joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49d2c1
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
mov eax, dword [0x52de80]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push str.LockDefaultViaDuba_Begin_r_n
mov ebx, 0x55913c
push ebx
call fcn.004a985e
pop ecx
pop ecx
call fcn.0049c8c0
test al, al
jne 0x49d302
push str.LockDefaultViaDuba_KDubaDetectLockLiebao_no_IsModuleSupport_r_n
push ebx
call fcn.004a985e
pop ecx
pop ecx
jmp 0x49d4d1
push esi
push 0x20019
xor esi, esi
lea ecx, [ebp - 0x230]
push str.SoftwarekingsoftKISCommon
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x230], esi
mov dword [ebp - 0x22c], esi
mov dword [ebp - 0x228], esi
call fcn.00425fcb
test eax, eax
je 0x49d34f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.LockDefaultViaDuba_Open_SoftwarekingsoftKISCommon_errcode_d_r_n
push ebx
call fcn.004a985e
add esp, 0xc
jmp 0x49d4ad
xor eax, eax
push 0x206
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push esi
push eax
call fcn.004bf1a0
add esp, 0xc
mov dword [ebp - 0x234], 0x104
lea eax, [ebp - 0x234]
lea ecx, [ebp - 0x230]
push eax
lea eax, [ebp - 0x20c]
push eax
push str.ProgramPath
call fcn.00426059
test eax, eax
je 0x49d3ba
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x20c]
push eax
push str.LockDefaultViaDuba_QueryStringValue_ws_errcode_d_r_n
push ebx
call fcn.004a985e
add esp, 0x10
jmp 0x49d4ad
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x49d3e0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x20c]
push eax
push str.LockDefaultViaDuba_PathFileExists_ws_errcode_d_r_n
jmp 0x49d3ac
push edi
lea edi, [ebp - 0x20c]
sub edi, 2
mov ax, word [edi + 2]
add edi, 2
cmp ax, si
jne 0x49d3ea
push 6
pop ecx
mov esi, str.kismain.exe
lea eax, [ebp - 0x20c]
rep movsd dword es:[edi], dword [esi]
push eax
movsw word es:[edi], word [esi]
call dword [sym.imp.SHLWAPI.dll_PathQuoteSpacesW]
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x224]
call fcn.004045b0
mov esi, str.__defendmon:lockliebao
push esi
call fcn.00402db0
pop ecx
push eax
push esi
lea ecx, [ebp - 0x224]
call fcn.004063e0
cmp dword [ebp - 0x210], 8
lea eax, [ebp - 0x224]
cmovae eax, dword [ebp - 0x224]
push eax
push str.LockDefaultViaDuba_cmdline_ws_r_n
push ebx
call fcn.004a985e
xor eax, eax
lea edi, [ebp - 0x244]
cmp dword [ebp - 0x210], 8
lea ecx, [ebp - 0x244]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x224]
cmovae eax, dword [ebp - 0x224]
xor esi, esi
push esi
push esi
push esi
push esi
push ecx
push esi
push eax
push esi
call fcn.00425175
push eax
push str.LockDefaultViaDuba_ExecuteAsDesktopUserEx3_hr0x_x_r_n
push ebx
call fcn.004a985e
add esp, 0x38
lea ecx, [ebp - 0x224]
push esi
push 1
call fcn.00402540
pop edi
lea ecx, [ebp - 0x230]
call fcn.00425fb1
push str.LockDefaultViaDuba_End_r_n
push ebx
call fcn.004a985e
pop ecx
pop ecx
lea ecx, [ebp - 0x230]
call fcn.00425fb1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.004bc11d
mov esp, ebp
pop ebp
ret
Function at 0x49da2b
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push 0
push 0x3000010
push 1
push 0
push 3
push 1
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
xor ebx, ebx
cmp eax, 0xffffffff
setne bl
test ebx, ebx
je 0x49da5e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
jmp 0x49da69
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
pop ebx
pop ebp
ret

Function at 0x49dac1
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x52de80]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x118
lea eax, [ebp - 0x11c]
mov dword [ebp - 0x120], 0x11c
push 0
push eax
call fcn.004bf1a0
add esp, 0xc
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x49db1c
cmp dword [ebp - 0x11c], 6
jne 0x49db1c
cmp dword [ebp - 0x118], 0
jne 0x49db1c
xor eax, eax
inc eax
jmp 0x49db1e
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bc11d
mov esp, ebp
pop ebp
ret

Function at 0x49db2c
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x52de80]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x118
lea eax, [ebp - 0x11c]
mov dword [ebp - 0x120], 0x11c
push 0
push eax
call fcn.004bf1a0
add esp, 0xc
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x49db7a
cmp dword [ebp - 0x11c], 6
sbb eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bc11d
mov esp, ebp
pop ebp
ret

Function at 0x49db88
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x52de80]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x118
lea eax, [ebp - 0x11c]
mov dword [ebp - 0x120], 0x11c
push 0
push eax
call fcn.004bf1a0
add esp, 0xc
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x49dbd6
cmp dword [ebp - 0x11c], 0xa
sbb eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bc11d
mov esp, ebp
pop ebp
ret

Function at 0x49dbe4
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x52de80]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x118
lea eax, [ebp - 0x11c]
mov dword [ebp - 0x120], 0x11c
push 0
push eax
call fcn.004bf1a0
add esp, 0xc
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x49dc3f
cmp dword [ebp - 0x11c], 6
jb 0x49dc3f
cmp dword [ebp - 0x118], 2
jb 0x49dc3f
xor eax, eax
inc eax
jmp 0x49dc41
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bc11d
mov esp, ebp
pop ebp
ret
Function at 0x49de03
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
mov edi, ecx
xor esi, esi
mov dword [ebp - 4], esi
cmp dword [edi], esi
je 0x49de83
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 8]
push eax
push esi
push dword [ebp + 8]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 8], 1
mov dword [edi + 4], eax
jne 0x49de83
mov ecx, dword [ebp + 0xc]
call fcn.00423cc1
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
shr eax, 1
inc eax
push eax
call fcn.00423ed3
lea ecx, [ebp - 4]
mov dword [ebp - 0xc], eax
push ecx
push eax
lea eax, [ebp - 8]
push eax
push esi
push dword [ebp + 8]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [edi + 4], eax
test eax, eax
jne 0x49de83
mov eax, dword [ebp - 4]
xor edx, edx
mov ecx, dword [ebp - 0xc]
shr eax, 1
push 0xffffffffffffffff
mov word [ecx + eax*2], dx
mov ecx, dword [ebp + 0xc]
call fcn.00425b83
inc esi
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x49de8d
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
push str.RunApp_szPath_ws_szCmd_ws_dwWaitTime_d_bShow_d_bWaitTimeTermination_d_r_n
push 0x55913c
call fcn.004a985e
xor esi, esi
lea eax, [ebp - 0x58]
push 0x40
push esi
push eax
mov dword [ebp - 8], esi
call fcn.004bf1a0
mov dword [ebp - 0x18], esi
lea edi, [ebp - 0x14]
xor eax, eax
mov dword [ebp - 0x5c], 0x44
stosd dword es:[edi], eax
add esp, 0x28
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor edi, edi
inc edi
mov dword [ebp - 0x30], edi
call fcn.00420e9a
push eax
lea ecx, [ebp - 4]
call fcn.00423ea0
push dword [ebp + 0xc]
lea eax, [ebp - 4]
push dword [ebp + 8]
push str.__s___s
push eax
call fcn.0042448a
add esp, 0x10
cmp dword [ebp + 0x14], esi
je 0x49df10
push 0xa
pop eax
jmp 0x49df12
xor eax, eax
mov word [ebp - 0x2c], ax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x5c]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
mov esi, dword [ebp - 4]
push esi
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x49df5c
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.KFunction::RunApp_CreateProcessW_error:_d__wait:_d__show:_d__path:_ws__cmd:_ws
push 0x55913c
call fcn.004a985e
mov ebx, dword [ebp - 8]
add esp, 0x1c
jmp 0x49df9e
test ebx, ebx
je 0x49df9c
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x49df9c
cmp dword [ebp + 0x18], 0
je 0x49df9c
push 0
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x49df9c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.TerminateProcess_errcode_d_r_n
push 0x55913c
call fcn.004a985e
add esp, 0xc
mov ebx, edi
cmp dword [ebp - 0x18], 0
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x49dfb3
push dword [ebp - 0x18]
call edi
and dword [ebp - 0x18], 0
cmp dword [ebp - 0x14], 0
je 0x49dfc2
push dword [ebp - 0x14]
call edi
and dword [ebp - 0x14], 0
lea ecx, [esi - 0x10]
call fcn.004209ab
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49dfd3
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push ebx
push esi
push edi
xor esi, esi
lea eax, [ebp - 0x58]
push 0x40
push esi
push eax
mov dword [ebp - 8], esi
call fcn.004bf1a0
mov dword [ebp - 0x18], esi
lea edi, [ebp - 0x14]
xor eax, eax
mov dword [ebp - 0x5c], 0x44
stosd dword es:[edi], eax
add esp, 0xc
mov ebx, esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor edi, edi
inc edi
mov dword [ebp - 0x30], edi
call fcn.00420e9a
push eax
lea ecx, [ebp - 4]
call fcn.00423ea0
push dword [ebp + 0xc]
lea eax, [ebp - 4]
push dword [ebp + 8]
push str.__s___s
push eax
call fcn.0042448a
add esp, 0x10
cmp dword [ebp + 0x18], ebx
je 0x49e039
push 0xa
pop eax
jmp 0x49e03b
xor eax, eax
mov word [ebp - 0x2c], ax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x5c]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
mov esi, dword [ebp - 4]
push esi
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x49e086
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp + 0xc]
mov ebx, eax
push dword [ebp + 8]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push ebx
push str.KFunction::RunApp_CreateProcessW_error:_d__wait:_d__show:_d__path:_ws__cmd:_ws
push 0x55913c
call fcn.004a985e
add esp, 0x1c
jmp 0x49e0b1
mov eax, dword [ebp - 0x18]
cmp dword [ebp + 0x14], ebx
je 0x49e09f
test eax, eax
je 0x49e09f
push dword [ebp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], edi
cmp dword [ebp + 0x10], ebx
je 0x49e0b4
push dword [ebp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [ebp - 0x18]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x49e0c5
push eax
call edi
and dword [ebp - 0x18], 0
cmp dword [ebp - 0x14], 0
je 0x49e0d4
push dword [ebp - 0x14]
call edi
and dword [ebp - 0x14], 0
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea ecx, [esi - 0x10]
call fcn.004209ab
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49ec9f
Capabilities:
Access firewall settings via inetfwmgr

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 8]
push eax
push 0x4fc9ec
xor ecx, ecx
push 1
push ecx
push 0x4fc9dc
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ecx
mov dword [edi], ecx
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
test esi, esi
jns 0x49ecd8
push esi
push str.CoCreateInstance_failed:_0x_08lx_n
jmp 0x49ed09
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov esi, eax
test esi, esi
jns 0x49ecf3
push esi
push str.get_LocalPolicy_failed:_0x_08lx_n
jmp 0x49ed09
mov eax, dword [ebp - 4]
push edi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov esi, eax
test esi, esi
jns 0x49ed16
push esi
push str.get_CurrentProfile_failed:_0x_08lx_n
push 0x55913c
call fcn.004a985e
add esp, 0xc
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x49ed23
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x49ed30
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x49ed3a
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, ecx
xor esi, esi
cmp dword [edi], esi
je 0x49ed81
mov edx, dword [ebp + 0xc]
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
cmp ax, si
jne 0x49ed4d
push ebx
sub edx, ecx
xor ebx, ebx
sar edx, 1
inc ebx
lea eax, [edx*2 + 2]
push eax
push dword [ebp + 0xc]
push ebx
push esi
push dword [ebp + 8]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
mov dword [edi + 4], eax
cmove esi, ebx
pop ebx
pop edi
mov eax, esi
pop esi
pop ebp
ret 8
Function at 0x4a087f
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, ecx
push esi
push edi
push 0x601
mov eax, dword [ebx]
mov dword [ebp - 0xc], ebx
call dword [eax + 4]
mov eax, dword [ebx + 8]
sub eax, 0x10
push eax
call fcn.00425c49
add eax, 0x10
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
call fcn.0049dd3c
mov esi, str.Module_thunderdownloadMiniThunderPlatform.exe
push esi
call fcn.00424236
add esp, 0xc
lea ecx, [ebp - 4]
push eax
push esi
call fcn.0043af25
push dword [ebp - 4]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4a08fb
lea ecx, [ebp - 8]
call fcn.0049afcf
push 0x4fd800
push dword [ebp - 4]
lea ecx, [ebp - 8]
call fcn.0049ebac
lea ecx, [ebp - 8]
mov edi, eax
call fcn.0049b02b
jmp 0x4a0912
push dword [ebp - 4]
push str.no_exists__ws
push 0x55913c
call fcn.004a985e
add esp, 0xc
xor edi, edi
mov esi, dword [ebx]
xor ebx, ebx
test edi, edi
setns bl
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0xc]
push eax
push ebx
push 0x601
call dword [esi + 8]
mov ecx, dword [ebp - 4]
add ecx, 0xfffffff0
call fcn.004209ab
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a0e3e
Capabilities:
Check if file exists
Copy file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
mov edi, ecx
push str.CopyDatFileForLego_Begin_r_n
push 0x55913c
mov dword [ebp - 8], edi
call fcn.004a985e
mov eax, dword [edi + 0x20]
sub eax, 0x10
push eax
call fcn.00425c49
add eax, 0x10
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
call fcn.0049dd3c
mov esi, dword [0x5590f8]
push esi
call fcn.00424236
add esp, 0x14
lea ecx, [ebp - 4]
push eax
push esi
call fcn.0043af25
lea eax, [ebp - 4]
push eax
call fcn.0049dd3c
pop ecx
push dword [ebp - 4]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4a0eda
push eax
push dword [ebp - 4]
call fcn.0049da2b
mov esi, dword [ebp - 4]
mov edi, eax
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push esi
push str.Create_Directory__s__bRet_d_error_d__r_n
push 0x55913c
call fcn.004a985e
add esp, 0x14
test edi, edi
je 0x4a0fa0
mov edi, dword [ebp - 8]
mov esi, dword [0x5590f0]
push esi
call fcn.00424236
pop ecx
push eax
push esi
lea ecx, [ebp - 4]
call fcn.0043af25
push dword [ebp - 4]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4a0f1b
push dword [ebp - 4]
push str._s_File_Exists__r_n
push 0x55913c
call fcn.004a985e
xor edi, edi
add esp, 0xc
inc edi
jmp 0x4a0fa0
mov eax, dword [edi + 8]
sub eax, 0x10
push eax
call fcn.00425c49
add eax, 0x10
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.0049dd3c
mov esi, str.Data_
push esi
call fcn.00424236
add esp, 0xc
lea ecx, [ebp - 8]
push eax
push esi
call fcn.0043af25
mov esi, dword [0x5590f0]
push esi
call fcn.00424236
pop ecx
push eax
push esi
lea ecx, [ebp - 8]
call fcn.0043af25
push 1
push dword [ebp - 4]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push dword [ebp - 4]
push dword [ebp - 8]
push str.Copy_lego.dat_src_ws_dst_ws_CopyFile_bRet_d_error_d
push 0x55913c
call fcn.004a985e
mov ecx, dword [ebp - 8]
add esp, 0x18
lea ecx, [ecx - 0x10]
call fcn.004209ab
push str.CopyDatFileForLego_End_r_n
push 0x55913c
call fcn.004a985e
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
lea ecx, [ecx - 0x10]
call fcn.004209ab
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4a0fc4
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x52de80]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x3c]
push esi
call fcn.004045b0
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x54]
call fcn.00408630
push eax
call fcn.0040a800
pop ecx
lea ecx, [ebp - 0x54]
mov bl, al
call fcn.00408680
push 0
push 1
lea ecx, [ebp - 0x3c]
call fcn.00402540
test bl, bl
je 0x4a1101
push edi
push esi
lea ecx, [ebp - 0x58]
call fcn.00425b11
lea eax, [ebp - 0x58]
push eax
call fcn.0049dd3c
mov edi, str.test_access
push edi
call fcn.00424236
pop ecx
pop ecx
push eax
push edi
lea ecx, [ebp - 0x58]
call fcn.0043af25
push 7
mov byte [ebp - 0x24], 0
lea edi, [ebp - 0x23]
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
push dword [ebp - 0x58]
lea ecx, [ebp - 0x3c]
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.004045b0
push 0x1e
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x54]
call fcn.00408630
push eax
call fcn.0040ac40
add esp, 0xc
lea ecx, [ebp - 0x54]
cmp eax, 0xffffffff
setne bl
call fcn.00408680
xor edi, edi
lea ecx, [ebp - 0x3c]
push 0
inc edi
push edi
call fcn.00402540
test bl, bl
je 0x4a109f
push dword [ebp - 0x58]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x4a10f5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.WriteFile_testfile_fail_errcode_d__r_n
push 0x55913c
call fcn.004a985e
add esp, 0xc
lea ecx, [ebp - 0x59]
push edi
push 0x1f01ff
push esi
call fcn.00432847
xor ebx, ebx
mov dword [ebp - 0x28], 0xf
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x2c], ebx
push eax
push ebx
push edi
push 2
push str.execptiondirectory_permissions_problems
push ebx
push 0x6e
mov byte [ebp - 0x3c], bl
call fcn.004b1b40
push ebx
push edi
lea ecx, [ebp - 0x3c]
call fcn.00402490
mov ecx, dword [ebp - 0x58]
lea ecx, [ecx - 0x10]
call fcn.004209ab
pop edi
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.004bc11d
mov esp, ebp
pop ebp
ret 4
Function at 0x4a1abf
Capabilities:
Check if file exists
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x52de80]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
push eax
lea ecx, [ebp - 0x23c]
call fcn.004045b0
lea eax, [ebp - 0x23c]
mov ecx, esi
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.004a080f
xor ebx, ebx
lea ecx, [ebp - 0x23c]
push ebx
push 1
call fcn.00402540
push ebx
push 0x1c
lea eax, [ebp - 0x20c]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov ebx, eax
lea eax, [ebp - 0x20c]
push eax
call fcn.00402db0
pop ecx
push eax
lea eax, [ebp - 0x20c]
mov ecx, edi
push eax
call fcn.004064c0
mov esi, 0x5115a8
push esi
call fcn.00402db0
pop ecx
push eax
push esi
mov ecx, edi
call fcn.004063e0
mov esi, 0x50c8cc
push esi
call fcn.00402db0
pop ecx
push eax
push esi
mov ecx, edi
call fcn.004063e0
cmp dword [ebp - 0x210], 8
lea esi, [ebp - 0x224]
cmovae esi, dword [ebp - 0x224]
push esi
call fcn.00402db0
pop ecx
push eax
push esi
mov ecx, edi
call fcn.004063e0
cmp dword [edi + 0x14], 8
jb 0x4a1b95
mov eax, dword [edi]
jmp 0x4a1b97
mov eax, edi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4a1bb8
cmp dword [ebp + 0x10], eax
je 0x4a1bb8
cmp dword [edi + 0x14], 8
jb 0x4a1baf
mov edi, dword [edi]
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0
push 1
lea ecx, [ebp - 0x224]
call fcn.00402540
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004bc11d
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4a20ba
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x52de80]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x114], 5
jne 0x4a20f1
cmp dword [ebp - 0x110], 0
mov eax, 0x4f6a6c
je 0x4a20f6
mov eax, str.SpoolerGroup
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bc11d
mov esp, ebp
pop ebp
ret

Function at 0x4a2640
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea esi, [ecx + 8]
mov eax, dword [esi]
sub eax, 0x10
push edi
push eax
call fcn.00425c49
add eax, 0x10
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
call fcn.0049dd3c
pop ecx
pop ecx
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
call fcn.00425bd3
push esi
call fcn.0049dd3c
mov edi, str.skinupdater.exe
push edi
call fcn.00424236
pop ecx
pop ecx
push eax
push edi
lea ecx, [ebp - 4]
call fcn.0043af25
push dword [ebp - 4]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4a269f
mov edi, 0x4fe628
push edi
call fcn.00424236
pop ecx
push eax
push edi
mov ecx, esi
call fcn.0043af25
mov ecx, dword [ebp - 4]
lea ecx, [ecx - 0x10]
call fcn.004209ab
xor eax, eax
pop edi
inc eax
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4a2793
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x52de80]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x38]
push edi
push 0
push eax
mov edi, ecx
call fcn.0049c103
push dword [ebp - 0x38]
mov ebx, 0x55913c
push str.Init_localpath___ws_r_n
push ebx
call fcn.004a985e
xor eax, eax
add esp, 0x14
test esi, esi
setne al
mov dword [edi + 0x28], eax
test eax, eax
je 0x4a2805
push esi
call fcn.00424236
pop ecx
push eax
push esi
lea ecx, [edi + 0x2c]
call fcn.004241bd
push esi
push str.Init_7zFilePath___ws_r_n
push ebx
call fcn.004a985e
add esp, 0xc
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ebx, eax
jmp 0x4a281a
lea ecx, [edi + 0x80]
call fcn.004a93a6
mov ebx, eax
test ebx, ebx
je 0x4a2947
lea esi, [edi + 4]
push esi
call fcn.0049bebc
pop ecx
test eax, eax
je 0x4a2831
mov dword [edi + 0x70], 1
jmp 0x4a2839
push esi
mov ecx, edi
call fcn.004a1ccc
push esi
call fcn.0049dd3c
push dword [edi + 0x70]
push dword [esi]
push str.Init_InstallPath_ws_m_bInstalled_d_r_n
push 0x55913c
call fcn.004a985e
and dword [ebp - 0xc], 0
xor eax, eax
mov word [ebp - 0x1c], ax
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 8], 7
call fcn.0049bcd3
lea eax, [ebp - 0x1c]
push eax
call fcn.0049dd7c
mov esi, str.liebao
push esi
call fcn.00402db0
add esp, 0x20
lea ecx, [ebp - 0x1c]
push eax
push esi
call fcn.004063e0
lea eax, [ebp - 0x1c]
push eax
call fcn.0049dd7c
cmp dword [ebp - 8], 8
lea esi, [ebp - 0x1c]
cmovae esi, dword [ebp - 0x1c]
push esi
call fcn.00424236
pop ecx
pop ecx
push eax
push esi
lea ecx, [edi + 0x24]
call fcn.004241bd
mov esi, 0x4fcce8
push esi
call fcn.00402db0
pop ecx
push eax
push esi
lea ecx, [ebp - 0x1c]
call fcn.004063e0
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x34]
call fcn.00408630
push eax
call fcn.00411fe0
pop ecx
lea ecx, [ebp - 0x34]
call fcn.00408680
lea eax, [ebp - 0x1c]
push eax
call fcn.0049dd7c
cmp dword [ebp - 8], 8
lea esi, [ebp - 0x1c]
cmovae esi, dword [ebp - 0x1c]
push esi
call fcn.00424236
pop ecx
pop ecx
push eax
push esi
lea ecx, [edi + 0x20]
call fcn.004241bd
mov ecx, edi
call fcn.004a4ecc
mov ecx, edi
call fcn.004a5043
cmp dword [edi + 0x70], 0
je 0x4a2926
mov ecx, edi
call fcn.004a50cf
mov ecx, edi
call fcn.004a3a93
mov ecx, edi
call fcn.004a7b35
mov ecx, edi
call fcn.004a6e65
push 0
push 1
lea ecx, [ebp - 0x1c]
call fcn.00402540
mov ecx, dword [ebp - 0x38]
lea ecx, [ecx - 0x10]
call fcn.004209ab
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004bc11d
mov esp, ebp
pop ebp
ret 4