joyce8/EMBER2024-capa huggingface dataset:
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..rdata
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x42d64a39
nop
nop
nop
nop
test eax, eax
je 0x43204e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x432024
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x42f314
nop
nop
mov ecx, 0x7de01636
nop
nop
nop
test eax, eax
nop
nop
je 0x432084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403d6f
nop
nop
sub eax, 0x403d15
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp loc.00401219

Function at 0x4e50ec
Capabilities:
Packed with generic packer

Disassembly:
clc
jae 0x4e50f5
push esp
test al, 0x13
or byte [ecx], bh
pushal
pushal
stc
jb 0x4e5101
outsd dx, dword [esi]
ret
call 0x4e510a
or al, 0xea
xor ah, byte [edx - 0x6eec8da5]
aaa
setnp byte [ebx - 0x72]
popfd
jge 0x4e517a
or esi, dword [ebx + ecx*8]
jl 0x4e5114
push es
lds ecx, [eax - 0x3c7e59d4]
cli
invalid
out dx, eax
movsb byte es:[edi], byte [esi]
or byte [ebp + 0x773bfc7d], al
dec ecx
in al, dx
test eax, 0xebfb8bb3
or eax, 0x63c65e4c
add eax, 0x834362e5
dec eax
ficomp word [eax]
add bx, 4
jmp 0x4e51c9
mov eax, dword [ebx]
jmp 0x4e51e6
add eax, ebx
jmp 0x4e51fa
mov edx, dword [ebx + 4]
jmp 0x4e5216
sub dword [eax], 0xb917b25e
jmp 0x4e5222
add eax, 4
jmp 0x4e523a
sub edx, 1
clc
jmp 0x4e5252
jne 0x4e51fd
jae 0x4e5282
fimul word [ebx]
xchg edi, eax
mov word [bp - 0x5a58], cs
shr dword [eax - 0x12], 0x9b
int 0xbb
rcr byte [ebp + 0x73e99a04], 1
arpl word [ebx], bx
les eax, [edi]
ja 0x4e5222
in al, 0x61
jnp 0x4e5225
or ch, dl
sal dword [ebp*4 - 0x2ccdac85], 0xe0
add ebx, 8
jmp 0x4e529c
sub dword [edi], 1
stc
jmp 0x4e52ad
jne 0x4e519a
clc
jae 0x4e52b8
jge 0x4e5308
call fcn.004e5302
jmp 0x4e52ea
popal
jmp 0x4e52fd
jmp 0x4e40e4
push ecx
mov ecx, 0xcca2c1dc
jmp 0x62906f08
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40915c
nop
mov ecx, 0x5092e7e
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43104e
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x431024
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42f3f8
nop
mov ecx, 0x5c455133
nop
test eax, eax
nop
nop
nop
nop
je 0x431084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x5a02b0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x42e030
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x42e01e
nop
nop
popal
nop
nop
nop
nop
jmp fcn.00401219
Function at 0x401000
Capabilities:
Get file version info

Disassembly:
sub esp, 0x10
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
lea eax, [esp + 0xc]
xor ebx, ebx
push eax
push ebp
mov byte [esp + 0x13], bl
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [esp + 0xc], eax
cmp eax, ebx
jne 0x401036
pop ebp
xor al, al
pop ebx
add esp, 0x10
ret
push esi
push eax
call fcn.004ccfcd
mov ecx, dword [esp + 0x14]
add esp, 4
mov esi, eax
push esi
push ecx
push ebx
push ebp
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x401094
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x18]
push eax
push 0x5212f4
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x401094
mov eax, dword [esp + 0x14]
movzx ecx, word [eax + 0xa]
movzx edx, word [eax + 8]
mov word [edi], cx
movzx ecx, word [eax + 0xe]
mov word [edi + 2], dx
movzx edx, word [eax + 0xc]
mov word [edi + 4], cx
mov word [edi + 6], dx
mov byte [esp + 0xf], 1
cmp esi, ebx
je 0x4010a1
push esi
call fcn.004ccef0
add esp, 4
mov al, byte [esp + 0xf]
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x4010b0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x214
mov eax, dword [0x5405a0]
xor eax, esp
mov dword [esp + 0x210], eax
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x12]
push ecx
mov word [esp + 0x14], ax
call fcn.004d3fc0
add esp, 0xc
push 0x104
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x401109
xor al, al
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.004ccee1
add esp, 0x214
ret
push edi
push 0x5212f8
lea eax, [esp + 0x10]
push 0x104
push eax
call fcn.004cd573
lea ecx, [esp + 0x18]
push ecx
lea edi, [esp + 0x14]
call fcn.00401000
add esp, 0x10
pop edi
test al, al
je 0x4010f2
movzx ecx, word [esp + 4]
movzx edx, word [esp]
movzx eax, word [esp + 2]
mov dword [esi + 0xc], ecx
mov ecx, dword [esp + 0x210]
mov dword [esi + 4], edx
xor edx, edx
mov dword [esi + 8], eax
xor ecx, esp
mov dword [esi], 0x114
mov dword [esi + 0x10], 2
mov word [esi + 0x14], dx
mov al, 1
call fcn.004ccee1
add esp, 0x214
ret

Function at 0x4018b0
Capabilities:
Delete file
Set file attributes

Disassembly:
cmp byte [edi + 0x112], 0
push esi
lea esi, [edi + 4]
mov eax, esi
jne 0x4018c5
mov eax, dword [esi + 0x108]
push 0x80
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp byte [esi + 0x10e], 0
jne 0x4018e3
mov esi, dword [esi + 0x108]
add esi, 4
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x401905
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, edi
call fcn.00401660
test al, al
sete al
pop esi
ret
mov al, 1
pop esi
ret
Function at 0x401910
Capabilities:
Delete directory
Delete file

Disassembly:
sub esp, 0x804
mov eax, dword [0x5405a0]
xor eax, esp
mov dword [esp + 0x800], eax
push esi
mov esi, dword [esp + 0x80c]
push 0x54b2d8
push esi
call fcn.004cd198
add esp, 8
test eax, eax
jne 0x401a6f
mov eax, 0x4000
test word [0x54b2de], ax
je 0x401a68
push edi
push esi
push str._s.
lea edx, [esp + 0x10]
call fcn.004023a0
add esp, 8
push 0x54b088
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x401a4a
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileW]
lea esp, [esp]
mov ecx, 0x521374
mov eax, 0x54b0b4
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4019c6
test dx, dx
je 0x4019c2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4019c6
add eax, 4
add ecx, 4
test dx, dx
jne 0x4019a0
xor eax, eax
jmp 0x4019cb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x401a32
mov ecx, 0x521378
mov eax, 0x54b0b4
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x401a06
test dx, dx
je 0x401a02
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x401a06
add eax, 4
add ecx, 4
test dx, dx
jne 0x4019e0
xor eax, eax
jmp 0x401a0b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x401a32
push 0x54b0b4
push esi
push 0x5213b4
lea edx, [esp + 0x18]
call fcn.004023a0
lea edx, [esp + 0x18]
push 1
push edx
call fcn.00401910
add esp, 0x14
push 0x54b088
push edi
call ebx
test eax, eax
jne 0x401990
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop ebx
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
pop edi
pop esi
mov ecx, dword [esp + 0x800]
xor ecx, esp
call fcn.004ccee1
add esp, 0x804
ret
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esp + 0x804]
pop esi
xor ecx, esp
call fcn.004ccee1
add esp, 0x804
ret
Function at 0x401a90
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x50cb7b
mov eax, dword fs:[0]
push eax
sub esp, 0x120
mov eax, dword [0x5405a0]
xor eax, esp
mov dword [esp + 0x118], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5405a0]
xor eax, esp
push eax
lea eax, [esp + 0x134]
mov dword fs:[0], eax
mov esi, ecx
cmp byte [esi + 0x112], 0
lea ebp, [esi + 4]
mov eax, ebp
jne 0x401ae1
mov eax, dword [ebp + 0x108]
push 2
add eax, 4
push 0x5213c4
push eax
call fcn.004cde12
add esp, 0xc
test eax, eax
je 0x401be2
mov ecx, esi
call fcn.004016a0
test al, al
je 0x401b17
cmp byte [esp + 0x144], 0
sete al
jmp 0x401be4
lea edi, [esp + 0x14]
call fcn.004023c0
mov ebx, edi
mov eax, esi
mov dword [esp + 0x13c], 0
call fcn.00401f90
test al, al
je 0x401b5e
mov eax, edi
call fcn.004014c0
test al, al
jne 0x401b5e
push 0
mov ecx, edi
call fcn.00401a90
test al, al
jne 0x401b5e
mov eax, edi
call fcn.004014a0
xor al, al
jmp 0x401be4
cmp byte [ebp + 0x10e], 0
mov eax, ebp
jne 0x401b6f
mov eax, dword [ebp + 0x108]
push 0
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x401ba4
cmp byte [esp + 0x126], al
jne 0x401ba0
mov eax, dword [esp + 0x120]
lea ecx, [esp + 0x18]
cmp eax, ecx
je 0x401ba0
push eax
call fcn.004ccef0
add esp, 4
xor al, al
jmp 0x401be4
cmp byte [ebp + 0x10e], 0
jne 0x401bb3
mov ebp, dword [ebp + 0x108]
lea ecx, [ebp + 4]
call fcn.00401380
call fcn.00402030
cmp byte [esp + 0x126], 0
jne 0x401be2
mov eax, dword [esp + 0x120]
lea edx, [esp + 0x18]
cmp eax, edx
je 0x401be2
push eax
call fcn.004ccef0
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x134]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x118]
xor ecx, esp
call fcn.004ccee1
add esp, 0x12c
ret 4
Function at 0x401c10
Capabilities:
Copy file
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x50cb7b
mov eax, dword fs:[0]
push eax
sub esp, 0x120
mov eax, dword [0x5405a0]
xor eax, esp
mov dword [esp + 0x118], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5405a0]
xor eax, esp
push eax
lea eax, [esp + 0x134]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x144]
lea edi, [esp + 0x14]
mov esi, ecx
call fcn.004023c0
mov ebx, edi
mov eax, esi
mov dword [esp + 0x13c], 0
call fcn.00401f90
test al, al
je 0x401caa
push 0
mov ecx, edi
call fcn.00401a90
test al, al
jne 0x401caa
cmp byte [esp + 0x126], al
jne 0x401ca3
mov eax, dword [esp + 0x120]
lea ecx, [esp + 0x18]
cmp eax, ecx
je 0x401ca3
push eax
call fcn.004ccef0
add esp, 4
xor al, al
jmp 0x401d7d
cmp byte [esi + 0x112], 0
lea edi, [esi + 4]
mov eax, edi
jne 0x401cbe
mov eax, dword [edi + 0x108]
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0x80
add eax, 4
push eax
call ebx
cmp byte [edi + 0x10e], 0
mov ecx, edi
jne 0x401ce0
mov ecx, dword [edi + 0x108]
cmp byte [ebp + 0x112], 0
lea eax, [ebp + 4]
jne 0x401cf2
mov eax, dword [eax + 0x108]
push 0
add ecx, 4
push ecx
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x401d21
cmp byte [esp + 0x126], al
jne 0x401ca3
mov eax, dword [esp + 0x120]
lea edx, [esp + 0x18]
cmp eax, edx
jmp 0x401c98
cmp byte [edi + 0x10e], 0
mov eax, edi
jne 0x401d32
mov eax, dword [edi + 0x108]
push 0x80
add eax, 4
push eax
call ebx
cmp byte [edi + 0x10e], 0
jne 0x401d4c
mov edi, dword [edi + 0x108]
lea ecx, [edi + 4]
call fcn.00401380
call fcn.00402030
cmp byte [esp + 0x126], 0
jne 0x401d7b
mov eax, dword [esp + 0x120]
lea ecx, [esp + 0x18]
cmp eax, ecx
je 0x401d7b
push eax
call fcn.004ccef0
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x134]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x118]
xor ecx, esp
call fcn.004ccee1
add esp, 0x12c
ret 4
Function at 0x401db0
Capabilities:
Move file
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x50cb7b
mov eax, dword fs:[0]
push eax
sub esp, 0x120
mov eax, dword [0x5405a0]
xor eax, esp
mov dword [esp + 0x118], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5405a0]
xor eax, esp
push eax
lea eax, [esp + 0x134]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x144]
lea edi, [esp + 0x14]
mov esi, ecx
call fcn.004023c0
mov ebx, edi
mov eax, esi
mov dword [esp + 0x13c], 0
call fcn.00401f90
test al, al
je 0x401e4a
push 0
mov ecx, edi
call fcn.00401a90
test al, al
jne 0x401e4a
cmp byte [esp + 0x126], al
jne 0x401e43
mov eax, dword [esp + 0x120]
lea ecx, [esp + 0x18]
cmp eax, ecx
je 0x401e43
push eax
call fcn.004ccef0
add esp, 4
xor al, al
jmp 0x401efc
cmp byte [esi + 0x112], 0
lea edi, [esi + 4]
mov ecx, edi
jne 0x401e5e
mov ecx, dword [edi + 0x108]
cmp byte [ebp + 0x112], 0
lea eax, [ebp + 4]
jne 0x401e70
mov eax, dword [eax + 0x108]
push 0xb
add ecx, 4
push ecx
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x401e9c
cmp byte [esp + 0x126], al
jne 0x401e43
mov eax, dword [esp + 0x120]
lea edx, [esp + 0x18]
cmp eax, edx
jmp 0x401e38
cmp byte [edi + 0x10e], 0
mov eax, edi
jne 0x401ead
mov eax, dword [edi + 0x108]
push 0x80
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp byte [edi + 0x10e], 0
jne 0x401ecb
mov edi, dword [edi + 0x108]
lea ecx, [edi + 4]
call fcn.00401380
call fcn.00402030
cmp byte [esp + 0x126], 0
jne 0x401efa
mov eax, dword [esp + 0x120]
lea ecx, [esp + 0x18]
cmp eax, ecx
je 0x401efa
push eax
call fcn.004ccef0
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x134]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x118]
xor ecx, esp
call fcn.004ccee1
add esp, 0x12c
ret 4
Function at 0x4055f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x509968
mov eax, dword fs:[0]
push eax
mov eax, dword [0x5405a0]
xor eax, esp
push eax
lea eax, [esp + 4]
mov dword fs:[0], eax
mov eax, dword [esp + 0x14]
xor ecx, ecx
mov byte [eax + 4], cl
mov dword [eax + 8], str.Cell
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x20], fcn.004ccfcd
mov dword [eax + 0x24], fcn.004cf168
mov dword [eax + 0x28], fcn.004ccef0
mov dword [eax + 0x2c], ecx
mov ecx, dword [esp + 0x18]
mov dword [eax], vtable.n_config::t_arraySection_class_t_configSystemUpdateListFile::t_recommend_.0
mov dword [eax + 0x30], ecx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
pop ecx
add esp, 0xc
ret 8

Function at 0x4059f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x509968
mov eax, dword fs:[0]
push eax
mov eax, dword [0x5405a0]
xor eax, esp
push eax
lea eax, [esp + 4]
mov dword fs:[0], eax
mov eax, dword [esp + 0x14]
xor ecx, ecx
mov byte [eax + 4], cl
mov dword [eax + 8], str.Cell
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x20], fcn.004ccfcd
mov dword [eax + 0x24], fcn.004cf168
mov dword [eax + 0x28], fcn.004ccef0
mov dword [eax + 0x2c], ecx
mov ecx, dword [esp + 0x18]
mov dword [eax], vtable.n_config::t_arraySection_class_t_configSystemCloudPicListFile::t_recommend_.0
mov dword [eax + 0x30], ecx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
pop ecx
add esp, 0xc
ret 8

Function at 0x409770
Capabilities:
Create thread
Resume thread

Disassembly:
push esi
push edi
push 0
push 4
mov esi, ecx
push esi
push 0x409730
push 0
push 0
call fcn.004d0cd7
mov edi, eax
add esp, 0x18
test edi, edi
je 0x4097d7
cmp dword [esi + 0x10], 0
je 0x4097d0
mov eax, dword [esi + 0x10]
mov edx, dword [esi]
push ebx
mov ebx, dword [eax]
mov eax, dword [edx + 0xc]
push edi
mov ecx, esi
call eax
mov ecx, dword [esi + 0x10]
mov edx, dword [ebx + 0x14]
push eax
call edx
pop ebx
test al, al
je 0x4097d0
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov al, 1
pop esi
ret
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor al, al
pop esi
ret
Function at 0x409bf0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x509def
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x5405a0]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x2c]
xor ebx, ebx
lea edi, [esi + 0x34]
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
call fcn.004023c0
lea ecx, [esi + 0x150]
mov dword [esp + 0x24], ebx
xor eax, eax
mov dword [ecx], vtable.t_mutex.0
mov dword [ecx + 4], ebx
mov dword [ecx + 0x210], 1
mov word [ecx + 8], ax
lea edi, [esi + 0x364]
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov dword [edi + 0x10], fcn.004ccfcd
mov dword [edi + 0x14], fcn.004cf168
mov dword [edi + 0x18], fcn.004ccef0
mov byte [esp + 0x14], bl
mov dword [esp + 0x10], ebx
mov byte [esp + 0x24], 3
mov edx, dword [ecx]
mov edx, dword [edx + 4]
push str.LocalInstall_PicFace_Proc_Mutex
lea eax, [esp + 0x14]
push eax
call edx
test al, al
jne 0x409cbb
lea ecx, [esp + 0x10]
call fcn.004394a0
mov dword [esi + 0x14c], ebx
call fcn.004131d0
lea ecx, [esp + 0x10]
mov byte [esp + 0x24], 2
call fcn.004393f0
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x18
ret 4
Function at 0x40df60
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x510e8c
mov eax, dword fs:[0]
push eax
sub esp, 0x274
mov eax, dword [0x5405a0]
xor eax, esp
mov dword [esp + 0x270], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5405a0]
xor eax, esp
push eax
lea eax, [esp + 0x288]
mov dword fs:[0], eax
mov esi, ecx
mov eax, str.http:__config.pinyin.sogou.com_picface_interface_get_picface_label_list.php
mov edx, esi
call fcn.0043a2e0
push esi
call fcn.00428b90
add esp, 4
push str.ver
push 0x52139c
mov edx, esi
call fcn.0043a8a0
add esp, 8
lea ecx, [esp + 0x15c]
call fcn.0043a090
xor ebx, ebx
lea edi, [esp + 0x15c]
mov dword [esp + 0x290], ebx
call fcn.00403180
lea eax, [esp + 0x168]
cmp byte [esp + 0x278], bl
jne 0x40dffe
mov eax, dword [esp + 0x164]
add eax, 4
push eax
push 0x52139c
mov edx, esi
call fcn.0043a8a0
push str.Lver
push 0x52139c
mov edx, esi
call fcn.0043a8a0
add esp, 0x10
call fcn.00442f80
cmp word [eax + 0x4d4], bx
lea edi, [eax + 0x4d4]
jne 0x40e057
mov ebp, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push edi
push ebx
push ebx
push 0x23
push ebx
call ebp
test eax, eax
je 0x40e057
push edi
push 1
push ebx
push 0x23
push ebx
call ebp
test eax, eax
je 0x40e057
xor edi, edi
push ebx
push ebx
push ebx
push 0x52140c
push str.SogouInputComponentsPicfaceJson
push edi
lea ecx, [esp + 0x4c]
call fcn.00436ef0
mov byte [esp + 0x290], 1
lea eax, [esp + 0x40]
cmp byte [esp + 0x150], bl
jne 0x40e087
mov eax, dword [esp + 0x3c]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40e162
shr eax, 4
not al
and al, 1
je 0x40e162
mov byte [esp + 0x30], bl
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x24], bl
mov dword [esp + 0x28], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov byte [esp + 0x290], 3
lea eax, [esp + 0x40]
cmp byte [esp + 0x150], bl
jne 0x40e0d8
mov eax, dword [esp + 0x3c]
push ebx
lea ecx, [eax + 4]
lea edx, [esp + 0x20]
call fcn.0042c5f0
add esp, 4
test al, al
je 0x40e12a
cmp byte [esp + 0x24], bl
je 0x40e12a
mov eax, dword [esp + 0x28]
push eax
push 0x52139c
mov edx, esi
call fcn.0043a8a0
add esp, 8
lea edi, [esp + 0x1c]
mov byte [esp + 0x290], 2
call fcn.00431b30
lea ecx, [esp + 0x2c]
mov byte [esp + 0x290], 1
call fcn.004393f0
jmp 0x40e176
push 0x522100
push 0x52139c
mov edx, esi
call fcn.0043a8a0
add esp, 8
lea edi, [esp + 0x1c]
mov byte [esp + 0x290], 2
call fcn.00431b30
lea ecx, [esp + 0x2c]
mov byte [esp + 0x290], 1
call fcn.004393f0
jmp 0x40e176
push 0x522100
push 0x52139c
mov edx, esi
call fcn.0043a8a0
add esp, 8
mov esi, vtable.t_str.0
mov dword [esp + 0x34], esi
cmp byte [esp + 0x150], bl
jne 0x40e19d
mov eax, dword [esp + 0x3c]
lea ecx, [esp + 0x40]
cmp eax, ecx
je 0x40e19d
push eax
call fcn.004ccef0
add esp, 4
mov dword [esp + 0x15c], esi
cmp byte [esp + 0x278], bl
jne 0x40e1c8
mov eax, dword [esp + 0x164]
lea edx, [esp + 0x168]
cmp eax, edx
je 0x40e1c8
push eax
call fcn.004ccef0
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x288]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x270]
xor ecx, esp
call fcn.004ccee1
add esp, 0x280
ret