joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40125e
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x40135a
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x40135a
cmp dword [ebp + 0x10], 1
jb 0x40135a
xor edx, edx
and dword [ebp + 8], edx
push edi
xor edi, edi
cmp dword [ebp + 0x10], edx
jbe 0x401351
mov cl, byte [edi + ebx]
inc edi
mov al, cl
and cl, 3
shr al, 2
movzx eax, al
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx + esi], al
cmp edi, dword [ebp + 0x10]
jae 0x401337
mov bl, byte [edi + ebx]
inc edi
mov al, bl
shl cl, 4
shr al, 4
and bl, 0xf
add cl, al
movzx eax, cl
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx + esi + 1], al
cmp edi, dword [ebp + 0x10]
jae 0x401320
mov eax, dword [ebp + 0xc]
shl bl, 2
mov cl, byte [edi + eax]
inc edi
mov al, cl
and cl, 0x3f
shr al, 6
add bl, al
movzx eax, bl
mov ebx, dword [ebp + 0xc]
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx + esi + 2], al
movzx eax, cl
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx + esi + 3], al
add edx, 4
mov eax, dword [ebp + 8]
add eax, 3
mov dword [ebp + 8], eax
cmp eax, dword [ebp + 0x10]
jb 0x401294
jmp 0x401351
shl bl, 2
movzx eax, bl
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx + esi + 2], al
mov byte [edx + esi + 3], 0x3d
jmp 0x40134e
shl cl, 4
movzx eax, cl
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx + esi + 1], al
mov word [edx + esi + 2], 0x3d3d
add edx, 4
mov byte [edx + esi], 0
mov eax, edx
pop edi
jmp 0x40135c
xor eax, eax
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x401362
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
push edi
mov esi, 0x208
push esi
call fcn.004182d8
xor ebx, ebx
mov dword [0x43e8cc], eax
pop ecx
test eax, eax
je 0x401387
push esi
push ebx
push eax
call fcn.0041ba00
add esp, 0xc
mov esi, 0xc8
push esi
call fcn.004182d8
mov dword [0x43e8c8], eax
pop ecx
test eax, eax
je 0x4013b2
push esi
push ebx
push eax
call fcn.0041ba00
add esp, 0xc
push dword [0x43e8c8]
call fcn.00401aff
push ebx
push 0x23
mov edi, 0x43c110
push edi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x4318c0
push edi
call esi
push 0x4318c4
push edi
call esi
push str._filecache.ini
push edi
call esi
call fcn.00401bdd
push 0x208
push ebx
push 0x43ec9c
mov dword [0x43e8d0], eax
call fcn.0041ba00
add esp, 0xc
mov dword [0x43e8d4], ebx
mov eax, 0x43e4b8
pop edi
pop esi
pop ebx
ret
Function at 0x401694
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x33c
mov eax, dword [0x439030]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
push 0x63
mov dword [ebp - 0x33c], eax
lea eax, [ebp - 0x67]
push 0
push eax
mov byte [ebp - 0x68], 0
call fcn.0041ba00
push 0x43aeb4
push 0x43adf4
mov ecx, 0x43ae02
mov eax, 0x43ae08
push ecx
push 0x43adfc
push 0x43ae92
push eax
push 0x43aeae
push 0x43adf2
push 0x43adec
push eax
push ecx
push 0x43ae06
push 0x43ae18
push eax
push 0x43ae8e
push 0x43ae9e
push 0x43aeaa
push 0x43aeb0
lea eax, [ebp - 0x68]
push 0x431b14
push eax
call fcn.00402d01
add esp, 0x5c
xor eax, eax
mov word [ebp - 0x338], ax
push 0x206
push eax
lea eax, [ebp - 0x336]
push eax
call fcn.0041ba00
add esp, 0xc
lea eax, [ebp - 0x338]
mov esi, 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 2
push esi
call fcn.004183a2
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x401853
push 0x208
push 0
push edi
call fcn.0041ba00
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x338]
add esp, 0xc
push eax
push edi
call esi
push 0x431b3c
push edi
call esi
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push str.online_update.exe
push edi
call esi
xor eax, eax
push 0xc6
push eax
mov word [ebp - 0x130], ax
lea eax, [ebp - 0x12e]
push eax
call fcn.0041ba00
mov eax, 0x43ae4c
push eax
push eax
push 0x43ae2c
push 0x43adb8
push 0x43ae54
push 0x43ae58
push 0x43ae50
push eax
push 0x43ae64
push 0x43ae70
lea eax, [ebp - 0x130]
push str._s_s_s_s_s_s_s_s_s_s
push eax
call fcn.00402d1a
add esp, 0x3c
lea eax, [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x40184c
lea eax, [ebp - 0x68]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x401845
xor ecx, ecx
push ecx
push ecx
push edi
push dword [ebp - 0x33c]
push ecx
call eax
test eax, eax
jne 0x401845
test ebx, ebx
je 0x401840
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
xor eax, eax
inc eax
jmp 0x401855
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push edi
call fcn.0041836a
pop ecx
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041813f
mov esp, ebp
pop ebp
ret 0xc

Function at 0x401988
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x439030]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.0041ba00
push 0
mov esi, 0x43c110
push esi
call fcn.004183e7
add esp, 0x14
cmp eax, 0xffffffff
je 0x401a09
push esi
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0x431c1c
push str.InstallName
push str.config
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x20c]
push str.iklit
push eax
call fcn.0041849b
pop ecx
pop ecx
test eax, eax
je 0x401a09
mov al, 1
jmp 0x401a0b
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0041813f
mov esp, ebp
pop ebp
ret
Function at 0x401a1a
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push 0
push 0x23
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.114MPlayer_Data
mov edi, 0x104
push edi
push dword [ebp + 8]
call fcn.0041826c
push 0x4318c0
push edi
push dword [ebp + 8]
call fcn.0041826c
add esp, 0x18
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
pop edi
pop ebp
ret 8

Function at 0x401a96
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x439030]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
mov word [ebp - 8], 0x500
lea eax, [ebp - 0x14]
mov dword [ebp - 0xc], ebx
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x401af0
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0041813f
mov esp, ebp
pop ebp
ret

Function at 0x401aff
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2888
call fcn.00423310
mov eax, dword [0x439030]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x401bcc
lea eax, [ebp - 0x2888]
mov dword [ebp - 0x2888], 0x2880
push eax
lea eax, [ebp - 0x2884]
push eax
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
jne 0x401bcc
lea ecx, [ebp - 0x2884]
cmp byte [ecx + 0x194], 0
jne 0x401b8c
cmp byte [ecx + 0x195], 0
jne 0x401b8c
cmp byte [ecx + 0x196], 0
jne 0x401b8c
cmp byte [ecx + 0x197], 0
jne 0x401b8c
cmp byte [ecx + 0x198], 0
jne 0x401b8c
cmp byte [ecx + 0x199], 0
jne 0x401b8c
mov ecx, dword [ecx]
test ecx, ecx
jne 0x401b4e
jmp 0x401bcc
movzx eax, byte [ecx + 0x199]
push eax
movzx eax, byte [ecx + 0x198]
push eax
movzx eax, byte [ecx + 0x197]
push eax
movzx eax, byte [ecx + 0x196]
push eax
movzx eax, byte [ecx + 0x195]
push eax
movzx eax, byte [ecx + 0x194]
push eax
push str._02X__02X__02X__02X__02X__02X
push 0x32
push esi
call fcn.00418250
add esp, 0x24
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0041813f
mov esp, ebp
pop ebp
ret 4
Function at 0x401bdd
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb40
mov eax, dword [0x439030]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
mov ebx, 0x206
push ebx
mov word [ebp - 0x61c], ax
xor edi, edi
lea eax, [ebp - 0x61a]
push edi
push eax
call fcn.0041ba00
xor eax, eax
push ebx
mov word [ebp - 0xb30], ax
lea eax, [ebp - 0xb2e]
push edi
push eax
call fcn.0041ba00
add esp, 0xc
call fcn.00409406
test al, al
jne 0x401c75
push edi
push 0x43c110
call fcn.004183e7
mov esi, 0x104
pop ecx
pop ecx
cmp eax, 0xffffffff
je 0x401c6d
push 0x43c110
push esi
lea eax, [ebp - 0xb30]
push eax
push 0x431c1c
push str.InstallName
push str.config
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0xb30]
jmp 0x401c9d
mov esi, 0x104
lea eax, [ebp - 0x720]
push esi
push esi
push eax
push str.InstallName
push ecx
push ecx
call fcn.00409352
test al, al
je 0x401e1e
lea eax, [ebp - 0x720]
push eax
lea eax, [ebp - 0x61c]
push esi
push eax
call fcn.0041814e
add esp, 0xc
xor eax, eax
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push ebx
push edi
push eax
call fcn.0041ba00
xor eax, eax
push ebx
mov word [ebp - 0x928], ax
lea eax, [ebp - 0x926]
push edi
push eax
call fcn.0041ba00
xor eax, eax
push ebx
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push edi
push eax
call fcn.0041ba00
lea eax, [ebp - 0xb38]
mov dword [ebp - 0xb3c], 0x5f
push eax
lea eax, [ebp - 0xb3c]
mov dword [ebp - 0xb40], 0x2e
push eax
lea eax, [ebp - 0x61c]
mov dword [ebp - 0xb38], edi
push eax
call fcn.0041872e
mov ebx, eax
mov dword [ebp - 0xb34], edi
add esp, 0x30
mov eax, edi
jmp 0x401d8e
cmp eax, 1
jne 0x401d52
push ebx
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.0041814e
mov eax, dword [ebp - 0xb34]
add esp, 0xc
cmp eax, 2
jne 0x401d68
push ebx
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.0041814e
add esp, 0xc
lea eax, [ebp - 0xb38]
push eax
lea eax, [ebp - 0xb3c]
push eax
push edi
call fcn.0041872e
mov ebx, eax
add esp, 0xc
mov eax, dword [ebp - 0xb34]
inc eax
mov dword [ebp - 0xb34], eax
test ebx, ebx
jne 0x401d36
lea ecx, [ebp - 0x414]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x401d9b
sub ecx, edx
sar ecx, 1
je 0x401e1e
lea eax, [ebp - 0xb40]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0041849b
pop ecx
pop ecx
test eax, eax
je 0x401df2
lea eax, [ebp - 0xb38]
push eax
lea eax, [ebp - 0xb40]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0041872e
push eax
lea eax, [ebp - 0x928]
push esi
push eax
call fcn.0041814e
add esp, 0x18
jmp 0x401e09
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x928]
push esi
push eax
call fcn.0041814e
add esp, 0xc
lea eax, [ebp - 0x414]
push eax
call fcn.00418803
pop ecx
mov edi, eax
push edi
call fcn.00401e31
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041813f
mov esp, ebp
pop ebp
ret
Function at 0x401f41
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push 5
xor eax, eax
mov dword [ebp - 0x54], 0x44
mov word [ebp - 0x22], ax
xor ecx, ecx
pop eax
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
mov dword [ebp - 0x50], ecx
push eax
push ecx
push ecx
push 0x200
push ecx
push ecx
push ecx
push dword [ebp + 0xc]
mov dword [ebp - 0x4c], 0x431c1c
push ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x20], ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x401fbc
cmp dword [ebp + 0x14], 0
je 0x401fa5
push 0xffffffffffffffff
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
jmp 0x401fbe
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10

Function at 0x402165
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push edi
mov eax, dword [edi]
call dword [eax + 0x64]
mov ebx, dword [ebp + 8]
mov esi, eax
push ebx
mov ecx, dword [ebx]
call dword [ecx + 0x64]
sub esi, eax
xor ecx, ecx
mov eax, dword [ebp + 0x10]
test esi, esi
push 8
setg cl
mov dword [eax], ecx
call fcn.004182d8
pop ecx
test eax, eax
je 0x4021b2
xor ecx, ecx
mov dword [eax + 4], edi
push ecx
push ecx
push eax
push 0x4021b9
push ecx
push ecx
mov dword [eax], ebx
call fcn.00418820
add esp, 0x18
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x403833
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x439030]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x43c104]
push edi
mov edi, ecx
test eax, eax
je 0x4038fe
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4038fe
push esi
push 0xfffffffffffffff0
push dword [0x43c104]
call dword [sym.imp.USER32.dll_GetWindowLongW]
push dword [0x43c108]
mov esi, eax
push dword [0x43c104]
and esi, 0x29ffffff
or esi, 0x56000000
call dword [sym.imp.USER32.dll_SetParent]
push esi
push 0xfffffffffffffff0
push dword [0x43c104]
call dword [sym.imp.USER32.dll_SetWindowLongW]
push str.hwnd_play
push dword [0x43c108]
call dword [sym.imp.zbgui.dll_GetPluginByName]
mov esi, eax
lea eax, [ebp - 0x14]
push eax
push esi
mov ecx, dword [esi]
call dword [ecx + 0x5c]
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
push 4
push ecx
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push 0xffffffffffffffff
push dword [0x43c104]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [esi]
push 0
push esi
call dword [eax + 0x114]
push 0
push dword [edi]
call dword [sym.imp.USER32.dll_ShowWindow]
and dword [0x43e478], 0
pop esi
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop edi
call fcn.0041813f
mov esp, ebp
pop ebp
ret 0xc
Function at 0x403f6b
Capabilities:
Check if file exists
Copy file
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xa44
mov eax, dword [0x439030]
xor eax, esp
mov dword [esp + 0xa40], eax
push ebx
mov ebx, dword [ebp + 8]
xor eax, eax
push esi
push edi
mov esi, 0x206
mov word [esp + 0x430], ax
push esi
xor edi, edi
lea eax, [esp + 0x436]
push edi
push eax
call fcn.0041ba00
add esp, 0xc
xor eax, eax
mov word [esp + 0x840], ax
lea eax, [esp + 0x842]
push esi
push edi
push eax
call fcn.0041ba00
add esp, 0xc
xor eax, eax
mov word [esp + 0x20], ax
lea eax, [esp + 0x22]
push esi
push edi
push eax
call fcn.0041ba00
add esp, 0xc
xor eax, eax
mov word [esp + 0x638], ax
lea eax, [esp + 0x63a]
push esi
push edi
push eax
call fcn.0041ba00
pop ecx
pop ecx
lea eax, [esp + 0x63c]
push eax
call fcn.00401a1a
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
movzx eax, word [esp + 0x10]
imul ecx, eax, 0x64
movzx eax, word [esp + 0x12]
add ecx, eax
mov eax, dword [ebx]
imul esi, ecx, 0x64
add esi, dword [eax + 0x105c]
lea eax, [esp + 0x638]
push esi
push eax
lea eax, [esp + 0x438]
push str._s_ld.xml
push eax
call fcn.00402d33
push esi
lea eax, [esp + 0x64c]
push eax
lea eax, [esp + 0x38]
push str._s_ld.zip
push eax
call fcn.00402d33
add esp, 0x20
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40412a
mov eax, dword [ebx]
lea ecx, [esp + 0x20]
add eax, 8
push ecx
push eax
call fcn.00402b48
test eax, eax
jne 0x40409c
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
jmp 0x404148
lea eax, [esp + 0x840]
push eax
lea eax, [esp + 0x24]
push eax
call fcn.004028e4
xor eax, eax
push 0x206
mov word [esp + 0x22c], ax
lea eax, [esp + 0x22e]
push edi
push eax
call fcn.0041ba00
add esp, 0xc
lea eax, [esp + 0x228]
push 0x43ec9c
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [esp + 0x840]
push eax
lea eax, [esp + 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push edi
lea eax, [esp + 0x434]
push eax
lea eax, [esp + 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x40412a
push 4
lea eax, [esp + 0x434]
push eax
lea eax, [esp + 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push ebx
lea eax, [esp + 0x434]
push eax
call fcn.00403cbe
test eax, eax
je 0x404146
mov ecx, dword [ebx]
xor edi, edi
inc edi
call fcn.00410f4c
mov eax, edi
mov ecx, dword [esp + 0xa4c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0041813f
mov esp, ebp
pop ebp
ret 4
Function at 0x406193
Capabilities:
Create thread

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.zbgui.dll_GetPluginByName]
push edi
push str.loading_play
push dword [0x43c108]
call esi
push str.page_play_content
push dword [0x43c108]
mov edi, eax
call esi
push edi
mov esi, eax
call dword [sym.imp.zbgui.dll_Plugin_IsValid]
xor ebx, ebx
test eax, eax
je 0x4061fb
mov ecx, dword [edi]
push 1
push edi
call dword [ecx + 0xb0]
mov eax, dword [esi]
push ebx
push esi
call dword [eax + 0xb0]
push ebx
push dword [0x43c104]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [edi]
push 1
push edi
call dword [eax + 0x84]
push eax
call dword [sym.imp.zbgui.dll_Plugin_Redraw]
mov ecx, dword [0x43c10c]
test ecx, ecx
je 0x4062d5
mov eax, dword [ecx]
push 0xffffffffffffffff
push dword [0x43c104]
call dword [eax + 0x78]
mov ecx, dword [0x43c10c]
push dword [0x43c104]
mov eax, dword [ecx]
call dword [eax + 0x70]
mov edi, eax
test edi, edi
je 0x4062c2
push 0x1050
call fcn.004182d8
mov esi, eax
pop ecx
test esi, esi
je 0x406277
mov ecx, dword [0x43c104]
push edi
mov dword [esi], ecx
lea ecx, [esi + 4]
push 0x824
push ecx
mov dword [esi + 0x104c], 0x3e8
call fcn.0041814e
push ebx
push ebx
push esi
push 0x401412
push ebx
push ebx
call fcn.00418820
add esp, 0x24
jmp 0x4062d5
mov ecx, dword [0x43c10c]
push 0x4045a4
push dword [0x43c104]
mov eax, dword [ecx]
call dword [eax + 0x98]
mov ecx, dword [0x43c10c]
push 0x4e20
push dword [0x43c104]
mov eax, dword [ecx]
call dword [eax + 0x94]
mov ecx, dword [0x43c10c]
push 0x3e8
push edi
push dword [0x43c104]
mov eax, dword [ecx]
call dword [eax + 0x34]
jmp 0x4062d5
mov ecx, dword [0x43c10c]
push 4
push dword [0x43c104]
mov eax, dword [ecx]
call dword [eax + 0x3c]
pop edi
pop esi
xor eax, eax
pop ebx
ret 0xc
Function at 0x4062dd
Capabilities:
Create thread

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.zbgui.dll_GetPluginByName]
push edi
push str.loading_tv
push dword [0x43c108]
call esi
push str.loading_tv_err
push dword [0x43c108]
mov edi, eax
call esi
xor ebx, ebx
push ebx
push eax
mov ecx, dword [eax]
call dword [ecx + 0xb0]
mov eax, dword [edi]
push 1
push edi
call dword [eax + 0xb0]
mov eax, dword [edi]
push 1
push edi
call dword [eax + 0x84]
push eax
call dword [sym.imp.zbgui.dll_Plugin_Redraw]
mov ecx, dword [0x43c10c]
test ecx, ecx
je 0x406448
mov eax, dword [ecx]
push 0xffffffffffffffff
push dword [0x43c100]
call dword [eax + 0x78]
mov ecx, dword [0x43c10c]
push 5
push dword [0x43c100]
mov eax, dword [ecx]
call dword [eax + 0x3c]
mov ecx, dword [0x43c10c]
push dword [0x43c100]
mov eax, dword [ecx]
call dword [eax + 0x70]
push 0x1050
mov edi, eax
call fcn.004182d8
mov esi, eax
pop ecx
test edi, edi
je 0x4063be
test esi, esi
je 0x406384
push edi
jmp 0x4063c7
mov ecx, dword [0x43c10c]
push 0x4045a4
push dword [0x43c100]
mov eax, dword [ecx]
call dword [eax + 0x98]
mov ecx, dword [0x43c10c]
push 0x4e20
push dword [0x43c100]
mov eax, dword [ecx]
call dword [eax + 0x94]
push 0x3e8
push edi
jmp 0x406437
test esi, esi
je 0x4063fb
push str.http:__dy.huanqiu001.com_tv_index.html
mov ecx, dword [0x43c100]
mov dword [esi + 0x104c], 0x3e8
mov dword [esi], ecx
lea ecx, [esi + 4]
push 0x824
push ecx
call fcn.0041814e
push ebx
push ebx
push esi
push 0x401412
push ebx
push ebx
call fcn.00418820
add esp, 0x24
jmp 0x406448
mov ecx, dword [0x43c10c]
push 0x4045a4
push dword [0x43c100]
mov eax, dword [ecx]
call dword [eax + 0x98]
mov ecx, dword [0x43c10c]
push 0x4e20
push dword [0x43c100]
mov eax, dword [ecx]
call dword [eax + 0x94]
push 0x3e8
push str.http:__dy.huanqiu001.com_tv_index.html
mov ecx, dword [0x43c10c]
push dword [0x43c100]
mov eax, dword [ecx]
call dword [eax + 0x34]
pop edi
pop esi
xor eax, eax
pop ebx
ret 0xc
Function at 0x406450
Capabilities:
Create thread

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.zbgui.dll_GetPluginByName]
push edi
push str.loading_sports
push dword [0x43c108]
call esi
push str.loading_sports_err
push dword [0x43c108]
mov edi, eax
call esi
xor ebx, ebx
push ebx
push eax
mov ecx, dword [eax]
call dword [ecx + 0xb0]
mov eax, dword [edi]
push 1
push edi
call dword [eax + 0xb0]
mov eax, dword [edi]
push 1
push edi
call dword [eax + 0x84]
push eax
call dword [sym.imp.zbgui.dll_Plugin_Redraw]
mov ecx, dword [0x43c10c]
test ecx, ecx
je 0x4065bb
mov eax, dword [ecx]
push 0xffffffffffffffff
push dword [0x43c0fc]
call dword [eax + 0x78]
mov ecx, dword [0x43c10c]
push 5
push dword [0x43c0fc]
mov eax, dword [ecx]
call dword [eax + 0x3c]
mov ecx, dword [0x43c10c]
push dword [0x43c0fc]
mov eax, dword [ecx]
call dword [eax + 0x70]
push 0x1050
mov edi, eax
call fcn.004182d8
mov esi, eax
pop ecx
test edi, edi
je 0x406531
test esi, esi
je 0x4064f7
push edi
jmp 0x40653a
mov ecx, dword [0x43c10c]
push 0x4045a4
push dword [0x43c0fc]
mov eax, dword [ecx]
call dword [eax + 0x98]
mov ecx, dword [0x43c10c]
push 0x4e20
push dword [0x43c0fc]
mov eax, dword [ecx]
call dword [eax + 0x94]
push 0x3e8
push edi
jmp 0x4065aa
test esi, esi
je 0x40656e
push str.http:__vod.114zhibo.com
mov ecx, dword [0x43c0fc]
mov dword [esi + 0x104c], 0x3e8
mov dword [esi], ecx
lea ecx, [esi + 4]
push 0x824
push ecx
call fcn.0041814e
push ebx
push ebx
push esi
push 0x401412
push ebx
push ebx
call fcn.00418820
add esp, 0x24
jmp 0x4065bb
mov ecx, dword [0x43c10c]
push 0x4045a4
push dword [0x43c0fc]
mov eax, dword [ecx]
call dword [eax + 0x98]
mov ecx, dword [0x43c10c]
push 0x4e20
push dword [0x43c0fc]
mov eax, dword [ecx]
call dword [eax + 0x94]
push 0x3e8
push str.http:__vod.114zhibo.com
mov ecx, dword [0x43c10c]
push dword [0x43c0fc]
mov eax, dword [ecx]
call dword [eax + 0x34]
pop edi
pop esi
xor eax, eax
pop ebx
ret 0xc

Function at 0x407769
Capabilities:
Create thread

Disassembly:
push ebx
push edi
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 4], ebx
je 0x4077db
cmp dword [edi + 8], ebx
je 0x4077db
push esi
push str.btn_close_1
push dword [edi]
call dword [sym.imp.zbgui.dll_GetPluginByName]
mov esi, eax
push ebx
push esi
mov ecx, dword [esi]
call dword [ecx + 0xb0]
mov ecx, dword [esi]
push 1
push esi
call dword [ecx + 0x84]
push eax
call dword [sym.imp.zbgui.dll_Plugin_Redraw]
pop esi
cmp dword [edi + 0x18], ebx
je 0x4077b4
push dword [edi + 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.MPLAYER_EVENT_DOWNLOAD
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push ebx
push ebx
push edi
push 0x40759d
push ebx
push ebx
mov dword [edi + 0x18], eax
call fcn.00418820
add esp, 0x18
mov dword [edi + 0x1c], eax
pop edi
xor eax, eax
pop ebx
ret 0xc
Function at 0x407b46
Capabilities:
Create directory
Get common file path

Disassembly:
push esi
push edi
push 0
push 0x23
push dword [0x43e4ac]
push dword [0x43c108]
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov esi, 0x4318c0
mov edi, 0x104
push esi
push edi
push dword [0x43e4ac]
call fcn.0041826c
push 0x4318c4
push edi
push dword [0x43e4ac]
call fcn.0041826c
push esi
push edi
push dword [0x43e4ac]
call fcn.0041826c
add esp, 0x24
push 0
push dword [0x43e4ac]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push str.plist.dat
push edi
push dword [0x43e4ac]
call fcn.0041826c
add esp, 0xc
pop edi
pop esi
ret