joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41e886
Capabilities:
Check if file exists
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x44a020]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, ecx
xor edi, edi
cmp esi, edi
je 0x41ea27
mov eax, dword [esi]
cmp eax, edi
je 0x41ea27
cmp word [eax], di
je 0x41ea27
push 0x206
lea eax, [ebp - 0x20e]
push edi
push eax
mov word [ebp - 0x210], di
call sub.MSVCR80.dll_memset
mov eax, dword [esi + 0xc]
add esp, 0xc
cmp eax, edi
je 0x41e95c
mov ecx, dword [esi + 0x10]
cmp ecx, edi
je 0x41e95c
mov edx, dword [esi + 0x14]
cmp edx, edi
je 0x41e95c
cmp word [ecx], di
je 0x41e95c
push edx
push ecx
push eax
lea edi, [ebp - 0x210]
call fcn.0041e81e
add esp, 0xc
test eax, eax
jne 0x41e95a
cmp dword [esi + 0x18], eax
jne 0x41e913
mov eax, edi
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea eax, [ebp - 0x210]
push eax
mov ecx, ebx
call dword [0x4392d8]
push dword [esi]
mov ecx, ebx
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
cmp dword [ebx + 0x18], 8
jb 0x41e944
mov eax, dword [ebx + 4]
jmp 0x41e947
lea eax, [ebx + 4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41e95a
xor eax, eax
inc eax
jmp 0x41ea29
xor edi, edi
mov eax, dword [esi + 8]
cmp eax, edi
je 0x41e9e7
cmp word [eax], di
je 0x41e9e7
cmp dword [esi + 4], 0xffffffff
je 0x41e994
push edi
push 0x26
lea eax, [ebp - 0x210]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x41e994
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
push dword [esi + 8]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea eax, [ebp - 0x210]
push eax
mov ecx, ebx
call dword [0x4392d8]
push dword [esi]
mov ecx, ebx
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
cmp dword [ebx + 0x18], 8
jb 0x41e9d5
mov eax, dword [ebx + 4]
jmp 0x41e9d8
lea eax, [ebx + 4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x41e952
mov eax, dword [esi + 0x1c]
cmp eax, edi
je 0x41ea1a
cmp word [eax], di
je 0x41ea1a
mov ecx, dword [esi]
lea edi, [ebp - 0x210]
lea esi, [ebp - 0x220]
call fcn.00424ee0
test eax, eax
je 0x41ea1a
mov eax, edi
push eax
mov ecx, ebx
call dword [0x4392d8]
jmp 0x41e952
push 0x4398dc
mov ecx, ebx
call dword [0x4392d8]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0043461c
leave
ret
Function at 0x41ea37
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push 0x38
lea eax, [ebp - 0x38]
push 0
push eax
call sub.MSVCR80.dll_memset
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
add esp, 0xc
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x30], str.properties
mov dword [ebp - 0x38], 0xc
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
leave
ret

Function at 0x41ea74
Capabilities:
Create process on windows

Disassembly:
push 0x48
mov eax, 0x436b41
call fcn.00434fb8
mov eax, dword [0x44b724]
mov ecx, 0x44b724
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
push dword [ebp + 8]
lea eax, [ebp - 0x10]
xor edi, edi
push eax
mov dword [ebp - 4], edi
call fcn.00402b38
push 0x5c
lea esi, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.0040323c
mov edx, eax
lea eax, [ebp - 0x18]
push eax
inc edx
mov eax, esi
call fcn.00409a38
mov byte [ebp - 4], 2
mov ebx, dword [ebp - 0x18]
push ebx
push str.http:__www.baidu.com_s_wd_s
lea eax, [ebp - 0x14]
call fcn.00405672
mov esi, dword [ebp - 0x14]
pop ecx
pop ecx
lea eax, [ebp - 0x54]
push eax
mov dword [ebp - 0x54], 0x3c
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x48], str.open
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x38], 1
mov dword [ebp - 0x34], edi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov edi, eax
lea eax, [ebx - 0x10]
call fcn.00401a71
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00401a71
lea eax, [esi - 0x10]
call fcn.00401a71
mov eax, edi
call fcn.00435090
ret
Function at 0x41eb30
Capabilities:
Create process on windows

Disassembly:
push 0x64
mov eax, 0x436b0e
call fcn.00434fb8
mov ebx, ecx
mov eax, dword [0x44b724]
xor esi, esi
mov ecx, 0x44b724
mov dword [ebp - 0x14], esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
push 0x40
lea eax, [ebp - 0x6c]
push esi
push eax
mov dword [ebp - 4], esi
call sub.MSVCR80.dll_memset
xor eax, eax
mov dword [ebp - 0x24], esi
lea edi, [ebp - 0x20]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebx]
push 0x20
push eax
mov dword [ebp - 0x70], 0x44
call dword [sym.imp.MSVCR80.dll_wcschr]
add esp, 0x14
test eax, eax
lea eax, [ebp - 0x10]
je 0x41ebb5
push str.explorer.exe__e__select__
push eax
call fcn.00402c06
mov ebx, dword [ebx]
push dword [ebx - 0xc]
lea eax, [ebp - 0x10]
push ebx
call fcn.00408f9b
push 0x43e938
lea eax, [ebp - 0x10]
push eax
call fcn.004077fc
jmp 0x41ebce
push 0x43e93c
push eax
call fcn.00402c06
mov ebx, dword [ebx]
push dword [ebx - 0xc]
lea eax, [ebp - 0x10]
push ebx
call fcn.00408f9b
mov ebx, dword [ebp - 0x10]
push ebx
call dword [sym.imp.MSVCR80.dll__wcsdup]
pop ecx
lea ecx, [ebp - 0x24]
push ecx
lea ecx, [ebp - 0x70]
push ecx
push esi
push esi
push esi
push esi
push esi
push esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x41ebfa
mov dword [ebp - 0x14], 1
cmp dword [ebp - 0x20], esi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x41ec0d
push dword [ebp - 0x20]
call edi
mov dword [ebp - 0x20], esi
cmp dword [ebp - 0x24], esi
je 0x41ec1a
push dword [ebp - 0x24]
call edi
mov dword [ebp - 0x24], esi
lea eax, [ebx - 0x10]
call fcn.00401a71
mov eax, dword [ebp - 0x14]
call fcn.00435090
ret

Function at 0x41ec2b
Capabilities:
Delete file

Disassembly:
push ebp
lea ebp, [esp - 0x1b0]
sub esp, 0x230
mov eax, dword [0x44a020]
xor eax, ebp
mov dword [ebp + 0x1ac], eax
push edi
xor edi, edi
push 0x206
lea eax, [ebp - 0x5a]
push edi
push eax
mov dword [ebp - 0x60], edi
mov word [ebp - 0x5c], di
call sub.MSVCR80.dll_memset
push 0x1e
lea eax, [ebp - 0x80]
push edi
push eax
call sub.MSVCR80.dll_memset
mov edx, dword [ebp + 0x1b8]
add esp, 0x18
cmp edx, edi
mov word [ebp - 0x70], 0x454
je 0x41ecf1
push ebx
lea eax, [ebp - 0x5c]
mov ecx, eax
push esi
xor ebx, ebx
mov esi, 0x104
sub edx, ecx
lea ecx, [esi + 0x7ffffefa]
test ecx, ecx
je 0x41eca9
movzx ecx, word [edx + eax]
cmp cx, di
je 0x41eca9
mov word [eax], cx
inc eax
inc eax
dec esi
jne 0x41ec8e
cmp esi, edi
jne 0x41ecb4
dec eax
dec eax
mov ebx, 0x8007007a
cmp ebx, edi
mov word [eax], di
jl 0x41ecef
lea eax, [ebp - 0x5c]
push edi
mov dword [ebp - 0x7c], 3
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, edi
jne 0x41ecef
mov dword [ebp - 0x60], 1
pop esi
pop ebx
mov ecx, dword [ebp + 0x1ac]
mov eax, dword [ebp - 0x60]
xor ecx, ebp
pop edi
call fcn.0043461c
add ebp, 0x1b0
leave
ret
Function at 0x41ed0a
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x88]
sub esp, 0x108
mov eax, dword [0x44a020]
xor eax, ebp
mov dword [ebp + 0x84], eax
push 0x103
lea eax, [ebp - 0x7f]
push 0
push eax
mov byte [ebp - 0x80], 0
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x104
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov ecx, dword [ebp + 0x84]
mov al, byte [ebp - 0x80]
xor ecx, ebp
call fcn.0043461c
add ebp, 0x88
leave
ret
Function at 0x41efa8
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push 0x284
mov eax, 0x436a80
call fcn.00435021
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x274], eax
lea eax, [ebp - 0x278]
push 0x43f074
xor ebx, ebx
push eax
mov ecx, esi
mov dword [ebp - 0x270], ebx
call fcn.0040325b
pop ecx
pop ecx
xor edi, edi
mov dword [ebp - 4], ebx
inc edi
test byte [0x44bdcc], 1
jne 0x41f006
or dword [0x44bdcc], edi
push 0x438e20
mov dword [0x44bdb8], edi
call fcn.0043480c
pop ecx
cmp dword [0x44bdb8], ebx
je 0x41f019
call fcn.0041d1ae
mov dword [0x44bdb8], ebx
lea eax, [ebp - 0x264]
push eax
push dword [ebp - 0x278]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x26c], eax
jne 0x41f042
mov dword [ebp - 0x270], edi
jmp 0x41f1d0
test byte [ebp - 0x264], 0x10
je 0x41f0f4
lea eax, [ebp - 0x238]
push 0x43e3a8
push eax
call dword [sym.imp.MSVCR80.dll_wcscmp]
test eax, eax
pop ecx
pop ecx
je 0x41f1a7
lea eax, [ebp - 0x238]
push 0x43e980
push eax
call dword [sym.imp.MSVCR80.dll_wcscmp]
test eax, eax
pop ecx
pop ecx
je 0x41f1a7
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x268]
push eax
mov ecx, esi
call fcn.0040325b
pop ecx
pop ecx
mov byte [ebp - 4], 1
push dword [ebp - 0x268]
call fcn.0041d221
test eax, eax
jne 0x41f0de
push 0x43e5dc
lea eax, [ebp - 0x268]
push eax
call fcn.004077fc
push dword [ebp - 0x274]
lea eax, [ebp - 0x268]
push eax
call fcn.0041efa8
test eax, eax
pop ecx
pop ecx
je 0x41f1f6
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x268]
add eax, 0xfffffff0
call fcn.00401a71
jmp 0x41f1a7
lea edi, [ebp - 0x28c]
call fcn.004169e1
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x290]
push eax
mov ecx, esi
mov byte [ebp - 4], 2
call fcn.0040325b
pop ecx
pop ecx
mov byte [ebp - 4], 3
call fcn.004057b0
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x290]
add eax, 0xfffffff0
call fcn.00401a71
push 1
push ebx
push ebx
push dword [ebp - 0x248]
call fcn.004351e0
mov ecx, dword [ebp - 0x244]
push dword [ebp - 0x28c]
xor edi, edi
add eax, ecx
adc edx, edi
mov dword [ebp - 0x284], eax
mov dword [ebp - 0x280], edx
call fcn.0041d221
test eax, eax
jne 0x41f185
mov ecx, dword [ebp - 0x274]
mov eax, dword [ecx]
lea edx, [ebp - 0x28c]
push edx
call dword [eax + 8]
cmp eax, ebx
je 0x41f206
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x288]
add eax, 0xfffffff0
call fcn.00401a71
mov eax, dword [ebp - 0x28c]
add eax, 0xfffffff0
call fcn.00401a71
xor edi, edi
inc edi
lea eax, [ebp - 0x264]
push eax
push dword [ebp - 0x26c]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x41f042
mov dword [ebp - 0x270], edi
cmp dword [ebp - 0x26c], ebx
je 0x41f1dc
push dword [ebp - 0x26c]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x278]
add eax, 0xfffffff0
call fcn.00401a71
mov eax, dword [ebp - 0x270]
call fcn.004350a4
ret
mov eax, dword [ebp - 0x268]
add eax, 0xfffffff0
call fcn.00401a71
jmp 0x41f1c8
mov eax, dword [ebp - 0x288]
add eax, 0xfffffff0
call fcn.00401a71
mov eax, dword [ebp - 0x28c]
jmp 0x41f1fc
Function at 0x41f21c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x44a020]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor esi, esi
push 0x206
lea eax, [ebp - 0x20a]
push esi
push eax
mov word [ebp - 0x20c], si
call sub.MSVCR80.dll_memset
add esp, 0xc
push esi
push esi
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov edi, eax
cmp edi, esi
je 0x41f27f
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea eax, [ebp - 0x20c]
push eax
push ebx
call fcn.00402c06
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.0043461c
leave
ret

Function at 0x41f28f
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x44a020]
xor eax, ebp
mov dword [ebp - 4], eax
and word [ebp - 0x20c], 0
push edi
push 0x206
lea eax, [ebp - 0x20a]
push 0
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0
push 5
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov edi, eax
test edi, edi
je 0x41f2f4
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea eax, [ebp - 0x20c]
push eax
push ebx
call fcn.00402c06
mov ecx, dword [ebp - 4]
mov eax, edi
xor ecx, ebp
pop edi
call fcn.0043461c
leave
ret

Function at 0x41f303
Capabilities:
Get file size

Disassembly:
push edi
xor edi, edi
cmp dword [esp + 8], edi
jne 0x41f310
xor eax, eax
pop edi
ret
push esi
push edi
push 0x80
push 3
push edi
push edi
push 0x80000000
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x41f342
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov eax, edi
pop edi
ret
Function at 0x420015
Capabilities:
Get common file path
Read .ini file

Disassembly:
push 0x62c
mov eax, 0x43780c
call fcn.00435021
mov esi, 0x206
xor ebx, ebx
push esi
lea eax, [ebp - 0x626]
mov edi, ecx
push ebx
push eax
mov dword [ebp - 0x638], edi
mov word [ebp - 0x628], bx
call sub.MSVCR80.dll_memset
mov eax, dword [0x44b724]
add esp, 0xc
mov ecx, 0x44b724
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x630], eax
push esi
lea eax, [ebp - 0x216]
push ebx
mov dword [ebp - 4], ebx
push eax
mov word [ebp - 0x218], bx
call sub.MSVCR80.dll_memset
add esp, 0xc
call fcn.0041ed0a
movsx ax, al
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x218]
push 0x43eb90
push eax
call dword [sym.imp.MSVCR80.dll_wcscat]
pop ecx
pop ecx
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x634]
push eax
call fcn.00402b38
lea eax, [ebp - 0x634]
push eax
mov eax, edi
mov byte [ebp - 4], 1
call fcn.0041a0f6
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x634]
add eax, 0xfffffff0
call fcn.00401a71
push ebx
push 0x1a
lea eax, [ebp - 0x628]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x630]
push eax
call fcn.00402c06
push str.360seextensionsExtDownloadExtDownload.ini
lea eax, [ebp - 0x630]
push eax
call fcn.004077fc
push esi
lea eax, [ebp - 0x41e]
push ebx
push eax
mov word [ebp - 0x420], bx
call sub.MSVCR80.dll_memset
mov esi, dword [ebp - 0x630]
add esp, 0xc
push esi
push 0x103
lea eax, [ebp - 0x420]
push eax
push ebx
push str.UserDefinePath
push str.Download
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x62c]
push eax
call fcn.00402b38
lea eax, [ebp - 0x420]
push 0x4398dc
push eax
mov byte [ebp - 4], 2
call dword [sym.imp.MSVCR80.dll__wcsicmp]
pop ecx
test eax, eax
mov eax, dword [ebp - 0x62c]
pop ecx
jne 0x420193
add eax, 0xfffffff0
call fcn.00401a71
lea eax, [esi - 0x10]
call fcn.00401a71
xor eax, eax
jmp 0x420227
cmp dword [eax - 0xc], ebx
jge 0x4201a2
push 0x80070057
call fcn.00402877
movzx edi, word [eax]
call fcn.0041ed0a
movsx eax, al
movzx ecx, di
cmp ecx, eax
je 0x4201fc
mov eax, dword [ebp - 0x62c]
cmp dword [eax - 0xc], ebx
jl 0x420198
movzx edi, word [eax]
call fcn.0041ed0a
movsx eax, al
movzx ecx, di
sub eax, 0x20
cmp ecx, eax
je 0x4201fc
mov eax, dword [ebp - 0x62c]
cmp dword [eax - 0xc], ebx
jl 0x420198
movzx ebx, word [eax]
call fcn.0041ed0a
movsx eax, al
movzx ecx, bx
add eax, 0x20
cmp ecx, eax
je 0x4201fc
mov eax, dword [ebp - 0x62c]
jmp 0x42017c
lea eax, [ebp - 0x62c]
push eax
mov eax, dword [ebp - 0x638]
call fcn.0041a0f6
mov eax, dword [ebp - 0x62c]
add eax, 0xfffffff0
call fcn.00401a71
lea eax, [esi - 0x10]
call fcn.00401a71
xor eax, eax
inc eax
call fcn.004350a4
ret
Function at 0x42140e
Capabilities:
Check if file exists
Get common file path
Get file attributes
Read .ini file

Disassembly:
push 0x630
mov eax, 0x4375e2
call fcn.00435021
mov eax, dword [ebp + 8]
xor ebx, ebx
mov esi, 0x206
push esi
mov dword [ebp - 0x63c], eax
lea eax, [ebp - 0x422]
push ebx
push eax
mov dword [ebp - 0x638], ebx
mov word [ebp - 0x424], bx
call sub.MSVCR80.dll_memset
add esp, 0xc
push esi
lea eax, [ebp - 0x21a]
push ebx
push eax
mov word [ebp - 0x21c], bx
call sub.MSVCR80.dll_memset
add esp, 0xc
mov edi, 0x4398dc
push edi
lea eax, [ebp - 0x630]
push eax
call fcn.00402b38
push esi
lea eax, [ebp - 0x62a]
push ebx
mov dword [ebp - 4], ebx
push eax
mov word [ebp - 0x62c], bx
call sub.MSVCR80.dll_memset
add esp, 0xc
call fcn.0041ed0a
movsx ax, al
mov word [ebp - 0x62c], ax
lea eax, [ebp - 0x62c]
push str.:qqdownload
push eax
call dword [sym.imp.MSVCR80.dll_wcscat]
pop ecx
pop ecx
lea eax, [ebp - 0x62c]
push eax
lea eax, [ebp - 0x634]
push eax
call fcn.00402b38
lea eax, [ebp - 0x634]
push eax
mov eax, dword [ebp - 0x63c]
mov byte [ebp - 4], 1
call fcn.0041a0f6
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x634]
add eax, 0xfffffff0
call fcn.00401a71
push ebx
push 0x1a
lea eax, [ebp - 0x424]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x421630
push str.QQDownload_
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [ebp - 0x424]
push eax
call esi
cmp eax, 0xffffffff
je 0x421630
lea eax, [ebp - 0x630]
push eax
lea eax, [ebp - 0x424]
push eax
call fcn.004211ed
cmp eax, ebx
pop ecx
pop ecx
je 0x421630
mov eax, dword [ebp - 0x630]
cmp dword [eax - 0xc], ebx
je 0x421636
cmp dword [eax - 4], 1
jle 0x421578
push dword [eax - 0xc]
lea eax, [ebp - 0x630]
push eax
call fcn.00402a7d
mov eax, dword [ebp - 0x630]
push eax
push 0x104
lea eax, [ebp - 0x21c]
push eax
push edi
push str.DefaultSavePath
push str.TaskInfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp eax, ebx
je 0x421630
lea eax, [ebp - 0x21c]
push eax
call esi
cmp eax, 0xffffffff
je 0x421630
call fcn.0041ed0a
movzx ecx, word [ebp - 0x21c]
movsx eax, al
cmp ecx, eax
je 0x4215ef
call fcn.0041ed0a
movzx ecx, word [ebp - 0x21c]
movsx eax, al
sub eax, 0x20
cmp ecx, eax
je 0x4215ef
call fcn.0041ed0a
movzx ecx, word [ebp - 0x21c]
movsx eax, al
add eax, 0x20
cmp ecx, eax
jne 0x421630
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x634]
push eax
call fcn.00402b38
lea eax, [ebp - 0x634]
push eax
mov eax, dword [ebp - 0x63c]
mov byte [ebp - 4], 2
call fcn.0041a0f6
mov eax, dword [ebp - 0x634]
add eax, 0xfffffff0
call fcn.00401a71
mov dword [ebp - 0x638], 1
mov eax, dword [ebp - 0x630]
add eax, 0xfffffff0
call fcn.00401a71
mov eax, dword [ebp - 0x638]
call fcn.004350a4
ret
Function at 0x4222c6
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b8
mov eax, dword [0x44a020]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x2b8], 0
push 0x2b0
lea eax, [ebp - 0x2b4]
push 0
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x101
push 0x2b4
lea eax, [ebp - 0x2b8]
push eax
push 0
push dword [esi]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x2b8]
xor ecx, ebp
call fcn.0043461c
leave
ret
Function at 0x42532a
Capabilities:
Check if file exists

Disassembly:
push 0
mov eax, 0x436967
call fcn.00434fb8
mov edi, edx
mov eax, dword [ebp + 0xc]
xor esi, esi
cmp ecx, esi
je 0x4253b2
cmp word [ecx], si
je 0x4253b2
cmp eax, esi
je 0x4253b2
cmp word [eax], si
je 0x4253b2
push eax
lea eax, [ebp + 0xc]
push eax
call fcn.00402b38
lea eax, [ebp + 0xc]
mov dword [ebp - 4], esi
call fcn.004057b0
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
call fcn.00401a71
push dword [edi]
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x4253b2
mov eax, dword [ebp + 8]
mov ebx, dword [eax + 4]
mov eax, edi
call fcn.004073d3
push dword [edi]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42539b
inc esi
jmp 0x4253ae
push dword [edi]
call dword [sym.imp.SHLWAPI.dll_PathIsRootW]
test eax, eax
jne 0x4253ae
mov eax, edi
call fcn.0040741a
mov eax, esi
jmp 0x4253b4
xor eax, eax
call fcn.00435090
ret 8
Function at 0x42acbc
Capabilities:
Read file on windows

Disassembly:
push 8
mov eax, 0x435cfc
call fcn.00434fb8
xor esi, esi
cmp dword [ebp + 0xc], esi
jne 0x42ace5
mov edi, dword [ebp + 8]
push esi
push esi
push 2
pop eax
xor ecx, ecx
call fcn.00429842
xor al, al
jmp 0x42ae51
mov ebx, dword [ebp + 8]
mov edi, ebx
call fcn.0042a6aa
mov edi, dword [sym.imp.MSVCR80.dll_fseek]
or dword [ebx + 8], 0xffffffff
or dword [ebx + 4], 0xffffffff
push 2
push esi
push dword [ebp + 0xc]
call edi
push dword [ebp + 0xc]
call dword [sym.imp.MSVCR80.dll_ftell]
push 0
push 0
push dword [ebp + 0xc]
mov esi, eax
call edi
xor eax, eax
add esp, 0x1c
cmp esi, eax
jg 0x42ad2a
push eax
push eax
push 0xd
mov edi, ebx
jmp 0x42acd6
mov dword [ebp - 0x10], 0x44bb7c
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10]
push eax
mov ecx, esi
call fcn.00428c5b
lea eax, [esi + 1]
push eax
call fcn.004346fa
push dword [ebp + 0xc]
mov edi, eax
push 1
push esi
push edi
mov dword [ebp - 0x14], edi
mov byte [edi], 0
call dword [sym.imp.MSVCR80.dll_fread]
add esp, 0x14
cmp eax, 1
je 0x42ad97
push edi
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
pop ecx
push 0
push 0
push 2
xor ecx, ecx
pop eax
mov edi, ebx
call fcn.00429842
cmp dword [ebp - 0x10], 0x44bb7c
je 0x42acde
push dword [ebp - 0x10]
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
pop ecx
jmp 0x42acde
mov ebx, edi
mov eax, ebx
mov byte [eax + esi], 0
cmp byte [eax], 0
je 0x42adfc
mov al, byte [ebx]
cmp al, 0xa
jne 0x42adbc
mov eax, ebx
sub eax, edi
inc eax
push eax
push edi
lea edi, [ebp - 0x10]
call fcn.00428d4c
inc ebx
jmp 0x42adf2
cmp al, 0xd
jne 0x42adf6
mov eax, ebx
sub eax, edi
test eax, eax
jle 0x42add2
push eax
push edi
lea edi, [ebp - 0x10]
call fcn.00428d4c
push 1
lea eax, [ebp + 0xc]
push eax
lea edi, [ebp - 0x10]
mov byte [ebp + 0xc], 0xa
call fcn.00428d4c
lea eax, [ebx + 1]
cmp byte [eax], 0xa
jne 0x42adf0
inc ebx
inc ebx
jmp 0x42adf2
mov ebx, eax
mov edi, ebx
jmp 0x42adf7
inc ebx
cmp byte [ebx], 0
jne 0x42ada4
sub ebx, edi
je 0x42ae0a
push ebx
push edi
lea edi, [ebp - 0x10]
call fcn.00428d4c
push dword [ebp - 0x14]
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp + 8]
mov eax, dword [esi]
pop ecx
push 1
push 0
lea ecx, [edi + 8]
push ecx
mov ecx, esi
call dword [eax + 8]
cmp byte [esi + 0x2c], 0
je 0x42ae40
cmp edi, 0x44bb7c
je 0x42acde
push edi
jmp 0x42ad8c
cmp edi, 0x44bb7c
je 0x42ae4f
push edi
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
pop ecx
mov al, 1
call fcn.00435090
ret 8