joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a0d5a
Capabilities:
Check if file exists
Copy file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
mov edi, ecx
push str.CopyDatFileForLego_Begin_r_n
push 0x55913c
mov dword [ebp - 8], edi
call fcn.004a9ba2
mov eax, dword [edi + 0x20]
sub eax, 0x10
push eax
call fcn.00425bf9
add eax, 0x10
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
call fcn.0049dc09
mov esi, dword [0x5590f8]
push esi
call fcn.004241e6
add esp, 0x14
lea ecx, [ebp - 4]
push eax
push esi
call fcn.0043ae55
lea eax, [ebp - 4]
push eax
call fcn.0049dc09
pop ecx
push dword [ebp - 4]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4a0df6
push eax
push dword [ebp - 4]
call fcn.0049d954
mov esi, dword [ebp - 4]
mov edi, eax
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push esi
push str.Create_Directory__s__bRet_d_error_d__r_n
push 0x55913c
call fcn.004a9ba2
add esp, 0x14
test edi, edi
je 0x4a0ebc
mov edi, dword [ebp - 8]
mov esi, dword [0x5590f0]
push esi
call fcn.004241e6
pop ecx
push eax
push esi
lea ecx, [ebp - 4]
call fcn.0043ae55
push dword [ebp - 4]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4a0e37
push dword [ebp - 4]
push str._s_File_Exists__r_n
push 0x55913c
call fcn.004a9ba2
xor edi, edi
add esp, 0xc
inc edi
jmp 0x4a0ebc
mov eax, dword [edi + 8]
sub eax, 0x10
push eax
call fcn.00425bf9
add eax, 0x10
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.0049dc09
mov esi, str.Data_
push esi
call fcn.004241e6
add esp, 0xc
lea ecx, [ebp - 8]
push eax
push esi
call fcn.0043ae55
mov esi, dword [0x5590f0]
push esi
call fcn.004241e6
pop ecx
push eax
push esi
lea ecx, [ebp - 8]
call fcn.0043ae55
push 1
push dword [ebp - 4]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push dword [ebp - 4]
push dword [ebp - 8]
push str.Copy_lego.dat_src_ws_dst_ws_CopyFile_bRet_d_error_d
push 0x55913c
call fcn.004a9ba2
mov ecx, dword [ebp - 8]
add esp, 0x18
lea ecx, [ecx - 0x10]
call fcn.0042095b
push str.CopyDatFileForLego_End_r_n
push 0x55913c
call fcn.004a9ba2
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
lea ecx, [ecx - 0x10]
call fcn.0042095b
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4a0ee0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x52de80]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x3c]
push esi
call fcn.004045f0
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x54]
call fcn.00408670
push eax
call fcn.0040a710
pop ecx
lea ecx, [ebp - 0x54]
mov bl, al
call fcn.004086c0
push 0
push 1
lea ecx, [ebp - 0x3c]
call fcn.00402540
test bl, bl
je 0x4a101d
push edi
push esi
lea ecx, [ebp - 0x58]
call fcn.00425ac1
lea eax, [ebp - 0x58]
push eax
call fcn.0049dc09
mov edi, str.test_access
push edi
call fcn.004241e6
pop ecx
pop ecx
push eax
push edi
lea ecx, [ebp - 0x58]
call fcn.0043ae55
push 7
mov byte [ebp - 0x24], 0
lea edi, [ebp - 0x23]
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
push dword [ebp - 0x58]
lea ecx, [ebp - 0x3c]
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.004045f0
push 0x1e
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x54]
call fcn.00408670
push eax
call fcn.0040ab50
add esp, 0xc
lea ecx, [ebp - 0x54]
cmp eax, 0xffffffff
setne bl
call fcn.004086c0
xor edi, edi
lea ecx, [ebp - 0x3c]
push 0
inc edi
push edi
call fcn.00402540
test bl, bl
je 0x4a0fbb
push dword [ebp - 0x58]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x4a1011
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.WriteFile_testfile_fail_errcode_d__r_n
push 0x55913c
call fcn.004a9ba2
add esp, 0xc
lea ecx, [ebp - 0x59]
push edi
push 0x1f01ff
push esi
call fcn.00432774
xor ebx, ebx
mov dword [ebp - 0x28], 0xf
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x2c], ebx
push eax
push ebx
push edi
push 2
push str.execptiondirectory_permissions_problems
push ebx
push 0x6e
mov byte [ebp - 0x3c], bl
call fcn.004b1e90
push ebx
push edi
lea ecx, [ebp - 0x3c]
call fcn.00402490
mov ecx, dword [ebp - 0x58]
lea ecx, [ecx - 0x10]
call fcn.0042095b
pop edi
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.004bc45f
mov esp, ebp
pop ebp
ret 4
Function at 0x4a1cd9
Capabilities:
Check if file exists
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x52de80]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
push eax
lea ecx, [ebp - 0x23c]
call fcn.004045f0
lea eax, [ebp - 0x23c]
mov ecx, esi
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.004a0711
xor ebx, ebx
lea ecx, [ebp - 0x23c]
push ebx
push 1
call fcn.00402540
push ebx
push 0x1c
lea eax, [ebp - 0x20c]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov ebx, eax
lea eax, [ebp - 0x20c]
push eax
call fcn.00402df0
pop ecx
push eax
lea eax, [ebp - 0x20c]
mov ecx, edi
push eax
call fcn.00406500
mov esi, 0x5115dc
push esi
call fcn.00402df0
pop ecx
push eax
push esi
mov ecx, edi
call fcn.00406420
mov esi, 0x50c8fc
push esi
call fcn.00402df0
pop ecx
push eax
push esi
mov ecx, edi
call fcn.00406420
cmp dword [ebp - 0x210], 8
lea esi, [ebp - 0x224]
cmovae esi, dword [ebp - 0x224]
push esi
call fcn.00402df0
pop ecx
push eax
push esi
mov ecx, edi
call fcn.00406420
cmp dword [edi + 0x14], 8
jb 0x4a1daf
mov eax, dword [edi]
jmp 0x4a1db1
mov eax, edi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4a1dd2
cmp dword [ebp + 0x10], eax
je 0x4a1dd2
cmp dword [edi + 0x14], 8
jb 0x4a1dc9
mov edi, dword [edi]
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0
push 1
lea ecx, [ebp - 0x224]
call fcn.00402540
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004bc45f
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4a22d4
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x52de80]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x114], 5
jne 0x4a230b
cmp dword [ebp - 0x110], 0
mov eax, 0x4f6a6c
je 0x4a2310
mov eax, str.SpoolerGroup
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bc45f
mov esp, ebp
pop ebp
ret

Function at 0x4a285a
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea esi, [ecx + 8]
mov eax, dword [esi]
sub eax, 0x10
push edi
push eax
call fcn.00425bf9
add eax, 0x10
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
call fcn.0049dc09
pop ecx
pop ecx
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
call fcn.00425b83
push esi
call fcn.0049dc09
mov edi, str.skinupdater.exe
push edi
call fcn.004241e6
pop ecx
pop ecx
push eax
push edi
lea ecx, [ebp - 4]
call fcn.0043ae55
push dword [ebp - 4]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4a28b9
mov edi, 0x4fe650
push edi
call fcn.004241e6
pop ecx
push eax
push edi
mov ecx, esi
call fcn.0043ae55
mov ecx, dword [ebp - 4]
lea ecx, [ecx - 0x10]
call fcn.0042095b
xor eax, eax
pop edi
inc eax
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4a29ad
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x52de80]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x38]
push edi
push 0
push eax
mov edi, ecx
call fcn.0049c02c
push dword [ebp - 0x38]
mov ebx, 0x55913c
push str.Init_localpath___ws_r_n
push ebx
call fcn.004a9ba2
xor eax, eax
add esp, 0x14
test esi, esi
setne al
mov dword [edi + 0x28], eax
test eax, eax
je 0x4a2a1f
push esi
call fcn.004241e6
pop ecx
push eax
push esi
lea ecx, [edi + 0x2c]
call fcn.0042416d
push esi
push str.Init_7zFilePath___ws_r_n
push ebx
call fcn.004a9ba2
add esp, 0xc
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ebx, eax
jmp 0x4a2a34
lea ecx, [edi + 0x80]
call fcn.004a96ea
mov ebx, eax
test ebx, ebx
je 0x4a2b61
lea esi, [edi + 4]
push esi
call fcn.0049bde5
pop ecx
test eax, eax
je 0x4a2a4b
mov dword [edi + 0x70], 1
jmp 0x4a2a53
push esi
mov ecx, edi
call fcn.004a1ee6
push esi
call fcn.0049dc09
push dword [edi + 0x70]
push dword [esi]
push str.Init_InstallPath_ws_m_bInstalled_d_r_n
push 0x55913c
call fcn.004a9ba2
and dword [ebp - 0xc], 0
xor eax, eax
mov word [ebp - 0x1c], ax
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 8], 7
call fcn.0049bbfc
lea eax, [ebp - 0x1c]
push eax
call fcn.0049dc49
mov esi, str.liebao
push esi
call fcn.00402df0
add esp, 0x20
lea ecx, [ebp - 0x1c]
push eax
push esi
call fcn.00406420
lea eax, [ebp - 0x1c]
push eax
call fcn.0049dc49
cmp dword [ebp - 8], 8
lea esi, [ebp - 0x1c]
cmovae esi, dword [ebp - 0x1c]
push esi
call fcn.004241e6
pop ecx
pop ecx
push eax
push esi
lea ecx, [edi + 0x24]
call fcn.0042416d
mov esi, 0x4fcd10
push esi
call fcn.00402df0
pop ecx
push eax
push esi
lea ecx, [ebp - 0x1c]
call fcn.00406420
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x34]
call fcn.00408670
push eax
call fcn.00411f30
pop ecx
lea ecx, [ebp - 0x34]
call fcn.004086c0
lea eax, [ebp - 0x1c]
push eax
call fcn.0049dc49
cmp dword [ebp - 8], 8
lea esi, [ebp - 0x1c]
cmovae esi, dword [ebp - 0x1c]
push esi
call fcn.004241e6
pop ecx
pop ecx
push eax
push esi
lea ecx, [edi + 0x20]
call fcn.0042416d
mov ecx, edi
call fcn.004a51ec
mov ecx, edi
call fcn.004a5363
cmp dword [edi + 0x70], 0
je 0x4a2b40
mov ecx, edi
call fcn.004a53ef
mov ecx, edi
call fcn.004a3cad
mov ecx, edi
call fcn.004a7e79
mov ecx, edi
call fcn.004a7185
push 0
push 1
lea ecx, [ebp - 0x1c]
call fcn.00402540
mov ecx, dword [ebp - 0x38]
lea ecx, [ecx - 0x10]
call fcn.0042095b
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004bc45f
mov esp, ebp
pop ebp
ret 4
Function at 0x4a310c
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, ecx
push ebx
mov dword [ebp - 0xc], eax
push esi
mov eax, dword [eax + 8]
sub eax, 0x10
push edi
push eax
call fcn.00425bf9
add eax, 0x10
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
call fcn.0049dc09
mov esi, str.knbcenter.exe
push esi
call fcn.004241e6
add esp, 0xc
lea ecx, [ebp - 4]
push eax
push esi
call fcn.0043ae55
push str.knbcenter
lea ecx, [ebp - 0x10]
call fcn.00425ac1
push 0x4fd6e0
lea ecx, [ebp - 0x18]
call fcn.00425ac1
push 0x4fd6f8
lea ecx, [ebp - 8]
call fcn.00425ac1
lea ecx, [ebp - 0x20]
call fcn.00464a72
push 2
xor ebx, ebx
lea ecx, [ebp - 0x20]
push ebx
call fcn.00464b05
mov edi, dword [ebp - 0x10]
test eax, eax
jne 0x4a31b3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 8]
push eax
push str.service_open_fail__err_d_r_n
push 0x55913c
mov dword [ecx], eax
call fcn.004a9ba2
add esp, 0xc
jmp 0x4a329b
lea ecx, [ebp - 0x14]
call fcn.00464a6c
mov ecx, dword [ebp - 0xc]
mov esi, dword [ebp - 4]
push ebx
push ebx
push ebx
push ebx
call fcn.004a22d4
push eax
push esi
push ebx
push 2
push 0x10
push ebx
push dword [ebp - 0x18]
lea eax, [ebp - 0x20]
push edi
push eax
lea ecx, [ebp - 0x14]
call fcn.00464abb
test eax, eax
jne 0x4a3212
mov esi, dword [ebp + 8]
push dword [esi]
push str.service_create_fail__err_d_r_n
push 0x55913c
call fcn.004a9ba2
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
cmp eax, 0x431
jne 0x4a3293
mov dword [esi], ebx
mov eax, dword [ebp - 8]
mov eax, dword [eax - 0xc]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x4a3290
call fcn.00420e4a
push eax
lea ecx, [ebp + 8]
call fcn.00423e50
push edi
lea eax, [ebp + 8]
push str.SYSTEMCurrentControlSetServices_s
push eax
call fcn.0042443a
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10]
add esp, 0xc
push eax
push 0x2001f
push ebx
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a3288
push dword [ebp - 0xc]
lea ecx, [ebp - 8]
call fcn.00423e83
mov ecx, dword [ebp - 0xc]
add ecx, ecx
push ecx
push eax
push 1
push ebx
push str.Description
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esi - 0x10]
call fcn.0042095b
xor ebx, ebx
inc ebx
lea ecx, [ebp - 0x14]
call fcn.00464a7c
lea ecx, [ebp - 0x20]
call fcn.00464a81
mov ecx, dword [ebp - 8]
lea ecx, [ecx - 0x10]
call fcn.0042095b
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.0042095b
lea ecx, [edi - 0x10]
call fcn.0042095b
mov ecx, dword [ebp - 4]
add ecx, 0xfffffff0
call fcn.0042095b
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4a3642
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8d0
mov eax, dword [0x52de80]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
xor eax, eax
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x8d0], ebx
push dword [ebx + 4]
mov ecx, ebx
mov dword [ebp - 0x8cc], edi
push dword [ebx]
mov esi, eax
call fcn.004a8b73
mov eax, dword [ebx]
mov ecx, edi
mov dword [ebx + 4], eax
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x808], 7
mov word [ebp - 0x81c], ax
lea eax, [ebp - 0x81c]
push eax
mov dword [ebp - 0x80c], ebx
call fcn.004a1df6
cmp dword [ebp - 0x808], 8
lea eax, [ebp - 0x81c]
cmovae eax, dword [ebp - 0x81c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4a37e4
xor eax, eax
push 0x7fe
mov word [ebp - 0x804], ax
lea eax, [ebp - 0x802]
push ebx
push eax
call fcn.004bf4f0
add esp, 0xc
lea eax, [ebp - 0x81c]
cmp dword [ebp - 0x808], 8
cmovae eax, dword [ebp - 0x81c]
push eax
push 0x400
lea eax, [ebp - 0x804]
push eax
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov edi, eax
test edi, edi
je 0x4a37e4
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004bb10a
mov ebx, eax
xor eax, eax
push edi
push eax
push ebx
call fcn.004bf4f0
xor edx, edx
add esp, 0x10
mov ecx, edx
test edi, edi
je 0x4a37d8
mov ax, word [ebp + esi*2 - 0x804]
mov word [ebx + ecx*2], ax
inc ecx
cmp word [ebp + esi*2 - 0x804], dx
jne 0x4a37cf
lea ecx, [ebp - 0x8c4]
call fcn.004a0097
cmp dword [ebp - 0x808], 8
lea eax, [ebp - 0x81c]
mov ecx, dword [ebp - 0x8cc]
cmovae eax, dword [ebp - 0x81c]
push eax
push ebx
lea eax, [ebp - 0x8c4]
push eax
call fcn.004a3807
mov ecx, dword [ebp - 0x8d0]
lea eax, [ebp - 0x8c4]
push eax
call fcn.004a917b
push edi
xor eax, eax
push eax
push ebx
call fcn.004bf4f0
add esp, 0xc
lea ecx, [ebp - 0x8c4]
xor eax, eax
mov dword [ebp - 0x8c8], eax
call fcn.004a044c
mov ecx, dword [ebp - 0x8c8]
xor edx, edx
inc esi
cmp esi, edi
jb 0x4a374b
push ebx
call fcn.004bbf48
xor esi, esi
inc esi
xor ebx, ebx
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x81c]
call fcn.00402540
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004bc45f
mov esp, ebp
pop ebp
ret 4
Function at 0x4a3ee2
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push str.Magic_DesktopShortcut_Begin_r_n
push 0x55913c
mov esi, ecx
call fcn.004a9ba2
pop ecx
pop ecx
call fcn.00420e4a
push eax
lea ecx, [ebp - 4]
call fcn.00423e50
lea eax, [ebp - 4]
mov ecx, esi
push eax
call fcn.004a2039
lea eax, [ebp - 4]
push eax
call fcn.0049dc09
pop ecx
call fcn.00420e4a
push eax
lea ecx, [ebp - 8]
call fcn.00423e50
lea eax, [ebp - 8]
mov ecx, esi
push eax
call fcn.004a2486
call fcn.00420e4a
push eax
lea ecx, [ebp - 0xc]
call fcn.00423e50
lea eax, [ebp - 0xc]
mov ecx, esi
push eax
call fcn.004a24e5
mov ecx, esi
call fcn.004a4030
push 0x4fe70c
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00442988
add esp, 0xc
push dword [eax]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, dword [ebp - 0x10]
mov ebx, eax
neg ebx
sbb bl, bl
add ecx, 0xfffffff0
call fcn.0042095b
mov edi, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
inc bl
je 0x4a3ff6
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
lea eax, [ebp - 4]
push 0x4fe70c
push eax
lea eax, [ebp - 0x10]
push eax
je 0x4a3fcd
call fcn.00442988
push str.Liebao
push esi
push dword [eax]
push str.__ico1
push edi
call fcn.0049b4bf
mov ecx, dword [ebp - 0x10]
add esp, 0x20
add ecx, 0xfffffff0
jmp 0x4a3fed
call fcn.00442988
push str.Liebao
push dword [eax]
push str.__ico1
push edi
call fcn.0049b6b4
mov ecx, dword [ebp - 0x10]
add esp, 0x1c
lea ecx, [ecx - 0x10]
mov ebx, eax
call fcn.0042095b
jmp 0x4a3ff9
xor ebx, ebx
inc ebx
push ebx
push str.Magic_DesktopShortcut_End_bRet___d_r_n
push 0x55913c
call fcn.004a9ba2
add esp, 0xc
lea ecx, [esi - 0x10]
call fcn.0042095b
lea ecx, [edi - 0x10]
call fcn.0042095b
mov ecx, dword [ebp - 4]
lea ecx, [ecx - 0x10]
call fcn.0042095b
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a4030
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push str.Magic_DesktopShortcutClear_Begin_r_n
push 0x55913c
mov esi, ecx
call fcn.004a9ba2
pop ecx
pop ecx
call fcn.00420e4a
push eax
lea ecx, [ebp - 4]
call fcn.00423e50
lea eax, [ebp - 4]
mov ecx, esi
push eax
call fcn.004a2039
lea eax, [ebp - 4]
push eax
call fcn.0049dc09
lea eax, [ebp - 4]
mov dword [esp], 0x4fe998
push eax
lea eax, [ebp - 8]
push eax
call fcn.00442988
add esp, 0xc
push dword [eax]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, dword [ebp - 8]
mov esi, eax
add ecx, 0xfffffff0
call fcn.0042095b
test esi, esi
je 0x4a40c3
push 0x4fe998
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
call fcn.00442988
add esp, 0xc
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 8]
lea ecx, [ecx - 0x10]
call fcn.0042095b
push 0x4fe70c
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
call fcn.00442988
add esp, 0xc
push dword [eax]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, dword [ebp - 8]
mov esi, eax
add ecx, 0xfffffff0
call fcn.0042095b
test esi, esi
pop esi
je 0x4a411a
push 0x4fe70c
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
call fcn.00442988
add esp, 0xc
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 8]
lea ecx, [ecx - 0x10]
call fcn.0042095b
push str.Magic_DesktopShortcutClear_End_r_n
push 0x55913c
call fcn.004a9ba2
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
lea ecx, [ecx - 0x10]
call fcn.0042095b
mov esp, ebp
pop ebp
ret
Function at 0x4a4b29
Capabilities:
Check if file exists
Create process on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
push str.Magic_StartMenuQuickLaunchShortcut_Begin_r_n
push 0x55913c
mov esi, ecx
call fcn.004a9ba2
pop ecx
pop ecx
xor edi, edi
call fcn.00420e4a
push eax
lea ecx, [ebp - 0x10]
call fcn.00423e50
lea eax, [ebp - 0x10]
mov ecx, esi
push eax
call fcn.004a24e5
mov ecx, esi
call fcn.004a4cc5
call fcn.0049da55
test eax, eax
je 0x4a4cb2
push ebx
call fcn.00420e4a
push eax
lea ecx, [ebp - 4]
call fcn.00423e50
lea eax, [esi + 4]
push eax
lea ecx, [ebp - 4]
call fcn.00425b83
lea eax, [ebp - 4]
push eax
call fcn.0049dc09
pop ecx
call fcn.00420e4a
push eax
lea ecx, [ebp - 8]
call fcn.00423e50
lea eax, [ebp - 8]
mov ecx, esi
push eax
call fcn.004a2486
call fcn.00420e4a
push eax
lea ecx, [ebp - 0xc]
call fcn.00423e50
lea eax, [ebp - 0xc]
mov ecx, esi
push eax
call fcn.004a24e5
mov edi, dword [ebp - 0xc]
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ebx, 0x4fe70c
test eax, eax
push ebx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
je 0x4a4c06
call fcn.00442988
mov esi, dword [ebp - 8]
push str.Liebao
push edi
push dword [eax]
push str.__ico4
push esi
call fcn.0049b4bf
add esp, 0x20
jmp 0x4a4c23
call fcn.00442988
mov esi, dword [ebp - 8]
push str.Liebao
push dword [eax]
push str.__ico4
push esi
call fcn.0049b6b4
add esp, 0x1c
mov ecx, dword [ebp - 0xc]
lea ecx, [ecx - 0x10]
call fcn.0042095b
lea ecx, [edi - 0x10]
call fcn.0042095b
lea ecx, [esi - 0x10]
call fcn.0042095b
push ebx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.00442988
add esp, 0xc
xor edi, edi
xor ecx, ecx
inc edi
push edi
push ecx
push ecx
push dword [eax]
push str.startpin
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 0xc]
mov esi, eax
lea ecx, [ecx - 0x10]
call fcn.0042095b
push esi
push str.ShellExecute_ret0x_x_r_n
push 0x55913c
call fcn.004a9ba2
push ebx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.00442988
add esp, 0x18
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0xc]
lea ecx, [ecx - 0x10]
call fcn.0042095b
mov ecx, dword [ebp - 4]
add ecx, 0xfffffff0
call fcn.0042095b
pop ebx
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0042095b
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4a4cc5
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push str.Magic_StartMenuQuickLaunchShortcutClear_Begin_r_n
push 0x55913c
call fcn.004a9ba2
pop ecx
pop ecx
call fcn.0049da55
test eax, eax
je 0x4a4e99
push ebx
push esi
push edi
call fcn.00420e4a
push eax
lea ecx, [ebp - 4]
call fcn.00423e50
push 0x104
lea ecx, [ebp - 4]
call fcn.00423e83
push eax
push 0
push 0x1a
push 0
call fcn.0049dfba
add esp, 0x10
lea ecx, [ebp - 4]
push 0xffffffffffffffff
call fcn.00425b33
mov esi, str.MicrosoftInternet_ExplorerQuick_LaunchUser_PinnedStartMenu_
push esi
call fcn.004241e6
pop ecx
push eax
push esi
lea ecx, [ebp - 4]
call fcn.0043ae55
push 0x4fe70c
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
call fcn.00442988
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0xc
push dword [eax]
call ebx
mov ecx, dword [ebp - 8]
mov esi, eax
add ecx, 0xfffffff0
call fcn.0042095b
mov edi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
test esi, esi
je 0x4a4daf
push 0x4fe70c
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
call fcn.00442988
add esp, 0xc
xor ecx, ecx
push ecx
push ecx
push ecx
push dword [eax]
push str.startunpin
push ecx
call edi
mov ecx, dword [ebp - 8]
mov esi, eax
add ecx, 0xfffffff0
call fcn.0042095b
push esi
push str.ShellExecute_ret0x_x_r_n
push 0x55913c
call fcn.004a9ba2
add esp, 0xc
push 0x4fe998
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
call fcn.00442988
add esp, 0xc
push dword [eax]
call ebx
mov ecx, dword [ebp - 8]
mov esi, eax
add ecx, 0xfffffff0
call fcn.0042095b
test esi, esi
je 0x4a4e1d
push 0x4fe998
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
call fcn.00442988
add esp, 0xc
xor ecx, ecx
push ecx
push ecx
push ecx
push dword [eax]
push str.startunpin
push ecx
call edi
mov ecx, dword [ebp - 8]
mov esi, eax
add ecx, 0xfffffff0
call fcn.0042095b
push esi
push str.ShellExecute_ret0x_x_r_n
push 0x55913c
call fcn.004a9ba2
add esp, 0xc
push 0x4fedf4
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
call fcn.00442988
add esp, 0xc
push dword [eax]
call ebx
mov ecx, dword [ebp - 8]
mov esi, eax
add ecx, 0xfffffff0
call fcn.0042095b
test esi, esi
je 0x4a4e8b
push 0x4fedf4
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
call fcn.00442988
add esp, 0xc
xor ecx, ecx
push ecx
push ecx
push ecx
push dword [eax]
push str.startunpin
push ecx
call edi
mov ecx, dword [ebp - 8]
mov esi, eax
add ecx, 0xfffffff0
call fcn.0042095b
push esi
push str.ShellExecute_ret0x_x_r_n
push 0x55913c
call fcn.004a9ba2
add esp, 0xc
mov ecx, dword [ebp - 4]
lea ecx, [ecx - 0x10]
call fcn.0042095b
pop edi
pop esi
pop ebx
push str.Magic_StartMenuQuickLaunchShortcutClear_End_r_n
push 0x55913c
call fcn.004a9ba2
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret