joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d3144
Capabilities:
Check if file exists
Copy file

Disassembly:
push 0xc
mov eax, 0x534705
call fcn.004f22ff
mov edi, ecx
mov dword [ebp - 0x18], edi
push str.CopyDatFileForLego_Begin_r_n
push 0x5aea00
call fcn.004de360
mov eax, dword [edi + 0x20]
sub eax, 0x10
push eax
call fcn.0043c35e
add eax, 0x10
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
call fcn.004cfddf
mov esi, dword [0x5ae9b4]
push esi
call fcn.0043a8c3
add esp, 0x14
lea ecx, [ebp - 0x10]
push eax
push esi
call fcn.004516f5
lea eax, [ebp - 0x10]
push eax
call fcn.004cfddf
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4d31e9
push eax
push dword [ebp - 0x10]
call fcn.004cfb20
mov esi, dword [ebp - 0x10]
mov edi, eax
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push esi
push str.Create_Directory__s__bRet_d_error_d__r_n
push 0x5aea00
call fcn.004de360
add esp, 0x14
test edi, edi
je 0x4d32b7
mov edi, dword [ebp - 0x18]
mov esi, dword [0x5ae9a4]
push esi
call fcn.0043a8c3
pop ecx
push eax
push esi
lea ecx, [ebp - 0x10]
call fcn.004516f5
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4d322a
push dword [ebp - 0x10]
push str._s_File_Exists__r_n
push 0x5aea00
call fcn.004de360
xor edi, edi
add esp, 0xc
inc edi
jmp 0x4d32b7
mov eax, dword [edi + 8]
sub eax, 0x10
push eax
call fcn.0043c35e
add eax, 0x10
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 1
push eax
call fcn.004cfddf
mov esi, str.Data_
push esi
call fcn.0043a8c3
add esp, 0xc
lea ecx, [ebp - 0x14]
push eax
push esi
call fcn.004516f5
mov esi, dword [0x5ae9a4]
push esi
call fcn.0043a8c3
pop ecx
push eax
push esi
lea ecx, [ebp - 0x14]
call fcn.004516f5
push 1
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push str.Copy_lego.dat_src_ws_dst_ws_CopyFile_bRet_d_error_d
push 0x5aea00
call fcn.004de360
mov ecx, dword [ebp - 0x14]
add esp, 0x18
mov byte [ebp - 4], 0
lea ecx, [ecx - 0x10]
call fcn.00436fdb
push str.CopyDatFileForLego_End_r_n
push 0x5aea00
call fcn.004de360
pop ecx
pop ecx
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00436fdb
mov eax, edi
call fcn.004f22cd
ret
Function at 0x4d32db
Capabilities:
Delete file

Disassembly:
push 0x60
mov eax, 0x534740
call fcn.004f2332
mov esi, dword [ebp + 8]
push ecx
push ecx
mov edi, esp
mov dword [edi], esi
test esi, esi
jne 0x4d32f8
xor eax, eax
jmp 0x4d32ff
push esi
call fcn.00416680
pop ecx
lea ecx, [ebp - 0x60]
mov dword [edi + 4], eax
call fcn.004195a0
and dword [ebp - 4], 0
push eax
call fcn.0041bae0
or dword [ebp - 4], 0xffffffff
mov bl, al
pop ecx
lea ecx, [ebp - 0x60]
call fcn.00419620
test bl, bl
je 0x4d3427
push esi
lea ecx, [ebp - 0x64]
call fcn.0043c206
lea eax, [ebp - 0x64]
mov dword [ebp - 4], 1
push eax
call fcn.004cfddf
mov edi, str.test_access
push edi
call fcn.0043a8c3
pop ecx
pop ecx
push eax
push edi
lea ecx, [ebp - 0x64]
call fcn.004516f5
push 7
xor eax, eax
mov byte [ebp - 0x30], 0
pop ecx
lea edi, [ebp - 0x2f]
rep stosd dword es:[edi], eax
push ecx
push ecx
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp - 0x64]
mov edi, esp
mov dword [edi], eax
test eax, eax
je 0x4d3380
push eax
call fcn.00416680
pop ecx
lea ecx, [ebp - 0x60]
mov dword [edi + 4], eax
call fcn.004195a0
push 0x1e
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 2
push ecx
push eax
call fcn.0041bf40
add esp, 0xc
mov byte [ebp - 4], 1
cmp eax, 0xffffffff
lea ecx, [ebp - 0x60]
setne bl
call fcn.00419620
test bl, bl
je 0x4d33bf
push dword [ebp - 0x64]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x4d341c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.WriteFile_testfile_fail_errcode_d__r_n
push 0x5aea00
call fcn.004de360
add esp, 0xc
lea ecx, [ebp - 0x65]
push 1
push 0x1f01ff
push esi
call fcn.00448f7b
xor ebx, ebx
mov dword [ebp - 0x34], 0xf
mov dword [ebp - 0x38], ebx
mov byte [ebp - 0x48], bl
lea eax, [ebp - 0x48]
mov byte [ebp - 4], 3
push eax
push ebx
push 1
push 2
push str.execptiondirectory_permissions_problems
push ebx
push 0x6e
call fcn.004e8cb0
push ebx
push 1
lea ecx, [ebp - 0x48]
call fcn.004178d0
mov ecx, dword [ebp - 0x64]
lea ecx, [ecx - 0x10]
call fcn.00436fdb
xor eax, eax
call fcn.004f22e1
ret 4
Function at 0x4d3eb8
Capabilities:
Check if file exists
Create directory
Get common file path

Disassembly:
push 0x23c
mov eax, 0x5348b3
call fcn.004f2332
mov esi, ecx
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x248]
mov edi, dword [ebp + 0xc]
push eax
call fcn.00417260
lea eax, [ebp - 0x248]
xor ebx, ebx
push eax
lea eax, [ebp - 0x230]
mov dword [ebp - 4], ebx
push eax
mov ecx, esi
call fcn.004d2ab4
push ebx
push 1
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], 2
call fcn.00417d20
push ebx
push 0x1c
lea eax, [ebp - 0x218]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov ebx, eax
lea eax, [ebp - 0x218]
push eax
call fcn.00416680
pop ecx
push eax
lea eax, [ebp - 0x218]
mov ecx, edi
push eax
call fcn.00417b50
mov esi, str.liebaoUser_Data
push esi
call fcn.00416680
pop ecx
push eax
push esi
mov ecx, edi
call fcn.00418190
mov esi, 0x55af84
push esi
call fcn.00416680
pop ecx
push eax
push esi
mov ecx, edi
call fcn.00418190
cmp dword [ebp - 0x21c], 8
lea esi, [ebp - 0x230]
cmovae esi, dword [ebp - 0x230]
push esi
call fcn.00416680
pop ecx
push eax
push esi
mov ecx, edi
call fcn.00418190
cmp dword [edi + 0x14], 8
jb 0x4d3f8e
mov eax, dword [edi]
jmp 0x4d3f90
mov eax, edi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4d3fb1
cmp dword [ebp + 0x10], eax
je 0x4d3fb1
cmp dword [edi + 0x14], 8
jb 0x4d3fa8
mov edi, dword [edi]
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0
push 1
lea ecx, [ebp - 0x230]
call fcn.00417d20
mov eax, ebx
call fcn.004f22e1
ret 0xc
Function at 0x4d46a7
Capabilities:
Check if file exists

Disassembly:
push 8
mov eax, 0x534966
call fcn.004f22ff
lea eax, [ebp - 0x10]
push eax
call fcn.00494b94
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
mov dword [esp], str.liebao.exe
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0045922d
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0xc
push dword [eax]
call esi
mov ecx, dword [ebp - 0x14]
neg eax
sbb edi, edi
neg edi
lea ecx, [ecx - 0x10]
call fcn.00436fdb
push str.knbcenter.exe
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0045922d
add esp, 0xc
push dword [eax]
call esi
mov ecx, dword [ebp - 0x14]
neg eax
sbb eax, eax
and eax, 2
lea ecx, [ecx - 0x10]
or edi, eax
call fcn.00436fdb
push str.liebao.dll
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0045922d
add esp, 0xc
push dword [eax]
call esi
mov ecx, dword [ebp - 0x14]
neg eax
sbb eax, eax
and eax, 4
lea ecx, [ecx - 0x10]
or edi, eax
call fcn.00436fdb
push str.chrome.dll
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0045922d
add esp, 0xc
push dword [eax]
call esi
mov ecx, dword [ebp - 0x14]
neg eax
sbb eax, eax
and eax, 8
lea ecx, [ecx - 0x10]
or edi, eax
call fcn.00436fdb
push str.chrome_child.dll
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0045922d
add esp, 0xc
push dword [eax]
call esi
neg eax
sbb eax, eax
and eax, 0x10
mov ecx, dword [ebp - 0x14]
or edi, eax
lea ecx, [ecx - 0x10]
call fcn.00436fdb
push str.uplive.dll
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0045922d
add esp, 0xc
push dword [eax]
call esi
mov ecx, dword [ebp - 0x14]
neg eax
sbb eax, eax
and eax, 0x20
lea ecx, [ecx - 0x10]
or edi, eax
call fcn.00436fdb
push str.uninst.exe
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0045922d
add esp, 0xc
push dword [eax]
call esi
mov ecx, dword [ebp - 0x14]
neg eax
sbb eax, eax
and eax, 0x40
lea ecx, [ecx - 0x10]
or edi, eax
call fcn.00436fdb
push str.Module_securityknbpolicy.dll
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0045922d
add esp, 0xc
push dword [eax]
call esi
mov ecx, dword [ebp - 0x14]
neg eax
sbb eax, eax
add ecx, 0xfffffff0
and eax, 0x80
or edi, eax
call fcn.00436fdb
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00436fdb
mov eax, edi
call fcn.004f22cd
ret
Function at 0x4d494b
Capabilities:
Check if file exists

Disassembly:
push 0x28
mov eax, 0x534999
call fcn.004f2332
mov ebx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 4], eax
call fcn.00437474
push eax
lea ecx, [ebp - 0x2c]
call fcn.0043a4ef
push 1
push str.Softwareliebao
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 1
call fcn.00498323
test eax, eax
je 0x4d4a17
lea eax, [ebp - 0x2c]
push eax
push str.ProgramPath
lea ecx, [ebp - 0x34]
call fcn.00498375
test eax, eax
je 0x4d4a17
mov esi, dword [ebp - 0x2c]
lea ecx, [ebp - 0x28]
push esi
call fcn.00417260
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 2
push eax
call fcn.004cfe1f
mov edi, str.liebao.exe
push edi
call fcn.00416680
pop ecx
pop ecx
push eax
push edi
lea ecx, [ebp - 0x28]
call fcn.00418190
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4d4a09
cmp dword [ebp - 0x14], 8
lea edi, [ebp - 0x28]
cmovae edi, dword [ebp - 0x28]
push edi
call fcn.0043a8c3
pop ecx
push eax
push edi
mov ecx, ebx
call fcn.0043a84a
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.00417d20
jmp 0x4d4a1a
mov esi, dword [ebp - 0x2c]
lea ecx, [esi - 0x10]
call fcn.00436fdb
cmp dword [ebp - 0x34], 0
je 0x4d4a31
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.004f22e1
ret 4
Function at 0x4d4c29
Capabilities:
Check if file exists

Disassembly:
push 0x2c
mov eax, 0x534a9d
call fcn.004f22ff
mov edi, ecx
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 4], eax
call fcn.00437474
push eax
lea ecx, [ebp - 0x1c]
call fcn.0043a4ef
xor ebx, ebx
lea ecx, [ebp - 0x38]
inc ebx
push ebx
push str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionUninstallWeChat
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [ebp - 4], bl
call fcn.00498323
test eax, eax
je 0x4d4c8f
lea eax, [ebp - 0x1c]
push eax
push str.DisplayIcon
lea ecx, [ebp - 0x38]
call fcn.00498375
test eax, eax
je 0x4d4c8f
mov eax, dword [ebp + 0xc]
mov dword [eax], ebx
jmp 0x4d4df7
and dword [ebp - 0x30], 0
and dword [ebp - 0x2c], 0
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallWeChat
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 2
call fcn.00498323
test eax, eax
je 0x4d4cd1
lea eax, [ebp - 0x1c]
push eax
push str.DisplayIcon
lea ecx, [ebp - 0x30]
call fcn.00498375
test eax, eax
je 0x4d4cd1
mov eax, dword [ebp + 0xc]
mov dword [eax], ebx
jmp 0x4d4de4
call fcn.00437474
push eax
lea ecx, [ebp - 0x18]
call fcn.0043a4ef
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 3
push eax
mov ecx, edi
call fcn.004d437a
lea eax, [ebp - 0x18]
push eax
call fcn.004cfddf
pop ecx
call fcn.00437474
push eax
lea ecx, [ebp - 0x14]
call fcn.0043a4ef
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 4
push eax
mov ecx, edi
call fcn.004d520e
lea eax, [ebp - 0x14]
push eax
call fcn.004cfddf
lea eax, [ebp - 0x18]
mov dword [esp], 0x540018
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.0045922d
add esp, 0xc
push dword [eax]
mov ecx, ebx
mov byte [ebp - 4], 5
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x20], ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4d4d76
push 0x540018
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.0045922d
add esp, 0xc
push 3
pop ecx
push dword [eax]
mov dword [ebp - 0x10], ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4d4d76
xor bl, bl
mov eax, dword [ebp - 0x10]
test al, 2
je 0x4d4d91
mov ecx, dword [ebp - 0x24]
and eax, 0xfffffffd
mov dword [ebp - 0x10], eax
lea ecx, [ecx - 0x10]
call fcn.00436fdb
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], 4
test al, 1
je 0x4d4da7
mov ecx, dword [ebp - 0x28]
lea ecx, [ecx - 0x10]
call fcn.00436fdb
test bl, bl
je 0x4d4db6
mov eax, dword [ebp + 0xc]
mov dword [eax], 2
jmp 0x4d4dce
push dword [edi + 4]
call fcn.004ce85f
neg eax
pop ecx
mov ecx, dword [ebp + 0xc]
sbb eax, eax
and eax, 0xfffffffd
add eax, 3
mov dword [ecx], eax
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00436fdb
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.00436fdb
cmp dword [ebp - 0x30], 0
je 0x4d4df3
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0x30], 0
mov ecx, dword [ebp - 0x1c]
lea ecx, [ecx - 0x10]
call fcn.00436fdb
cmp dword [ebp - 0x38], 0
je 0x4d4e11
push dword [ebp - 0x38]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.004f22cd
ret 8
Function at 0x4d5454
Capabilities:
Check if file exists

Disassembly:
push 4
mov eax, 0x534b56
call fcn.004f22ff
lea esi, [ecx + 8]
mov eax, dword [esi]
sub eax, 0x10
push eax
call fcn.0043c35e
add eax, 0x10
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
call fcn.004cfddf
pop ecx
pop ecx
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
call fcn.0043c2e8
push esi
call fcn.004cfddf
mov edi, str.skinupdater.exe
push edi
call fcn.0043a8c3
pop ecx
pop ecx
push eax
push edi
lea ecx, [ebp - 0x10]
call fcn.004516f5
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4d54bd
mov edi, 0x542108
push edi
call fcn.0043a8c3
pop ecx
push eax
push edi
mov ecx, esi
call fcn.004516f5
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00436fdb
xor eax, eax
inc eax
call fcn.004f22cd
ret 4
Function at 0x4d55f8
Capabilities:
Check if file exists

Disassembly:
push 0x40
mov eax, 0x534bac
call fcn.004f2332
mov ebx, ecx
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x44]
xor esi, esi
push esi
push eax
call fcn.004cde4e
push dword [ebp - 0x44]
mov dword [ebp - 4], esi
push str.Init_localpath___ws_r_n
push 0x5aea00
call fcn.004de360
xor eax, eax
add esp, 0x14
test edi, edi
setne al
mov dword [ebx + 0x28], eax
test eax, eax
je 0x4d566b
push edi
call fcn.0043a8c3
pop ecx
push eax
push edi
lea ecx, [ebx + 0x2c]
call fcn.0043a84a
push edi
push str.Init_7zFilePath___ws_r_n
push 0x5aea00
call fcn.004de360
add esp, 0xc
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov dword [ebp - 0x48], eax
jmp 0x4d5693
push 0x55aff0
push esi
push 4
call fcn.004db115
add esp, 0xc
lea ecx, [ebx + 0x80]
call fcn.004dde65
mov esi, eax
mov dword [ebp - 0x48], esi
test esi, esi
je 0x4d57e8
lea esi, [ebx + 4]
push esi
call fcn.004cdbfa
pop ecx
test eax, eax
je 0x4d56aa
mov dword [ebx + 0x70], 1
jmp 0x4d56b2
push esi
mov ecx, ebx
call fcn.004d4227
push esi
call fcn.004cfddf
push dword [ebx + 0x70]
push dword [esi]
push str.Init_InstallPath_ws_m_bInstalled_d_r_n
push 0x5aea00
call fcn.004de360
and dword [ebp - 0x18], 0
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
call fcn.004cda05
lea eax, [ebp - 0x28]
push eax
call fcn.004cfe1f
mov esi, str.liebao
push esi
call fcn.00416680
add esp, 0x20
lea ecx, [ebp - 0x28]
push eax
push esi
call fcn.00418190
lea eax, [ebp - 0x28]
push eax
call fcn.004cfe1f
cmp dword [ebp - 0x14], 8
lea edi, [ebp - 0x28]
cmovae edi, dword [ebp - 0x28]
push edi
call fcn.0043a8c3
pop ecx
pop ecx
push eax
push edi
lea ecx, [ebx + 0x24]
call fcn.0043a84a
mov esi, 0x5406e4
push esi
call fcn.00416680
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00418190
push ecx
push ecx
lea eax, [ebp - 0x28]
mov ecx, esp
push eax
call fcn.0041a660
lea ecx, [ebp - 0x40]
call fcn.004195a0
push eax
mov byte [ebp - 4], 2
call fcn.004217a0
pop ecx
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 1
call fcn.00419620
lea eax, [ebp - 0x28]
push eax
call fcn.004cfe1f
cmp dword [ebp - 0x14], 8
lea esi, [ebp - 0x28]
cmovae esi, dword [ebp - 0x28]
push esi
call fcn.0043a8c3
pop ecx
pop ecx
push eax
push esi
lea ecx, [ebx + 0x20]
call fcn.0043a84a
mov ecx, ebx
call fcn.004d83df
mov ecx, ebx
call fcn.004d8573
xor esi, esi
cmp dword [ebx + 0x70], esi
je 0x4d57b5
mov ecx, ebx
call fcn.004d85f1
mov ecx, ebx
call fcn.004d6b09
mov ecx, ebx
call fcn.004dc3b3
push 0x55aff0
push esi
push 5
call fcn.004db115
add esp, 0xc
mov ecx, ebx
call fcn.004daab8
push esi
push 1
lea ecx, [ebp - 0x28]
call fcn.00417d20
mov esi, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x44]
lea ecx, [ecx - 0x10]
call fcn.00436fdb
mov eax, esi
call fcn.004f22e1
ret 4
Function at 0x4d6595
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push 0x8d0
mov eax, 0x534dd6
call fcn.004f2332
mov edi, ecx
mov dword [ebp - 0x8d8], edi
mov ebx, dword [ebp + 8]
xor eax, eax
mov ecx, ebx
mov dword [ebp - 0x8dc], ebx
mov esi, eax
push dword [ebx + 4]
push dword [ebx]
call fcn.004dd291
mov eax, dword [ebx]
mov dword [ebx + 4], eax
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x814], 7
mov dword [ebp - 0x818], ebx
mov word [ebp - 0x828], ax
lea eax, [ebp - 0x828]
mov dword [ebp - 4], ebx
push eax
mov ecx, edi
call fcn.004d3fcb
cmp dword [ebp - 0x814], 8
lea eax, [ebp - 0x828]
cmovae eax, dword [ebp - 0x828]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4d661c
mov esi, ebx
jmp 0x4d673f
xor eax, eax
push 0x7fe
mov word [ebp - 0x810], ax
lea eax, [ebp - 0x80e]
push ebx
push eax
call fcn.004f2e30
add esp, 0xc
lea eax, [ebp - 0x828]
cmp dword [ebp - 0x814], 8
cmovae eax, dword [ebp - 0x828]
push eax
push 0x400
lea eax, [ebp - 0x810]
push eax
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov edi, eax
test edi, edi
je 0x4d673f
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004f09ec
mov ebx, eax
xor eax, eax
push edi
push eax
push ebx
call fcn.004f2e30
xor edx, edx
add esp, 0x10
mov ecx, edx
mov esi, edx
test edi, edi
je 0x4d6733
mov ax, word [ebp + esi*2 - 0x810]
mov word [ebx + ecx*2], ax
inc ecx
cmp word [ebp + esi*2 - 0x810], dx
jne 0x4d672a
lea ecx, [ebp - 0x8d0]
call fcn.004d222b
cmp dword [ebp - 0x814], 8
lea eax, [ebp - 0x828]
mov ecx, dword [ebp - 0x8d8]
cmovae eax, dword [ebp - 0x828]
push eax
push ebx
lea eax, [ebp - 0x8d0]
mov byte [ebp - 4], 1
push eax
call fcn.004d6757
mov ecx, dword [ebp - 0x8dc]
lea eax, [ebp - 0x8d0]
push eax
call fcn.004dd887
push edi
xor eax, eax
push eax
push ebx
call fcn.004f2e30
add esp, 0xc
lea ecx, [ebp - 0x8d0]
xor eax, eax
mov dword [ebp - 0x8d4], eax
mov byte [ebp - 4], al
call fcn.004d26cc
mov ecx, dword [ebp - 0x8d4]
xor edx, edx
inc esi
cmp esi, edi
jb 0x4d669f
push ebx
call fcn.004f304f
xor esi, esi
inc esi
xor ebx, ebx
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x828]
call fcn.00417d20
mov eax, esi
call fcn.004f22e1
ret 4
Function at 0x4d6757
Capabilities:
Read .ini file

Disassembly:
push 0xac8
mov eax, 0x534e09
call fcn.004f2332
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
push ebx
mov dword [ebp - 0xac4], esi
call fcn.00416680
pop ecx
push eax
push ebx
mov ecx, esi
call fcn.00417b50
xor eax, eax
push 0x800
push eax
mov word [ebp - 0xaa8], ax
lea eax, [ebp - 0xaa6]
push eax
call fcn.004f2e30
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0xaa8]
add esp, 0xc
push edi
push 0x400
push eax
push 0x55aff0
push str.passport
push ebx
call esi
lea eax, [ebp - 0xaa8]
push eax
call fcn.00416680
pop ecx
mov ecx, dword [ebp - 0xac4]
push eax
lea eax, [ebp - 0xaa8]
add ecx, 0x30
push eax
call fcn.00417b50
xor eax, eax
push 0x80
push eax
mov word [ebp - 0x94], ax
lea eax, [ebp - 0x92]
push eax
call fcn.004f2e30
add esp, 0xc
lea eax, [ebp - 0x94]
push edi
push 0x40
push eax
push 0x55da5c
push str.autologin
push ebx
call esi
lea eax, [ebp - 0x94]
push eax
mov dword [ebp - 0xacc], eax
call fcn.00416680
mov dword [ebp - 0xac8], eax
mov eax, dword [ebp - 0xac4]
add eax, 0x18
push eax
lea eax, [ebp - 0xacc]
push eax
call fcn.00426970
xor eax, eax
push 0x80
push eax
mov word [ebp - 0x118], ax
lea eax, [ebp - 0x116]
push eax
call fcn.004f2e30
add esp, 0x18
lea eax, [ebp - 0x118]
push edi
push 0x40
push eax
push 0x55da5c
push str.savepassword
push ebx
call esi
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0xacc], eax
call fcn.00416680
mov dword [ebp - 0xac8], eax
mov eax, dword [ebp - 0xac4]
add eax, 0x1c
push eax
lea eax, [ebp - 0xacc]
push eax
call fcn.00426970
xor eax, eax
push 0x80
push eax
mov word [ebp - 0x2a4], ax
lea eax, [ebp - 0x2a2]
push eax
call fcn.004f2e30
add esp, 0x18
lea eax, [ebp - 0x2a4]
push edi
push 0x40
push eax
push 0x55da5c
push str.time
push ebx
call esi
lea eax, [ebp - 0x2a4]
push eax
lea ecx, [ebp - 0xac0]
call fcn.00417260
and dword [ebp - 4], 0
lea eax, [ebp - 0xac0]
cmp dword [ebp - 0xaac], 8
cmovae eax, dword [ebp - 0xac0]
mov dword [ebp - 0xad4], eax
mov eax, dword [ebp - 0xab0]
mov dword [ebp - 0xad0], eax
mov eax, dword [ebp - 0xac4]
add eax, 0x28
push eax
lea eax, [ebp - 0xad4]
push eax
call fcn.00426990
xor eax, eax
push 0x80
push eax
mov word [ebp - 0x19c], ax
lea eax, [ebp - 0x19a]
push eax
call fcn.004f2e30
add esp, 0x14
lea eax, [ebp - 0x19c]
push edi
push 0x40
push eax
push 0x55aff0
push str.priaccount
push ebx
call esi
lea eax, [ebp - 0x19c]
push eax
call fcn.00416680
pop ecx
mov ecx, dword [ebp - 0xac4]
push eax
lea eax, [ebp - 0x19c]
push eax
lea ecx, [ecx + 0x60]
call fcn.00417b50
xor eax, eax
push 0x80
push eax
mov word [ebp - 0x220], ax
lea eax, [ebp - 0x21e]
push eax
call fcn.004f2e30
add esp, 0xc
push edi
push 0x40
lea eax, [ebp - 0x220]
push eax
push 0x55aff0
push 0x55eef4
push ebx
call esi
lea eax, [ebp - 0x220]
push eax
call fcn.00416680
pop ecx
mov ecx, dword [ebp - 0xac4]
push eax
lea eax, [ebp - 0x220]
push eax
lea ecx, [ecx + 0x78]
call fcn.00417b50
push 0
push 1
lea ecx, [ebp - 0xac0]
call fcn.00417d20
xor eax, eax
inc eax
call fcn.004f22e1
ret 0xc