joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d672e
Capabilities:
Check if file exists

Disassembly:
push 0x18
mov eax, 0x534858
call fcn.004f1d7f
mov esi, ecx
push str.Magic_DesktopShortcut_Begin_r_n
xor ebx, ebx
push 0x5aca00
mov dword [ebp - 0x14], ebx
call fcn.004dddd9
pop ecx
pop ecx
call fcn.00437474
push eax
lea ecx, [ebp - 0x10]
call fcn.0043a4ef
lea eax, [ebp - 0x10]
mov dword [ebp - 4], ebx
push eax
mov ecx, esi
call fcn.004d3e59
lea eax, [ebp - 0x10]
push eax
call fcn.004cf906
pop ecx
call fcn.00437474
push eax
lea ecx, [ebp - 0x18]
call fcn.0043a4ef
lea eax, [ebp - 0x18]
inc ebx
push eax
mov ecx, esi
mov byte [ebp - 4], bl
call fcn.004d4632
call fcn.00437474
push eax
lea ecx, [ebp - 0x1c]
call fcn.0043a4ef
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 2
push eax
mov ecx, esi
call fcn.004d469d
call fcn.00437474
push eax
lea ecx, [ebp - 0x20]
call fcn.0043a4ef
lea eax, [esi + 0x11c]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp - 0x20]
mov ecx, esi
push eax
call fcn.004d4708
mov ecx, esi
call fcn.004d693f
push 0x5410e4
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.0045922d
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0xc
push dword [eax]
call edi
test eax, eax
jne 0x4d680b
cmp dword [esi + 0x11c], eax
jne 0x4d680b
mov byte [ebp - 0x14], bl
mov ecx, dword [ebp - 0x24]
lea ecx, [ecx - 0x10]
call fcn.00436fdb
cmp byte [ebp - 0x14], 0
mov esi, dword [ebp - 0x18]
je 0x4d685a
push 0x5410e4
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.0045922d
push str.Liebao
push esi
push dword [eax]
mov byte [ebp - 4], 4
push str.__lbwx___ico7
push esi
call fcn.004ccf79
mov ecx, dword [ebp - 0x24]
add esp, 0x20
mov byte [ebp - 4], 3
lea ecx, [ecx - 0x10]
call fcn.00436fdb
push 0x540e44
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.0045922d
add esp, 0xc
push dword [eax]
call edi
mov ecx, dword [ebp - 0x24]
mov ebx, eax
neg ebx
sbb bl, bl
add ecx, 0xfffffff0
call fcn.00436fdb
mov edi, dword [ebp - 0x1c]
inc bl
je 0x4d68fb
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
lea eax, [ebp - 0x10]
push 0x540e44
push eax
lea eax, [ebp - 0x24]
push eax
je 0x4d68ca
call fcn.0045922d
push str.Liebao
push edi
push dword [eax]
mov byte [ebp - 4], 5
push str.__ico1
push esi
call fcn.004ccc17
mov ecx, dword [ebp - 0x24]
add esp, 0x20
add ecx, 0xfffffff0
jmp 0x4d68ee
call fcn.0045922d
push str.Liebao
push dword [eax]
mov byte [ebp - 4], 6
push str.__ico1
push esi
call fcn.004cce10
mov ecx, dword [ebp - 0x24]
add esp, 0x1c
lea ecx, [ecx - 0x10]
mov byte [ebp - 4], 3
mov ebx, eax
call fcn.00436fdb
jmp 0x4d68fe
xor ebx, ebx
inc ebx
push ebx
push str.Magic_DesktopShortcut_End_bRet___d_r_n
push 0x5aca00
call fcn.004dddd9
mov ecx, dword [ebp - 0x20]
add esp, 0xc
lea ecx, [ecx - 0x10]
call fcn.00436fdb
lea ecx, [edi - 0x10]
call fcn.00436fdb
lea ecx, [esi - 0x10]
call fcn.00436fdb
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00436fdb
mov eax, ebx
call fcn.004f1d4d
ret
Function at 0x4d693f
Capabilities:
Check if file exists
Delete file

Disassembly:
push 8
mov eax, 0x53487b
call fcn.004f1d7f
mov esi, ecx
push str.Magic_DesktopShortcutClear_Begin_r_n
push 0x5aca00
call fcn.004dddd9
pop ecx
pop ecx
call fcn.00437474
push eax
lea ecx, [ebp - 0x10]
call fcn.0043a4ef
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
mov ecx, esi
call fcn.004d3e59
lea eax, [ebp - 0x10]
push eax
call fcn.004cf906
lea eax, [ebp - 0x10]
mov dword [esp], 0x5410d0
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0045922d
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0xc
push dword [eax]
call ebx
mov ecx, dword [ebp - 0x14]
mov esi, eax
add ecx, 0xfffffff0
call fcn.00436fdb
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
test esi, esi
je 0x4d69e0
push 0x5410d0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0045922d
add esp, 0xc
push dword [eax]
call edi
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00436fdb
push 0x540e44
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0045922d
add esp, 0xc
push dword [eax]
call ebx
mov ecx, dword [ebp - 0x14]
mov esi, eax
add ecx, 0xfffffff0
call fcn.00436fdb
test esi, esi
je 0x4d6a2e
push 0x540e44
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0045922d
add esp, 0xc
push dword [eax]
call edi
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00436fdb
push 0x5410e4
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0045922d
add esp, 0xc
push dword [eax]
call ebx
mov ecx, dword [ebp - 0x14]
mov esi, eax
add ecx, 0xfffffff0
call fcn.00436fdb
test esi, esi
je 0x4d6a7c
push 0x5410e4
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0045922d
add esp, 0xc
push dword [eax]
call edi
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00436fdb
push str.Magic_DesktopShortcutClear_End_r_n
push 0x5aca00
call fcn.004dddd9
pop ecx
pop ecx
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00436fdb
call fcn.004f1d4d
ret
Function at 0x4d7727
Capabilities:
Check if file exists
Create process on windows
Delete file

Disassembly:
push 0x14
mov eax, 0x5349d9
call fcn.004f1d7f
mov esi, ecx
push str.Magic_StartMenuQuickLaunchShortcut_Begin_r_n
push 0x5aca00
call fcn.004dddd9
pop ecx
pop ecx
xor ebx, ebx
call fcn.00437474
push eax
lea ecx, [ebp - 0x1c]
call fcn.0043a4ef
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], ebx
push eax
mov ecx, esi
call fcn.004d469d
mov ecx, esi
call fcn.004d78e1
call fcn.004cf6f3
test eax, eax
je 0x4d78ce
call fcn.00437474
push eax
lea ecx, [ebp - 0x10]
call fcn.0043a4ef
lea eax, [esi + 4]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x10]
call fcn.0043c2e8
lea eax, [ebp - 0x10]
push eax
call fcn.004cf906
pop ecx
call fcn.00437474
push eax
lea ecx, [ebp - 0x14]
call fcn.0043a4ef
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 2
push eax
mov ecx, esi
call fcn.004d4632
call fcn.00437474
push eax
lea ecx, [ebp - 0x18]
call fcn.0043a4ef
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 3
push eax
mov ecx, esi
call fcn.004d469d
mov edi, dword [ebp - 0x18]
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ebx, 0x540e44
test eax, eax
push ebx
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x20]
push eax
je 0x4d781a
call fcn.0045922d
mov esi, dword [ebp - 0x14]
push str.Liebao
push edi
push dword [eax]
mov byte [ebp - 4], 4
push str.__ico4
push esi
call fcn.004ccc17
add esp, 0x20
jmp 0x4d783b
call fcn.0045922d
mov esi, dword [ebp - 0x14]
push str.Liebao
push dword [eax]
mov byte [ebp - 4], 5
push str.__ico4
push esi
call fcn.004cce10
add esp, 0x1c
mov ecx, dword [ebp - 0x20]
lea ecx, [ecx - 0x10]
call fcn.00436fdb
lea ecx, [edi - 0x10]
call fcn.00436fdb
lea ecx, [esi - 0x10]
mov byte [ebp - 4], 1
call fcn.00436fdb
push ebx
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.0045922d
add esp, 0xc
xor ecx, ecx
push 1
push ecx
push ecx
push dword [eax]
push str.startpin
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 0x20]
mov esi, eax
lea ecx, [ecx - 0x10]
call fcn.00436fdb
push esi
push str.ShellExecute_ret0x_x_r_n
push 0x5aca00
call fcn.004dddd9
push ebx
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.0045922d
add esp, 0x18
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0x20]
lea ecx, [ecx - 0x10]
call fcn.00436fdb
mov ecx, dword [ebp - 0x10]
xor ebx, ebx
add ecx, 0xfffffff0
inc ebx
call fcn.00436fdb
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.00436fdb
mov eax, ebx
call fcn.004f1d4d
ret
Function at 0x4d78e1
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push 8
mov eax, 0x5349fc
call fcn.004f1d7f
push str.Magic_StartMenuQuickLaunchShortcutClear_Begin_r_n
push 0x5aca00
call fcn.004dddd9
pop ecx
pop ecx
call fcn.004cf6f3
test eax, eax
je 0x4d7abd
call fcn.00437474
push eax
lea ecx, [ebp - 0x10]
call fcn.0043a4ef
xor ebx, ebx
lea ecx, [ebp - 0x10]
push 0x104
mov dword [ebp - 4], ebx
call fcn.0043a522
push eax
push ebx
push 0x1a
push ebx
call fcn.004cfc49
add esp, 0x10
lea ecx, [ebp - 0x10]
push 0xffffffffffffffff
call fcn.0043c298
mov esi, str.MicrosoftInternet_ExplorerQuick_LaunchUser_PinnedStartMenu_
push esi
call fcn.0043a8c3
pop ecx
push eax
push esi
lea ecx, [ebp - 0x10]
call fcn.004516f5
push 0x540e44
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0045922d
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0xc
push dword [eax]
call ebx
mov ecx, dword [ebp - 0x14]
mov esi, eax
add ecx, 0xfffffff0
call fcn.00436fdb
mov edi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
test esi, esi
je 0x4d79d2
push 0x540e44
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0045922d
add esp, 0xc
xor ecx, ecx
push ecx
push ecx
push ecx
push dword [eax]
push str.startunpin
push ecx
call edi
mov ecx, dword [ebp - 0x14]
mov esi, eax
add ecx, 0xfffffff0
call fcn.00436fdb
push esi
push str.ShellExecute_ret0x_x_r_n
push 0x5aca00
call fcn.004dddd9
add esp, 0xc
push 0x5410d0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0045922d
add esp, 0xc
push dword [eax]
call ebx
mov ecx, dword [ebp - 0x14]
mov esi, eax
add ecx, 0xfffffff0
call fcn.00436fdb
test esi, esi
je 0x4d7a40
push 0x5410d0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0045922d
add esp, 0xc
xor ecx, ecx
push ecx
push ecx
push ecx
push dword [eax]
push str.startunpin
push ecx
call edi
mov ecx, dword [ebp - 0x14]
mov esi, eax
add ecx, 0xfffffff0
call fcn.00436fdb
push esi
push str.ShellExecute_ret0x_x_r_n
push 0x5aca00
call fcn.004dddd9
add esp, 0xc
push 0x54168c
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0045922d
add esp, 0xc
push dword [eax]
call ebx
mov ecx, dword [ebp - 0x14]
mov esi, eax
add ecx, 0xfffffff0
call fcn.00436fdb
test esi, esi
je 0x4d7aae
push 0x54168c
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0045922d
add esp, 0xc
xor ecx, ecx
push ecx
push ecx
push ecx
push dword [eax]
push str.startunpin
push ecx
call edi
mov ecx, dword [ebp - 0x14]
mov esi, eax
add ecx, 0xfffffff0
call fcn.00436fdb
push esi
push str.ShellExecute_ret0x_x_r_n
push 0x5aca00
call fcn.004dddd9
add esp, 0xc
mov ecx, dword [ebp - 0x10]
or dword [ebp - 4], 0xffffffff
lea ecx, [ecx - 0x10]
call fcn.00436fdb
push str.Magic_StartMenuQuickLaunchShortcutClear_End_r_n
push 0x5aca00
call fcn.004dddd9
pop ecx
pop ecx
call fcn.004f1d4d
ret
Function at 0x4d8067
Capabilities:
Check if file exists

Disassembly:
push 0x28
mov eax, 0x534b76
call fcn.004f1db2
mov edi, ecx
lea ebx, [edi + 4]
push dword [ebx]
lea ecx, [ebp - 0x28]
call fcn.00417260
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
call fcn.004cf946
mov esi, str.liebao.exe
push esi
call fcn.00416680
pop ecx
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00418190
call fcn.00437474
push eax
lea ecx, [ebp - 0x2c]
call fcn.0043a4ef
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4d8113
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x2c]
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push ecx
push eax
call fcn.004cdb36
pop ecx
pop ecx
lea esi, [edi + 0x14]
push ebx
mov ecx, esi
call fcn.0043c2e8
push esi
call fcn.004cf906
mov eax, dword [ebp - 0x2c]
pop ecx
mov ecx, esi
push dword [eax - 0xc]
push eax
call fcn.004516f5
push esi
lea ecx, [edi + 0x10]
call fcn.0043c2e8
jmp 0x4d81df
call fcn.00437474
push eax
lea ecx, [ebp - 0x34]
call fcn.0043a4ef
lea eax, [ebp - 0x34]
mov byte [ebp - 4], 2
push eax
call fcn.004cd850
mov eax, dword [ebp - 0x34]
add eax, 0xfffffff0
push eax
call fcn.0043c35e
add eax, 0x10
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 3
push eax
call fcn.004cf906
mov esi, str.knbcenter.exe
push esi
call fcn.0043a8c3
add esp, 0x10
lea ecx, [ebp - 0x30]
push eax
push esi
call fcn.004516f5
mov esi, str.LBBrowser
push esi
push dword [ebp - 0x30]
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
jne 0x4d8188
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x30]
call fcn.004cdb36
pop ecx
pop ecx
jmp 0x4d8199
push esi
call fcn.0043a8c3
pop ecx
push eax
push esi
lea ecx, [ebp - 0x2c]
call fcn.0043a84a
lea esi, [edi + 0x14]
push ebx
mov ecx, esi
call fcn.0043c2e8
push esi
call fcn.004cf906
mov eax, dword [ebp - 0x2c]
pop ecx
mov ecx, esi
push dword [eax - 0xc]
push eax
call fcn.004516f5
push esi
call fcn.004cf906
pop ecx
push esi
lea ecx, [edi + 0x10]
call fcn.0043c2e8
mov ecx, dword [ebp - 0x30]
lea ecx, [ecx - 0x10]
call fcn.00436fdb
mov ecx, dword [ebp - 0x34]
lea ecx, [ecx - 0x10]
call fcn.00436fdb
mov ecx, dword [ebp - 0x2c]
lea ecx, [ecx - 0x10]
call fcn.00436fdb
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.00417d20
call fcn.004f1d61
ret
Function at 0x4d8d10
Capabilities:
Copy file

Disassembly:
push 0x28
mov eax, 0x534d36
call fcn.004f1db2
mov edi, ecx
mov eax, dword [edi + 0x14]
sub eax, 0x10
push eax
call fcn.0043c35e
add eax, 0x10
mov dword [ebp - 0x30], eax
and dword [ebp - 4], 0
lea eax, [ebp - 0x30]
push eax
call fcn.004cf906
mov esi, str.DataPresetExtensionsPreferences
push esi
call fcn.0043a8c3
add esp, 0xc
lea ecx, [ebp - 0x30]
push eax
push esi
call fcn.004516f5
mov eax, dword [edi + 0x20]
sub eax, 0x10
push eax
call fcn.0043c35e
add eax, 0x10
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 1
push eax
call fcn.004cf906
mov esi, str.old_skin_preferences
push esi
call fcn.0043a8c3
add esp, 0xc
lea ecx, [ebp - 0x2c]
push eax
push esi
call fcn.004516f5
mov eax, dword [ebp - 0x2c]
cmp dword [eax - 4], 1
jle 0x4d8da3
push dword [eax - 0xc]
lea ecx, [ebp - 0x2c]
call fcn.0043a8e3
mov eax, dword [ebp - 0x2c]
push ecx
push ecx
mov esi, esp
mov dword [esi], eax
test eax, eax
je 0x4d8db4
push eax
call fcn.00416680
pop ecx
lea ecx, [ebp - 0x28]
mov dword [esi + 4], eax
call fcn.004195a0
push 0
push eax
mov byte [ebp - 4], 2
call fcn.0041b8d0
pop ecx
pop ecx
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
mov bl, al
call fcn.00419620
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test bl, bl
jne 0x4d8dfd
call esi
push eax
push dword [ebp - 0x2c]
push str.CopySkinPreferences_Delete_dst_ws_fail_errcode_d_r_n
push 0x5aca00
call fcn.004dddd9
add esp, 0x10
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
push str.CopySkinPreferences_CopyFile_src_ws_dst_ws_r_n
push 0x5aca00
call fcn.004dddd9
add esp, 0x10
push 1
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x4d8e3c
call esi
push eax
push str.CopySkinPreferences_CopyFile__errcode_d_r_n
push 0x5aca00
call fcn.004dddd9
add esp, 0xc
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], 4
push eax
lea ecx, [edi + 0xe4]
call fcn.00433210
mov ecx, dword [ebp - 0x2c]
lea ecx, [ecx - 0x10]
call fcn.00436fdb
mov ecx, dword [ebp - 0x30]
lea ecx, [ecx - 0x10]
call fcn.00436fdb
call fcn.004f1d61
ret
Function at 0x4d8e6e
Capabilities:
Check if file exists
Delete file

Disassembly:
push 0x14
mov eax, 0x534d8b
call fcn.004f1d7f
mov esi, ecx
push str.Begin_PM_Req_Create17zyDesktopLnk___r_n
push 0x5aca00
call fcn.004dddd9
pop ecx
pop ecx
call fcn.00437474
push eax
lea ecx, [ebp - 0x18]
call fcn.0043a4ef
and dword [ebp - 4], 0
lea eax, [ebp - 0x18]
push str.http:__www.17zuoye.com__fromliebao
push 0x55cf64
push eax
call fcn.0043ab29
add esp, 0xc
call fcn.00437474
push eax
lea ecx, [ebp - 0x14]
call fcn.0043a4ef
lea eax, [esi + 8]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x14]
call fcn.0043c2e8
lea eax, [ebp - 0x14]
push eax
call fcn.004cf906
mov edi, str.17zuoye.ico
push edi
call fcn.0043a8c3
pop ecx
pop ecx
push eax
push edi
lea ecx, [ebp - 0x14]
call fcn.004516f5
call fcn.00437474
push eax
lea ecx, [ebp - 0x1c]
call fcn.0043a4ef
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 2
push eax
mov ecx, esi
call fcn.004d4632
call fcn.00437474
push eax
lea ecx, [ebp - 0x10]
call fcn.0043a4ef
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 3
push eax
mov ecx, esi
call fcn.004d3e59
lea eax, [ebp - 0x10]
push eax
call fcn.004cf906
mov esi, 0x5402f8
lea eax, [ebp - 0x10]
push esi
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.0045922d
add esp, 0x10
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0x20]
lea ecx, [ecx - 0x10]
call fcn.00436fdb
push dword [ebp - 0x14]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
lea eax, [ebp - 0x10]
push esi
push eax
lea eax, [ebp - 0x20]
push eax
je 0x4d8fb8
call fcn.0045922d
mov esi, dword [ebp - 0x18]
mov edi, dword [ebp - 0x1c]
push str.liebao
push dword [ebp - 0x14]
mov byte [ebp - 4], 4
push dword [eax]
push esi
push edi
call fcn.004ccc17
mov ecx, dword [ebp - 0x20]
add esp, 0x20
add ecx, 0xfffffff0
mov byte [ebp - 4], 3
mov ebx, eax
call fcn.00436fdb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
push str.PM_Req_Create17zyDesktopLnk___CreateShellLink2_bRet_d_errcode_d_r_n
jmp 0x4d8ff6
call fcn.0045922d
mov esi, dword [ebp - 0x18]
mov edi, dword [ebp - 0x1c]
push str.liebao
push dword [eax]
mov byte [ebp - 4], 5
push esi
push edi
call fcn.004cce10
mov ecx, dword [ebp - 0x20]
add esp, 0x1c
add ecx, 0xfffffff0
mov byte [ebp - 4], 3
mov ebx, eax
call fcn.00436fdb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
push str.PM_Req_Create17zyDesktopLnk_CreateShellLink_bRet_d_errcode_d_r_n
mov ebx, 0x5aca00
push ebx
call fcn.004dddd9
add esp, 0x10
push str.End_PM_Req_Create17zyDesktopLnk___r_n
push ebx
call fcn.004dddd9
pop ecx
pop ecx
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00436fdb
lea ecx, [edi - 0x10]
call fcn.00436fdb
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00436fdb
lea ecx, [esi - 0x10]
call fcn.00436fdb
call fcn.004f1d4d
ret
Function at 0x4d92d9
Capabilities:
Check if file exists
Delete file

Disassembly:
push 0x18
mov eax, 0x534e29
call fcn.004f1d7f
mov esi, ecx
push str.Begin_PM_Req_CreateURLDesktopLnk___r_n
push 0x5aca00
call fcn.004dddd9
pop ecx
pop ecx
call fcn.00437474
push eax
lea ecx, [ebp - 0x1c]
call fcn.0043a4ef
push str.https:__www.duba.com__fliebaoins
lea eax, [ebp - 0x1c]
xor ebx, ebx
push 0x55cf64
push eax
mov dword [ebp - 0x24], ebx
mov dword [ebp - 4], ebx
call fcn.0043ab29
mov eax, dword [esi + 8]
sub eax, 0x10
push eax
call fcn.0043c35e
add eax, 0x10
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 1
push eax
call fcn.004cf906
mov edi, str.Dataduba123ie.ico
push edi
call fcn.0043a8c3
add esp, 0x18
lea ecx, [ebp - 0x14]
push eax
push edi
call fcn.004516f5
call fcn.00437474
push eax
lea ecx, [ebp - 0x20]
call fcn.0043a4ef
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 2
push eax
mov ecx, esi
call fcn.004d4632
call fcn.00437474
push eax
lea ecx, [ebp - 0x10]
call fcn.0043a4ef
push 0x104
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 3
call fcn.0043a522
push eax
push ebx
push 0x19
push ebx
call fcn.004cfc49
add esp, 0x10
lea ecx, [ebp - 0x10]
push 0xffffffffffffffff
call fcn.0043c298
lea eax, [ebp - 0x10]
push eax
call fcn.004cf906
mov esi, 0x53ff78
lea eax, [ebp - 0x10]
push esi
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.0045922d
add esp, 0x10
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.00436fdb
push dword [ebp - 0x14]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edi, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x20]
test eax, eax
je 0x4d9444
push esi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.0045922d
push str.Liebao
push dword [ebp - 0x14]
mov byte [ebp - 4], 4
push dword [eax]
push edi
push ebx
call fcn.004ccc17
mov ecx, dword [ebp - 0x18]
add esp, 0x20
mov esi, eax
mov byte [ebp - 4], 3
add ecx, 0xfffffff0
mov dword [ebp - 0x24], esi
call fcn.00436fdb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.PM_Req_CreateURLDesktopLnk___CreateShellLink2_bRet_d_errcode_d_r_n
push 0x5aca00
call fcn.004dddd9
add esp, 0x10
lea ecx, [ebp - 0x18]
call fcn.004d1e1f
mov esi, dword [ebp - 0x18]
mov byte [ebp - 4], 5
test esi, esi
je 0x4d946c
push 0xe6
mov ecx, esi
call fcn.0049734b
push 1
mov ecx, esi
call fcn.00496eb5
cmp dword [ebp - 0x24], 0
jne 0x4d947a
test esi, esi
je 0x4d9487
push 2
jmp 0x4d9480
test esi, esi
je 0x4d9487
push 3
mov ecx, esi
call fcn.00496eb5
lea ecx, [ebp - 0x18]
call fcn.004da609
push str.End_PM_Req_CreateURLDesktopLnk___r_n
push 0x5aca00
call fcn.004dddd9
pop ecx
pop ecx
mov ecx, dword [ebp - 0x18]
mov byte [ebp - 4], 3
test ecx, ecx
je 0x4d94b1
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00436fdb
lea ecx, [ebx - 0x10]
call fcn.00436fdb
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00436fdb
lea ecx, [edi - 0x10]
call fcn.00436fdb
call fcn.004f1d4d
ret
Function at 0x4d96da
Capabilities:
Check if file exists

Disassembly:
push 8
mov eax, 0x534e99
call fcn.004f1d7f
mov edi, ecx
push str.PM_Req_RunSkinupdater_Begin_r_n
mov ebx, 0x5aca00
push ebx
call fcn.004dddd9
pop ecx
pop ecx
xor esi, esi
call fcn.00437474
push eax
lea ecx, [ebp - 0x10]
call fcn.0043a4ef
lea eax, [ebp - 0x10]
mov dword [ebp - 4], esi
push eax
mov ecx, edi
call fcn.004d4ecb
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4d9773
push 1
push esi
push 0x2710
push str.__skin_updater
push dword [ebp - 0x10]
call fcn.004cf9dd
mov esi, eax
add esp, 0x14
test esi, esi
jne 0x4d975b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp - 0x10]
push str.PM_Req_RunSkinupdater_RunApp_PathFileExists_ws_errcode_d
push ebx
call fcn.004dddd9
add esp, 0x10
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 6
push eax
lea ecx, [edi + 0xe4]
call fcn.00433210
jmp 0x4d9784
push dword [ebp - 0x10]
push str.PM_Req_RunSkinupdater_PathFileExists_ws_no_exists_r_n
push ebx
call fcn.004dddd9
add esp, 0xc
push esi
push str.PM_Req_RunSkinupdater_End_bRet_d_r_n
push ebx
call fcn.004dddd9
mov ecx, dword [ebp - 0x10]
add esp, 0xc
lea ecx, [ecx - 0x10]
call fcn.00436fdb
mov eax, esi
call fcn.004f1d4d
ret
Function at 0x4d9f5f
Capabilities:
Check if file exists
Create thread
Terminate thread

Disassembly:
push 0xc
mov eax, 0x534fbf
call fcn.004f1d7f
mov esi, ecx
test byte [esi + 0x118], 2
jne 0x4da0c2
push str.PM_Req_XPQuickLanuchIconFirst_Begin_r_n
mov ebx, 0x5aca00
push ebx
call fcn.004dddd9
pop ecx
pop ecx
call fcn.004cf6f3
test eax, eax
jne 0x4da0b5
push str.PM_Req_XPQuickLanuchIconFirst_OsIsVistaAndAfter_gnf_r_n
push ebx
call fcn.004dddd9
pop ecx
pop ecx
call fcn.00437474
push eax
lea ecx, [ebp - 0x14]
call fcn.0043a4ef
and dword [ebp - 4], 0
lea eax, [ebp - 0x14]
push eax
mov ecx, esi
call fcn.004d4632
xor esi, esi
lea eax, [ebp - 0x18]
push eax
push esi
push esi
push 0x4a1824
push esi
push esi
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, dword [ebp - 0x14]
mov ebx, eax
test ebx, ebx
je 0x4da0a4
push 0xbb8
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x4da095
push str.CreateAndAdjustQuickLaunch_timeout_r_n
push 0x5aca00
call fcn.004dddd9
pop ecx
pop ecx
push esi
push esi
push 0x12
push dword [ebp - 0x18]
call dword [sym.imp.USER32.dll_PostThreadMessageW]
call fcn.00437474
push eax
lea ecx, [ebp - 0x10]
call fcn.0043a4ef
push 0x104
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.0043a522
push eax
push esi
push 0x1a
push esi
call fcn.004cfc49
add esp, 0x10
lea ecx, [ebp - 0x10]
push 0xffffffffffffffff
call fcn.0043c298
mov esi, 0x53b598
push esi
call fcn.0043a8c3
pop ecx
push eax
push esi
lea ecx, [ebp - 0x10]
call fcn.004516f5
mov esi, dword [ebp - 0x10]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4da08b
push str.Liebao
push esi
push 0x559c78
push edi
call fcn.004cce10
add esp, 0x10
lea ecx, [esi - 0x10]
call fcn.00436fdb
xor esi, esi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [ebp - 4], 0xffffffff
lea ecx, [edi - 0x10]
call fcn.00436fdb
mov ebx, 0x5aca00
push str.PM_Req_XPQuickLanuchIconFirst_End_r_n
push ebx
call fcn.004dddd9
pop ecx
pop ecx
call fcn.004f1d4d
ret