joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46899b
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push ebx
push esi
push edi
xor esi, esi
push 0x40
lea eax, [ebp - 0x58]
push esi
push eax
mov dword [ebp - 8], esi
call fcn.004921d0
mov dword [ebp - 0x18], esi
xor eax, eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
xor edi, edi
inc edi
push 0x4eb630
lea ecx, [ebp - 4]
mov ebx, esi
mov dword [ebp - 0x5c], 0x44
mov dword [ebp - 0x30], edi
call fcn.004044ee
lea eax, [ebp - 4]
push dword [ebp + 0xc]
push dword [ebp + 8]
push str.__s___s
push eax
call fcn.00404994
add esp, 0x10
cmp dword [ebp + 0x18], ebx
je 0x468a00
push 0xa
pop eax
jmp 0x468a02
xor eax, eax
mov word [ebp - 0x2c], ax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x5c]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
mov esi, dword [ebp - 4]
push esi
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x468a4d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp + 0xc]
mov ebx, eax
push dword [ebp + 8]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push ebx
push str.KFunction::RunApp_CreateProcessW_error:_d__wait:_d__show:_d__path:_ws__cmd:_ws
push 0x4eee98
call fcn.004738c9
add esp, 0x1c
jmp 0x468a78
mov eax, dword [ebp - 0x18]
cmp dword [ebp + 0x14], ebx
je 0x468a66
test eax, eax
je 0x468a66
push dword [ebp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], edi
cmp dword [ebp + 0x10], ebx
je 0x468a7b
push dword [ebp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [ebp - 0x18]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x468a8c
push eax
call edi
and dword [ebp - 0x18], 0
cmp dword [ebp - 0x14], 0
je 0x468a9b
push dword [ebp - 0x14]
call edi
and dword [ebp - 0x14], 0
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea ecx, [esi - 0x10]
call fcn.00404f8d
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x468af5
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push esi
push str.TerminateBrowser_Begin_hProcess__0x_x_r_n
mov ebx, 0x4eee98
push ebx
call fcn.004738c9
mov eax, dword [0x4eede0]
mov ecx, dword [0x4eeddc]
sub eax, ecx
sar eax, 2
add esp, 0xc
xor edi, edi
test eax, eax
je 0x468b50
push 0
push 0x184ef
push 0x10
push dword [ecx + edi*4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [0x4eede0]
mov ecx, dword [0x4eeddc]
sub eax, ecx
inc edi
sar eax, 2
cmp edi, eax
jb 0x468b29
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x7d0
push esi
mov dword [0x4eede0], ecx
call edi
test eax, eax
je 0x468c1a
push eax
push str.WaitForSingleObject__dwRet___d_r_n
push ebx
call fcn.004738c9
add esp, 0xc
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x468bd8
and dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x468bc1
cmp dword [ebp - 4], 0x103
jne 0x468c1a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0xc]
push eax
push str.TerminateProcess_fail_errcode_d
push ebx
mov dword [ecx], eax
call fcn.004738c9
add esp, 0xc
xor eax, eax
jmp 0x468c2a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetExitCodeProcess_errcode_d_r_n
push ebx
call fcn.004738c9
add esp, 0xc
jmp 0x468c1a
push 0xbb8
push esi
call edi
mov esi, eax
test esi, esi
jne 0x468bed
push str.Terminate_liebao_process_WaitForSingleObject_WAIT_OBJECT_0
jmp 0x468bfa
cmp esi, 0x102
jne 0x468c04
push str.Terminate_liebao_process_WaitForSingleObject_WAIT_TIMEOUT
push ebx
call fcn.004738c9
pop ecx
pop ecx
jmp 0x468c1a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.Terminate_liebao_process_WaitForSingleObject_dwRet_d_errcode_d_r_n
push ebx
call fcn.004738c9
add esp, 0x10
push str.TerminateBrowser_End_r_n
push ebx
call fcn.004738c9
pop ecx
xor eax, eax
pop ecx
inc eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x468c93
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, ecx
xor esi, esi
cmp dword [edi], esi
je 0x468cda
mov edx, dword [ebp + 0xc]
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
cmp ax, si
jne 0x468ca6
push ebx
sub edx, ecx
sar edx, 1
xor ebx, ebx
lea eax, [edx*2 + 2]
push eax
push dword [ebp + 0xc]
inc ebx
push ebx
push esi
push dword [ebp + 8]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
cmove esi, ebx
mov dword [edi + 4], eax
pop ebx
pop edi
mov eax, esi
pop esi
pop ebp
ret 8
Function at 0x469479
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x278
mov eax, dword [0x4eb664]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push eax
lea ecx, [ebp - 0x258]
xor ebx, ebx
call fcn.00406b6a
push 0x4d44cc
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x278]
push eax
call fcn.0042367e
add esp, 0xc
lea ecx, [ebp - 0x254]
push ecx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ecx, dword [ebp - 0x278]
mov esi, eax
add ecx, 0xfffffff0
mov dword [ebp - 0x260], esi
call fcn.00404f8d
cmp esi, 0xffffffff
mov esi, dword [ebp - 0x258]
jne 0x4694f0
inc ebx
jmp 0x4696bb
push edi
test byte [ebp - 0x254], 0x10
lea eax, [ebp - 0x228]
je 0x46959c
push 0x4d4a18
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x469690
push 0x4d4a1c
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x469690
push 0x4d3c8c
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x26c]
push eax
call fcn.0042367e
add esp, 0xc
push eax
lea eax, [ebp - 0x264]
push eax
call fcn.0042367e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [eax]
call fcn.00469479
mov ecx, dword [ebp - 0x264]
add esp, 0x18
add ecx, 0xfffffff0
mov edi, eax
call fcn.00404f8d
mov ecx, dword [ebp - 0x26c]
add ecx, 0xfffffff0
call fcn.00404f8d
test edi, edi
je 0x4696ae
jmp 0x469690
push eax
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x274]
push eax
call fcn.0042367e
add esp, 0xc
push 0x80
push dword [eax]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ecx, dword [ebp - 0x274]
lea ecx, [ecx - 0x10]
call fcn.00404f8d
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x268]
push eax
call fcn.0042367e
add esp, 0xc
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0x268]
add ecx, 0xfffffff0
mov edi, eax
call fcn.00404f8d
test edi, edi
jne 0x469690
push 0x4eb630
lea ecx, [ebp - 0x25c]
call fcn.004044ee
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea eax, [ebp - 0x228]
push eax
push esi
lea eax, [ebp - 0x25c]
push str._s_s_d__x
push eax
call fcn.00404994
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x270]
push eax
call fcn.0042367e
mov edi, dword [ebp - 0x25c]
push edi
push dword [eax]
call fcn.00493b54
mov ecx, dword [ebp - 0x270]
add esp, 0x28
add ecx, 0xfffffff0
mov ebx, eax
call fcn.00404f8d
test ebx, ebx
jne 0x469686
push 4
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
jmp 0x469688
xor ebx, ebx
lea ecx, [edi - 0x10]
call fcn.00404f8d
lea eax, [ebp - 0x254]
push eax
push dword [ebp - 0x260]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4694f1
xor ebx, ebx
inc ebx
push dword [ebp - 0x260]
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea ecx, [esi - 0x10]
call fcn.00404f8d
mov ecx, dword [ebp - 4]
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.0048f059
leave
ret
Function at 0x46a6e3
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x4eb664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
push 0xc
mov dword [ebp - 0x20], edi
call fcn.00449b05
pop ecx
test eax, eax
je 0x46a715
mov ecx, eax
call fcn.0046a3b2
mov ebx, eax
mov dword [ebp - 0x28], eax
jmp 0x46a71a
xor ebx, ebx
mov dword [ebp - 0x28], ebx
or dword [ebx], 0xffffffff
push dword [edi + 0x104]
lea ecx, [ebp - 0x1c]
call fcn.0040513a
cmp dword [ebp - 8], 8
lea esi, [ebp - 0x1c]
cmovae esi, dword [ebp - 0x1c]
push esi
call fcn.0040481a
pop ecx
push eax
push esi
lea ecx, [edi + 0x4c]
call fcn.004047a1
push dword [edi + 0x4c]
mov esi, edi
lea ecx, [ebp - 0x24]
mov esi, dword [esi + 0x38]
call fcn.004301a0
push esi
lea ecx, [ebp - 0x2c]
mov edi, eax
call fcn.004301a0
push dword [edi]
add ebx, 4
push dword [eax]
push str.reportver2.0.0.0installstepbeginoldver_snewver_s
push ebx
call fcn.00404980
mov ecx, dword [ebp - 0x2c]
add esp, 0x10
lea ecx, [ecx - 0x10]
call fcn.00404f8d
mov ecx, dword [ebp - 0x24]
lea ecx, [ecx - 0x10]
call fcn.00404f8d
push 0xc
push 0x4c29d4
mov ecx, ebx
call fcn.0041e2ec
push dword [0x4eee38]
lea ecx, [ebp - 0x24]
call fcn.004301a0
mov eax, dword [eax]
mov ecx, ebx
push dword [eax - 0xc]
push eax
call fcn.0041e2ec
mov ecx, dword [ebp - 0x24]
lea ecx, [ecx - 0x10]
call fcn.00404f8d
push 8
push 0x4c4bb4
mov ecx, ebx
call fcn.0041e2ec
mov eax, dword [ebp - 0x20]
mov edi, 0x4c25a0
cmp dword [eax + 0xb4], 0
mov ecx, 0x4c4bc0
mov esi, edi
cmove esi, ecx
push esi
call fcn.0040de6d
pop ecx
push eax
push esi
mov ecx, ebx
call fcn.0041e2ec
push 7
push str.force
mov ecx, ebx
call fcn.0041e2ec
mov eax, dword [ebp - 0x20]
mov esi, edi
cmp dword [eax + 0xc8], 0
mov eax, 0x4c4bc0
cmove esi, eax
push esi
call fcn.0040de6d
pop ecx
push eax
push esi
mov ecx, ebx
call fcn.0041e2ec
push 0x17
push str.innver2013_11_22_1849
mov ecx, ebx
call fcn.0041e2ec
push 0xb
push str.installed
mov ecx, ebx
call fcn.0041e2ec
mov eax, dword [ebp - 0x20]
cmp dword [eax + 0x70], 0
mov eax, 0x4c4bc0
cmove edi, eax
push edi
call fcn.0040de6d
pop ecx
push eax
push edi
mov ecx, ebx
call fcn.0041e2ec
push dword [ebx]
mov edi, 0x4eee98
push str._r_n_beginreport_s_r_n
push edi
call fcn.004738c9
add esp, 0xc
xor ebx, ebx
push ebx
push ebx
push dword [ebp - 0x28]
push 0x4709a1
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x46a8c3
push 0x3a98
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x46a8b4
push str.Report_timeout_r_n
push edi
call fcn.004738c9
pop ecx
pop ecx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.CusReport_Report_end_r_n
push edi
call fcn.004738c9
pop ecx
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x1c]
call fcn.00405ac5
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0048f059
leave
ret
Function at 0x46ac61
Capabilities:
Check if file exists
Copy file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
mov edi, ecx
push str.CopyDatFileForLego_Begin_r_n
push 0x4eee98
mov dword [ebp - 8], edi
call fcn.004738c9
mov eax, dword [edi + 0x20]
sub eax, 0x10
push eax
call fcn.00406c4d
add eax, 0x10
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
call fcn.00468709
mov esi, dword [0x4eee54]
push esi
call fcn.0040481a
add esp, 0x14
lea ecx, [ebp - 4]
push eax
push esi
call fcn.0041e1c3
lea eax, [ebp - 4]
push eax
call fcn.00468709
pop ecx
push dword [ebp - 4]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x46acfd
push eax
push dword [ebp - 4]
call fcn.0046845c
mov esi, dword [ebp - 4]
pop ecx
pop ecx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push esi
push str.Create_Directory__s__bRet_d_error_d__r_n
push 0x4eee98
call fcn.004738c9
add esp, 0x14
test edi, edi
je 0x46adc3
mov edi, dword [ebp - 8]
mov esi, dword [0x4eee4c]
push esi
call fcn.0040481a
pop ecx
push eax
push esi
lea ecx, [ebp - 4]
call fcn.0041e1c3
push dword [ebp - 4]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x46ad3e
push dword [ebp - 4]
push str._s_File_Exists__r_n
push 0x4eee98
call fcn.004738c9
xor edi, edi
add esp, 0xc
inc edi
jmp 0x46adc3
mov eax, dword [edi + 8]
sub eax, 0x10
push eax
call fcn.00406c4d
add eax, 0x10
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.00468709
mov esi, str.Data_
push esi
call fcn.0040481a
add esp, 0xc
lea ecx, [ebp - 8]
push eax
push esi
call fcn.0041e1c3
mov esi, dword [0x4eee4c]
push esi
call fcn.0040481a
pop ecx
push eax
push esi
lea ecx, [ebp - 8]
call fcn.0041e1c3
push 1
push dword [ebp - 4]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push dword [ebp - 4]
push dword [ebp - 8]
push str.Copy_lego.dat_src_ws_dst_ws_CopyFile_bRet_d_error_d
push 0x4eee98
call fcn.004738c9
mov ecx, dword [ebp - 8]
add esp, 0x18
lea ecx, [ecx - 0x10]
call fcn.00404f8d
push str.CopyDatFileForLego_End_r_n
push 0x4eee98
call fcn.004738c9
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
lea ecx, [ecx - 0x10]
call fcn.00404f8d
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x46ade5
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x4eb664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push esi
lea ecx, [ebp - 0x3c]
call fcn.0040513a
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x54]
call fcn.0047a0b4
push eax
call fcn.0047b0b6
pop ecx
lea ecx, [ebp - 0x54]
mov bl, al
call fcn.0047a0fe
push 0
push 1
lea ecx, [ebp - 0x3c]
call fcn.00405ac5
test bl, bl
je 0x46af20
push edi
push esi
lea ecx, [ebp - 0x58]
call fcn.00406b6a
lea eax, [ebp - 0x58]
push eax
call fcn.00468709
mov edi, str.test_access
push edi
call fcn.0040481a
pop ecx
pop ecx
push eax
push edi
lea ecx, [ebp - 0x58]
call fcn.0041e1c3
push 7
mov byte [ebp - 0x24], 0
pop ecx
push dword [ebp - 0x58]
xor eax, eax
lea edi, [ebp - 0x23]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [ebp - 0x3c]
stosb byte es:[edi], al
call fcn.0040513a
lea eax, [ebp - 0x24]
push 0x1e
push eax
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x54]
call fcn.0047a0b4
push eax
call fcn.0047b4f6
add esp, 0xc
cmp eax, 0xffffffff
lea ecx, [ebp - 0x54]
setne bl
call fcn.0047a0fe
push 0
push 1
lea ecx, [ebp - 0x3c]
call fcn.00405ac5
pop edi
test bl, bl
je 0x46aebf
push dword [ebp - 0x58]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x46af15
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.WriteFile_testfile_fail_errcode_d__r_n
push 0x4eee98
call fcn.004738c9
add esp, 0xc
lea ecx, [ebp - 0x59]
push 1
push 0x1f01ff
push esi
call fcn.004132a9
xor ecx, ecx
lea eax, [ebp - 0x3c]
push eax
push ecx
push 1
push 2
push str.execptiondirectory_permissions_problems
push ecx
push 0x6e
mov dword [ebp - 0x28], 0xf
mov dword [ebp - 0x2c], ecx
mov byte [ebp - 0x3c], cl
call fcn.0048ad9a
lea ecx, [ebp - 0x3c]
call fcn.004073c4
mov ecx, dword [ebp - 0x58]
lea ecx, [ecx - 0x10]
call fcn.00404f8d
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.0048f059
leave
ret 4
Function at 0x46af32
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [0x4eb664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push edi
push str.EndInstall_bRet_r_n
push 0x4eee98
mov esi, ecx
call fcn.004738c9
add esp, 0xc
xor ebx, ebx
mov dword [esi + 0x74], edi
test edi, edi
je 0x46afe2
mov ecx, esi
call fcn.00470865
cmp dword [esi + 0x110], ebx
je 0x46af8a
push dword [ebp + 0x10]
mov ecx, dword [esi + 0x114]
push dword [ebp + 0xc]
push edi
call fcn.0042f070
push ebx
push ebx
push ebx
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
push 0x4d3c88
lea ecx, [ebp - 0x70]
call fcn.00406b6a
lea eax, [ebp - 0x70]
push eax
mov ecx, esi
call fcn.0046b0d4
mov ecx, dword [ebp - 0x70]
lea ecx, [ecx - 0x10]
call fcn.00404f8d
mov ecx, dword [esi + 0xd0]
test ecx, ecx
je 0x46afd1
push dword [ebp + 0x10]
mov eax, dword [ecx]
push dword [ebp + 0xc]
push edi
call dword [eax + 0x14]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0048f059
leave
ret 0xc
cmp dword [esi + 0x28], ebx
jne 0x46af70
push str.svrexecupdate
push 0x4eee38
call fcn.0046a622
pop ecx
pop ecx
test al, al
je 0x46af70
push str.messeboxbeginbegin
lea ecx, [ebp - 0x70]
call fcn.00406b6a
lea eax, [ebp - 0x70]
push eax
mov ecx, esi
call fcn.0046b0d4
mov ecx, dword [ebp - 0x70]
lea ecx, [ecx - 0x10]
call fcn.00404f8d
push dword [esi + 0x78]
lea eax, [ebp - 0x70]
push dword [esi + 0x7c]
mov ecx, esi
push eax
call fcn.0046bc3a
mov edi, 0x4d3c88
push edi
lea ecx, [ebp - 0xa0]
call fcn.0040513a
push edi
lea ecx, [ebp - 0x88]
call fcn.0040513a
lea ecx, [ebp - 0x68]
mov dword [ebp - 0x6c], 0x4bd798
call fcn.0042f7fb
lea eax, [ebp - 0xa0]
push eax
lea eax, [ebp - 0x88]
push eax
mov eax, dword [ebp - 0x6c]
push 0x30
push 0x4c2f70
push dword [ebp - 0x70]
lea ecx, [ebp - 0x6c]
push dword [esi + 0xb8]
call dword [eax]
lea ecx, [ebp - 0x68]
call fcn.0042f889
push ebx
push 1
lea ecx, [ebp - 0x88]
call fcn.00405ac5
push ebx
push 1
lea ecx, [ebp - 0xa0]
call fcn.00405ac5
push str.messeboxbeginend
lea ecx, [ebp - 0x70]
call fcn.00406b6a
lea eax, [ebp - 0x70]
push eax
mov ecx, esi
call fcn.0046b0d4
mov ecx, dword [ebp - 0x70]
lea ecx, [ecx - 0x10]
call fcn.00404f8d
push ebx
call fcn.00495a71
int3
Function at 0x46b891
Capabilities:
Check if file exists
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x4eb664]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
push eax
lea ecx, [ebp - 0x23c]
call fcn.0040513a
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x224]
push eax
mov ecx, esi
call fcn.0046a65b
xor ebx, ebx
push ebx
push 1
lea ecx, [ebp - 0x23c]
call fcn.00405ac5
push ebx
push 0x1c
lea eax, [ebp - 0x20c]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov ebx, eax
lea eax, [ebp - 0x20c]
push eax
call fcn.00405113
pop ecx
push eax
lea eax, [ebp - 0x20c]
push eax
mov ecx, edi
call fcn.0040509a
mov esi, str.liebaoUser_Data
push esi
call fcn.00405113
pop ecx
push eax
push esi
mov ecx, edi
call fcn.004046dd
mov esi, 0x4d3c8c
push esi
call fcn.00405113
pop ecx
push eax
push esi
mov ecx, edi
call fcn.004046dd
cmp dword [ebp - 0x210], 8
lea esi, [ebp - 0x224]
cmovae esi, dword [ebp - 0x224]
push esi
call fcn.00405113
pop ecx
push eax
push esi
mov ecx, edi
call fcn.004046dd
cmp dword [edi + 0x14], 8
jb 0x46b967
mov eax, dword [edi]
jmp 0x46b969
mov eax, edi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x46b98a
cmp dword [ebp + 0x10], eax
je 0x46b98a
cmp dword [edi + 0x14], 8
jb 0x46b981
mov edi, dword [edi]
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0
push 1
lea ecx, [ebp - 0x224]
call fcn.00405ac5
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.0048f059
leave
ret 0xc

Function at 0x46be4b
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x4eb664]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x114], 5
jne 0x46be82
cmp dword [ebp - 0x110], 0
mov eax, str.SchedulerGroup
je 0x46be87
mov eax, str.SpoolerGroup
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048f059
leave
ret
Function at 0x46c36d
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x4eb664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
lea eax, [ebp - 0x38]
push 0
push eax
mov edi, ecx
call fcn.00466af4
push dword [ebp - 0x38]
mov ebx, 0x4eee98
push str.Init_localpath___ws_r_n
push ebx
call fcn.004738c9
xor eax, eax
add esp, 0x14
test esi, esi
setne al
mov dword [edi + 0x28], eax
test eax, eax
je 0x46c3df
push esi
call fcn.0040481a
pop ecx
push eax
push esi
lea ecx, [edi + 0x2c]
call fcn.004047a1
push esi
push str.Init_7zFilePath___ws_r_n
push ebx
call fcn.004738c9
add esp, 0xc
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ebx, eax
jmp 0x46c3f4
lea ecx, [edi + 0x80]
call fcn.00473444
mov ebx, eax
test ebx, ebx
je 0x46c521
lea esi, [edi + 4]
push esi
call fcn.004668b3
pop ecx
test eax, eax
je 0x46c40b
mov dword [edi + 0x70], 1
jmp 0x46c413
push esi
mov ecx, edi
call fcn.0046ba9a
push esi
call fcn.00468709
push dword [edi + 0x70]
push dword [esi]
push str.Init_InstallPath_ws_m_bInstalled_d_r_n
push 0x4eee98
call fcn.004738c9
and dword [ebp - 0xc], 0
xor eax, eax
mov word [ebp - 0x1c], ax
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 8], 7
call fcn.0046670d
lea eax, [ebp - 0x1c]
push eax
call fcn.00468749
mov esi, 0x4bdc60
push esi
call fcn.00405113
add esp, 0x20
lea ecx, [ebp - 0x1c]
push eax
push esi
call fcn.004046dd
lea eax, [ebp - 0x1c]
push eax
call fcn.00468749
cmp dword [ebp - 8], 8
lea esi, [ebp - 0x1c]
cmovae esi, dword [ebp - 0x1c]
push esi
call fcn.0040481a
pop ecx
pop ecx
push eax
push esi
lea ecx, [edi + 0x24]
call fcn.004047a1
mov esi, 0x4c2630
push esi
call fcn.00405113
pop ecx
push eax
push esi
lea ecx, [ebp - 0x1c]
call fcn.004046dd
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x34]
call fcn.0047a0b4
push eax
call fcn.0047e2df
pop ecx
lea ecx, [ebp - 0x34]
call fcn.0047a0fe
lea eax, [ebp - 0x1c]
push eax
call fcn.00468749
cmp dword [ebp - 8], 8
lea esi, [ebp - 0x1c]
cmovae esi, dword [ebp - 0x1c]
push esi
call fcn.0040481a
pop ecx
pop ecx
push eax
push esi
lea ecx, [edi + 0x20]
call fcn.004047a1
mov ecx, edi
call fcn.0046eb48
mov ecx, edi
call fcn.0046ece4
cmp dword [edi + 0x70], 0
je 0x46c500
mov ecx, edi
call fcn.0046ed6e
mov ecx, edi
call fcn.0046d7c7
mov ecx, edi
call fcn.00471c6d
mov ecx, edi
call fcn.004708db
push 0
push 1
lea ecx, [ebp - 0x1c]
call fcn.00405ac5
mov ecx, dword [ebp - 0x38]
lea ecx, [ecx - 0x10]
call fcn.00404f8d
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.0048f059
leave
ret 4