joyce8/EMBER2024-capa huggingface dataset:
Function at 0x457300
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x5159c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x228], ecx
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 8]
call fcn.00413a00
lea ecx, [ebp - 8]
push ecx
push 0x4fe310
lea edx, [ebp - 0x21c]
push edx
call fcn.00413ac0
add esp, 0xc
push eax
lea ecx, [ebp - 8]
call fcn.004121a0
lea ecx, [ebp - 0x21c]
call fcn.00413a40
push 0x4fe314
lea ecx, [ebp - 8]
call fcn.0041fe40
push 0x4fe320
lea ecx, [ebp - 8]
call fcn.0041fe40
lea ecx, [ebp - 8]
call fcn.00412240
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0xc]
call fcn.00413a00
lea ecx, [ebp - 0xc]
call fcn.00412240
xor ecx, ecx
mov word [ebp - 0x218], cx
push 0x206
push 0
lea edx, [ebp - 0x216]
push edx
call fcn.004c62e0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea ecx, [ebp - 0x218]
push ecx
lea ecx, [ebp - 4]
call fcn.00413a00
lea ecx, [ebp - 4]
call fcn.00412240
push 0
lea ecx, [ebp - 4]
call fcn.00413b20
push eax
lea ecx, [ebp - 0xc]
call fcn.004121c0
cmp eax, 0xffffffff
je 0x457434
push 0
lea ecx, [ebp - 8]
call fcn.00413b20
push eax
mov ecx, dword [ebp - 0x228]
add ecx, 0x124
call fcn.004121c0
cmp eax, 0xffffffff
je 0x457434
mov dword [ebp - 0x220], 1
lea ecx, [ebp - 4]
call fcn.00413a40
lea ecx, [ebp - 0xc]
call fcn.00413a40
lea ecx, [ebp - 8]
call fcn.00413a40
mov eax, dword [ebp - 0x220]
jmp 0x457476
mov dword [ebp - 0x224], 0
lea ecx, [ebp - 4]
call fcn.00413a40
lea ecx, [ebp - 0xc]
call fcn.00413a40
lea ecx, [ebp - 8]
call fcn.00413a40
mov eax, dword [ebp - 0x224]
jmp 0x457476
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c62c9
mov esp, ebp
pop ebp
ret 8

Function at 0x457780
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
push ecx
mov ecx, esp
lea eax, [ebp + 8]
push eax
call fcn.004139e0
lea ecx, [ebp - 4]
push ecx
mov ecx, dword [ebp - 0x18]
call fcn.00457800
lea edx, [ebp - 8]
push edx
call fcn.0043bb30
add esp, 4
lea ecx, [ebp - 8]
call fcn.00413b20
push eax
push 0
push 0x4fe354
lea ecx, [ebp - 4]
call fcn.00413b20
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 0xc], eax
xor eax, eax
cmp dword [ebp - 0xc], 1
sete al
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 8]
call fcn.00413a40
lea ecx, [ebp - 4]
call fcn.00413a40
lea ecx, [ebp + 8]
call fcn.00413a40
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret 4

Function at 0x4579e0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
lea eax, [ebp - 8]
push eax
call fcn.0043bb30
add esp, 4
lea ecx, [ebp - 8]
call fcn.00413b20
push eax
push 0
push 0x4fe384
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 4], eax
xor edx, edx
cmp dword [ebp - 4], 1
sete dl
mov dword [ebp - 0xc], edx
lea ecx, [ebp - 8]
call fcn.00413a40
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x459950
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x5159c4]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x220], ecx
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4fe538
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x459a82
xor ecx, ecx
mov word [ebp - 0x210], cx
push 0x206
push 0
lea edx, [ebp - 0x20e]
push edx
call fcn.004c62e0
add esp, 0xc
mov dword [ebp - 0x218], 0x208
mov dword [ebp - 0x214], 1
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 0x214]
push edx
push 0
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x459a82
push 0x4fe560
lea ecx, [ebp - 0x210]
push ecx
call fcn.004120f0
add esp, 8
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0
je 0x459a6c
xor edx, edx
mov eax, dword [ebp - 0x21c]
mov word [eax + 2], dx
push 0x5c
lea ecx, [ebp - 0x210]
push ecx
call fcn.0040d270
add esp, 8
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0
je 0x459a41
xor edx, edx
mov eax, dword [ebp - 0x21c]
mov word [eax], dx
push 0x5c
lea ecx, [ebp - 0x210]
push ecx
call fcn.0040d270
add esp, 8
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0
je 0x459a6c
xor edx, edx
mov eax, dword [ebp - 0x21c]
mov word [eax], dx
lea ecx, [ebp - 0x210]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00413a60
mov eax, 1
jmp 0x459a84
xor eax, eax
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004c62c9
mov esp, ebp
pop ebp
ret 4

Function at 0x459aa0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x5159c4]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x220], ecx
lea eax, [ebp - 4]
push eax
push 1
push 0
push str.Softwareduowanyy
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x459b77
xor ecx, ecx
mov word [ebp - 0x210], cx
push 0x206
push 0
lea edx, [ebp - 0x20e]
push edx
call fcn.004c62e0
add esp, 0xc
mov dword [ebp - 0x218], 0x208
mov dword [ebp - 0x214], 1
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 0x214]
push edx
push 0
push str.RootPath
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x459b77
push 0x5c
lea ecx, [ebp - 0x210]
push ecx
call fcn.0040d270
add esp, 8
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0
je 0x459b61
xor edx, edx
mov eax, dword [ebp - 0x21c]
mov word [eax], dx
lea ecx, [ebp - 0x210]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00413a60
mov eax, 1
jmp 0x459b79
xor eax, eax
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004c62c9
mov esp, ebp
pop ebp
ret 4
Function at 0x4607c0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x26c
mov eax, dword [0x5159c4]
xor eax, ebp
mov dword [ebp - 0xc], eax
lea ecx, [ebp - 4]
call fcn.004139c0
lea eax, [ebp - 8]
push eax
call fcn.004619e0
add esp, 4
cmp dword [ebp + 0xc], 1
je 0x4607f3
cmp dword [ebp + 0xc], 4
jne 0x46080e
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
push edx
push str._s_s_.bmp
lea eax, [ebp - 4]
push eax
call fcn.00415220
add esp, 0x10
jmp 0x460848
cmp dword [ebp + 0xc], 2
jne 0x46082f
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
push edx
push 0x4fe5f4
lea eax, [ebp - 4]
push eax
call fcn.00415220
add esp, 0x10
jmp 0x460848
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
push edx
push str._s_s_
lea eax, [ebp - 4]
push eax
call fcn.00415220
add esp, 0x10
push 0x250
push 0
lea ecx, [ebp - 0x260]
push ecx
call fcn.004c62e0
add esp, 0xc
lea edx, [ebp - 0x260]
push edx
lea ecx, [ebp - 4]
call fcn.00413b20
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x264], eax
cmp dword [ebp - 0x264], 0xffffffff
jne 0x4608a5
mov byte [ebp - 0x269], 0
lea ecx, [ebp - 8]
call fcn.00413a40
lea ecx, [ebp - 4]
call fcn.00413a40
mov al, byte [ebp - 0x269]
jmp 0x4609a3
cmp dword [ebp + 0xc], 1
jne 0x460979
mov eax, 1
test eax, eax
je 0x460979
push 0x4fe63c
lea ecx, [ebp - 0x234]
push ecx
call fcn.004120f0
add esp, 8
test eax, eax
jne 0x4608ec
push 0x4fe648
lea edx, [ebp - 0x234]
push edx
call fcn.004120f0
add esp, 8
test eax, eax
je 0x460948
lea eax, [ebp - 0x260]
push eax
mov ecx, dword [ebp - 0x264]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov dword [ebp - 0x268], eax
cmp dword [ebp - 0x268], 0
je 0x46091a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x460946
mov edx, dword [ebp - 0x264]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov byte [ebp - 0x26a], 0
lea ecx, [ebp - 8]
call fcn.00413a40
lea ecx, [ebp - 4]
call fcn.00413a40
mov al, byte [ebp - 0x26a]
jmp 0x4609a3
jmp 0x460974
mov eax, dword [ebp - 0x264]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov byte [ebp - 0x26b], 1
lea ecx, [ebp - 8]
call fcn.00413a40
lea ecx, [ebp - 4]
call fcn.00413a40
mov al, byte [ebp - 0x26b]
jmp 0x4609a3
jmp 0x4608af
mov ecx, dword [ebp - 0x264]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov byte [ebp - 0x26c], 1
lea ecx, [ebp - 8]
call fcn.00413a40
lea ecx, [ebp - 4]
call fcn.00413a40
mov al, byte [ebp - 0x26c]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004c62c9
mov esp, ebp
pop ebp
ret
Function at 0x461490
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x5159c4]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x218], ecx
push 0x4fe780
lea ecx, [ebp - 4]
call fcn.00413a00
mov eax, dword [ebp - 0x218]
cmp dword [eax + 0xec], 1
je 0x4614d4
mov ecx, dword [ebp - 0x218]
cmp dword [ecx + 0xec], 2
jne 0x4614e8
mov edx, dword [ebp - 0x218]
add edx, 0x64
push edx
lea ecx, [ebp - 4]
call fcn.004121a0
jmp 0x4614fc
mov eax, dword [ebp - 0x218]
add eax, 0xd8
push eax
lea ecx, [ebp - 4]
call fcn.004121a0
lea ecx, [ebp - 4]
call fcn.00413b20
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x46156b
xor ecx, ecx
mov word [ebp - 0x210], cx
push 0x206
push 0
lea edx, [ebp - 0x20e]
push edx
call fcn.004c62e0
add esp, 0xc
mov eax, dword [ebp - 4]
push eax
push str._select____s_
push 0x104
lea ecx, [ebp - 0x210]
push ecx
call fcn.00422bc0
add esp, 0x10
push 5
push 0x4fe7a0
lea edx, [ebp - 0x210]
push edx
push str.Explorer.exe
push 0x4fe7c0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 0x214], 0
lea ecx, [ebp - 4]
call fcn.00413a40
mov eax, dword [ebp - 0x214]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004c62c9
mov esp, ebp
pop ebp
ret 0x10
Function at 0x46d1c0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x5159c4]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x8c], ecx
push 1
mov eax, dword [ebp - 0x8c]
mov ecx, dword [eax + 0x140]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x46d1fc
xor eax, eax
jmp 0x46d342
mov edx, dword [ebp - 0x8c]
mov dword [edx + 0x188], 2
mov ecx, dword [ebp - 0x8c]
call fcn.0046d740
mov ecx, dword [ebp - 0x8c]
call fcn.0046b8c0
mov ecx, dword [ebp - 0x8c]
call fcn.0046b5c0
mov ecx, dword [ebp - 0x8c]
call fcn.004710e0
mov ecx, dword [ebp - 0x8c]
call fcn.00471110
mov ecx, dword [ebp - 0x8c]
call fcn.00472090
mov eax, dword [ebp - 0x8c]
cmp dword [eax + 0x188], 2
jne 0x46d340
mov ecx, dword [ebp - 0x8c]
cmp dword [ecx + 0x1064], 0
je 0x46d340
mov edx, dword [ebp - 0x8c]
cmp dword [edx + 0x1060], 0
jne 0x46d340
lea eax, [ebp - 0x84]
push eax
call fcn.00410200
add esp, 4
mov ecx, eax
call fcn.00413b20
push eax
push 0
push 0x4ff2e8
push 0x4ff2f0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x84]
call fcn.00413a40
cmp dword [ebp - 4], 0
jne 0x46d340
lea ecx, [ebp - 0x88]
push ecx
call fcn.00410200
add esp, 4
mov ecx, eax
call fcn.00413b20
push eax
push 0x4ff304
push 0x4ff308
push 0x4ff310
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea ecx, [ebp - 0x88]
call fcn.00413a40
lea ecx, [ebp - 0x80]
call fcn.00442180
push 0
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea ecx, [ebp - 0x54]
call fcn.004740b0
cmp eax, 0x5c43
jne 0x46d338
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
movzx ecx, word [ebp + 0xc]
push ecx
movzx edx, word [ebp + 8]
push edx
mov ecx, dword [ebp - 0x8c]
call fcn.00471f60
lea ecx, [ebp - 0x80]
call fcn.004421e0
xor eax, eax
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004c62c9
mov esp, ebp
pop ebp
ret 0x10
Function at 0x46dbe0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x1c0], 0
jne 0x46dc0c
mov ecx, dword [ebp - 0x10]
add ecx, 0x18c
call fcn.00424be0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x1c0], eax
mov edx, dword [ebp - 0x10]
cmp dword [edx + 0x1fc], 0
je 0x46dcb8
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x1fc], 0
lea ecx, [ebp - 0xc]
push ecx
call fcn.00410200
add esp, 4
mov ecx, eax
call fcn.00413b20
push eax
push 0
push 0x4ff5ac
push 0x4ff5b4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 4], eax
lea ecx, [ebp - 0xc]
call fcn.00413a40
cmp dword [ebp - 4], 0
jne 0x46dcb3
mov edx, dword [ebp - 0x10]
cmp dword [edx + 0x1c0], 0
je 0x46dc93
mov ecx, dword [ebp - 0x10]
add ecx, 0x18c
call fcn.004250b0
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x46dc93
push 2
mov ecx, dword [ebp - 0x10]
add ecx, 0x18c
call fcn.00424e60
push 1
mov ecx, dword [ebp - 0x10]
add ecx, 0x2f4
call fcn.004240c0
push 1
mov ecx, dword [ebp - 0x10]
add ecx, 0x2f8
call fcn.00423950
jmp 0x46dd9c
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x1c0], 0
je 0x46dd18
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x188]
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], 0
je 0x46dce4
cmp dword [ebp - 0x14], 1
je 0x46dcf6
cmp dword [ebp - 0x14], 2
je 0x46dd08
jmp 0x46dd18
push 1
mov ecx, dword [ebp - 0x10]
add ecx, 0x18c
call fcn.00424e60
jmp 0x46dd18
push 2
mov ecx, dword [ebp - 0x10]
add ecx, 0x18c
call fcn.00424e60
jmp 0x46dd18
push 3
mov ecx, dword [ebp - 0x10]
add ecx, 0x18c
call fcn.00424e60
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x188]
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], 0
je 0x46dd38
cmp dword [ebp - 0x18], 1
je 0x46dd5a
cmp dword [ebp - 0x18], 2
je 0x46dd7c
jmp 0x46dd9c
push 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x2f4
call fcn.004240c0
push 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x2f8
call fcn.00423950
jmp 0x46dd9c
push 1
mov ecx, dword [ebp - 0x10]
add ecx, 0x2f4
call fcn.004240c0
push 1
mov ecx, dword [ebp - 0x10]
add ecx, 0x2f8
call fcn.00423950
jmp 0x46dd9c
push 2
mov ecx, dword [ebp - 0x10]
add ecx, 0x2f4
call fcn.004240c0
push 2
mov ecx, dword [ebp - 0x10]
add ecx, 0x2f8
call fcn.00423950
mov esp, ebp
pop ebp
ret
Function at 0x46e0e0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov dword [ebp - 0x34], ecx
push str.feedback.exe
push 0
lea eax, [ebp - 8]
push eax
call fcn.0040d0e0
add esp, 8
push eax
lea ecx, [ebp - 4]
push ecx
call fcn.004123a0
add esp, 0xc
lea ecx, [ebp - 8]
call fcn.00413a40
lea ecx, [ebp - 4]
call fcn.00413b20
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x46e1b8
lea ecx, [ebp - 4]
call fcn.00413b20
push eax
call fcn.0044da10
add esp, 4
test eax, eax
je 0x46e1b8
push 0
push 0
lea edx, [ebp - 0xc]
push edx
call fcn.0040d0e0
add esp, 8
mov ecx, eax
call fcn.00413b20
push eax
push ecx
mov ecx, esp
push 0x4ff5e4
call fcn.00436630
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x34]
add ecx, 0x5c
call fcn.00433d30
mov ecx, eax
call fcn.00436db0
mov ecx, eax
call fcn.00440bd0
push eax
lea ecx, [ebp - 4]
call fcn.00413b20
push eax
call fcn.00428690
add esp, 0x10
lea ecx, [ebp - 0x14]
call fcn.00436690
lea ecx, [ebp - 0xc]
call fcn.00413a40
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 4]
call fcn.00413a40
mov eax, dword [ebp - 0x18]
jmp 0x46e29d
push 0x4ff608
lea ecx, [ebp - 0x1c]
push ecx
call fcn.0040d000
add esp, 8
push eax
lea ecx, [ebp - 4]
call fcn.004121a0
lea ecx, [ebp - 0x1c]
call fcn.00413a40
lea ecx, [ebp - 4]
call fcn.00413b20
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x46e27e
lea ecx, [ebp - 4]
call fcn.00413b20
push eax
call fcn.0044da10
add esp, 4
test eax, eax
je 0x46e27e
push 0
push 0
lea edx, [ebp - 0x20]
push edx
call fcn.0040d0e0
add esp, 8
mov ecx, eax
call fcn.00413b20
push eax
push ecx
mov ecx, esp
push str.IDS_FEEDBACK_TILE
call fcn.00436630
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x34]
add ecx, 0x5c
call fcn.00433d30
mov ecx, eax
call fcn.00436db0
mov ecx, eax
call fcn.00440bd0
push eax
lea ecx, [ebp - 4]
call fcn.00413b20
push eax
call fcn.00428690
add esp, 0x10
lea ecx, [ebp - 0x28]
call fcn.00436690
lea ecx, [ebp - 0x20]
call fcn.00413a40
mov dword [ebp - 0x2c], 0
lea ecx, [ebp - 4]
call fcn.00413a40
mov eax, dword [ebp - 0x2c]
jmp 0x46e29d
push str.http:__bbs.360safe.com_forum.php
call fcn.00427510
add esp, 4
mov dword [ebp - 0x30], 0
lea ecx, [ebp - 4]
call fcn.00413a40
mov eax, dword [ebp - 0x30]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x46fe50
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
mov eax, dword [0x5159c4]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x13c], ecx
lea ecx, [ebp - 0x128]
call fcn.00449ed0
lea ecx, [ebp - 0x130]
call fcn.004139c0
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0
jne 0x46feb7
lea ecx, [ebp - 0x130]
call fcn.00413a40
lea ecx, [ebp - 0x128]
call fcn.0044a090
jmp 0x46ffe5
cmp dword [ebp - 4], 2
jl 0x46ffc2
mov edx, dword [ebp - 0x12c]
mov eax, dword [edx]
push eax
lea ecx, [ebp - 0x130]
call fcn.00413a60
push str._ShowSetting
lea ecx, [ebp - 0x130]
push ecx
call fcn.00459f40
add esp, 8
movzx edx, al
test edx, edx
je 0x46ffc2
mov eax, dword [ebp - 0x12c]
mov ecx, dword [eax + 4]
push ecx
lea ecx, [ebp - 0x130]
call fcn.00413a60
push 0x4ff870
lea edx, [ebp - 0x130]
push edx
call fcn.00459f40
add esp, 8
movzx eax, al
test eax, eax
je 0x46ff91
lea ecx, [ebp - 0x128]
call fcn.0044aee0
push ecx
mov ecx, esp
mov edx, dword [ebp - 0x12c]
mov eax, dword [edx + 8]
push eax
call fcn.00413a00
lea ecx, [ebp - 0x128]
call fcn.0044b1b0
push ecx
mov ecx, esp
mov edx, dword [ebp - 0x12c]
mov eax, dword [edx + 0xc]
push eax
call fcn.00413a00
lea ecx, [ebp - 0x128]
call fcn.0044b1e0
mov ecx, dword [ebp - 0x13c]
push ecx
lea ecx, [ebp - 0x128]
call fcn.0044b210
push 0
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea ecx, [ebp - 0xfc]
call fcn.00473bb0
jmp 0x46ffc2
lea ecx, [ebp - 0x128]
call fcn.0044af00
mov edx, dword [ebp - 0x13c]
push edx
lea ecx, [ebp - 0x128]
call fcn.0044b210
push 0
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea ecx, [ebp - 0xfc]
call fcn.00473bb0
mov eax, dword [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea ecx, [ebp - 0x130]
call fcn.00413a40
lea ecx, [ebp - 0x128]
call fcn.0044a090
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004c62c9
mov esp, ebp
pop ebp
ret 8
Function at 0x4700f0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov dword [ebp - 0x68], ecx
push 0x4ff874
push 0
lea eax, [ebp - 0x38]
push eax
call fcn.0040d0e0
add esp, 8
push eax
lea ecx, [ebp - 4]
push ecx
call fcn.004123a0
add esp, 0xc
lea ecx, [ebp - 0x38]
call fcn.00413a40
push str.Utils360Feedback.exe
lea edx, [ebp - 8]
push edx
call fcn.0040d000
add esp, 8
lea ecx, [ebp - 4]
call fcn.00413b20
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x470158
lea ecx, [ebp - 8]
call fcn.00413b20
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x47015d
jmp 0x4702db
mov ecx, dword [ebp - 0x68]
add ecx, 0x58
call fcn.00434510
movzx eax, al
test eax, eax
je 0x4702db
push 1
push 0x5960
lea ecx, [ebp - 0x3c]
push ecx
mov ecx, dword [ebp - 0x68]
add ecx, 0x58
call fcn.004344e0
mov ecx, eax
call fcn.00436a70
push eax
lea ecx, [ebp - 0xc]
call fcn.00435420
lea ecx, [ebp - 0x3c]
call fcn.004373f0
lea ecx, [ebp - 0xc]
call fcn.00434650
movzx edx, al
test edx, edx
je 0x4701c6
push 0x10000000
push 0
lea ecx, [ebp - 0xc]
call fcn.00434620
mov ecx, eax
call fcn.004369d0
push 1
push 0x5b5e
lea eax, [ebp - 0x40]
push eax
mov ecx, dword [ebp - 0x68]
add ecx, 0x58
call fcn.004344e0
mov ecx, eax
call fcn.00436a70
push eax
lea ecx, [ebp - 0x10]
call fcn.00435420
lea ecx, [ebp - 0x40]
call fcn.004373f0
lea ecx, [ebp - 0x10]
call fcn.00434650
movzx ecx, al
test ecx, ecx
je 0x4702cb
lea ecx, [ebp - 0xc]
call fcn.00434650
movzx edx, al
test edx, edx
je 0x4702cb
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0xc]
call fcn.00434620
mov ecx, eax
call fcn.00436920
push eax
lea ecx, [ebp - 0x34]
call fcn.00436610
lea ecx, [ebp - 0x60]
push ecx
lea ecx, [ebp - 0x10]
call fcn.00434620
mov ecx, eax
call fcn.00436920
push eax
lea ecx, [ebp - 0x20]
call fcn.00436610
push 1
push 0x5c69
lea edx, [ebp - 0x64]
push edx
mov ecx, dword [ebp - 0x68]
add ecx, 0x58
call fcn.004344e0
mov ecx, eax
call fcn.00436a70
push eax
lea ecx, [ebp - 0x24]
call fcn.00435420
lea ecx, [ebp - 0x64]
call fcn.004373f0
lea ecx, [ebp - 0x24]
call fcn.00434650
movzx eax, al
test eax, eax
je 0x4702a9
push 1
lea ecx, [ebp - 0x20]
call fcn.0043f3f0
push eax
lea ecx, [ebp - 0x24]
call fcn.00434620
mov ecx, eax
call fcn.00436980
push 1
lea ecx, [ebp - 0x34]
call fcn.0043f3f0
push eax
lea ecx, [ebp - 0x10]
call fcn.00434620
mov ecx, eax
call fcn.00436980
lea ecx, [ebp - 0x24]
call fcn.00434600
lea ecx, [ebp - 0x10]
call fcn.00434600
lea ecx, [ebp - 0xc]
call fcn.00434600
lea ecx, [ebp - 8]
call fcn.00413a40
lea ecx, [ebp - 4]
call fcn.00413a40
mov esp, ebp
pop ebp
ret
Function at 0x470e00
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0xc]
call fcn.004139c0
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x470e32
lea ecx, [ebp - 0xc]
call fcn.00413a40
jmp 0x470e8c
cmp dword [ebp - 4], 3
jne 0x470e84
mov edx, dword [ebp - 8]
mov eax, dword [edx]
push eax
lea ecx, [ebp - 0xc]
call fcn.00413a60
push str._ShowDetail
lea ecx, [ebp - 0xc]
call fcn.00421960
test eax, eax
jne 0x470e6c
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 4]
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0x41c
call fcn.00413a60
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 8]
push ecx
call fcn.004c662a
add esp, 4
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x420], eax
lea ecx, [ebp - 0xc]
call fcn.00413a40
mov esp, ebp
pop ebp
ret 4

Function at 0x472330
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
mov eax, dword [0x5159c4]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0xa8], ecx
lea eax, [ebp - 0x9c]
push eax
call fcn.00410200
add esp, 4
mov ecx, eax
call fcn.00413b20
push eax
push 0
push str.Start
push 0x4ffad8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x9c]
call fcn.00413a40
cmp dword [ebp - 4], 0
jne 0x472401
lea ecx, [ebp - 0x98]
call fcn.00441090
push 0
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea ecx, [ebp - 0x6c]
call fcn.00474140
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x5c56
jne 0x4723e5
lea ecx, [ebp - 0xa0]
push ecx
call fcn.00410200
add esp, 4
mov ecx, eax
call fcn.00413b20
push eax
push 0x4ffaec
push 0x4ffaf0
push 0x4ffafc
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea ecx, [ebp - 0xa0]
call fcn.00413a40
mov edx, dword [ebp - 8]
mov dword [ebp - 0xa4], edx
lea ecx, [ebp - 0x98]
call fcn.00441130
mov eax, dword [ebp - 0xa4]
jmp 0x472404
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004c62c9
mov esp, ebp
pop ebp
ret