joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bafe7
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xa5c
mov eax, dword [0x6d35ac]
xor eax, esp
mov dword [esp + 0xa58], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
test ecx, ecx
je 0x4bb20e
test edx, edx
je 0x4bb20e
test esi, esi
je 0x4bb20e
xor eax, eax
cmp ax, word [esi]
je 0x4bb20e
push eax
push edx
push ecx
call fcn.0043ad51
mov edi, eax
add esp, 0xc
test edi, edi
je 0x4bb20e
push 0x410
lea eax, [esp + 0x654]
push 0
push eax
call fcn.005b24a0
add esp, 0xc
lea eax, [esp + 0x650]
mov ebx, 0x207
push esi
push 0x634350
push ebx
push eax
call fcn.00412a13
lea eax, [esp + 0x660]
push eax
call fcn.005c2f90
add esp, 0x14
test eax, eax
je 0x4bb20e
lea eax, [esp + 0x650]
push eax
call fcn.005c2f90
pop ecx
cmp word [esp + eax*2 + 0x64e], 0x5c
je 0x4bb0b6
push ebx
lea eax, [esp + 0x654]
push 0x633b6c
push eax
call fcn.005c95a8
add esp, 0xc
lea ecx, [esp + 0x650]
call fcn.0041e71d
test eax, eax
je 0x4bb20e
lea eax, [esp + 0x10]
or edx, 0xffffffff
push eax
mov ecx, edi
call fcn.0043ad6a
mov ebx, dword [esp + 0x14]
xor esi, esi
pop ecx
test ebx, ebx
jle 0x4bb202
lea eax, [esp + 0x10]
mov edx, esi
push eax
mov ecx, edi
call fcn.0043ad6a
pop ecx
test eax, eax
jne 0x4bb1f9
push 0x410
push eax
lea eax, [esp + 0x248]
push eax
call fcn.005b24a0
add esp, 0xc
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x654]
push eax
push 0x635ea8
lea eax, [esp + 0x24c]
push 0x207
push eax
call fcn.00412a13
add esp, 0x14
lea eax, [esp + 0x14]
push 0x6361d4
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
jne 0x4bb1f9
test byte [esp + 0x21c], 0x10
je 0x4bb16f
lea ecx, [esp + 0x240]
call fcn.0041e71d
jmp 0x4bb1f9
lea eax, [esp + 0x240]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [esp + 0x240]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4bb1b4
lea eax, [esp + 0x240]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4bb1b4
and eax, 0xfffffffe
push eax
lea eax, [esp + 0x244]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [esp + 0x240]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [esp + 0x240]
mov edx, esi
push eax
mov ecx, edi
call fcn.0043ae14
pop ecx
lea eax, [esp + 0x240]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4bb1f9
and eax, 0xfffffffe
push eax
lea eax, [esp + 0x244]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
inc esi
cmp esi, ebx
jl 0x4bb0e8
push edi
call fcn.0043ae45
xor eax, eax
pop ecx
inc eax
jmp 0x4bb210
xor eax, eax
mov ecx, dword [esp + 0xa64]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0059a7a2
mov esp, ebp
pop ebp
ret
Function at 0x4bb611
Capabilities:
Check if file exists

Disassembly:
push 0x64
mov eax, 0x5f278c
call fcn.0059bbd7
mov edx, dword [ebp + 0x10]
lea ecx, [ebp - 0x70]
mov esi, dword [ebp + 0xc]
xor ebx, ebx
mov edi, dword [ebp + 0x14]
push ebx
call fcn.00426d6b
pop ecx
mov dword [ebp - 4], ebx
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x4bb63f
mov eax, dword [esi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4bb775
push 0x627e3e
lea ecx, [ebp - 0x40]
call fcn.004045aa
mov bl, byte [ebp + 8]
movzx eax, bl
push eax
push 0x8d
push 0x66a648
push str.__s__d___download_file_file_encrypt___d
mov byte [ebp - 4], 1
call fcn.0040a649
add esp, 0x10
test bl, bl
je 0x4bb6dd
mov edx, esi
lea ecx, [ebp - 0x28]
call fcn.004257c4
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 2
push eax
mov edx, eax
mov ecx, str.0aa4efce
call fcn.00416ad9
cmp dword [ebp - 0x14], 0x10
lea edx, [ebp - 0x28]
push dword [ebp - 0x18]
cmovae edx, dword [ebp - 0x28]
lea ecx, [ebp - 0x58]
call fcn.004210f5
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x40]
call fcn.00409145
lea ecx, [ebp - 0x58]
call fcn.00404812
xor ebx, ebx
lea ecx, [ebp - 0x28]
inc ebx
mov byte [ebp - 4], bl
call fcn.00404812
mov esi, 0x66a648
jmp 0x4bb732
push 0x96
push 0x66a648
push str.__s__d___get_file_md5_start
call fcn.0040a649
add esp, 0xc
cmp dword [esi + 0x14], 8
jb 0x4bb6fc
mov esi, dword [esi]
mov edx, esi
lea ecx, [ebp - 0x58]
call fcn.004236f2
push eax
lea ecx, [ebp - 0x40]
call fcn.00409145
lea ecx, [ebp - 0x58]
call fcn.00404812
push 0x98
mov esi, 0x66a648
push esi
push str.__s__d___get_file_md5_end
call fcn.0040a649
xor ebx, ebx
add esp, 0xc
inc ebx
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.00423e8e
pop ecx
pop ecx
test al, al
je 0x4bb756
push 0x9e
xor eax, eax
push esi
mov bl, al
push str.__s__d___download_file_md5_same
jmp 0x4bb761
push 0xa2
push esi
push str.__s__d___download_file_md5_different
call fcn.0040a649
add esp, 0xc
lea ecx, [ebp - 0x40]
call fcn.00404812
mov al, bl
jmp 0x4bb790
push 0xa9
push 0x66a648
push str.__s__d___download_file_not_exist
call fcn.0040a649
add esp, 0xc
mov bl, 1
xor eax, eax
lea ecx, [ebp - 0x70]
mov byte [edi], al
call fcn.00404812
mov al, bl
call fcn.0059bb81
ret 0x10
Function at 0x4bc001
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [0x6f16ac], 0
push esi
mov esi, ecx
je 0x4bc02c
push 0x158
push str.DownloadMgr::Init
push str.__s__d___DownloadMgr::Init_inited
call fcn.0040a649
add esp, 0xc
mov al, 1
jmp 0x4bc09d
push ebx
xor ebx, ebx
mov byte [0x6f16ac], 1
mov byte [esi + 0x2c], bl
call fcn.004bc49c
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x24], eax
test eax, eax
jne 0x4bc060
push 0x161
push str.DownloadMgr::Init
push str.__s__d___create_event_failed
jmp 0x4bc08e
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
push ebx
push esi
push 0x4bbfae
push ebx
push ebx
call fcn.005c30ff
add esp, 0x18
mov dword [esi + 0x28], eax
test eax, eax
jne 0x4bc09a
push 0x168
push str.DownloadMgr::Init
push str.__s__d___create_thread_failed
call fcn.0040a649
add esp, 0xc
xor al, al
jmp 0x4bc09c
mov al, 1
pop ebx
pop esi
leave
ret 4

Function at 0x4bc48e
Capabilities:
Terminate thread

Disassembly:
push 0
push dword [ecx + 0x28]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
xor al, al
ret
Function at 0x4bd8aa
Capabilities:
Check if file exists

Disassembly:
push 0x34
mov eax, 0x5e2702
call fcn.0059bbd7
mov ebx, ecx
cmp byte [0x6f16b4], 0
je 0x4bd8dd
push 0xa6
push str.PicLoopMgr::Init
push str.__s__d___PicLoopMgr::Init_inited
call fcn.0040a649
add esp, 0xc
jmp 0x4bdadb
lea ecx, [ebp - 0x28]
mov byte [0x6f16b4], 1
mov dword [ebx + 0x8c], 0x927c0
call fcn.004d6c63
and dword [ebp - 4], 0
mov esi, str._bkinfo_
push esi
call fcn.005c2f90
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.0040b220
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov esi, dword [sym.imp.SHELL32.dll_SHCreateDirectory]
test eax, eax
jne 0x4bd93c
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push 0
call esi
lea ecx, [ebp - 0x28]
push ecx
lea ecx, [ebx + 0x54]
call fcn.0041322b
lea ecx, [ebp - 0x40]
call fcn.00425665
lea edi, [ebx + 0x6c]
push eax
mov ecx, edi
call fcn.0040b0ac
lea ecx, [ebp - 0x40]
call fcn.0040b67e
push str.360browser_bkinfo_
call fcn.005c2f90
pop ecx
push eax
push str.360browser_bkinfo_
mov ecx, edi
call fcn.0040b220
cmp dword [edi + 0x14], 8
mov eax, edi
jb 0x4bd985
mov eax, dword [edi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4bd99f
cmp dword [edi + 0x14], 8
mov eax, edi
jb 0x4bd99a
mov eax, dword [edi]
push eax
push 0
call esi
push str.watermark_
mov edx, edi
lea ecx, [ebp - 0x40]
call fcn.00411559
pop ecx
lea esi, [ebx + 0xa8]
push eax
mov ecx, esi
call fcn.0040b0ac
lea ecx, [ebp - 0x40]
call fcn.0040b67e
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x4bd9cf
mov eax, dword [esi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4bd9eb
cmp dword [esi + 0x14], 8
jb 0x4bd9e2
mov esi, dword [esi]
push esi
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
push str.composite_
mov edx, edi
lea ecx, [ebp - 0x40]
call fcn.00411559
pop ecx
lea esi, [ebx + 0xc0]
push eax
mov ecx, esi
call fcn.0040b0ac
lea ecx, [ebp - 0x40]
call fcn.0040b67e
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x4bda1b
mov eax, dword [esi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4bda37
cmp dword [esi + 0x14], 8
jb 0x4bda2e
mov esi, dword [esi]
push esi
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
push ecx
mov word [ebx + 0x84], 1
call fcn.004bb5b3
mov ecx, eax
call fcn.004bc001
mov ecx, ebx
lea eax, [ebx + 0x24]
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
call fcn.004bb5b3
mov ecx, eax
call fcn.004ba3f2
mov ecx, ebx
call fcn.004bd593
mov ecx, ebx
call fcn.004bde12
and dword [ebx + 0x88], 0
call fcn.004bfd46
push eax
mov ecx, ebx
call fcn.004bdae5
movzx eax, byte [ebx + 0x86]
push eax
push dword [ebx + 0x8c]
push dword [ebx + 0x50]
push 0xcb
push str.PicLoopMgr::Init
push str.__s__d___m_nCurIndex___d_m_nLoopTimeInterval___d_m_bIsLoopEnable___d
call fcn.0040a649
push str.dynloopconfig
lea edx, [ebx + 0x54]
lea ecx, [ebp - 0x40]
call fcn.00411559
add esp, 0x1c
lea ecx, [ebx + 0x1a0]
push eax
call fcn.0040b0ac
lea ecx, [ebp - 0x40]
call fcn.0040b67e
lea ecx, [ebp - 0x28]
call fcn.0040b67e
mov al, 1
call fcn.0059bb81
ret 8
Function at 0x4bdc19
Capabilities:
Check if file exists
Delete file

Disassembly:
push 0xc
mov eax, 0x5f2c19
call fcn.0059bba3
mov esi, ecx
push 0xed
push str.PicLoopMgr::Reset
push str.__s__d___loop_need_reset
call fcn.0040a649
add esp, 0xc
call fcn.004bb5b3
mov ecx, eax
call fcn.004bc154
lea eax, [esi + 0x38]
mov dword [ebp - 0x14], vtable.CAutoLock.0
lea ebx, [esi + 0x34]
push eax
mov dword [ebp - 0x10], ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
and dword [ebp - 4], 0
lea ecx, [esi + 0x28]
and dword [esi + 0x50], 0
call fcn.004c17fa
lea ecx, [esi + 0x1b8]
call fcn.0047f3db
and dword [esi + 0xa4], 0
mov ecx, esi
call fcn.004bde12
and dword [0x6d4654], 0
lea edi, [esi + 0x1a0]
cmp dword [0x6d4658], 0x10
mov eax, 0x6d4644
cmovae eax, dword [0x6d4644]
mov byte [eax], 0
mov eax, edi
cmp dword [edi + 0x14], 8
jb 0x4bdcb7
mov eax, dword [edi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4bdcd1
cmp dword [edi + 0x14], 8
jb 0x4bdcca
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [esi + 0x88]
sub eax, 1
je 0x4bdd06
sub eax, 1
je 0x4bdcfd
sub eax, 1
je 0x4bdcf4
sub eax, 1
jne 0x4bdd0d
mov ecx, esi
call fcn.004bff4c
jmp 0x4bdd0d
mov ecx, esi
call fcn.004c0131
jmp 0x4bdd0d
mov ecx, esi
call fcn.004c0016
jmp 0x4bdd0d
mov ecx, esi
call fcn.004bfeb2
lea eax, [ebx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.0059bb6c
ret
Function at 0x4bf58c
Capabilities:
Check if file exists
Delete file

Disassembly:
push 0x118
mov eax, 0x5f2ef1
call fcn.0059bbd7
mov edi, ecx
mov eax, dword [ebp + 8]
mov edx, str.Software360360huabao
and dword [ebp - 0x124], 0
mov ecx, reloc.WS2_32.dll_accept
mov dword [ebp - 0x120], eax
lea eax, [ebp - 0x124]
push eax
push str.360huabao_loopindex
mov byte [edi + 0x1dc], 1
call fcn.004261bf
mov eax, dword [ebp - 0x124]
mov esi, str.PicLoopMgr::PreWallPaper
dec eax
push eax
push 0x29d
push esi
push str.__s__d___PreWallPaper_m_nCurIndex___d
mov dword [edi + 0x50], eax
call fcn.0040a649
add esp, 0x18
lea ecx, [ebp - 0x11c]
call fcn.004bd00c
and dword [ebp - 4], 0
cmp dword [edi + 0x90], 1
jne 0x4bf61c
cmp dword [edi + 0x94], 2
jne 0x4bf61c
mov ecx, edi
call fcn.004c07ec
jmp 0x4bf61f
mov eax, dword [edi + 0x50]
push eax
lea eax, [ebp - 0x11c]
mov ecx, edi
push eax
call fcn.004bdd1d
test al, al
je 0x4bf7c5
mov eax, dword [edi + 0x90]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 2
je 0x4bf650
cmp eax, 4
jne 0x4bf789
push 0xfde9
lea edx, [ebp - 0xd8]
lea ecx, [ebp - 0x2c]
call fcn.00426ce7
pop ecx
mov byte [ebp - 4], 1
lea eax, [ebp - 0x2c]
cmp dword [ebp - 0x18], 8
cmovae eax, dword [ebp - 0x2c]
push eax
call ebx
test eax, eax
jne 0x4bf6a9
push eax
lea edx, [ebp - 0xf0]
lea ecx, [ebp - 0x44]
call fcn.00426ce7
pop ecx
mov esi, eax
mov byte [ebp - 4], 2
call fcn.004c1eeb
push 0
lea eax, [ebp - 0x2c]
push eax
push esi
call fcn.004c1f49
lea ecx, [ebp - 0x44]
call fcn.0040b67e
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0
call fcn.0040b67e
mov eax, dword [edi + 0x90]
cmp eax, 4
jne 0x4bf789
cmp dword [ebp - 0x114], 2
jne 0x4bf789
sub esp, 0x18
lea eax, [ebp - 0xa8]
mov ecx, esp
push eax
and dword [ecx + 0x10], 0
and dword [ecx + 0x14], 0
call fcn.00404267
lea ecx, [ebp - 0x44]
call fcn.00435b82
push eax
lea edx, [edi + 0x6c]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2c]
call fcn.0042adab
add esp, 0x1c
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 5
call fcn.0040b67e
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push eax
call ebx
test eax, eax
jne 0x4bf771
cmp dword [ebp - 0xb0], eax
je 0x4bf771
xor edx, edx
lea eax, [ebp - 0x2c]
push edx
push eax
sub esp, 0x18
lea eax, [ebp - 0xc0]
mov ecx, esp
push eax
mov dword [ecx + 0x10], edx
mov dword [ecx + 0x14], edx
call fcn.00404267
lea ecx, [ebp - 0x5c]
call fcn.00435b82
add esp, 0x18
mov esi, eax
mov byte [ebp - 4], 6
call fcn.004c1eeb
push esi
call fcn.004c1f49
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 5
call fcn.0040b67e
lea eax, [ebp - 0x11c]
mov ecx, edi
push eax
call fcn.004bf390
lea ecx, [ebp - 0x2c]
call fcn.0040b67e
jmp 0x4bf7d8
lea esi, [edi + 0x1a0]
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x4bf799
mov eax, dword [esi]
push eax
call ebx
test eax, eax
je 0x4bf7af
cmp dword [esi + 0x14], 8
jb 0x4bf7a8
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push dword [ebp - 0x120]
lea eax, [ebp - 0x11c]
mov ecx, edi
push eax
call fcn.004bef52
jmp 0x4bf7d8
push 0x2be
push esi
push str.__s__d___GetLoopItem_error
call fcn.0040a649
add esp, 0xc
lea ecx, [ebp - 0x11c]
call fcn.004bd3ee
call fcn.0059bb81
ret 4
Function at 0x4bf7eb
Capabilities:
Check if file exists
Delete file

Disassembly:
push 0x118
mov eax, 0x5f2ef1
call fcn.0059bbd7
mov edi, ecx
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x120], eax
mov edx, str.Software360360huabao
lea eax, [ebp - 0x124]
mov byte [edi + 0x1dc], bl
push eax
push str.360huabao_loopindex
mov ecx, reloc.WS2_32.dll_accept
mov dword [ebp - 0x124], ebx
call fcn.004261bf
mov eax, dword [ebp - 0x124]
mov esi, str.PicLoopMgr::NextWallPaper
inc eax
push eax
push 0x2c8
push esi
push str.__s__d___NextWallPaper_m_nCurIndex___d
mov dword [edi + 0x50], eax
call fcn.0040a649
add esp, 0x18
lea ecx, [ebp - 0x11c]
call fcn.004bd00c
mov dword [ebp - 4], ebx
cmp dword [edi + 0x90], 1
jne 0x4bf87a
cmp dword [edi + 0x94], 2
jne 0x4bf87a
mov ecx, edi
call fcn.004c07ec
jmp 0x4bf87d
mov eax, dword [edi + 0x50]
push eax
lea eax, [ebp - 0x11c]
mov ecx, edi
push eax
call fcn.004bdd1d
test al, al
je 0x4bfa23
mov eax, dword [edi + 0x90]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 2
je 0x4bf8ae
cmp eax, 4
jne 0x4bf9e7
push 0xfde9
lea edx, [ebp - 0xd8]
lea ecx, [ebp - 0x2c]
call fcn.00426ce7
pop ecx
mov byte [ebp - 4], 1
lea eax, [ebp - 0x2c]
cmp dword [ebp - 0x18], 8
cmovae eax, dword [ebp - 0x2c]
push eax
call ebx
test eax, eax
jne 0x4bf907
push eax
lea edx, [ebp - 0xf0]
lea ecx, [ebp - 0x44]
call fcn.00426ce7
pop ecx
mov esi, eax
mov byte [ebp - 4], 2
call fcn.004c1eeb
push 0
lea eax, [ebp - 0x2c]
push eax
push esi
call fcn.004c1f49
lea ecx, [ebp - 0x44]
call fcn.0040b67e
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0
call fcn.0040b67e
mov eax, dword [edi + 0x90]
cmp eax, 4
jne 0x4bf9e7
cmp dword [ebp - 0x114], 2
jne 0x4bf9e7
sub esp, 0x18
lea eax, [ebp - 0xa8]
mov ecx, esp
push eax
and dword [ecx + 0x10], 0
and dword [ecx + 0x14], 0
call fcn.00404267
lea ecx, [ebp - 0x44]
call fcn.00435b82
push eax
lea edx, [edi + 0x6c]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2c]
call fcn.0042adab
add esp, 0x1c
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 5
call fcn.0040b67e
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push eax
call ebx
test eax, eax
jne 0x4bf9cf
cmp dword [ebp - 0xb0], eax
je 0x4bf9cf
xor edx, edx
lea eax, [ebp - 0x2c]
push edx
push eax
sub esp, 0x18
lea eax, [ebp - 0xc0]
mov ecx, esp
push eax
mov dword [ecx + 0x10], edx
mov dword [ecx + 0x14], edx
call fcn.00404267
lea ecx, [ebp - 0x5c]
call fcn.00435b82
add esp, 0x18
mov esi, eax
mov byte [ebp - 4], 6
call fcn.004c1eeb
push esi
call fcn.004c1f49
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 5
call fcn.0040b67e
lea eax, [ebp - 0x11c]
mov ecx, edi
push eax
call fcn.004bf390
lea ecx, [ebp - 0x2c]
call fcn.0040b67e
jmp 0x4bfa36
lea esi, [edi + 0x1a0]
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x4bf9f7
mov eax, dword [esi]
push eax
call ebx
test eax, eax
je 0x4bfa0d
cmp dword [esi + 0x14], 8
jb 0x4bfa06
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push dword [ebp - 0x120]
lea eax, [ebp - 0x11c]
mov ecx, edi
push eax
call fcn.004bef52
jmp 0x4bfa36
push 0x2e8
push esi
push str.__s__d___GetLoopItem_error
call fcn.0040a649
add esp, 0xc
lea ecx, [ebp - 0x11c]
call fcn.004bd3ee
call fcn.0059bb81
ret 4
Function at 0x4bfa8f
Capabilities:
Check if file exists
Delete file

Disassembly:
push 0x12c
mov eax, 0x5f2f4c
call fcn.0059bbd7
mov edi, ecx
lea ecx, [ebp - 0x134]
call fcn.004bd00c
and dword [ebp - 4], 0
cmp dword [edi + 0x90], 1
jne 0x4bfacc
cmp dword [edi + 0x94], 2
jne 0x4bfacc
mov ecx, edi
call fcn.004c07ec
mov esi, eax
jmp 0x4bfacf
mov esi, dword [edi + 0x50]
push esi
push 0x2fe
mov ebx, str.PicLoopMgr::SetCurWallPaper
push ebx
push str.__s__d___SetCurWallPaper_m_nCurIndex___d
call fcn.0040a649
add esp, 0x10
lea eax, [ebp - 0x134]
mov ecx, edi
push esi
push eax
call fcn.004bdd1d
test al, al
je 0x4bfcab
push 0xfde9
lea edx, [ebp - 0xf0]
lea ecx, [ebp - 0x2c]
call fcn.00426ce7
pop ecx
mov byte [ebp - 4], 1
lea eax, [ebp - 0x2c]
cmp dword [ebp - 0x18], 8
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmovae eax, dword [ebp - 0x2c]
push eax
call ebx
test eax, eax
jne 0x4bfb62
push eax
lea edx, [ebp - 0x108]
lea ecx, [ebp - 0x44]
call fcn.00426ce7
pop ecx
mov esi, eax
mov byte [ebp - 4], 2
call fcn.004c1eeb
push 0
lea eax, [ebp - 0x2c]
push eax
push esi
call fcn.004c1f49
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 1
call fcn.0040b67e
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push eax
call ebx
test eax, eax
je 0x4bfc81
cmp dword [edi + 0x90], 4
jne 0x4bfc48
cmp dword [ebp - 0x12c], 2
jne 0x4bfc48
sub esp, 0x18
lea eax, [ebp - 0xc0]
mov ecx, esp
xor esi, esi
push eax
mov dword [ecx + 0x10], esi
mov dword [ecx + 0x14], esi
call fcn.00404267
lea ecx, [ebp - 0x5c]
call fcn.00435b82
push eax
lea edx, [edi + 0x6c]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x44]
call fcn.0042adab
add esp, 0x1c
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 5
call fcn.0040b67e
cmp dword [ebp - 0x30], 8
lea eax, [ebp - 0x44]
cmovae eax, dword [ebp - 0x44]
push eax
call ebx
test eax, eax
jne 0x4bfc30
cmp dword [ebp - 0xc8], eax
je 0x4bfc30
push esi
lea eax, [ebp - 0x44]
push eax
sub esp, 0x18
lea eax, [ebp - 0xd8]
mov ecx, esp
push eax
mov dword [ecx + 0x10], esi
mov dword [ecx + 0x14], esi
call fcn.00404267
lea ecx, [ebp - 0x74]
call fcn.00435b82
add esp, 0x18
mov esi, eax
mov byte [ebp - 4], 6
call fcn.004c1eeb
push esi
call fcn.004c1f49
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 5
call fcn.0040b67e
lea eax, [ebp - 0x134]
mov ecx, edi
push eax
call fcn.004bf390
lea ecx, [ebp - 0x44]
call fcn.0040b67e
jmp 0x4bfc81
lea esi, [edi + 0x1a0]
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x4bfc58
mov eax, dword [esi]
push eax
call ebx
test eax, eax
je 0x4bfc6e
cmp dword [esi + 0x14], 8
jb 0x4bfc67
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x4beeac
lea eax, [ebp - 0x134]
mov ecx, edi
push eax
call fcn.004bef52
mov eax, dword [edi + 0x90]
cmp eax, 2
je 0x4bfc9e
cmp eax, 1
jne 0x4bfc99
cmp dword [edi + 0x94], eax
je 0x4bfc9e
cmp eax, 4
jne 0x4bfca1
inc dword [edi + 0x50]
lea ecx, [ebp - 0x2c]
call fcn.0040b67e
jmp 0x4bfcbe
push 0x319
push ebx
push str.__s__d___GetLoopItem_error
call fcn.0040a649
add esp, 0xc
lea ecx, [ebp - 0x134]
call fcn.004bd3ee
call fcn.0059bb81
ret
Function at 0x4c1f49
Capabilities:
Check if file exists

Disassembly:
push 0x80
mov eax, 0x5f33ef
call fcn.0059bbd7
mov ebx, dword [ebp + 0xc]
lea ecx, [ebp - 0x84]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x8c], ebx
call fcn.0040ba47
and dword [ebp - 4], 0
push 0x170
call fcn.0059a7c1
pop ecx
mov dword [ebp - 0x88], eax
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.0040b6b1
sub esp, 0x18
mov edi, eax
mov ecx, esp
xor eax, eax
mov byte [ebp - 4], al
push esi
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
call fcn.0040b155
lea ecx, [ebp - 0x2c]
call fcn.00435a2c
add esp, 0x18
push eax
mov ecx, edi
mov byte [ebp - 4], 2
call fcn.0040b8cb
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0
call fcn.00404812
sub esp, 0x18
mov ecx, esp
push ebx
and dword [ecx + 0x10], 0
and dword [ecx + 0x14], 0
call fcn.0040b155
lea ecx, [ebp - 0x2c]
call fcn.00435a2c
add esp, 0x18
push eax
mov ecx, edi
mov byte [ebp - 4], 3
call fcn.0040b9f4
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0
call fcn.00404812
push edi
call fcn.0040bde3
cmp dword [ebx + 0x14], 8
mov esi, eax
mov ecx, ebx
jb 0x4c2012
mov ecx, dword [ebx]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
setne bl
test esi, esi
jne 0x4c2093
test bl, bl
je 0x4c2093
push dword [ebp - 0x8c]
and dword [ebp - 0x1c], esi
lea ecx, [ebp - 0x2c]
and dword [ebp - 0x18], esi
call fcn.0040b155
cmp byte [ebp + 0x10], 0
mov byte [ebp - 4], 4
je 0x4c208b
lea edx, [ebp - 0x2c]
lea ecx, [ebp - 0x44]
call fcn.004257c4
lea eax, [ebp - 0x44]
mov byte [ebp - 4], 5
push eax
mov edx, eax
mov ecx, str.0aa4efce
call fcn.00416a1a
cmp dword [ebp - 0x30], 0x10
lea edx, [ebp - 0x44]
pop ecx
cmovae edx, dword [ebp - 0x44]
lea ecx, [ebp - 0x2c]
cmp dword [ebp - 0x18], 8
push dword [ebp - 0x34]
cmovae ecx, dword [ebp - 0x2c]
call fcn.0041e514
pop ecx
lea ecx, [ebp - 0x44]
call fcn.00404812
lea ecx, [ebp - 0x2c]
call fcn.0040b67e
lea ecx, [ebp - 0x84]
call fcn.0040ba62
mov al, bl
call fcn.0059bb81
ret 0xc
Function at 0x4c370d
Capabilities:
Check if file exists
Create directory

Disassembly:
push 0x22c
mov eax, 0x5f350b
call fcn.0059bbd7
mov edi, ecx
mov dword [ebp - 0x238], edi
xor esi, esi
mov dword [ebp - 0x238], edi
xor eax, eax
mov dword [ebp - 0x224], esi
mov dword [ebp - 0x220], 7
mov word [ebp - 0x234], ax
lea eax, [ebp - 0x234]
mov dword [ebp - 4], esi
push eax
push str.InstallPath
mov edx, str.Software360360huabao
mov ecx, reloc.WS2_32.dll_accept
call fcn.004261ea
pop ecx
pop ecx
cmp dword [ebp - 0x224], esi
je 0x4c37ff
cmp dword [ebp - 0x220], 8
lea eax, [ebp - 0x234]
cmovae eax, dword [ebp - 0x234]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4c37ff
push 0x208
lea eax, [ebp - 0x21c]
push esi
push eax
call fcn.005b24a0
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x234]
add esp, 0xc
cmp dword [ebp - 0x220], 8
cmovae eax, dword [ebp - 0x234]
push eax
lea eax, [ebp - 0x21c]
push eax
call esi
push str.user_data_
lea eax, [ebp - 0x21c]
push eax
call esi
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4c37f6
push eax
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [ebp - 0x21c]
push eax
jmp 0x4c3804
push 0x6335fc
mov ecx, edi
call fcn.0040b0d5
lea ecx, [ebp - 0x234]
call fcn.0040b67e
mov eax, edi
call fcn.0059bb81
ret