joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49309f
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x30]
test ecx, ecx
je 0x4930c6
mov eax, dword [ecx]
push 0
call dword [eax + 4]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0
push 0x10
push dword [esi + 8]
call dword [sym.imp.USER32.dll_PostMessageW]
pop esi
ret

Function at 0x493bb6
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0
call fcn.005c35ca
pop ecx
mov dword [ebp - 0xc], eax
lea eax, [ebp - 4]
push eax
push 0x20006
push 0
push 0x63362c
push reloc.WS2_32.dll_accept
mov dword [ebp - 8], edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x493c0a
push 8
lea eax, [ebp - 0xc]
push eax
push 0xb
push 0
push str.rd_popup_time
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
leave
ret

Function at 0x493c0c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push edi
xor ebx, ebx
push ebx
call fcn.005c35ca
pop ecx
push 4
mov edi, eax
mov dword [ebp - 0x1c], edx
pop eax
mov dword [ebp - 0x14], eax
xorps xmm0, xmm0
mov dword [ebp - 0x18], eax
lea eax, [ebp - 4]
push eax
push 0x20019
push ebx
push 0x63362c
push reloc.WS2_32.dll_accept
movlpd qword [ebp - 0x24], xmm0
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], 8
mov dword [ebp - 0x10], 0xb
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x493c66
mov al, 1
jmp 0x493cc0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push str.rd_popup_time
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
push str.total_duration
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
imul ecx, dword [ebp - 8], 0x3c
xor eax, eax
add ecx, dword [ebp - 0x24]
adc eax, dword [ebp - 0x20]
cmp dword [ebp - 0x1c], eax
jl 0x493cbe
jg 0x493cbc
cmp edi, ecx
jbe 0x493cbe
mov bl, 1
mov al, bl
pop edi
pop ebx
leave
ret

Function at 0x493cc4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
and dword [ebp - 8], 0
mov esi, eax
push 4
pop eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x63362c
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x493d03
mov al, 1
jmp 0x493d34
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push str.boot_duration
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
imul eax, dword [ebp - 8], 0xea60
cmp esi, eax
seta al
pop esi
leave
ret
Function at 0x493d37
Capabilities:
Check mutex on windows

Disassembly:
push ebx
push esi
push edi
mov ebx, str.Q360_SE_SAFE_PopupWindowMutex
xor edi, edi
push ebx
push edi
push 0x1f0001
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [esi + 0x64], eax
test eax, eax
je 0x493d65
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x64], edi
xor al, al
jmp 0x493d89
push ebx
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 0x64], eax
test eax, eax
je 0x493d61
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x493d87
push dword [esi + 0x64]
jmp 0x493d58
mov al, 1
pop edi
pop esi
pop ebx
ret
Function at 0x49e451
Capabilities:
Get common file path
Get disk size

Disassembly:
push 0x260
mov eax, 0x5ef58f
call fcn.0059bbd7
mov edi, ecx
call fcn.004278e7
test eax, eax
jne 0x49e66d
push 0x208
xor ebx, ebx
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.005b24a0
add esp, 0xc
lea eax, [ebp - 0x218]
push 1
push 0x1a
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp word [ebp - 0x218], bx
je 0x49e66d
cmp word [ebp - 0x216], bx
je 0x49e66d
xor eax, eax
mov word [ebp - 0x214], ax
lea eax, [ebp - 0x26c]
push eax
push ebx
push ebx
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x49e66d
mov esi, dword [ebp - 0x26c]
lea ecx, [ebp - 0x230]
mov eax, dword [ebp - 0x268]
shrd esi, eax, 0x14
push 0x6335fc
call fcn.0040b0d5
mov dword [ebp - 4], ebx
test esi, esi
jle 0x49e50f
cmp esi, 0x1f4
jg 0x49e517
mov esi, 0x633e74
jmp 0x49e54a
cmp esi, 0x1f4
jle 0x49e526
cmp esi, 0x400
jg 0x49e52e
mov esi, 0x64689c
jmp 0x49e54a
cmp esi, 0x400
jle 0x49e53d
cmp esi, 0x2000
jg 0x49e545
mov esi, 0x64dd50
jmp 0x49e54a
cmp esi, 0x2000
jle 0x49e55e
mov esi, 0x64dd54
push esi
call fcn.005c2f90
pop ecx
push eax
push esi
lea ecx, [ebp - 0x230]
call fcn.0040b566
mov eax, dword [0x6d3fd4]
mov dword [ebp - 0x264], eax
push ebx
mov byte [ebp - 4], 1
call fcn.005c35ca
push edx
push eax
lea eax, [ebp - 0x264]
push 0x63af98
push eax
call fcn.00414053
add esp, 0x14
lea ecx, [ebp - 0x264]
push ebx
call fcn.00413c4d
push eax
lea ecx, [ebp - 0x260]
call fcn.0040b0d5
push eax
push str.ReqDate
mov edx, str.Software360360huabaohuabao
call fcn.004264a4
pop ecx
pop ecx
lea ecx, [ebp - 0x260]
call fcn.0040b67e
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x248]
push 0x65fb88
push eax
call fcn.00445efc
add esp, 0xc
mov byte [ebp - 4], 2
mov eax, dword [edi + 0x154]
cmp eax, 2
jne 0x49e61c
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x260]
push str.https:__dd.browser.360.cn_static_a_1317.1463.gif__referer
push eax
call fcn.00445efc
add esp, 0xc
lea ecx, [ebp - 0x248]
push eax
call fcn.0040b0ac
lea ecx, [ebp - 0x260]
call fcn.0040b67e
jmp 0x49e63a
cmp eax, 5
jne 0x49e63a
mov esi, str.pid360hb_core_safe
push esi
call fcn.005c2f90
pop ecx
push eax
push esi
lea ecx, [ebp - 0x248]
call fcn.0040b220
push 1
push ebx
mov dl, 1
lea ecx, [ebp - 0x248]
call fcn.004ce396
pop ecx
pop ecx
lea ecx, [ebp - 0x248]
call fcn.0040b67e
lea ecx, [ebp - 0x264]
call fcn.0040a4ed
lea ecx, [ebp - 0x230]
call fcn.0040b67e
call fcn.0059bb81
ret
Function at 0x4a1357
Capabilities:
Check if file exists

Disassembly:
push 0x5c
mov eax, 0x5efabd
call fcn.0059bbd7
mov esi, ecx
and dword [ebp - 0x68], 0
lea ecx, [ebp - 0x2c]
call fcn.004d4353
cmp dword [eax + 0x14], 8
jb 0x4a1379
mov eax, dword [eax]
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push eax
call edi
xor ebx, ebx
inc ebx
test eax, eax
jne 0x4a1395
call fcn.004d3e72
mov byte [ebp - 0x5d], bl
test eax, eax
je 0x4a1399
mov byte [ebp - 0x5d], 0
lea ecx, [ebp - 0x2c]
call fcn.0040b67e
cmp byte [ebp - 0x5d], 0
je 0x4a13c9
push 0xd88
push str.ScreenSaverFrame::Init360inidll
push str.__s__d___Init360inidll_retry
mov byte [esi + 0x148], bl
call fcn.0040a649
add esp, 0xc
jmp 0x4a14ba
push 0x3f1
push dword [esi + 0xc]
mov byte [esi + 0x148], 0
call dword [sym.imp.USER32.dll_KillTimer]
lea ecx, [ebp - 0x44]
call fcn.004d4353
and dword [ebp - 4], 0
cmp dword [eax + 0x14], 8
push 2
pop ecx
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0x68], ecx
jb 0x4a13fb
mov eax, dword [eax]
push eax
call edi
test eax, eax
je 0x4a1424
lea ecx, [ebp - 0x2c]
call fcn.004d4353
mov dword [ebp - 0x64], 6
cmp dword [eax + 0x14], 8
jb 0x4a1419
mov eax, dword [eax]
push eax
call fcn.004352fd
pop ecx
test eax, eax
jne 0x4a1426
xor bl, bl
test byte [ebp - 0x64], 4
je 0x4a1434
lea ecx, [ebp - 0x2c]
call fcn.0040b67e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x44]
call fcn.0040b67e
test bl, bl
je 0x4a14ba
push 0xd90
mov edi, str.ScreenSaverFrame::Init360inidll
push edi
push str.__s__d___start_LoadLibraryExW_ini
call fcn.0040a649
add esp, 0xc
lea ecx, [ebp - 0x5c]
call fcn.004d4353
cmp dword [eax + 0x14], 8
jb 0x4a146c
mov eax, dword [eax]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
lea ecx, [ebp - 0x5c]
mov dword [esi + 0x108], eax
call fcn.0040b67e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xd93
push edi
push str.__s__d___LoadLibraryExW_status_d
call fcn.0040a649
mov eax, dword [esi + 0x108]
add esp, 0x10
test eax, eax
je 0x4a14ba
push str.IsSafeExist
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x6f0e2c], eax
call fcn.0059bb81
ret

Function at 0x4a1e27
Capabilities:
Terminate process

Disassembly:
mov ecx, dword [ecx + 0x4c]
push esi
test ecx, ecx
je 0x4a1ec8
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, eax
test esi, esi
je 0x4a1e75
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4a1e75
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x4a1e75
push 0xeca
mov esi, str.ScreenSaverFrame::ReCheckProcess
push esi
push str.__s__d___ReCheckProcess_wnd_ok
call fcn.0040a649
add esp, 0xc
xor eax, eax
mov dword [0x6f1694], eax
jmp 0x4a1e9e
mov eax, dword [0x6f1694]
mov esi, str.ScreenSaverFrame::ReCheckProcess
inc eax
push eax
push 0xec6
push esi
push str.__s__d___ReCheckProcess_wnd_error_count_d
mov dword [0x6f1694], eax
call fcn.0040a649
mov eax, dword [0x6f1694]
add esp, 0x10
cmp eax, 5
jne 0x4a1ec8
push 0xecf
push esi
push str.__s__d___exit_process
call fcn.0040a649
add esp, 0xc
push 0x29a
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret
Function at 0x4a34b4
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
mov esi, ecx
push 3
push ebx
push ebx
push ebx
push ebx
cmp dword [0x6decc8], ebx
je 0x4a34d5
push 1
jmp 0x4a34d7
push 0xffffffffffffffff
push edi
call dword [sym.imp.USER32.dll_SetWindowPos]
cmp dword [esi + 0x5c], 0
je 0x4a34f8
cmp dword [esi + 0x5c], 1
je 0x4a34f8
call fcn.0042709e
cmp eax, 7
je 0x4a3586
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push ebx
push esi
mov dword [ebp + 8], eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov esi, eax
mov dword [ebp - 8], esi
test esi, esi
je 0x4a3571
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x4a3571
cmp ecx, edi
je 0x4a3571
mov eax, dword [ebp + 8]
cmp eax, esi
je 0x4a3571
push esi
push eax
push edi
push ecx
push 0x114b
push str.ScreenSaverFrame::SetForegroundWindowInternal
push str._wndtop:_s__d__SetForegroundWindowInternal_hCurWnd__0x_x_hWnd_0x_x_dwMyID_d_dwCurID_d_
call fcn.0040a649
add esp, 0x1c
push 1
push esi
push dword [ebp + 8]
mov esi, dword [sym.imp.USER32.dll_AttachThreadInput]
call esi
push edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push edi
call dword [sym.imp.USER32.dll_SetFocus]
push ebx
push dword [ebp - 8]
push dword [ebp + 8]
call esi
jmp 0x4a3586
push edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push edi
call dword [sym.imp.USER32.dll_SetActiveWindow]
push edi
call dword [sym.imp.USER32.dll_SetFocus]
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x4a368a
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0x119a
push str.MayBeShowExitPopupAsnc
push str.__s__d__ExitPreviewAsnc
mov esi, ecx
call fcn.0040a649
push 4
call fcn.0059a7c1
xor edx, edx
lea ecx, [ebp - 4]
push ecx
push edx
push eax
push 0x4a3639
push edx
mov dword [eax], esi
push edx
mov dword [ebp - 4], edx
call fcn.005c30ff
add esp, 0x28
pop esi
leave
ret

Function at 0x4a5529
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x48]
test ecx, ecx
je 0x4a5550
mov eax, dword [ecx]
push 0
call dword [eax + 4]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0
push 0x10
push dword [esi + 8]
call dword [sym.imp.USER32.dll_PostMessageW]
pop esi
ret
Function at 0x4a73bc
Capabilities:
Delete file

Disassembly:
push 0x54
mov eax, 0x5f04d4
call fcn.0059bbd7
mov esi, dword [ebp + 8]
mov eax, esi
mov edi, dword [ebp + 0xc]
mov byte [ebp - 0x48], 0
mov dword [ebp - 0x50], 0x226
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x4c], 0x136
jb 0x4a73ea
mov eax, dword [esi]
push eax
push 0x1bb
push str.HuabaoMainFrame::GenVideoImg
push str.__s__d___GenVideoImg_strSrc___s
call fcn.0040a649
add esp, 0x10
cmp dword [esi + 0x14], 8
jb 0x4a740a
mov esi, dword [esi]
lea eax, [ebp - 0x50]
push eax
push esi
call fcn.004a7308
mov ebx, eax
mov dword [ebp - 0x4c], ebx
test ebx, ebx
je 0x4a7568
push 0x1be
push str.HuabaoMainFrame::GenVideoImg
push str.__s__d___GenVideoImg_ok
call fcn.0040a649
and dword [ebp - 0x44], 0
lea eax, [ebp - 0x44]
add esp, 0xc
mov dword [ebp - 0x60], vtable.Gdiplus::Bitmap.0
push eax
push 0
push ebx
call dword [sym.imp.gdiplus.dll_GdipCreateBitmapFromHBITMAP]
mov esi, dword [ebp - 0x44]
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x5c], esi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x40], ecx
xor edx, edx
lea eax, [ebp - 0x40]
inc edx
push eax
push edx
push ecx
mov byte [ebp - 4], dl
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
lea edx, [ebp - 0x38]
call fcn.004d57b2
test al, al
je 0x4a7547
push 0
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 0x40]
push esi
call dword [sym.imp.gdiplus.dll_GdipSaveImageToStream]
test eax, eax
je 0x4a749c
mov dword [ebp - 0x58], eax
jmp 0x4a749e
xor eax, eax
test eax, eax
jne 0x4a7547
and dword [ebp - 0x3c], eax
lea eax, [ebp - 0x3c]
push eax
push dword [ebp - 0x40]
call dword [sym.imp.ole32.dll_GetHGlobalFromStream]
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push 0x664b14
mov edx, edi
lea ecx, [ebp - 0x28]
mov ebx, eax
call fcn.00411559
pop ecx
mov byte [ebp - 4], 2
lea esi, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
push dword [ebp - 0x3c]
cmovae esi, dword [ebp - 0x28]
mov edi, dword [sym.imp.KERNEL32.dll_GlobalSize]
call edi
push eax
push esi
push 0x1cd
push str.HuabaoMainFrame::GenVideoImg
push str.__s__d___GenVideoImg_getEncoderClsid__s_GlobalSize_d
call fcn.0040a649
add esp, 0x14
lea esi, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
cmovae esi, dword [ebp - 0x28]
push dword [ebp - 0x3c]
call edi
push eax
mov edx, ebx
mov ecx, esi
call fcn.0041e514
pop ecx
mov ecx, dword [ebp - 0x48]
test eax, eax
push 1
pop eax
push dword [ebp - 0x3c]
movzx ecx, cl
cmovne ecx, eax
mov dword [ebp - 0x48], ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea ecx, [ebp - 0x28]
call fcn.0040b67e
mov ebx, dword [ebp - 0x4c]
mov esi, dword [ebp - 0x44]
push ebx
call dword [sym.imp.GDI32.dll_DeleteObject]
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x40]
test eax, eax
je 0x4a755f
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push esi
call dword [sym.imp.gdiplus.dll_GdipDisposeImage]
jmp 0x4a7577
cmp dword [edi + 0x14], 8
jb 0x4a7570
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov al, byte [ebp - 0x48]
call fcn.0059bb81
ret 8
Function at 0x4b5d04
Capabilities:
Check if file exists
Copy file

Disassembly:
push 0x50
mov eax, 0x5f2032
call fcn.0059bbd7
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x5c]
xor ebx, ebx
call fcn.00425665
push 0x668c20
mov edx, eax
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x2c]
call fcn.0041152a
pop ecx
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 2
call fcn.0040b67e
push 8
pop edi
cmp dword [ebp - 0x18], edi
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4b5dac
cmp dword [ebp - 0x18], edi
lea edx, [ebp - 0x2c]
lea ecx, [ebp - 0x44]
cmovae edx, dword [ebp - 0x2c]
call fcn.004236f2
push str.5c5e3afd499e5146fef1da5ef8a23205
lea ecx, [ebp - 0x44]
call fcn.004115c4
test al, al
je 0x4b5da4
mov ecx, esi
cmp dword [esi + 0x14], edi
jb 0x4b5d80
mov ecx, dword [esi]
call fcn.0041e71d
cmp dword [esi + 0x14], edi
jb 0x4b5d8c
mov esi, dword [esi]
cmp dword [ebp - 0x18], edi
lea eax, [ebp - 0x2c]
push ebx
cmovae eax, dword [ebp - 0x2c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
setne bl
lea ecx, [ebp - 0x44]
call fcn.00404812
lea ecx, [ebp - 0x2c]
call fcn.0040b67e
mov al, bl
call fcn.0059bb81
ret 4

Function at 0x4b5dbe
Capabilities:
Check if file exists
Get common file path

Disassembly:
push 0x460
mov eax, 0x5f209a
call fcn.0059bbd7
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 4], eax
mov edi, 0x20a
push edi
mov dword [ebp - 0x46c], esi
push eax
mov dword [ebp - 0x468], eax
lea eax, [ebp - 0x434]
push eax
call fcn.005b24a0
add esp, 0xc
lea eax, [ebp - 0x434]
mov ebx, 0x104
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push edi
xor edi, edi
lea eax, [ebp - 0x224]
push edi
push eax
call fcn.005b24a0
add esp, 0xc
lea eax, [ebp - 0x434]
push 0xffffffffffffffff
push 0x633600
push eax
push str._s_s
lea eax, [ebp - 0x224]
push ebx
push eax
call fcn.004b6387
add esp, 0x18
lea eax, [ebp - 0x224]
mov ecx, esi
push eax
call fcn.0040b0d5
xor ebx, ebx
mov dword [ebp - 0x43c], edi
inc ebx
mov dword [ebp - 0x438], 7
xor eax, eax
mov dword [ebp - 0x468], ebx
mov word [ebp - 0x44c], ax
lea eax, [ebp - 0x224]
mov dword [ebp - 4], ebx
push eax
lea ecx, [ebp - 0x464]
call fcn.0040b0d5
lea edx, [ebp - 0x44c]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x464]
call fcn.004272ec
lea ecx, [ebp - 0x464]
mov byte [ebp - 4], bl
call fcn.0040b67e
cmp dword [0x6dea94], edi
jne 0x4b5f36
cmp dword [ebp - 0x438], 8
lea ecx, [ebp - 0x44c]
mov edx, str.6.11.0.0
cmovae ecx, dword [ebp - 0x44c]
call fcn.004275c6
test eax, eax
jg 0x4b5f36
mov dword [ebp - 0x454], edi
lea ecx, [ebp - 0x464]
mov dword [ebp - 0x450], edi
mov edi, 0x6e9288
push edi
call fcn.0040b155
mov byte [ebp - 4], 3
mov eax, edi
cmp dword [0x6e929c], 8
cmovae eax, dword [0x6e9288]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4b5f25
call fcn.004b60ab
test al, al
je 0x4b5f25
push edi
mov ecx, esi
call fcn.0041322b
jmp 0x4b5f2b
mov byte [0x6e92e8], bl
lea ecx, [ebp - 0x464]
call fcn.0040b67e
lea ecx, [ebp - 0x44c]
call fcn.0040b67e
mov eax, esi
call fcn.0059bb81
ret 4
Function at 0x4b619f
Capabilities:
Check if file exists
Delete file
Extract resource via kernel32 functions
Get common file path
Write file on windows

Disassembly:
push 0x234
mov eax, 0x5f2100
call fcn.0059bbd7
mov esi, dword [ebp + 8]
xor ebx, ebx
mov eax, dword [ebp + 0x14]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x240], eax
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x4b61c9
mov eax, dword [esi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4b62b6
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x4b61e2
mov eax, dword [esi]
push eax
call fcn.00426b60
pop ecx
test eax, eax
je 0x4b62b6
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x4b61fb
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4b62b4
push 0x668cf4
push str.DBGHELPDAT
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x234], eax
test eax, eax
je 0x4b62ad
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
push dword [ebp - 0x234]
mov dword [ebp - 0x238], eax
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
cmp dword [ebp - 0x238], 0
mov dword [ebp - 0x234], eax
je 0x4b62ad
test eax, eax
jle 0x4b62ad
cmp dword [edi + 0x14], 8
mov ecx, edi
jb 0x4b6263
mov ecx, dword [edi]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [edi + 0x14], 8
mov eax, edi
jb 0x4b6274
mov eax, dword [edi]
push 0x63331c
push eax
call fcn.005c2b8a
mov dword [ebp - 0x23c], eax
pop ecx
pop ecx
test eax, eax
je 0x4b62ad
push eax
push 1
push dword [ebp - 0x234]
push dword [ebp - 0x238]
call fcn.005c2f38
push dword [ebp - 0x23c]
call fcn.005c2c80
add esp, 0x14
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor ebx, ebx
cmp dword [edi + 0x14], 8
mov eax, edi
jb 0x4b62c0
mov eax, dword [edi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4b637d
push 0x208
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.005b24a0
add esp, 0xc
lea eax, [ebp - 0x218]
push 1
push 0x1a
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.0040b0d5
push 0x633b6c
mov dword [ebp - 4], ebx
call fcn.005c2f90
pop ecx
push eax
push 0x633b6c
lea ecx, [ebp - 0x230]
call fcn.0040b220
lea edx, [ebp - 0x230]
mov ecx, edi
call fcn.00425e7a
mov eax, dword [ebp - 0x240]
cmp dword [eax + 0x14], 8
jb 0x4b6342
mov eax, dword [eax]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
movzx ebx, bl
push 1
pop eax
cmovne ebx, eax
cmp dword [edi + 0x14], 8
jb 0x4b635c
mov edi, dword [edi]
mov ecx, edi
call fcn.00425c92
cmp dword [esi + 0x14], 8
jb 0x4b636b
mov esi, dword [esi]
mov ecx, esi
call fcn.00425c92
lea ecx, [ebp - 0x230]
call fcn.0040b67e
mov al, bl
call fcn.0059bb81
ret 0x10

Function at 0x4b65be
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x6eea7e
xor esi, esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4b65ee
push dword [ebp + 8]
push 0x634348
push 0x104
push 0x6eec88
call fcn.0040cef9
add esp, 0x10
inc esi
mov eax, esi
pop esi
pop ebp
ret 4
Function at 0x4b666d
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push 0xc
push 0x697390
call fcn.0059c060
and dword [ebp - 0x1c], 0
push dword [ebp + 0xc]
push 0x634350
mov esi, 0x104
push esi
mov ebx, 0x6eea7e
push ebx
call fcn.00412a13
add esp, 0x10
push dword [ebp + 8]
call fcn.004b65be
test eax, eax
je 0x4b68ff
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4b68ff
mov dword [ebp - 0x1c], 1
push ebx
push esi
push 0x6e9d54
mov edi, 0x6335fc
push edi
push str.pdtname
mov ebx, 0x6eec88
push ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
call esi
push 0x6eea7e
push 0x63
push 0x6eef68
push edi
push str.proctype
push ebx
call esi
push 0x6eea7e
push 0x104
push 0x6e993c
push edi
push str.crashtype
push ebx
call esi
push 0x6eea7e
push 0x104
push 0x6e9b46
push edi
push str.trycatchcnt
push ebx
call esi
push 0x6eea7e
push 0x104
push 0x6ea372
push edi
push 0x633f20
push ebx
call esi
push 0x6eea7e
push 0x104
push 0x6e9f5e
push edi
push str.pdtver
push ebx
call esi
push 0x6eea7e
push 0x104
push 0x6ebaa8
push edi
push 0x633f40
push ebx
call esi
push 0x6eea7e
push 0x3ff
push 0x6ef030
push edi
push str.cururl
push ebx
call esi
push 0x6eea7e
push 0
push 0x633e7c
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [0x6ef830], eax
push 0x6eea7e
push 0x103
push 0x6e9524
push edi
push 0x633f80
push ebx
call esi
push 0x6eea7e
push 0x104
push 0x6ea57c
push edi
push str.module
push ebx
call esi
push 0x6eea7e
push 0x104
push 0x6eb694
push edi
push str.osver
push ebx
call esi
push 0x6eea7e
push 0x104
push 0x6eb89e
push edi
push str.iever
push ebx
call esi
push 0x6eea7e
push 0x104
push 0x6eafae
push edi
push str.modulever
push ebx
call esi
push 0x6eea7e
push 0x104
push 0x6ee66a
push edi
push str.dump
push ebx
call esi
push 0x6eea7e
push 0x1f
mov edi, 0x6f0db4
push edi
push 0x6335fc
push str.ExcptCode
push ebx
call esi
xor esi, esi
push str.0x80000003
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_StrCmpIW]
call edi
test eax, eax
jne 0x4b6875
push 0x633e74
push 0xa
push 0x6ef834
call fcn.005c4440
add esp, 0xc
xor ebx, ebx
inc ebx
mov esi, ebx
jmp 0x4b688c
push 0x633e78
push 0xa
push 0x6ef834
call fcn.005c4440
add esp, 0xc
xor ebx, ebx
inc ebx
push dword [ebp + 8]
push 0x634348
push 0x6e972c
call fcn.00412837
add esp, 0xc
push str.unknown
push 0x6ea57c
call edi
xor edx, edx
test eax, eax
cmove edx, ebx
xor eax, eax
mov word [0x6ebcb2], ax
and dword [ebp - 4], eax
push 0x6eafae
push 0x6e9524
test edx, edx
mov edx, 0x6ebcb2
je 0x4b68d9
push 0x6ea57c
jmp 0x4b68db
push 0
push esi
push ecx
mov ecx, 0x6ee66a
call fcn.004b42e5
add esp, 0x14
jmp 0x4b68f8
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 0xc