joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b225f
Capabilities:
Check if file exists
Create directory

Disassembly:
push 0x88
mov eax, 0x5e96b7
call fcn.00593b07
mov ebx, ecx
mov edi, dword [ebp + 8]
push 0x2fd
push str.P2PDownLoad::AddDownTaskAsync
push str.__s__d___AddDownTaskAsync_start_to_run
mov dword [ebp - 0x90], edi
call fcn.0040a649
add esp, 0xc
cmp dword [ebx + 0xc], 0
je 0x4b2434
test edi, edi
je 0x4b2434
mov edx, dword [edi + 0x8c]
lea ecx, [ebp - 0x5c]
call fcn.00429b84
and dword [ebp - 4], 0
mov esi, str..zip
push esi
call fcn.005ae8e0
pop ecx
push eax
push esi
lea ecx, [ebp - 0x5c]
call fcn.004043c3
lea ecx, [ebp - 0x2c]
call fcn.004251b3
mov esi, str.360browserdownload
mov byte [ebp - 4], 1
push esi
call fcn.005baec0
pop ecx
push eax
push esi
lea ecx, [ebp - 0x2c]
call fcn.0040b220
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4b2316
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
push 0
cmovae eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
sub esp, 0x18
lea eax, [ebp - 0x5c]
mov ecx, esp
push eax
and dword [ecx + 0x10], 0
and dword [ecx + 0x14], 0
call fcn.00404267
lea ecx, [ebp - 0x8c]
call fcn.004b18c2
mov esi, eax
push 0x62aa1c
lea edx, [ebp - 0x2c]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x74]
call fcn.0041154e
add esp, 0x1c
push esi
mov edx, eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x44]
call fcn.00420b1c
pop ecx
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040b0ac
lea ecx, [ebp - 0x44]
call fcn.0040b67e
lea ecx, [ebp - 0x74]
call fcn.0040b67e
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 1
call fcn.0040b67e
lea eax, [ebp - 0x2c]
push eax
lea ecx, [edi + 0x64]
call fcn.00413220
push str.https:__dd.browser.360.cn_static_a_1298.4281.gif
lea ecx, [ebp - 0x44]
call fcn.0040b0d5
push 1
push 1
xor dl, dl
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x44]
call fcn.004c6673
pop ecx
pop ecx
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 1
call fcn.0040b67e
cmp dword [ebp - 0x18], 8
lea ecx, [ebp - 0x2c]
lea eax, [edi + 4]
cmovae ecx, dword [ebp - 0x2c]
cmp dword [eax + 0x14], 8
jb 0x4b23d7
mov eax, dword [eax]
sub esp, 0x18
push ecx
mov ecx, dword [ebx + 0xc]
push eax
call fcn.004b0ecb
mov dword [edi + 0x7c], eax
test eax, eax
jne 0x4b2404
mov ecx, edi
mov byte [ebx + 8], al
call fcn.004b0f4e
push 0x90
push edi
call fcn.005926e9
pop ecx
pop ecx
jmp 0x4b2424
lea ecx, [ebx + 0x10]
mov eax, dword [ecx + 4]
cmp dword [ecx + 8], eax
je 0x4b2417
mov dword [eax], edi
add dword [ecx + 4], 4
jmp 0x4b2424
lea edx, [ebp - 0x90]
push edx
push eax
call fcn.0040de03
lea ecx, [ebp - 0x2c]
call fcn.0040b67e
lea ecx, [ebp - 0x5c]
call fcn.00404812
call fcn.00593ab1
ret 4
Function at 0x4b2907
Capabilities:
Create thread

Disassembly:
push 0x20
mov eax, 0x5d963b
call fcn.00593b07
mov esi, ecx
lea ecx, [ebp - 0x28]
call fcn.004251b3
mov edi, str.360browser_bkinfop2pconfig
xor ebx, ebx
push edi
mov dword [ebp - 4], ebx
call fcn.005baec0
pop ecx
push eax
push edi
lea ecx, [ebp - 0x28]
call fcn.0040b220
lea eax, [ebp - 0x28]
push eax
lea ecx, [esi + 0xc]
call fcn.00413220
lea ecx, [esi + 4]
call fcn.004b33d6
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x40], eax
test eax, eax
jne 0x4b296e
push 0xba
push str.P2pDownloadMgr::Init
push str.__s__d___create_event_failed
jmp 0x4b299c
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], ebx
push eax
push ebx
push esi
push 0x4b28b4
push ebx
push ebx
call fcn.005bb02f
add esp, 0x18
mov dword [esi + 0x44], eax
test eax, eax
jne 0x4b29a6
push 0xc1
push str.P2pDownloadMgr::Init
push str.__s__d___create_thread_failed
call fcn.0040a649
add esp, 0xc
jmp 0x4b29d3
push 0xc4
push str.P2pDownloadMgr::Init
push str.__s__d___P2PDownload::Init
call fcn.0040a649
add esp, 0xc
push esi
call fcn.004b243c
mov ecx, eax
call fcn.004b194b
mov ecx, esi
call fcn.004b2bbe
mov bl, 1
lea ecx, [ebp - 0x28]
call fcn.0040b67e
mov al, bl
call fcn.00593ab1
ret
Function at 0x4b34d8
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xa5c
mov eax, dword [0x6c75ac]
xor eax, esp
mov dword [esp + 0xa58], eax
push ebx
push esi
mov esi, edx
push edi
test ecx, ecx
je 0x4b36fd
xor eax, eax
cmp ax, word [ecx]
je 0x4b36fd
test esi, esi
je 0x4b36fd
cmp ax, word [esi]
je 0x4b36fd
push eax
push ecx
call fcn.00435c6b
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x4b36fd
push 0x410
lea eax, [esp + 0x654]
push 0
push eax
call fcn.005aa3d0
add esp, 0xc
lea eax, [esp + 0x650]
mov ebx, 0x207
push esi
push 0x62b200
push ebx
push eax
call fcn.00412a08
lea eax, [esp + 0x660]
push eax
call fcn.005baec0
add esp, 0x14
test eax, eax
je 0x4b36fd
lea eax, [esp + 0x650]
push eax
call fcn.005baec0
pop ecx
cmp word [esp + eax*2 + 0x64e], 0x5c
je 0x4b35a5
push ebx
lea eax, [esp + 0x654]
push 0x62aa1c
push eax
call fcn.005c14d8
add esp, 0xc
lea ecx, [esp + 0x650]
call fcn.0041e4f4
test eax, eax
je 0x4b36fd
lea eax, [esp + 0x10]
or edx, 0xffffffff
push eax
mov ecx, edi
call fcn.00435c9a
mov ebx, dword [esp + 0x14]
xor esi, esi
pop ecx
test ebx, ebx
jle 0x4b36f1
lea eax, [esp + 0x10]
mov edx, esi
push eax
mov ecx, edi
call fcn.00435c9a
pop ecx
test eax, eax
jne 0x4b36e8
push 0x410
push eax
lea eax, [esp + 0x248]
push eax
call fcn.005aa3d0
add esp, 0xc
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x654]
push eax
push 0x62cd08
lea eax, [esp + 0x24c]
push 0x207
push eax
call fcn.00412a08
add esp, 0x14
lea eax, [esp + 0x14]
push 0x62d034
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
jne 0x4b36e8
test byte [esp + 0x21c], 0x10
je 0x4b365e
lea ecx, [esp + 0x240]
call fcn.0041e4f4
jmp 0x4b36e8
lea eax, [esp + 0x240]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [esp + 0x240]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4b36a3
lea eax, [esp + 0x240]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4b36a3
and eax, 0xfffffffe
push eax
lea eax, [esp + 0x244]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [esp + 0x240]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [esp + 0x240]
mov edx, esi
push eax
mov ecx, edi
call fcn.00435d44
pop ecx
lea eax, [esp + 0x240]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4b36e8
and eax, 0xfffffffe
push eax
lea eax, [esp + 0x244]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
inc esi
cmp esi, ebx
jl 0x4b35d7
push edi
call fcn.00435d75
xor eax, eax
pop ecx
inc eax
jmp 0x4b36ff
xor eax, eax
mov ecx, dword [esp + 0xa64]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.005926d8
mov esp, ebp
pop ebp
ret
Function at 0x4b3714
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xa5c
mov eax, dword [0x6c75ac]
xor eax, esp
mov dword [esp + 0xa58], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
test ecx, ecx
je 0x4b393b
test edx, edx
je 0x4b393b
test esi, esi
je 0x4b393b
xor eax, eax
cmp ax, word [esi]
je 0x4b393b
push eax
push edx
push ecx
call fcn.00435c81
mov edi, eax
add esp, 0xc
test edi, edi
je 0x4b393b
push 0x410
lea eax, [esp + 0x654]
push 0
push eax
call fcn.005aa3d0
add esp, 0xc
lea eax, [esp + 0x650]
mov ebx, 0x207
push esi
push 0x62b200
push ebx
push eax
call fcn.00412a08
lea eax, [esp + 0x660]
push eax
call fcn.005baec0
add esp, 0x14
test eax, eax
je 0x4b393b
lea eax, [esp + 0x650]
push eax
call fcn.005baec0
pop ecx
cmp word [esp + eax*2 + 0x64e], 0x5c
je 0x4b37e3
push ebx
lea eax, [esp + 0x654]
push 0x62aa1c
push eax
call fcn.005c14d8
add esp, 0xc
lea ecx, [esp + 0x650]
call fcn.0041e4f4
test eax, eax
je 0x4b393b
lea eax, [esp + 0x10]
or edx, 0xffffffff
push eax
mov ecx, edi
call fcn.00435c9a
mov ebx, dword [esp + 0x14]
xor esi, esi
pop ecx
test ebx, ebx
jle 0x4b392f
lea eax, [esp + 0x10]
mov edx, esi
push eax
mov ecx, edi
call fcn.00435c9a
pop ecx
test eax, eax
jne 0x4b3926
push 0x410
push eax
lea eax, [esp + 0x248]
push eax
call fcn.005aa3d0
add esp, 0xc
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x654]
push eax
push 0x62cd08
lea eax, [esp + 0x24c]
push 0x207
push eax
call fcn.00412a08
add esp, 0x14
lea eax, [esp + 0x14]
push 0x62d034
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
jne 0x4b3926
test byte [esp + 0x21c], 0x10
je 0x4b389c
lea ecx, [esp + 0x240]
call fcn.0041e4f4
jmp 0x4b3926
lea eax, [esp + 0x240]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [esp + 0x240]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4b38e1
lea eax, [esp + 0x240]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4b38e1
and eax, 0xfffffffe
push eax
lea eax, [esp + 0x244]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [esp + 0x240]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [esp + 0x240]
mov edx, esi
push eax
mov ecx, edi
call fcn.00435d44
pop ecx
lea eax, [esp + 0x240]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4b3926
and eax, 0xfffffffe
push eax
lea eax, [esp + 0x244]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
inc esi
cmp esi, ebx
jl 0x4b3815
push edi
call fcn.00435d75
xor eax, eax
pop ecx
inc eax
jmp 0x4b393d
xor eax, eax
mov ecx, dword [esp + 0xa64]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.005926d8
mov esp, ebp
pop ebp
ret
Function at 0x4b3d3e
Capabilities:
Check if file exists

Disassembly:
push 0x64
mov eax, 0x5e99ef
call fcn.00593b07
mov edx, dword [ebp + 0x10]
lea ecx, [ebp - 0x70]
mov esi, dword [ebp + 0xc]
xor ebx, ebx
mov edi, dword [ebp + 0x14]
push ebx
call fcn.00426889
pop ecx
mov dword [ebp - 4], ebx
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x4b3d6c
mov eax, dword [esi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4b3e76
push 0x61ee2e
lea ecx, [ebp - 0x40]
call fcn.004045aa
mov bl, byte [ebp + 8]
movzx eax, bl
push eax
push 0x8d
push str.DownloadMgr::HasLocalFile
push 0x65fd80
mov byte [ebp - 4], 1
call fcn.0040a649
add esp, 0x10
test bl, bl
je 0x4b3e05
mov edx, esi
lea ecx, [ebp - 0x28]
call fcn.00425312
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 2
push eax
mov edx, eax
mov ecx, str.0aa4efce
call fcn.004168b0
cmp dword [ebp - 0x14], 0x10
lea edx, [ebp - 0x28]
push dword [ebp - 0x18]
cmovae edx, dword [ebp - 0x28]
lea ecx, [ebp - 0x58]
call fcn.00420e93
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x40]
call fcn.00409145
lea ecx, [ebp - 0x58]
call fcn.00404812
xor ebx, ebx
lea ecx, [ebp - 0x28]
inc ebx
mov byte [ebp - 4], bl
call fcn.00404812
jmp 0x4b3e2b
cmp dword [esi + 0x14], 8
jb 0x4b3e0d
mov esi, dword [esi]
mov edx, esi
lea ecx, [ebp - 0x58]
call fcn.00423490
push eax
lea ecx, [ebp - 0x40]
call fcn.00409145
lea ecx, [ebp - 0x58]
call fcn.00404812
xor ebx, ebx
inc ebx
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.00423c0f
pop ecx
pop ecx
test al, al
je 0x4b3e53
push 0x9c
xor eax, eax
push str.DownloadMgr::HasLocalFile
mov bl, al
push str.__s__d___download_file_md5_same
jmp 0x4b3e62
push 0xa0
push str.DownloadMgr::HasLocalFile
push str.__s__d___download_file_md5_different
call fcn.0040a649
add esp, 0xc
lea ecx, [ebp - 0x40]
call fcn.00404812
mov al, bl
jmp 0x4b3e91
push 0xa7
push str.DownloadMgr::HasLocalFile
push str.__s__d___download_file_not_exist
call fcn.0040a649
add esp, 0xc
mov bl, 1
xor eax, eax
lea ecx, [ebp - 0x70]
mov byte [edi], al
call fcn.00404812
mov al, bl
call fcn.00593ab1
ret 0x10
Function at 0x4b4702
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [0x6e5630], 0
push esi
mov esi, ecx
je 0x4b472d
push 0x156
push str.DownloadMgr::Init
push str.__s__d___DownloadMgr::Init_inited
call fcn.0040a649
add esp, 0xc
mov al, 1
jmp 0x4b479e
push ebx
xor ebx, ebx
mov byte [0x6e5630], 1
mov byte [esi + 0x2c], bl
call fcn.004b4b9d
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x24], eax
test eax, eax
jne 0x4b4761
push 0x15f
push str.DownloadMgr::Init
push str.__s__d___create_event_failed
jmp 0x4b478f
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
push ebx
push esi
push 0x4b46af
push ebx
push ebx
call fcn.005bb02f
add esp, 0x18
mov dword [esi + 0x28], eax
test eax, eax
jne 0x4b479b
push 0x166
push str.DownloadMgr::Init
push str.__s__d___create_thread_failed
call fcn.0040a649
add esp, 0xc
xor al, al
jmp 0x4b479d
mov al, 1
pop ebx
pop esi
leave
ret 4

Function at 0x4b4b8f
Capabilities:
Terminate thread

Disassembly:
push 0
push dword [ecx + 0x28]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
xor al, al
ret
Function at 0x4b5fab
Capabilities:
Check if file exists

Disassembly:
push 0x34
mov eax, 0x5da632
call fcn.00593b07
mov ebx, ecx
cmp byte [0x6e5638], 0
je 0x4b5fde
push 0xa6
push str.PicLoopMgr::Init
push str.__s__d___PicLoopMgr::Init_inited
call fcn.0040a649
add esp, 0xc
jmp 0x4b61dc
lea ecx, [ebp - 0x28]
mov byte [0x6e5638], 1
mov dword [ebx + 0x8c], 0x927c0
call fcn.004ced2c
and dword [ebp - 4], 0
mov esi, str._bkinfo_
push esi
call fcn.005baec0
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.0040b220
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov esi, dword [sym.imp.SHELL32.dll_SHCreateDirectory]
test eax, eax
jne 0x4b603d
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push 0
call esi
lea ecx, [ebp - 0x28]
push ecx
lea ecx, [ebx + 0x54]
call fcn.00413220
lea ecx, [ebp - 0x40]
call fcn.004251b3
lea edi, [ebx + 0x6c]
push eax
mov ecx, edi
call fcn.0040b0ac
lea ecx, [ebp - 0x40]
call fcn.0040b67e
push str.360browser_bkinfo_
call fcn.005baec0
pop ecx
push eax
push str.360browser_bkinfo_
mov ecx, edi
call fcn.0040b220
cmp dword [edi + 0x14], 8
mov eax, edi
jb 0x4b6086
mov eax, dword [edi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4b60a0
cmp dword [edi + 0x14], 8
mov eax, edi
jb 0x4b609b
mov eax, dword [edi]
push eax
push 0
call esi
push str.watermark_
mov edx, edi
lea ecx, [ebp - 0x40]
call fcn.0041154e
pop ecx
lea esi, [ebx + 0xa8]
push eax
mov ecx, esi
call fcn.0040b0ac
lea ecx, [ebp - 0x40]
call fcn.0040b67e
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x4b60d0
mov eax, dword [esi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4b60ec
cmp dword [esi + 0x14], 8
jb 0x4b60e3
mov esi, dword [esi]
push esi
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
push str.composite_
mov edx, edi
lea ecx, [ebp - 0x40]
call fcn.0041154e
pop ecx
lea esi, [ebx + 0xc0]
push eax
mov ecx, esi
call fcn.0040b0ac
lea ecx, [ebp - 0x40]
call fcn.0040b67e
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x4b611c
mov eax, dword [esi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4b6138
cmp dword [esi + 0x14], 8
jb 0x4b612f
mov esi, dword [esi]
push esi
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
push ecx
mov word [ebx + 0x84], 1
call fcn.004b3ce0
mov ecx, eax
call fcn.004b4702
mov ecx, ebx
lea eax, [ebx + 0x24]
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
call fcn.004b3ce0
mov ecx, eax
call fcn.004b2b1f
mov ecx, ebx
call fcn.004b5c94
mov ecx, ebx
call fcn.004b6513
and dword [ebx + 0x88], 0
call fcn.004b8447
push eax
mov ecx, ebx
call fcn.004b61e6
movzx eax, byte [ebx + 0x86]
push eax
push dword [ebx + 0x8c]
push dword [ebx + 0x50]
push 0xcb
push str.PicLoopMgr::Init
push str.__s__d___m_nCurIndex___d_m_nLoopTimeInterval___d_m_bIsLoopEnable___d
call fcn.0040a649
push str.dynloopconfig
lea edx, [ebx + 0x54]
lea ecx, [ebp - 0x40]
call fcn.0041154e
add esp, 0x1c
lea ecx, [ebx + 0x1a0]
push eax
call fcn.0040b0ac
lea ecx, [ebp - 0x40]
call fcn.0040b67e
lea ecx, [ebp - 0x28]
call fcn.0040b67e
mov al, 1
call fcn.00593ab1
ret 8
Function at 0x4b631a
Capabilities:
Check if file exists
Delete file

Disassembly:
push 0xc
mov eax, 0x5e9e7c
call fcn.00593ad3
mov esi, ecx
push 0xed
push str.PicLoopMgr::Reset
push str.__s__d___loop_need_reset
call fcn.0040a649
add esp, 0xc
call fcn.004b3ce0
mov ecx, eax
call fcn.004b4855
lea eax, [esi + 0x38]
mov dword [ebp - 0x14], vtable.CAutoLock.0
lea ebx, [esi + 0x34]
push eax
mov dword [ebp - 0x10], ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
and dword [ebp - 4], 0
lea ecx, [esi + 0x28]
and dword [esi + 0x50], 0
call fcn.004b9efb
lea ecx, [esi + 0x1b8]
call fcn.004790db
and dword [esi + 0xa4], 0
mov ecx, esi
call fcn.004b6513
and dword [0x6c8654], 0
lea edi, [esi + 0x1a0]
cmp dword [0x6c8658], 0x10
mov eax, 0x6c8644
cmovae eax, dword [0x6c8644]
mov byte [eax], 0
mov eax, edi
cmp dword [edi + 0x14], 8
jb 0x4b63b8
mov eax, dword [edi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4b63d2
cmp dword [edi + 0x14], 8
jb 0x4b63cb
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [esi + 0x88]
sub eax, 1
je 0x4b6407
sub eax, 1
je 0x4b63fe
sub eax, 1
je 0x4b63f5
sub eax, 1
jne 0x4b640e
mov ecx, esi
call fcn.004b864d
jmp 0x4b640e
mov ecx, esi
call fcn.004b8832
jmp 0x4b640e
mov ecx, esi
call fcn.004b8717
jmp 0x4b640e
mov ecx, esi
call fcn.004b85b3
lea eax, [ebx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.00593a9c
ret
Function at 0x4b7c8d
Capabilities:
Check if file exists
Delete file

Disassembly:
push 0x118
mov eax, 0x5ea154
call fcn.00593b07
mov edi, ecx
mov eax, dword [ebp + 8]
mov edx, str.Software360360huabao
and dword [ebp - 0x124], 0
mov ecx, reloc.WS2_32.dll_accept
mov dword [ebp - 0x120], eax
lea eax, [ebp - 0x124]
push eax
push str.360huabao_loopindex
mov byte [edi + 0x1dc], 1
call fcn.00425cdd
mov eax, dword [ebp - 0x124]
mov esi, str.PicLoopMgr::PreWallPaper
dec eax
push eax
push 0x29d
push esi
push str.__s__d___PreWallPaper_m_nCurIndex___d
mov dword [edi + 0x50], eax
call fcn.0040a649
add esp, 0x18
lea ecx, [ebp - 0x11c]
call fcn.004b570d
and dword [ebp - 4], 0
cmp dword [edi + 0x90], 1
jne 0x4b7d1d
cmp dword [edi + 0x94], 2
jne 0x4b7d1d
mov ecx, edi
call fcn.004b8eed
jmp 0x4b7d20
mov eax, dword [edi + 0x50]
push eax
lea eax, [ebp - 0x11c]
mov ecx, edi
push eax
call fcn.004b641e
test al, al
je 0x4b7ec6
mov eax, dword [edi + 0x90]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 2
je 0x4b7d51
cmp eax, 4
jne 0x4b7e8a
push 0xfde9
lea edx, [ebp - 0xd8]
lea ecx, [ebp - 0x2c]
call fcn.00426805
pop ecx
mov byte [ebp - 4], 1
lea eax, [ebp - 0x2c]
cmp dword [ebp - 0x18], 8
cmovae eax, dword [ebp - 0x2c]
push eax
call ebx
test eax, eax
jne 0x4b7daa
push eax
lea edx, [ebp - 0xf0]
lea ecx, [ebp - 0x44]
call fcn.00426805
pop ecx
mov esi, eax
mov byte [ebp - 4], 2
call fcn.004ba5ec
push 0
lea eax, [ebp - 0x2c]
push eax
push esi
call fcn.004ba64a
lea ecx, [ebp - 0x44]
call fcn.0040b67e
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0
call fcn.0040b67e
mov eax, dword [edi + 0x90]
cmp eax, 4
jne 0x4b7e8a
cmp dword [ebp - 0x114], 2
jne 0x4b7e8a
sub esp, 0x18
lea eax, [ebp - 0xa8]
mov ecx, esp
push eax
and dword [ecx + 0x10], 0
and dword [ecx + 0x14], 0
call fcn.00404267
lea ecx, [ebp - 0x44]
call fcn.00430ab2
push eax
lea edx, [edi + 0x6c]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2c]
call fcn.004296d1
add esp, 0x1c
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 5
call fcn.0040b67e
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push eax
call ebx
test eax, eax
jne 0x4b7e72
cmp dword [ebp - 0xb0], eax
je 0x4b7e72
xor edx, edx
lea eax, [ebp - 0x2c]
push edx
push eax
sub esp, 0x18
lea eax, [ebp - 0xc0]
mov ecx, esp
push eax
mov dword [ecx + 0x10], edx
mov dword [ecx + 0x14], edx
call fcn.00404267
lea ecx, [ebp - 0x5c]
call fcn.00430ab2
add esp, 0x18
mov esi, eax
mov byte [ebp - 4], 6
call fcn.004ba5ec
push esi
call fcn.004ba64a
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 5
call fcn.0040b67e
lea eax, [ebp - 0x11c]
mov ecx, edi
push eax
call fcn.004b7a91
lea ecx, [ebp - 0x2c]
call fcn.0040b67e
jmp 0x4b7ed9
lea esi, [edi + 0x1a0]
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x4b7e9a
mov eax, dword [esi]
push eax
call ebx
test eax, eax
je 0x4b7eb0
cmp dword [esi + 0x14], 8
jb 0x4b7ea9
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push dword [ebp - 0x120]
lea eax, [ebp - 0x11c]
mov ecx, edi
push eax
call fcn.004b7653
jmp 0x4b7ed9
push 0x2be
push esi
push str.__s__d___GetLoopItem_error
call fcn.0040a649
add esp, 0xc
lea ecx, [ebp - 0x11c]
call fcn.004b5aef
call fcn.00593ab1
ret 4
Function at 0x4b7eec
Capabilities:
Check if file exists
Delete file

Disassembly:
push 0x118
mov eax, 0x5ea154
call fcn.00593b07
mov edi, ecx
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x120], eax
mov edx, str.Software360360huabao
lea eax, [ebp - 0x124]
mov byte [edi + 0x1dc], bl
push eax
push str.360huabao_loopindex
mov ecx, reloc.WS2_32.dll_accept
mov dword [ebp - 0x124], ebx
call fcn.00425cdd
mov eax, dword [ebp - 0x124]
mov esi, str.PicLoopMgr::NextWallPaper
inc eax
push eax
push 0x2c8
push esi
push str.__s__d___NextWallPaper_m_nCurIndex___d
mov dword [edi + 0x50], eax
call fcn.0040a649
add esp, 0x18
lea ecx, [ebp - 0x11c]
call fcn.004b570d
mov dword [ebp - 4], ebx
cmp dword [edi + 0x90], 1
jne 0x4b7f7b
cmp dword [edi + 0x94], 2
jne 0x4b7f7b
mov ecx, edi
call fcn.004b8eed
jmp 0x4b7f7e
mov eax, dword [edi + 0x50]
push eax
lea eax, [ebp - 0x11c]
mov ecx, edi
push eax
call fcn.004b641e
test al, al
je 0x4b8124
mov eax, dword [edi + 0x90]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 2
je 0x4b7faf
cmp eax, 4
jne 0x4b80e8
push 0xfde9
lea edx, [ebp - 0xd8]
lea ecx, [ebp - 0x2c]
call fcn.00426805
pop ecx
mov byte [ebp - 4], 1
lea eax, [ebp - 0x2c]
cmp dword [ebp - 0x18], 8
cmovae eax, dword [ebp - 0x2c]
push eax
call ebx
test eax, eax
jne 0x4b8008
push eax
lea edx, [ebp - 0xf0]
lea ecx, [ebp - 0x44]
call fcn.00426805
pop ecx
mov esi, eax
mov byte [ebp - 4], 2
call fcn.004ba5ec
push 0
lea eax, [ebp - 0x2c]
push eax
push esi
call fcn.004ba64a
lea ecx, [ebp - 0x44]
call fcn.0040b67e
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0
call fcn.0040b67e
mov eax, dword [edi + 0x90]
cmp eax, 4
jne 0x4b80e8
cmp dword [ebp - 0x114], 2
jne 0x4b80e8
sub esp, 0x18
lea eax, [ebp - 0xa8]
mov ecx, esp
push eax
and dword [ecx + 0x10], 0
and dword [ecx + 0x14], 0
call fcn.00404267
lea ecx, [ebp - 0x44]
call fcn.00430ab2
push eax
lea edx, [edi + 0x6c]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2c]
call fcn.004296d1
add esp, 0x1c
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 5
call fcn.0040b67e
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push eax
call ebx
test eax, eax
jne 0x4b80d0
cmp dword [ebp - 0xb0], eax
je 0x4b80d0
xor edx, edx
lea eax, [ebp - 0x2c]
push edx
push eax
sub esp, 0x18
lea eax, [ebp - 0xc0]
mov ecx, esp
push eax
mov dword [ecx + 0x10], edx
mov dword [ecx + 0x14], edx
call fcn.00404267
lea ecx, [ebp - 0x5c]
call fcn.00430ab2
add esp, 0x18
mov esi, eax
mov byte [ebp - 4], 6
call fcn.004ba5ec
push esi
call fcn.004ba64a
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 5
call fcn.0040b67e
lea eax, [ebp - 0x11c]
mov ecx, edi
push eax
call fcn.004b7a91
lea ecx, [ebp - 0x2c]
call fcn.0040b67e
jmp 0x4b8137
lea esi, [edi + 0x1a0]
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x4b80f8
mov eax, dword [esi]
push eax
call ebx
test eax, eax
je 0x4b810e
cmp dword [esi + 0x14], 8
jb 0x4b8107
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push dword [ebp - 0x120]
lea eax, [ebp - 0x11c]
mov ecx, edi
push eax
call fcn.004b7653
jmp 0x4b8137
push 0x2e8
push esi
push str.__s__d___GetLoopItem_error
call fcn.0040a649
add esp, 0xc
lea ecx, [ebp - 0x11c]
call fcn.004b5aef
call fcn.00593ab1
ret 4