp - 0x2c]
push eax
lea ecx, [edi + 0x64]
call fcn.0041321d
push str.https:__dd.browser.360.cn_static_a_1298.4281.gif
lea ecx, [ebp - 0x44]
call fcn.0040b0d5
push 1
push 1
xor dl, dl
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x44]
call fcn.004c4bab
pop ecx
pop ecx
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 1
call fcn.0040b67b
cmp dword [ebp - 0x18], 8
lea ecx, [ebp - 0x2c]
lea eax, [edi + 4]
cmovae ecx, dword [ebp - 0x2c]
cmp dword [eax + 0x14], 8
jb 0x4b0ca0
mov eax, dword [eax]
sub esp, 0x18
push ecx
mov ecx, dword [ebx + 0xc]
push eax
call fcn.004af794
mov dword [edi + 0x7c], eax
test eax, eax
jne 0x4b0ccd
mov ecx, edi
mov byte [ebx + 8], al
call fcn.004af817
push 0x90
push edi
call fcn.00590bf9
pop ecx
pop ecx
jmp 0x4b0ced
lea ecx, [ebx + 0x10]
mov eax, dword [ecx + 4]
cmp dword [ecx + 8], eax
je 0x4b0ce0
mov dword [eax], edi
add dword [ecx + 4], 4
jmp 0x4b0ced
lea edx, [ebp - 0x90]
push edx
push eax
call fcn.0040de00
lea ecx, [ebp - 0x2c]
call fcn.0040b67b
lea ecx, [ebp - 0x5c]
call fcn.00404812
call fcn.00591fc1
ret 4
Function at 0x4b11d0
Capabilities:
Create thread

Disassembly:
push 0x20
mov eax, 0x5d7b4b
call fcn.00592017
mov esi, ecx
lea ecx, [ebp - 0x28]
call fcn.004251b0
mov edi, str.360browser_bkinfop2pconfig
xor ebx, ebx
push edi
mov dword [ebp - 4], ebx
call fcn.005b93d0
pop ecx
push eax
push edi
lea ecx, [ebp - 0x28]
call fcn.0040b220
lea eax, [ebp - 0x28]
push eax
lea ecx, [esi + 0xc]
call fcn.0041321d
lea ecx, [esi + 4]
call fcn.004b1c9f
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x40], eax
test eax, eax
jne 0x4b1237
push 0xba
push str.P2pDownloadMgr::Init
push str.__s__d___create_event_failed
jmp 0x4b1265
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], ebx
push eax
push ebx
push esi
push 0x4b117d
push ebx
push ebx
call fcn.005b953f
add esp, 0x18
mov dword [esi + 0x44], eax
test eax, eax
jne 0x4b126f
push 0xc1
push str.P2pDownloadMgr::Init
push str.__s__d___create_thread_failed
call fcn.0040a649
add esp, 0xc
jmp 0x4b129c
push 0xc4
push str.P2pDownloadMgr::Init
push str.__s__d___P2PDownload::Init
call fcn.0040a649
add esp, 0xc
push esi
call fcn.004b0d05
mov ecx, eax
call fcn.004b0214
mov ecx, esi
call fcn.004b1487
mov bl, 1
lea ecx, [ebp - 0x28]
call fcn.0040b67b
mov al, bl
call fcn.00591fc1
ret
Function at 0x4b1da1
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xa5c
mov eax, dword [0x6c45ac]
xor eax, esp
mov dword [esp + 0xa58], eax
push ebx
push esi
mov esi, edx
push edi
test ecx, ecx
je 0x4b1fc6
xor eax, eax
cmp ax, word [ecx]
je 0x4b1fc6
test esi, esi
je 0x4b1fc6
cmp ax, word [esi]
je 0x4b1fc6
push eax
push ecx
call fcn.00435c68
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x4b1fc6
push 0x410
lea eax, [esp + 0x654]
push 0
push eax
call fcn.005a88e0
add esp, 0xc
lea eax, [esp + 0x650]
mov ebx, 0x207
push esi
push 0x629208
push ebx
push eax
call fcn.00412a05
lea eax, [esp + 0x660]
push eax
call fcn.005b93d0
add esp, 0x14
test eax, eax
je 0x4b1fc6
lea eax, [esp + 0x650]
push eax
call fcn.005b93d0
pop ecx
cmp word [esp + eax*2 + 0x64e], 0x5c
je 0x4b1e6e
push ebx
lea eax, [esp + 0x654]
push 0x628a24
push eax
call fcn.005bf9e8
add esp, 0xc
lea ecx, [esp + 0x650]
call fcn.0041e4f1
test eax, eax
je 0x4b1fc6
lea eax, [esp + 0x10]
or edx, 0xffffffff
push eax
mov ecx, edi
call fcn.00435c97
mov ebx, dword [esp + 0x14]
xor esi, esi
pop ecx
test ebx, ebx
jle 0x4b1fba
lea eax, [esp + 0x10]
mov edx, esi
push eax
mov ecx, edi
call fcn.00435c97
pop ecx
test eax, eax
jne 0x4b1fb1
push 0x410
push eax
lea eax, [esp + 0x248]
push eax
call fcn.005a88e0
add esp, 0xc
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x654]
push eax
push 0x62ad10
lea eax, [esp + 0x24c]
push 0x207
push eax
call fcn.00412a05
add esp, 0x14
lea eax, [esp + 0x14]
push 0x62b03c
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
jne 0x4b1fb1
test byte [esp + 0x21c], 0x10
je 0x4b1f27
lea ecx, [esp + 0x240]
call fcn.0041e4f1
jmp 0x4b1fb1
lea eax, [esp + 0x240]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [esp + 0x240]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4b1f6c
lea eax, [esp + 0x240]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4b1f6c
and eax, 0xfffffffe
push eax
lea eax, [esp + 0x244]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [esp + 0x240]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [esp + 0x240]
mov edx, esi
push eax
mov ecx, edi
call fcn.00435d41
pop ecx
lea eax, [esp + 0x240]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4b1fb1
and eax, 0xfffffffe
push eax
lea eax, [esp + 0x244]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
inc esi
cmp esi, ebx
jl 0x4b1ea0
push edi
call fcn.00435d72
xor eax, eax
pop ecx
inc eax
jmp 0x4b1fc8
xor eax, eax
mov ecx, dword [esp + 0xa64]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00590be8
mov esp, ebp
pop ebp
ret
Function at 0x4b1fdd
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xa5c
mov eax, dword [0x6c45ac]
xor eax, esp
mov dword [esp + 0xa58], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
test ecx, ecx
je 0x4b2204
test edx, edx
je 0x4b2204
test esi, esi
je 0x4b2204
xor eax, eax
cmp ax, word [esi]
je 0x4b2204
push eax
push edx
push ecx
call fcn.00435c7e
mov edi, eax
add esp, 0xc
test edi, edi
je 0x4b2204
push 0x410
lea eax, [esp + 0x654]
push 0
push eax
call fcn.005a88e0
add esp, 0xc
lea eax, [esp + 0x650]
mov ebx, 0x207
push esi
push 0x629208
push ebx
push eax
call fcn.00412a05
lea eax, [esp + 0x660]
push eax
call fcn.005b93d0
add esp, 0x14
test eax, eax
je 0x4b2204
lea eax, [esp + 0x650]
push eax
call fcn.005b93d0
pop ecx
cmp word [esp + eax*2 + 0x64e], 0x5c
je 0x4b20ac
push ebx
lea eax, [esp + 0x654]
push 0x628a24
push eax
call fcn.005bf9e8
add esp, 0xc
lea ecx, [esp + 0x650]
call fcn.0041e4f1
test eax, eax
je 0x4b2204
lea eax, [esp + 0x10]
or edx, 0xffffffff
push eax
mov ecx, edi
call fcn.00435c97
mov ebx, dword [esp + 0x14]
xor esi, esi
pop ecx
test ebx, ebx
jle 0x4b21f8
lea eax, [esp + 0x10]
mov edx, esi
push eax
mov ecx, edi
call fcn.00435c97
pop ecx
test eax, eax
jne 0x4b21ef
push 0x410
push eax
lea eax, [esp + 0x248]
push eax
call fcn.005a88e0
add esp, 0xc
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x654]
push eax
push 0x62ad10
lea eax, [esp + 0x24c]
push 0x207
push eax
call fcn.00412a05
add esp, 0x14
lea eax, [esp + 0x14]
push 0x62b03c
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
jne 0x4b21ef
test byte [esp + 0x21c], 0x10
je 0x4b2165
lea ecx, [esp + 0x240]
call fcn.0041e4f1
jmp 0x4b21ef
lea eax, [esp + 0x240]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [esp + 0x240]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4b21aa
lea eax, [esp + 0x240]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4b21aa
and eax, 0xfffffffe
push eax
lea eax, [esp + 0x244]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [esp + 0x240]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [esp + 0x240]
mov edx, esi
push eax
mov ecx, edi
call fcn.00435d41
pop ecx
lea eax, [esp + 0x240]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4b21ef
and eax, 0xfffffffe
push eax
lea eax, [esp + 0x244]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
inc esi
cmp esi, ebx
jl 0x4b20de
push edi
call fcn.00435d72
xor eax, eax
pop ecx
inc eax
jmp 0x4b2206
xor eax, eax
mov ecx, dword [esp + 0xa64]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00590be8
mov esp, ebp
pop ebp
ret
Function at 0x4b2607
Capabilities:
Check if file exists

Disassembly:
push 0x64
mov eax, 0x5e7c1f
call fcn.00592017
mov edx, dword [ebp + 0x10]
lea ecx, [ebp - 0x70]
mov esi, dword [ebp + 0xc]
xor ebx, ebx
mov edi, dword [ebp + 0x14]
push ebx
call fcn.00426886
pop ecx
mov dword [ebp - 4], ebx
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x4b2635
mov eax, dword [esi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4b273f
push 0x61ce3e
lea ecx, [ebp - 0x40]
call fcn.004045aa
mov bl, byte [ebp + 8]
movzx eax, bl
push eax
push 0x8d
push str.DownloadMgr::HasLocalFile
push str.__s__d___download_file_file_encrypt___d
mov byte [ebp - 4], 1
call fcn.0040a649
add esp, 0x10
test bl, bl
je 0x4b26ce
mov edx, esi
lea ecx, [ebp - 0x28]
call fcn.0042530f
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 2
push eax
mov edx, eax
mov ecx, str.0aa4efce
call fcn.004168ad
cmp dword [ebp - 0x14], 0x10
lea edx, [ebp - 0x28]
push dword [ebp - 0x18]
cmovae edx, dword [ebp - 0x28]
lea ecx, [ebp - 0x58]
call fcn.00420e90
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x40]
call fcn.00409145
lea ecx, [ebp - 0x58]
call fcn.00404812
xor ebx, ebx
lea ecx, [ebp - 0x28]
inc ebx
mov byte [ebp - 4], bl
call fcn.00404812
jmp 0x4b26f4
cmp dword [esi + 0x14], 8
jb 0x4b26d6
mov esi, dword [esi]
mov edx, esi
lea ecx, [ebp - 0x58]
call fcn.0042348d
push eax
lea ecx, [ebp - 0x40]
call fcn.00409145
lea ecx, [ebp - 0x58]
call fcn.00404812
xor ebx, ebx
inc ebx
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.00423c0c
pop ecx
pop ecx
test al, al
je 0x4b271c
push 0x9c
xor eax, eax
push str.DownloadMgr::HasLocalFile
mov bl, al
push str.__s__d___download_file_md5_same
jmp 0x4b272b
push 0xa0
push str.DownloadMgr::HasLocalFile
push str.__s__d___download_file_md5_different
call fcn.0040a649
add esp, 0xc
lea ecx, [ebp - 0x40]
call fcn.00404812
mov al, bl
jmp 0x4b275a
push 0xa7
push str.DownloadMgr::HasLocalFile
push str.__s__d___download_file_not_exist
call fcn.0040a649
add esp, 0xc
mov bl, 1
xor eax, eax
lea ecx, [ebp - 0x70]
mov byte [edi], al
call fcn.00404812
mov al, bl
call fcn.00591fc1
ret 0x10
Function at 0x4b2fcb
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [0x6e25e0], 0
push esi
mov esi, ecx
je 0x4b2ff6
push 0x156
push str.DownloadMgr::Init
push str.__s__d___DownloadMgr::Init_inited
call fcn.0040a649
add esp, 0xc
mov al, 1
jmp 0x4b3067
push ebx
xor ebx, ebx
mov byte [0x6e25e0], 1
mov byte [esi + 0x2c], bl
call fcn.004b3466
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x24], eax
test eax, eax
jne 0x4b302a
push 0x15f
push str.DownloadMgr::Init
push str.__s__d___create_event_failed
jmp 0x4b3058
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
push ebx
push esi
push 0x4b2f78
push ebx
push ebx
call fcn.005b953f
add esp, 0x18
mov dword [esi + 0x28], eax
test eax, eax
jne 0x4b3064
push 0x166
push str.DownloadMgr::Init
push str.__s__d___create_thread_failed
call fcn.0040a649
add esp, 0xc
xor al, al
jmp 0x4b3066
mov al, 1
pop ebx
pop esi
leave
ret 4

Function at 0x4b3458
Capabilities:
Terminate thread

Disassembly:
push 0
push dword [ecx + 0x28]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
xor al, al
ret
Function at 0x4b4874
Capabilities:
Check if file exists

Disassembly:
push 0x34
mov eax, 0x5d8b42
call fcn.00592017
mov ebx, ecx
cmp byte [0x6e25e8], 0
je 0x4b48a7
push 0xa6
push str.PicLoopMgr::Init
push str.__s__d___PicLoopMgr::Init_inited
call fcn.0040a649
add esp, 0xc
jmp 0x4b4aa5
lea ecx, [ebp - 0x28]
mov byte [0x6e25e8], 1
mov dword [ebx + 0x8c], 0x927c0
call fcn.004cd264
and dword [ebp - 4], 0
mov esi, str._bkinfo_
push esi
call fcn.005b93d0
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.0040b220
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov esi, dword [sym.imp.SHELL32.dll_SHCreateDirectory]
test eax, eax
jne 0x4b4906
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push 0
call esi
lea ecx, [ebp - 0x28]
push ecx
lea ecx, [ebx + 0x54]
call fcn.0041321d
lea ecx, [ebp - 0x40]
call fcn.004251b0
lea edi, [ebx + 0x6c]
push eax
mov ecx, edi
call fcn.0040b0ac
lea ecx, [ebp - 0x40]
call fcn.0040b67b
push str.360browser_bkinfo_
call fcn.005b93d0
pop ecx
push eax
push str.360browser_bkinfo_
mov ecx, edi
call fcn.0040b220
cmp dword [edi + 0x14], 8
mov eax, edi
jb 0x4b494f
mov eax, dword [edi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4b4969
cmp dword [edi + 0x14], 8
mov eax, edi
jb 0x4b4964
mov eax, dword [edi]
push eax
push 0
call esi
push str.watermark_
mov edx, edi
lea ecx, [ebp - 0x40]
call fcn.0041154b
pop ecx
lea esi, [ebx + 0xa8]
push eax
mov ecx, esi
call fcn.0040b0ac
lea ecx, [ebp - 0x40]
call fcn.0040b67b
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x4b4999
mov eax, dword [esi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4b49b5
cmp dword [esi + 0x14], 8
jb 0x4b49ac
mov esi, dword [esi]
push esi
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
push str.composite_
mov edx, edi
lea ecx, [ebp - 0x40]
call fcn.0041154b
pop ecx
lea esi, [ebx + 0xc0]
push eax
mov ecx, esi
call fcn.0040b0ac
lea ecx, [ebp - 0x40]
call fcn.0040b67b
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x4b49e5
mov eax, dword [esi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4b4a01
cmp dword [esi + 0x14], 8
jb 0x4b49f8
mov esi, dword [esi]
push esi
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
push ecx
mov word [ebx + 0x84], 1
call fcn.004b25a9
mov ecx, eax
call fcn.004b2fcb
mov ecx, ebx
lea eax, [ebx + 0x24]
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
call fcn.004b25a9
mov ecx, eax
call fcn.004b13e8
mov ecx, ebx
call fcn.004b455d
mov ecx, ebx
call fcn.004b4ddc
and dword [ebx + 0x88], 0
call fcn.004b6d10
push eax
mov ecx, ebx
call fcn.004b4aaf
movzx eax, byte [ebx + 0x86]
push eax
push dword [ebx + 0x8c]
push dword [ebx + 0x50]
push 0xcb
push str.PicLoopMgr::Init
push str.__s__d___m_nCurIndex___d_m_nLoopTimeInterval___d_m_bIsLoopEnable___d
call fcn.0040a649
push str.dynloopconfig
lea edx, [ebx + 0x54]
lea ecx, [ebp - 0x40]
call fcn.0041154b
add esp, 0x1c
lea ecx, [ebx + 0x1a0]
push eax
call fcn.0040b0ac
lea ecx, [ebp - 0x40]
call fcn.0040b67b
lea ecx, [ebp - 0x28]
call fcn.0040b67b
mov al, 1
call fcn.00591fc1
ret 8
Function at 0x4b4be3
Capabilities:
Check if file exists
Delete file

Disassembly:
push 0xc
mov eax, 0x5e80ac
call fcn.00591fe3
mov esi, ecx
push 0xed
push str.PicLoopMgr::Reset
push str.__s__d___loop_need_reset
call fcn.0040a649
add esp, 0xc
call fcn.004b25a9
mov ecx, eax
call fcn.004b311e
lea eax, [esi + 0x38]
mov dword [ebp - 0x14], vtable.CAutoLock.0
lea ebx, [esi + 0x34]
push eax
mov dword [ebp - 0x10], ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
and dword [ebp - 4], 0
lea ecx, [esi + 0x28]
and dword [esi + 0x50], 0
call fcn.004b87c4
lea ecx, [esi + 0x1b8]
call fcn.00478667
and dword [esi + 0xa4], 0
mov ecx, esi
call fcn.004b4ddc
and dword [0x6c5654], 0
lea edi, [esi + 0x1a0]
cmp dword [0x6c5658], 0x10
mov eax, 0x6c5644
cmovae eax, dword [0x6c5644]
mov byte [eax], 0
mov eax, edi
cmp dword [edi + 0x14], 8
jb 0x4b4c81
mov eax, dword [edi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4b4c9b
cmp dword [edi + 0x14], 8
jb 0x4b4c94
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [esi + 0x88]
sub eax, 1
je 0x4b4cd0
sub eax, 1
je 0x4b4cc7
sub eax, 1
je 0x4b4cbe
sub eax, 1
jne 0x4b4cd7
mov ecx, esi
call fcn.004b6f16
jmp 0x4b4cd7
mov ecx, esi
call fcn.004b70fb
jmp 0x4b4cd7
mov ecx, esi
call fcn.004b6fe0
jmp 0x4b4cd7
mov ecx, esi
call fcn.004b6e7c
lea eax, [ebx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.00591fac
ret
Function at 0x4b6556
Capabilities:
Check if file exists
Delete file

Disassembly:
push 0x118
mov eax, 0x5e8384
call fcn.00592017
mov edi, ecx
mov eax, dword [ebp + 8]
mov edx, str.Software360360huabao
and dword [ebp - 0x124], 0
mov ecx, reloc.WS2_32.dll_accept
mov dword [ebp - 0x120], eax
lea eax, [ebp - 0x124]
push eax
push str.360huabao_loopindex
mov byte [edi + 0x1dc], 1
call fcn.00425cda
mov eax, dword [ebp - 0x124]
mov esi, str.PicLoopMgr::PreWallPaper
dec eax
push eax
push 0x29d
push esi
push str.__s__d___PreWallPaper_m_nCurIndex___d
mov dword [edi + 0x50], eax
call fcn.0040a649
add esp, 0x18
lea ecx, [ebp - 0x11c]
call fcn.004b3fd6
and dword [ebp - 4], 0
cmp dword [edi + 0x90], 1
jne 0x4b65e6
cmp dword [edi + 0x94], 2
jne 0x4b65e6
mov ecx, edi
call fcn.004b77b6
jmp 0x4b65e9
mov eax, dword [edi + 0x50]
push eax
lea eax, [ebp - 0x11c]
mov ecx, edi
push eax
call fcn.004b4ce7
test al, al
je 0x4b678f
mov eax, dword [edi + 0x90]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 2
je 0x4b661a
cmp eax, 4
jne 0x4b6753
push 0xfde9
lea edx, [ebp - 0xd8]
lea ecx, [ebp - 0x2c]
call fcn.00426802
pop ecx
mov byte [ebp - 4], 1
lea eax, [ebp - 0x2c]
cmp dword [ebp - 0x18], 8
cmovae eax, dword [ebp - 0x2c]
push eax
call ebx
test eax, eax
jne 0x4b6673
push eax
lea edx, [ebp - 0xf0]
lea ecx, [ebp - 0x44]
call fcn.00426802
pop ecx
mov esi, eax
mov byte [ebp - 4], 2
call fcn.004b8eb5
push 0
lea eax, [ebp - 0x2c]
push eax
push esi
call fcn.004b8f13
lea ecx, [ebp - 0x44]
call fcn.0040b67b
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0
call fcn.0040b67b
mov eax, dword [edi + 0x90]
cmp eax, 4
jne 0x4b6753
cmp dword [ebp - 0x114], 2
jne 0x4b6753
sub esp, 0x18
lea eax, [ebp - 0xa8]
mov ecx, esp
push eax
and dword [ecx + 0x10], 0
and dword [ecx + 0x14], 0
call fcn.00404267
lea ecx, [ebp - 0x44]
call fcn.00430aaf
push eax
lea edx, [edi + 0x6c]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2c]
call fcn.004296ce
add esp, 0x1c
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 5
call fcn.0040b67b
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push eax
call ebx
test eax, eax
jne 0x4b673b
cmp dword [ebp - 0xb0], eax
je 0x4b673b
xor edx, edx
lea eax, [ebp - 0x2c]
push edx
push eax
sub esp, 0x18
lea eax, [ebp - 0xc0]
mov ecx, esp
push eax
mov dword [ecx + 0x10], edx
mov dword [ecx + 0x14], edx
call fcn.00404267
lea ecx, [ebp - 0x5c]
call fcn.00430aaf
add esp, 0x18
mov esi, eax
mov byte [ebp - 4], 6
call fcn.004b8eb5
push esi
call fcn.004b8f13
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 5
call fcn.0040b67b
lea eax, [ebp - 0x11c]
mov ecx, edi
push eax
call fcn.004b635a
lea ecx, [ebp - 0x2c]
call fcn.0040b67b
jmp 0x4b67a2
lea esi, [edi + 0x1a0]
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x4b6763
mov eax, dword [esi]
push eax
call ebx
test eax, eax
je 0x4b6779
cmp dword [esi + 0x14], 8
jb 0x4b6772
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push dword [ebp - 0x120]
lea eax, [ebp - 0x11c]
mov ecx, edi
push eax
call fcn.004b5f1c
jmp 0x4b67a2
push 0x2be
push esi
push str.__s__d___GetLoopItem_error
call fcn.0040a649
add esp, 0xc
lea ecx, [ebp - 0x11c]
call fcn.004b43b8
call fcn.00591fc1
ret 4