joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d6cb8
Capabilities:
Check if file exists

Disassembly:
push 0x18
mov eax, 0x534eff
call fcn.004f22ff
mov esi, ecx
push str.Magic_DesktopShortcut_Begin_r_n
xor ebx, ebx
push 0x5aea00
mov dword [ebp - 0x14], ebx
call fcn.004de360
pop ecx
pop ecx
call fcn.00437474
push eax
lea ecx, [ebp - 0x10]
call fcn.0043a4ef
lea eax, [ebp - 0x10]
mov dword [ebp - 4], ebx
push eax
mov ecx, esi
call fcn.004d437a
lea eax, [ebp - 0x10]
push eax
call fcn.004cfddf
pop ecx
call fcn.00437474
push eax
lea ecx, [ebp - 0x18]
call fcn.0043a4ef
lea eax, [ebp - 0x18]
inc ebx
push eax
mov ecx, esi
mov byte [ebp - 4], bl
call fcn.004d4b53
call fcn.00437474
push eax
lea ecx, [ebp - 0x1c]
call fcn.0043a4ef
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 2
push eax
mov ecx, esi
call fcn.004d4bbe
call fcn.00437474
push eax
lea ecx, [ebp - 0x20]
call fcn.0043a4ef
lea eax, [esi + 0x11c]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp - 0x20]
mov ecx, esi
push eax
call fcn.004d4c29
mov ecx, esi
call fcn.004d6ec9
push 0x542464
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.0045922d
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0xc
push dword [eax]
call edi
test eax, eax
jne 0x4d6d95
cmp dword [esi + 0x11c], eax
jne 0x4d6d95
mov byte [ebp - 0x14], bl
mov ecx, dword [ebp - 0x24]
lea ecx, [ecx - 0x10]
call fcn.00436fdb
cmp byte [ebp - 0x14], 0
mov esi, dword [ebp - 0x18]
je 0x4d6de4
push 0x542464
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.0045922d
push str.Liebao
push esi
push dword [eax]
mov byte [ebp - 4], 4
push str.__lbwx___ico7
push esi
call fcn.004cd452
mov ecx, dword [ebp - 0x24]
add esp, 0x20
mov byte [ebp - 4], 3
lea ecx, [ecx - 0x10]
call fcn.00436fdb
push 0x5421c4
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.0045922d
add esp, 0xc
push dword [eax]
call edi
mov ecx, dword [ebp - 0x24]
mov ebx, eax
neg ebx
sbb bl, bl
add ecx, 0xfffffff0
call fcn.00436fdb
mov edi, dword [ebp - 0x1c]
inc bl
je 0x4d6e85
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
lea eax, [ebp - 0x10]
push 0x5421c4
push eax
lea eax, [ebp - 0x24]
push eax
je 0x4d6e54
call fcn.0045922d
push str.Liebao
push edi
push dword [eax]
mov byte [ebp - 4], 5
push str.__ico1
push esi
call fcn.004cd0f0
mov ecx, dword [ebp - 0x24]
add esp, 0x20
add ecx, 0xfffffff0
jmp 0x4d6e78
call fcn.0045922d
push str.Liebao
push dword [eax]
mov byte [ebp - 4], 6
push str.__ico1
push esi
call fcn.004cd2e9
mov ecx, dword [ebp - 0x24]
add esp, 0x1c
lea ecx, [ecx - 0x10]
mov byte [ebp - 4], 3
mov ebx, eax
call fcn.00436fdb
jmp 0x4d6e88
xor ebx, ebx
inc ebx
push ebx
push str.Magic_DesktopShortcut_End_bRet___d_r_n
push 0x5aea00
call fcn.004de360
mov ecx, dword [ebp - 0x20]
add esp, 0xc
lea ecx, [ecx - 0x10]
call fcn.00436fdb
lea ecx, [edi - 0x10]
call fcn.00436fdb
lea ecx, [esi - 0x10]
call fcn.00436fdb
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00436fdb
mov eax, ebx
call fcn.004f22cd
ret
Function at 0x4d6ec9
Capabilities:
Check if file exists
Delete file

Disassembly:
push 8
mov eax, 0x534f22
call fcn.004f22ff
mov esi, ecx
push str.Magic_DesktopShortcutClear_Begin_r_n
push 0x5aea00
call fcn.004de360
pop ecx
pop ecx
call fcn.00437474
push eax
lea ecx, [ebp - 0x10]
call fcn.0043a4ef
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
mov ecx, esi
call fcn.004d437a
lea eax, [ebp - 0x10]
push eax
call fcn.004cfddf
lea eax, [ebp - 0x10]
mov dword [esp], 0x542450
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0045922d
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0xc
push dword [eax]
call ebx
mov ecx, dword [ebp - 0x14]
mov esi, eax
add ecx, 0xfffffff0
call fcn.00436fdb
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
test esi, esi
je 0x4d6f6a
push 0x542450
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0045922d
add esp, 0xc
push dword [eax]
call edi
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00436fdb
push 0x5421c4
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0045922d
add esp, 0xc
push dword [eax]
call ebx
mov ecx, dword [ebp - 0x14]
mov esi, eax
add ecx, 0xfffffff0
call fcn.00436fdb
test esi, esi
je 0x4d6fb8
push 0x5421c4
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0045922d
add esp, 0xc
push dword [eax]
call edi
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00436fdb
push 0x542464
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0045922d
add esp, 0xc
push dword [eax]
call ebx
mov ecx, dword [ebp - 0x14]
mov esi, eax
add ecx, 0xfffffff0
call fcn.00436fdb
test esi, esi
je 0x4d7006
push 0x542464
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0045922d
add esp, 0xc
push dword [eax]
call edi
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00436fdb
push str.Magic_DesktopShortcutClear_End_r_n
push 0x5aea00
call fcn.004de360
pop ecx
pop ecx
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00436fdb
call fcn.004f22cd
ret
Function at 0x4d7cb1
Capabilities:
Check if file exists
Create process on windows
Delete file

Disassembly:
push 0x14
mov eax, 0x535080
call fcn.004f22ff
mov esi, ecx
push str.Magic_StartMenuQuickLaunchShortcut_Begin_r_n
push 0x5aea00
call fcn.004de360
pop ecx
pop ecx
xor ebx, ebx
call fcn.00437474
push eax
lea ecx, [ebp - 0x1c]
call fcn.0043a4ef
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], ebx
push eax
mov ecx, esi
call fcn.004d4bbe
mov ecx, esi
call fcn.004d7e6b
call fcn.004cfbcc
test eax, eax
je 0x4d7e58
call fcn.00437474
push eax
lea ecx, [ebp - 0x10]
call fcn.0043a4ef
lea eax, [esi + 4]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x10]
call fcn.0043c2e8
lea eax, [ebp - 0x10]
push eax
call fcn.004cfddf
pop ecx
call fcn.00437474
push eax
lea ecx, [ebp - 0x14]
call fcn.0043a4ef
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 2
push eax
mov ecx, esi
call fcn.004d4b53
call fcn.00437474
push eax
lea ecx, [ebp - 0x18]
call fcn.0043a4ef
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 3
push eax
mov ecx, esi
call fcn.004d4bbe
mov edi, dword [ebp - 0x18]
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ebx, 0x5421c4
test eax, eax
push ebx
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x20]
push eax
je 0x4d7da4
call fcn.0045922d
mov esi, dword [ebp - 0x14]
push str.Liebao
push edi
push dword [eax]
mov byte [ebp - 4], 4
push str.__ico4
push esi
call fcn.004cd0f0
add esp, 0x20
jmp 0x4d7dc5
call fcn.0045922d
mov esi, dword [ebp - 0x14]
push str.Liebao
push dword [eax]
mov byte [ebp - 4], 5
push str.__ico4
push esi
call fcn.004cd2e9
add esp, 0x1c
mov ecx, dword [ebp - 0x20]
lea ecx, [ecx - 0x10]
call fcn.00436fdb
lea ecx, [edi - 0x10]
call fcn.00436fdb
lea ecx, [esi - 0x10]
mov byte [ebp - 4], 1
call fcn.00436fdb
push ebx
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.0045922d
add esp, 0xc
xor ecx, ecx
push 1
push ecx
push ecx
push dword [eax]
push str.startpin
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 0x20]
mov esi, eax
lea ecx, [ecx - 0x10]
call fcn.00436fdb
push esi
push str.ShellExecute_ret0x_x_r_n
push 0x5aea00
call fcn.004de360
push ebx
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.0045922d
add esp, 0x18
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0x20]
lea ecx, [ecx - 0x10]
call fcn.00436fdb
mov ecx, dword [ebp - 0x10]
xor ebx, ebx
add ecx, 0xfffffff0
inc ebx
call fcn.00436fdb
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.00436fdb
mov eax, ebx
call fcn.004f22cd
ret
Function at 0x4d7e6b
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push 8
mov eax, 0x5350a3
call fcn.004f22ff
push str.Magic_StartMenuQuickLaunchShortcutClear_Begin_r_n
push 0x5aea00
call fcn.004de360
pop ecx
pop ecx
call fcn.004cfbcc
test eax, eax
je 0x4d8047
call fcn.00437474
push eax
lea ecx, [ebp - 0x10]
call fcn.0043a4ef
xor ebx, ebx
lea ecx, [ebp - 0x10]
push 0x104
mov dword [ebp - 4], ebx
call fcn.0043a522
push eax
push ebx
push 0x1a
push ebx
call fcn.004d0122
add esp, 0x10
lea ecx, [ebp - 0x10]
push 0xffffffffffffffff
call fcn.0043c298
mov esi, str.MicrosoftInternet_ExplorerQuick_LaunchUser_PinnedStartMenu_
push esi
call fcn.0043a8c3
pop ecx
push eax
push esi
lea ecx, [ebp - 0x10]
call fcn.004516f5
push 0x5421c4
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0045922d
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0xc
push dword [eax]
call ebx
mov ecx, dword [ebp - 0x14]
mov esi, eax
add ecx, 0xfffffff0
call fcn.00436fdb
mov edi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
test esi, esi
je 0x4d7f5c
push 0x5421c4
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0045922d
add esp, 0xc
xor ecx, ecx
push ecx
push ecx
push ecx
push dword [eax]
push str.startunpin
push ecx
call edi
mov ecx, dword [ebp - 0x14]
mov esi, eax
add ecx, 0xfffffff0
call fcn.00436fdb
push esi
push str.ShellExecute_ret0x_x_r_n
push 0x5aea00
call fcn.004de360
add esp, 0xc
push 0x542450
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0045922d
add esp, 0xc
push dword [eax]
call ebx
mov ecx, dword [ebp - 0x14]
mov esi, eax
add ecx, 0xfffffff0
call fcn.00436fdb
test esi, esi
je 0x4d7fca
push 0x542450
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0045922d
add esp, 0xc
xor ecx, ecx
push ecx
push ecx
push ecx
push dword [eax]
push str.startunpin
push ecx
call edi
mov ecx, dword [ebp - 0x14]
mov esi, eax
add ecx, 0xfffffff0
call fcn.00436fdb
push esi
push str.ShellExecute_ret0x_x_r_n
push 0x5aea00
call fcn.004de360
add esp, 0xc
push 0x542a0c
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0045922d
add esp, 0xc
push dword [eax]
call ebx
mov ecx, dword [ebp - 0x14]
mov esi, eax
add ecx, 0xfffffff0
call fcn.00436fdb
test esi, esi
je 0x4d8038
push 0x542a0c
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0045922d
add esp, 0xc
xor ecx, ecx
push ecx
push ecx
push ecx
push dword [eax]
push str.startunpin
push ecx
call edi
mov ecx, dword [ebp - 0x14]
mov esi, eax
add ecx, 0xfffffff0
call fcn.00436fdb
push esi
push str.ShellExecute_ret0x_x_r_n
push 0x5aea00
call fcn.004de360
add esp, 0xc
mov ecx, dword [ebp - 0x10]
or dword [ebp - 4], 0xffffffff
lea ecx, [ecx - 0x10]
call fcn.00436fdb
push str.Magic_StartMenuQuickLaunchShortcutClear_End_r_n
push 0x5aea00
call fcn.004de360
pop ecx
pop ecx
call fcn.004f22cd
ret
Function at 0x4d85f1
Capabilities:
Check if file exists

Disassembly:
push 0x28
mov eax, 0x53521d
call fcn.004f2332
mov edi, ecx
lea ebx, [edi + 4]
push dword [ebx]
lea ecx, [ebp - 0x28]
call fcn.00417260
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
call fcn.004cfe1f
mov esi, str.liebao.exe
push esi
call fcn.00416680
pop ecx
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00418190
call fcn.00437474
push eax
lea ecx, [ebp - 0x2c]
call fcn.0043a4ef
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4d869d
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x2c]
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push ecx
push eax
call fcn.004ce00f
pop ecx
pop ecx
lea esi, [edi + 0x14]
push ebx
mov ecx, esi
call fcn.0043c2e8
push esi
call fcn.004cfddf
mov eax, dword [ebp - 0x2c]
pop ecx
mov ecx, esi
push dword [eax - 0xc]
push eax
call fcn.004516f5
push esi
lea ecx, [edi + 0x10]
call fcn.0043c2e8
jmp 0x4d8769
call fcn.00437474
push eax
lea ecx, [ebp - 0x34]
call fcn.0043a4ef
lea eax, [ebp - 0x34]
mov byte [ebp - 4], 2
push eax
call fcn.004cdd29
mov eax, dword [ebp - 0x34]
add eax, 0xfffffff0
push eax
call fcn.0043c35e
add eax, 0x10
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 3
push eax
call fcn.004cfddf
mov esi, str.knbcenter.exe
push esi
call fcn.0043a8c3
add esp, 0x10
lea ecx, [ebp - 0x30]
push eax
push esi
call fcn.004516f5
mov esi, str.LBBrowser
push esi
push dword [ebp - 0x30]
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
jne 0x4d8712
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x30]
call fcn.004ce00f
pop ecx
pop ecx
jmp 0x4d8723
push esi
call fcn.0043a8c3
pop ecx
push eax
push esi
lea ecx, [ebp - 0x2c]
call fcn.0043a84a
lea esi, [edi + 0x14]
push ebx
mov ecx, esi
call fcn.0043c2e8
push esi
call fcn.004cfddf
mov eax, dword [ebp - 0x2c]
pop ecx
mov ecx, esi
push dword [eax - 0xc]
push eax
call fcn.004516f5
push esi
call fcn.004cfddf
pop ecx
push esi
lea ecx, [edi + 0x10]
call fcn.0043c2e8
mov ecx, dword [ebp - 0x30]
lea ecx, [ecx - 0x10]
call fcn.00436fdb
mov ecx, dword [ebp - 0x34]
lea ecx, [ecx - 0x10]
call fcn.00436fdb
mov ecx, dword [ebp - 0x2c]
lea ecx, [ecx - 0x10]
call fcn.00436fdb
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.00417d20
call fcn.004f22e1
ret
Function at 0x4d929a
Capabilities:
Copy file

Disassembly:
push 0x28
mov eax, 0x5353dd
call fcn.004f2332
mov edi, ecx
mov eax, dword [edi + 0x14]
sub eax, 0x10
push eax
call fcn.0043c35e
add eax, 0x10
mov dword [ebp - 0x30], eax
and dword [ebp - 4], 0
lea eax, [ebp - 0x30]
push eax
call fcn.004cfddf
mov esi, str.DataPresetExtensionsPreferences
push esi
call fcn.0043a8c3
add esp, 0xc
lea ecx, [ebp - 0x30]
push eax
push esi
call fcn.004516f5
mov eax, dword [edi + 0x20]
sub eax, 0x10
push eax
call fcn.0043c35e
add eax, 0x10
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 1
push eax
call fcn.004cfddf
mov esi, str.old_skin_preferences
push esi
call fcn.0043a8c3
add esp, 0xc
lea ecx, [ebp - 0x2c]
push eax
push esi
call fcn.004516f5
mov eax, dword [ebp - 0x2c]
cmp dword [eax - 4], 1
jle 0x4d932d
push dword [eax - 0xc]
lea ecx, [ebp - 0x2c]
call fcn.0043a8e3
mov eax, dword [ebp - 0x2c]
push ecx
push ecx
mov esi, esp
mov dword [esi], eax
test eax, eax
je 0x4d933e
push eax
call fcn.00416680
pop ecx
lea ecx, [ebp - 0x28]
mov dword [esi + 4], eax
call fcn.004195a0
push 0
push eax
mov byte [ebp - 4], 2
call fcn.0041b8d0
pop ecx
pop ecx
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
mov bl, al
call fcn.00419620
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test bl, bl
jne 0x4d9387
call esi
push eax
push dword [ebp - 0x2c]
push str.CopySkinPreferences_Delete_dst_ws_fail_errcode_d_r_n
push 0x5aea00
call fcn.004de360
add esp, 0x10
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
push str.CopySkinPreferences_CopyFile_src_ws_dst_ws_r_n
push 0x5aea00
call fcn.004de360
add esp, 0x10
push 1
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x4d93c6
call esi
push eax
push str.CopySkinPreferences_CopyFile__errcode_d_r_n
push 0x5aea00
call fcn.004de360
add esp, 0xc
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], 4
push eax
lea ecx, [edi + 0xe4]
call fcn.00433210
mov ecx, dword [ebp - 0x2c]
lea ecx, [ecx - 0x10]
call fcn.00436fdb
mov ecx, dword [ebp - 0x30]
lea ecx, [ecx - 0x10]
call fcn.00436fdb
call fcn.004f22e1
ret
Function at 0x4d93f8
Capabilities:
Check if file exists
Delete file

Disassembly:
push 0x14
mov eax, 0x535432
call fcn.004f22ff
mov esi, ecx
push str.Begin_PM_Req_Create17zyDesktopLnk___r_n
push 0x5aea00
call fcn.004de360
pop ecx
pop ecx
call fcn.00437474
push eax
lea ecx, [ebp - 0x18]
call fcn.0043a4ef
and dword [ebp - 4], 0
lea eax, [ebp - 0x18]
push str.http:__www.17zuoye.com__fromliebao
push 0x55e2e4
push eax
call fcn.0043ab29
add esp, 0xc
call fcn.00437474
push eax
lea ecx, [ebp - 0x14]
call fcn.0043a4ef
lea eax, [esi + 8]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x14]
call fcn.0043c2e8
lea eax, [ebp - 0x14]
push eax
call fcn.004cfddf
mov edi, str.17zuoye.ico
push edi
call fcn.0043a8c3
pop ecx
pop ecx
push eax
push edi
lea ecx, [ebp - 0x14]
call fcn.004516f5
call fcn.00437474
push eax
lea ecx, [ebp - 0x1c]
call fcn.0043a4ef
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 2
push eax
mov ecx, esi
call fcn.004d4b53
call fcn.00437474
push eax
lea ecx, [ebp - 0x10]
call fcn.0043a4ef
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 3
push eax
mov ecx, esi
call fcn.004d437a
lea eax, [ebp - 0x10]
push eax
call fcn.004cfddf
mov esi, 0x541678
lea eax, [ebp - 0x10]
push esi
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.0045922d
add esp, 0x10
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0x20]
lea ecx, [ecx - 0x10]
call fcn.00436fdb
push dword [ebp - 0x14]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
lea eax, [ebp - 0x10]
push esi
push eax
lea eax, [ebp - 0x20]
push eax
je 0x4d9542
call fcn.0045922d
mov esi, dword [ebp - 0x18]
mov edi, dword [ebp - 0x1c]
push str.liebao
push dword [ebp - 0x14]
mov byte [ebp - 4], 4
push dword [eax]
push esi
push edi
call fcn.004cd0f0
mov ecx, dword [ebp - 0x20]
add esp, 0x20
add ecx, 0xfffffff0
mov byte [ebp - 4], 3
mov ebx, eax
call fcn.00436fdb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
push str.PM_Req_Create17zyDesktopLnk___CreateShellLink2_bRet_d_errcode_d_r_n
jmp 0x4d9580
call fcn.0045922d
mov esi, dword [ebp - 0x18]
mov edi, dword [ebp - 0x1c]
push str.liebao
push dword [eax]
mov byte [ebp - 4], 5
push esi
push edi
call fcn.004cd2e9
mov ecx, dword [ebp - 0x20]
add esp, 0x1c
add ecx, 0xfffffff0
mov byte [ebp - 4], 3
mov ebx, eax
call fcn.00436fdb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
push str.PM_Req_Create17zyDesktopLnk_CreateShellLink_bRet_d_errcode_d_r_n
mov ebx, 0x5aea00
push ebx
call fcn.004de360
add esp, 0x10
push str.End_PM_Req_Create17zyDesktopLnk___r_n
push ebx
call fcn.004de360
pop ecx
pop ecx
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00436fdb
lea ecx, [edi - 0x10]
call fcn.00436fdb
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00436fdb
lea ecx, [esi - 0x10]
call fcn.00436fdb
call fcn.004f22cd
ret
Function at 0x4d9863
Capabilities:
Check if file exists
Delete file

Disassembly:
push 0x18
mov eax, 0x5354d0
call fcn.004f22ff
mov esi, ecx
push str.Begin_PM_Req_CreateURLDesktopLnk___r_n
push 0x5aea00
call fcn.004de360
pop ecx
pop ecx
call fcn.00437474
push eax
lea ecx, [ebp - 0x1c]
call fcn.0043a4ef
push str.https:__www.duba.com__fliebaoins
lea eax, [ebp - 0x1c]
xor ebx, ebx
push 0x55e2e4
push eax
mov dword [ebp - 0x24], ebx
mov dword [ebp - 4], ebx
call fcn.0043ab29
mov eax, dword [esi + 8]
sub eax, 0x10
push eax
call fcn.0043c35e
add eax, 0x10
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 1
push eax
call fcn.004cfddf
mov edi, str.Dataduba123ie.ico
push edi
call fcn.0043a8c3
add esp, 0x18
lea ecx, [ebp - 0x14]
push eax
push edi
call fcn.004516f5
call fcn.00437474
push eax
lea ecx, [ebp - 0x20]
call fcn.0043a4ef
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 2
push eax
mov ecx, esi
call fcn.004d4b53
call fcn.00437474
push eax
lea ecx, [ebp - 0x10]
call fcn.0043a4ef
push 0x104
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 3
call fcn.0043a522
push eax
push ebx
push 0x19
push ebx
call fcn.004d0122
add esp, 0x10
lea ecx, [ebp - 0x10]
push 0xffffffffffffffff
call fcn.0043c298
lea eax, [ebp - 0x10]
push eax
call fcn.004cfddf
mov esi, 0x5412f8
lea eax, [ebp - 0x10]
push esi
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.0045922d
add esp, 0x10
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.00436fdb
push dword [ebp - 0x14]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edi, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x20]
test eax, eax
je 0x4d99ce
push esi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.0045922d
push str.Liebao
push dword [ebp - 0x14]
mov byte [ebp - 4], 4
push dword [eax]
push edi
push ebx
call fcn.004cd0f0
mov ecx, dword [ebp - 0x18]
add esp, 0x20
mov esi, eax
mov byte [ebp - 4], 3
add ecx, 0xfffffff0
mov dword [ebp - 0x24], esi
call fcn.00436fdb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.PM_Req_CreateURLDesktopLnk___CreateShellLink2_bRet_d_errcode_d_r_n
push 0x5aea00
call fcn.004de360
add esp, 0x10
lea ecx, [ebp - 0x18]
call fcn.004d22f7
mov esi, dword [ebp - 0x18]
mov byte [ebp - 4], 5
test esi, esi
je 0x4d99f6
push 0xe6
mov ecx, esi
call fcn.00497768
push 1
mov ecx, esi
call fcn.004972d2
cmp dword [ebp - 0x24], 0
jne 0x4d9a04
test esi, esi
je 0x4d9a11
push 2
jmp 0x4d9a0a
test esi, esi
je 0x4d9a11
push 3
mov ecx, esi
call fcn.004972d2
lea ecx, [ebp - 0x18]
call fcn.004dab90
push str.End_PM_Req_CreateURLDesktopLnk___r_n
push 0x5aea00
call fcn.004de360
pop ecx
pop ecx
mov ecx, dword [ebp - 0x18]
mov byte [ebp - 4], 3
test ecx, ecx
je 0x4d9a3b
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00436fdb
lea ecx, [ebx - 0x10]
call fcn.00436fdb
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00436fdb
lea ecx, [edi - 0x10]
call fcn.00436fdb
call fcn.004f22cd
ret
Function at 0x4d9c64
Capabilities:
Check if file exists

Disassembly:
push 8
mov eax, 0x535540
call fcn.004f22ff
mov edi, ecx
push str.PM_Req_RunSkinupdater_Begin_r_n
mov ebx, 0x5aea00
push ebx
call fcn.004de360
pop ecx
pop ecx
xor esi, esi
call fcn.00437474
push eax
lea ecx, [ebp - 0x10]
call fcn.0043a4ef
lea eax, [ebp - 0x10]
mov dword [ebp - 4], esi
push eax
mov ecx, edi
call fcn.004d5454
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4d9cfd
push 1
push esi
push 0x2710
push str.__skin_updater
push dword [ebp - 0x10]
call fcn.004cfeb6
mov esi, eax
add esp, 0x14
test esi, esi
jne 0x4d9ce5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp - 0x10]
push str.PM_Req_RunSkinupdater_RunApp_PathFileExists_ws_errcode_d
push ebx
call fcn.004de360
add esp, 0x10
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 6
push eax
lea ecx, [edi + 0xe4]
call fcn.00433210
jmp 0x4d9d0e
push dword [ebp - 0x10]
push str.PM_Req_RunSkinupdater_PathFileExists_ws_no_exists_r_n
push ebx
call fcn.004de360
add esp, 0xc
push esi
push str.PM_Req_RunSkinupdater_End_bRet_d_r_n
push ebx
call fcn.004de360
mov ecx, dword [ebp - 0x10]
add esp, 0xc
lea ecx, [ecx - 0x10]
call fcn.00436fdb
mov eax, esi
call fcn.004f22cd
ret
Function at 0x4da4e6
Capabilities:
Check if file exists
Create thread
Terminate thread

Disassembly:
push 0xc
mov eax, 0x535666
call fcn.004f22ff
mov esi, ecx
test byte [esi + 0x118], 2
jne 0x4da649
push str.PM_Req_XPQuickLanuchIconFirst_Begin_r_n
mov ebx, 0x5aea00
push ebx
call fcn.004de360
pop ecx
pop ecx
call fcn.004cfbcc
test eax, eax
jne 0x4da63c
push str.PM_Req_XPQuickLanuchIconFirst_OsIsVistaAndAfter_gnf_r_n
push ebx
call fcn.004de360
pop ecx
pop ecx
call fcn.00437474
push eax
lea ecx, [ebp - 0x14]
call fcn.0043a4ef
and dword [ebp - 4], 0
lea eax, [ebp - 0x14]
push eax
mov ecx, esi
call fcn.004d4b53
xor esi, esi
lea eax, [ebp - 0x18]
push eax
push esi
push esi
push 0x4a1d00
push esi
push esi
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, dword [ebp - 0x14]
mov ebx, eax
test ebx, ebx
je 0x4da62b
push 0xbb8
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x4da61c
push str.CreateAndAdjustQuickLaunch_timeout_r_n
push 0x5aea00
call fcn.004de360
pop ecx
pop ecx
push esi
push esi
push 0x12
push dword [ebp - 0x18]
call dword [sym.imp.USER32.dll_PostThreadMessageW]
call fcn.00437474
push eax
lea ecx, [ebp - 0x10]
call fcn.0043a4ef
push 0x104
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.0043a522
push eax
push esi
push 0x1a
push esi
call fcn.004d0122
add esp, 0x10
lea ecx, [ebp - 0x10]
push 0xffffffffffffffff
call fcn.0043c298
mov esi, 0x53c940
push esi
call fcn.0043a8c3
pop ecx
push eax
push esi
lea ecx, [ebp - 0x10]
call fcn.004516f5
mov esi, dword [ebp - 0x10]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4da612
push str.Liebao
push esi
push 0x55aff0
push edi
call fcn.004cd2e9
add esp, 0x10
lea ecx, [esi - 0x10]
call fcn.00436fdb
xor esi, esi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [ebp - 4], 0xffffffff
lea ecx, [edi - 0x10]
call fcn.00436fdb
mov ebx, 0x5aea00
push str.PM_Req_XPQuickLanuchIconFirst_End_r_n
push ebx
call fcn.004de360
pop ecx
pop ecx
call fcn.004f22cd
ret