joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b2b0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xd0
mov eax, dword [0x42d028]
xor eax, esp
mov dword [esp + 0xcc], eax
mov eax, dword [esp + 0xd4]
test eax, eax
push ebp
mov ebp, dword [esp + 0xdc]
je 0x40b448
test ebp, ebp
je 0x40b448
push ebx
push 0
push 0
push 3
push 0
push 0
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40b30f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x40b3ce
push esi
push edi
push 0x62
lea eax, [esp + 0x1a]
push 0
push eax
mov dword [esp + 0x1c], 1
mov word [esp + 0x20], 0
call sub.MSVCR80.dll_memset
mov ecx, 8
mov esi, str.zbsharewarecrypt
lea edi, [esp + 0x84]
rep movsd dword es:[edi], dword [esi]
push 0x42
lea ecx, [esp + 0xaa]
push 0
push ecx
movsw word es:[edi], word [esi]
call sub.MSVCR80.dll_memset
lea eax, [esp + 0x90]
add esp, 0x18
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40b361
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
sub eax, edx
push 0
sar eax, 1
lea edx, [esp + 0x14]
push edx
add eax, eax
push eax
lea ecx, [esp + 0x20]
push ecx
push ebx
call edi
test eax, eax
je 0x40b3c3
lea edx, [esp + 0x78]
lea ecx, [esp + 0x14]
mov ax, word [ecx]
cmp ax, word [edx]
jne 0x40b3ba
test ax, ax
je 0x40b3b6
mov ax, word [ecx + 2]
cmp ax, word [edx + 2]
jne 0x40b3ba
add ecx, 4
add edx, 4
test ax, ax
jne 0x40b394
xor eax, eax
jmp 0x40b3bf
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40b3e7
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop edi
pop esi
pop ebx
pop ebp
mov ecx, dword [esp + 0xcc]
xor ecx, esp
call fcn.0041d7b2
add esp, 0xd0
ret 8
xor ax, ax
mov dword [esp + 0x10], 2
mov word [esp + 0x14], ax
xor esi, esi
lea esp, [esp]
cmp ax, 0xd
je 0x40b436
push 0
lea edx, [esp + 0x14]
push edx
push 2
lea eax, [esp + 0x20]
push eax
push ebx
call edi
mov ax, word [esp + 0x14]
cmp ax, 0xd
mov ecx, dword [esp + 0x10]
je 0x40b432
test ecx, ecx
jbe 0x40b436
mov word [ebp + esi*2], ax
add esi, 1
test ecx, ecx
ja 0x40b400
push ebx
mov word [ebp + esi*2], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x40b3cc
mov ecx, dword [esp + 0xd0]
pop ebp
xor ecx, esp
xor al, al
call fcn.0041d7b2
add esp, 0xd0
ret 8
Function at 0x40b470
Capabilities:
Get common file path

Disassembly:
mov eax, 0x1a04
call fcn.0041e070
mov eax, dword [0x42d028]
xor eax, esp
mov dword [esp + 0x1a00], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp esi, ebx
jne 0x40b4ab
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x1a00]
xor ecx, esp
call fcn.0041d7b2
add esp, 0x1a04
ret
push 0x7fe
lea eax, [esp + 0x20e]
push ebx
push eax
mov word [esp + 0x214], bx
call sub.MSVCR80.dll_memset
push 0x7fe
lea ecx, [esp + 0x121a]
push ebx
push ecx
mov word [esp + 0x1220], bx
call sub.MSVCR80.dll_memset
push esi
lea edx, [esp + 0x224]
push 0x400
push edx
call dword [sym.imp.MSVCR80.dll_wcscpy_s]
add esp, 0x24
lea eax, [esp + 0x1208]
push eax
lea ecx, [esp + 0x20c]
push ecx
call fcn.0040b2b0
test al, al
je 0x40b492
push ebx
lea edx, [esp + 0x20c]
push edx
lea ecx, [esp + 0x1210]
call fcn.0040ab30
cmp eax, 1
jne 0x40b542
pop esi
pop ebx
mov ecx, dword [esp + 0x1a00]
xor ecx, esp
call fcn.0041d7b2
add esp, 0x1a04
ret
push edi
push 0x1fe
lea eax, [esp + 0x12]
push ebx
push eax
mov word [esp + 0x18], bx
call sub.MSVCR80.dll_memset
add esp, 0xc
lea edi, [esp + 0xc]
lea ecx, [esp + 0x120c]
call fcn.00408f60
test al, al
pop edi
je 0x40b492
push 0x7fe
lea ecx, [esp + 0xa0e]
push ebx
push ecx
mov word [esp + 0xa14], bx
call sub.MSVCR80.dll_memset
add esp, 0xc
push ebx
push 0x10
lea edx, [esp + 0xa10]
push edx
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov esi, dword [sym.imp.MSVCR80.dll_wcscat_s]
push 0x4218ec
lea eax, [esp + 0xa0c]
push 0x400
push eax
call esi
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0xa18]
push 0x400
push edx
call esi
add esp, 0x18
push ebx
lea eax, [esp + 0x20c]
push eax
lea ecx, [esp + 0xa10]
call fcn.0040ab30
mov ecx, dword [esp + 0x1a08]
sub eax, 1
neg eax
sbb eax, eax
pop esi
and eax, 0xfffffffe
pop ebx
xor ecx, esp
add eax, 2
call fcn.0041d7b2
add esp, 0x1a04
ret
Function at 0x40bf70
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xe9c
mov eax, dword [0x42d028]
xor eax, esp
mov dword [esp + 0xe98], eax
push ebx
mov ebx, dword [sym.imp.MSVCR80.dll_wcscpy_s]
push esi
push edi
push 0x422f88
lea eax, [esp + 0x2a]
push 0x14
push eax
mov esi, ecx
call ebx
add esp, 0xc
mov edi, 0x200
lea ecx, [esp + 0xaa0]
call fcn.0040b030
lea ecx, [esi + 0xe38]
xor edi, edi
push edi
mov dword [esp + 0x20], ecx
call sub.MFC80U.DLL_Ordinal_2155
lea ecx, [esi + 0x15a8]
push edi
mov dword [esp + 0x1c], ecx
call sub.MFC80U.DLL_Ordinal_2155
lea ecx, [esi + 0x1d18]
push edi
mov dword [esp + 0x18], ecx
call sub.MFC80U.DLL_Ordinal_2155
mov ecx, dword [esi + 0xd60]
push edi
push edi
push 0x1009
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x3fe
lea edx, [esp + 0x2a6]
push edi
push edx
mov word [esp + 0x2ac], di
call sub.MSVCR80.dll_memset
push 0x3fe
lea eax, [esp + 0x6b2]
push edi
push eax
mov word [esp + 0x6b8], di
call sub.MSVCR80.dll_memset
lea ecx, [esp + 0xab8]
push ecx
lea edx, [esp + 0x2bc]
push 0x200
push edx
mov dword [esp + 0x34], 1
call ebx
push str..qua
lea eax, [esp + 0x2c8]
push 0x200
push eax
call dword [sym.imp.MSVCR80.dll_wcscat_s]
add esp, 0x30
lea ecx, [esp + 0x50]
push ecx
lea edx, [esp + 0x2a4]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
mov dword [esp + 0x20], ebx
je 0x40c13b
nop
cmp dword [esp + 0x10], 0
je 0x40c13b
lea eax, [esp + 0xaa0]
push eax
lea ecx, [esp + 0x2a4]
push 0x200
push ecx
call dword [sym.imp.MSVCR80.dll_wcscpy_s]
lea edx, [esp + 0x88]
push edx
lea eax, [esp + 0x2b0]
push 0x200
push eax
call dword [sym.imp.MSVCR80.dll_wcscat_s]
add esp, 0x18
lea ecx, [esp + 0x6a0]
push ecx
lea edx, [esp + 0x2a4]
push edx
call fcn.0040b2b0
test al, al
je 0x40c126
push 0
push 0
push 0
push 0
lea eax, [esp + 0x6b0]
push eax
push edi
lea ebx, [esi + 0xd40]
push 3
mov ecx, ebx
call sub.MFC80U.DLL_Ordinal_3873
lea ecx, [esp + 0x2a0]
push ecx
push 1
push edi
mov ecx, ebx
call sub.MFC80U.DLL_Ordinal_5869
mov ebx, dword [esp + 0x20]
add edi, 1
lea edx, [esp + 0x50]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov dword [esp + 0x10], eax
jmp 0x40c090
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x1c]
push 1
call sub.MFC80U.DLL_Ordinal_2155
mov ecx, dword [esp + 0x18]
push 1
call sub.MFC80U.DLL_Ordinal_2155
mov ecx, dword [esp + 0x14]
push 1
call sub.MFC80U.DLL_Ordinal_2155
mov ecx, dword [esp + 0xea4]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0041d7b2
mov esp, ebp
pop ebp
ret
Function at 0x40c610
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x430
mov eax, dword [0x42d028]
xor eax, esp
mov dword [esp + 0x42c], eax
push esi
push edi
mov edi, edx
push 0
mov esi, ecx
mov dword [esp + 0xc], edi
call dword [sym.imp.MSVCP80.dll_public:_wchar_t____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator___unsigned_int_]
cmp word [eax], 0
jne 0x40c662
push 0x423220
mov ecx, edi
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
pop edi
xor al, al
pop esi
mov ecx, dword [esp + 0x42c]
xor ecx, esp
call fcn.0041d7b2
add esp, 0x430
ret
mov edi, dword [str.none]
push ebx
mov ebx, dword [0x4218a4]
push ebp
mov bp, word [0x4218a8]
push 0x3f6
lea eax, [esp + 0x4a]
push 0
push eax
mov dword [esp + 0x48], edi
mov dword [esp + 0x4c], ebx
mov word [esp + 0x50], bp
call sub.MSVCR80.dll_memset
xor eax, eax
add esp, 0xc
cmp dword [esi + 0x18], 8
mov word [esp + 0x1c], bp
pop ebp
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], edi
mov dword [esp + 0x1a], eax
mov dword [esp + 0x1e], eax
mov dword [esp + 0x22], eax
mov dword [esp + 0x26], eax
mov dword [esp + 0x2a], eax
mov dword [esp + 0x2e], eax
mov dword [esp + 0x32], eax
mov word [esp + 0x36], ax
pop ebx
jb 0x40c6d5
mov esi, dword [esi + 4]
jmp 0x40c6d8
add esi, 4
push esi
push 0x200
lea ecx, [esp + 0x3c]
push ecx
lea edx, [esp + 0x18]
push edx
push str.CurrentVersion
push str.VersionInfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [esp + 0xc]
lea eax, [esp + 0x34]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40c726
test dx, dx
je 0x40c722
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40c726
add eax, 4
add ecx, 4
test dx, dx
jne 0x40c700
xor eax, eax
jmp 0x40c72b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
mov ecx, dword [esp + 8]
jne 0x40c757
push 0x423220
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
pop edi
xor al, al
pop esi
mov ecx, dword [esp + 0x42c]
xor ecx, esp
call fcn.0041d7b2
add esp, 0x430
ret
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
mov ecx, dword [esp + 0x434]
pop edi
pop esi
xor ecx, esp
mov al, 1
call fcn.0041d7b2
add esp, 0x430
ret
Function at 0x40c780
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x42c
mov eax, dword [0x42d028]
xor eax, esp
mov dword [esp + 0x428], eax
push esi
push 0
mov esi, ecx
call dword [sym.imp.MSVCP80.dll_public:_wchar_t____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator___unsigned_int_]
cmp word [eax], 0
jne 0x40c7bd
xor al, al
pop esi
mov ecx, dword [esp + 0x428]
xor ecx, esp
call fcn.0041d7b2
add esp, 0x42c
ret
mov ecx, dword [str.none]
mov edx, dword [0x4218a4]
xor eax, eax
push edi
mov di, word [0x4218a8]
push 0x3f6
push eax
mov dword [esp + 0x1a], eax
mov dword [esp + 0x1e], eax
mov dword [esp + 0x22], eax
mov dword [esp + 0x26], eax
mov dword [esp + 0x2a], eax
mov dword [esp + 0x2e], eax
mov dword [esp + 0x32], eax
mov word [esp + 0x36], ax
lea eax, [esp + 0x42]
push eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
mov word [esp + 0x1c], di
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], edx
mov word [esp + 0x44], di
call sub.MSVCR80.dll_memset
add esp, 0xc
cmp dword [esi + 0x18], 8
pop edi
jb 0x40c82d
mov esi, dword [esi + 4]
jmp 0x40c830
add esi, 4
push esi
push 0x200
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x10]
push edx
push str.Type
push str.AppType
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov eax, dword [str.business]
mov ecx, dword [0x423288]
mov edx, dword [0x42328c]
mov dword [esp + 4], eax
mov eax, dword [0x423290]
mov dword [esp + 8], ecx
mov cx, word [0x423294]
mov dword [esp + 0x10], eax
xor eax, eax
mov word [esp + 0x14], cx
mov dword [esp + 0x16], eax
mov dword [esp + 0x1a], eax
mov dword [esp + 0x1e], eax
mov dword [esp + 0x22], eax
mov dword [esp + 0x26], eax
mov word [esp + 0x2a], ax
mov dword [esp + 0xc], edx
lea ecx, [esp + 4]
lea eax, [esp + 0x2c]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40c8cb
test dx, dx
je 0x40c8c7
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40c8cb
add eax, 4
add ecx, 4
test dx, dx
jne 0x40c8a5
xor eax, eax
jmp 0x40c8d0
sbb eax, eax
sbb eax, 0xffffffff
mov ecx, dword [esp + 0x42c]
test eax, eax
sete al
pop esi
xor ecx, esp
call fcn.0041d7b2
add esp, 0x42c
ret
Function at 0x40cf50
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x42c
mov eax, dword [0x42d028]
xor eax, esp
mov dword [esp + 0x428], eax
push esi
push 0
mov esi, ecx
call dword [sym.imp.MSVCP80.dll_public:_wchar_t____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator___unsigned_int_]
cmp word [eax], 0
je 0x40d068
mov ecx, dword [str.none]
mov edx, dword [0x4218a4]
xor eax, eax
push edi
mov di, word [0x4218a8]
push 0x3f6
push eax
mov dword [esp + 0x1a], eax
mov dword [esp + 0x1e], eax
mov dword [esp + 0x22], eax
mov dword [esp + 0x26], eax
mov dword [esp + 0x2a], eax
mov dword [esp + 0x2e], eax
mov dword [esp + 0x32], eax
mov word [esp + 0x36], ax
lea eax, [esp + 0x42]
push eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
mov word [esp + 0x1c], di
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], edx
mov word [esp + 0x44], di
call sub.MSVCR80.dll_memset
add esp, 0xc
cmp dword [esi + 0x18], 8
pop edi
jb 0x40cfe9
mov esi, dword [esi + 4]
jmp 0x40cfec
add esi, 4
push esi
push 0x200
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x10]
push edx
push str.DonwloadLink
push str.GoodSecure
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [esp + 4]
lea eax, [esp + 0x2c]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40d03a
test dx, dx
je 0x40d036
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40d03a
add eax, 4
add ecx, 4
test dx, dx
jne 0x40d014
xor eax, eax
jmp 0x40d03f
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40d068
lea eax, [esp + 0x2c]
push eax
mov ecx, ebx
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
mov al, 1
pop esi
mov ecx, dword [esp + 0x428]
xor ecx, esp
call fcn.0041d7b2
add esp, 0x42c
ret
push 0x4218f0
mov ecx, ebx
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
mov ecx, dword [esp + 0x42c]
pop esi
xor ecx, esp
xor al, al
call fcn.0041d7b2
add esp, 0x42c
ret
Function at 0x40d090
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x430
mov eax, dword [0x42d028]
xor eax, esp
mov dword [esp + 0x42c], eax
push ebp
mov ebp, dword [esp + 0x438]
push esi
push edi
mov edi, edx
push 0
mov esi, ecx
mov dword [esp + 0x10], edi
call dword [sym.imp.MSVCP80.dll_public:_wchar_t____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator___unsigned_int_]
cmp word [eax], 0
je 0x40d1b2
test ebx, ebx
je 0x40d1b2
test ebp, ebp
je 0x40d1b2
mov ecx, dword [str.none]
mov edx, dword [0x4218a4]
mov di, word [0x4218a8]
xor eax, eax
push 0x3f6
push eax
mov dword [esp + 0x22], eax
mov dword [esp + 0x26], eax
mov dword [esp + 0x2a], eax
mov dword [esp + 0x2e], eax
mov dword [esp + 0x32], eax
mov dword [esp + 0x36], eax
mov dword [esp + 0x3a], eax
mov word [esp + 0x3e], ax
lea eax, [esp + 0x4a]
push eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], edx
mov word [esp + 0x24], di
mov dword [esp + 0x44], ecx
mov dword [esp + 0x48], edx
mov word [esp + 0x4c], di
call sub.MSVCR80.dll_memset
add esp, 0xc
cmp dword [esi + 0x18], 8
jb 0x40d146
mov esi, dword [esi + 4]
jmp 0x40d149
add esi, 4
push esi
push 0x200
lea ecx, [esp + 0x40]
push ecx
lea edx, [esp + 0x1c]
push edx
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [esp + 0x10]
lea eax, [esp + 0x38]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40d196
test dx, dx
je 0x40d192
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40d196
add eax, 4
add ecx, 4
test dx, dx
jne 0x40d170
xor eax, eax
jmp 0x40d19b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
mov ecx, dword [esp + 0xc]
je 0x40d1b4
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
mov al, 1
jmp 0x40d1c1
mov ecx, edi
push 0x4218f0
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
xor al, al
mov ecx, dword [esp + 0x438]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.0041d7b2
add esp, 0x430
ret 4
Function at 0x40d1e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x41f8c9
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x42d028]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
mov eax, dword [0x42d028]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
push 0x4218f0
lea ecx, [esp + 0xc]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
push str.NotifyPerVersion
lea edx, [esp + 0xc]
mov ebx, str.GoodSecure
mov ecx, esi
mov dword [esp + 0x34], 0
call fcn.0040d090
push 0x421be0
lea ecx, [esp + 0xc]
call dword [sym.imp.MSVCP80.dll_public:_int___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::compare_wchar_t_const__const]
test eax, eax
mov dword [esp + 0x30], 0xffffffff
lea ecx, [esp + 8]
jne 0x40d264
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov al, 1
jmp 0x40d26c
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
xor al, al
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.0041d7b2
add esp, 0x2c
ret
Function at 0x40e020
Capabilities:
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x4206b6
mov eax, dword fs:[0]
push eax
sub esp, 0x23c
mov eax, dword [0x42d028]
xor eax, esp
mov dword [esp + 0x238], eax
push ebx
push ebp
push esi
mov eax, dword [0x42d028]
xor eax, esp
push eax
lea eax, [esp + 0x24c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x25c]
push 0xa
lea ecx, [esp + 0x14]
xor ebx, ebx
xor esi, esi
call sub.MFC80U.DLL_Ordinal_558
push 0xa
lea ecx, [esp + 0x30]
mov dword [esp + 0x258], ebx
call sub.MFC80U.DLL_Ordinal_558
push ebx
lea eax, [esp + 0x4c]
push eax
push 0x100
push ebx
push edi
push ebx
mov byte [esp + 0x26c], 1
call dword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
jne 0x40e0cd
lea ecx, [esp + 0x2c]
mov byte [esp + 0x254], bl
call sub.MFC80U.DLL_Ordinal_746
lea ecx, [esp + 0x10]
mov dword [esp + 0x254], 0xffffffff
call sub.MFC80U.DLL_Ordinal_746
xor eax, eax
jmp 0x40e1a7
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
jne 0x40e0a2
lea ecx, [esp + 0x10]
push ecx
mov ebx, edi
mov ecx, str.open
call fcn.0040e360
test al, al
je 0x40e0f2
mov esi, 1
lea edx, [esp + 0x10]
push edx
mov ebx, edi
mov ecx, str.shellexecute
call fcn.0040e360
test al, al
je 0x40e10a
add esi, 1
lea eax, [esp + 0x10]
push eax
mov ebx, edi
mov ecx, str.shell
call fcn.0040e360
test al, al
je 0x40e122
add esi, 1
lea ecx, [esp + 0x10]
push ecx
mov ebx, edi
mov ecx, str.shellopencommand
call fcn.0040e360
test al, al
je 0x40e13a
add esi, 1
lea edx, [esp + 0x10]
push edx
mov ebx, edi
mov ecx, str.shellexplorecommand
call fcn.0040e360
test al, al
je 0x40e152
add esi, 1
lea eax, [esp + 0x10]
push eax
mov ebx, edi
mov ecx, str.shell_autoplaycommand
call fcn.0040e360
test al, al
je 0x40e16a
add esi, 1
lea ecx, [esp + 0x10]
lea ebx, [esp + 0x2c]
call fcn.0040e5e0
mov ecx, ebx
mov ebx, ebp
call fcn.0040e5e0
lea ecx, [esp + 0x2c]
mov byte [esp + 0x254], 0
call sub.MFC80U.DLL_Ordinal_746
lea ecx, [esp + 0x10]
mov dword [esp + 0x254], 0xffffffff
call sub.MFC80U.DLL_Ordinal_746
mov eax, esi
mov ecx, dword [esp + 0x24c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x238]
xor ecx, esp
call fcn.0041d7b2
add esp, 0x248
ret 4
Function at 0x40e1d0
Capabilities:
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x41f82c
mov eax, dword fs:[0]
push eax
sub esp, 0x808
mov eax, dword [0x42d028]
xor eax, esp
mov dword [esp + 0x804], eax
push esi
mov eax, dword [0x42d028]
xor eax, esp
push eax
lea eax, [esp + 0x810]
mov dword fs:[0], eax
cmp word [edi], 0x5c
mov ax, word [esp + 0x820]
mov word [esp + 0xc], ax
mov word [esp + 0xe], 0x3a
mov word [esp + 0x10], 0
jne 0x40e23f
push edi
lea ecx, [esp + 0x10]
push 0x200
push ecx
call dword [sym.imp.MSVCR80.dll_wcscat_s]
add esp, 0xc
jmp 0x40e266
mov esi, dword [sym.imp.MSVCR80.dll_wcscat_s]
push 0x4218ec
lea edx, [esp + 0x10]
push 0x200
push edx
call esi
push edi
lea eax, [esp + 0x1c]
push 0x200
push eax
call esi
add esp, 0x18
lea eax, [esp + 0xc]
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40e270
sub eax, edx
lea ecx, [esp + 0xc]
sar eax, 1
push ecx
lea ecx, [esp + 0xc]
mov esi, eax
call dword [sym.imp.MFC80U.DLL_Ordinal_283]
push 0x2e
lea ecx, [esp + 0xc]
mov dword [esp + 0x81c], 0
call dword [sym.imp.MFC80U.DLL_Ordinal_5524]
test eax, eax
jle 0x40e2cb
cmp eax, esi
jge 0x40e2cb
mov ecx, 0x20
cmp word [esp + eax*2 + 0xc], cx
je 0x40e2c4
add eax, 1
cmp eax, esi
jl 0x40e2b4
jmp 0x40e2cb
mov word [esp + eax*2 + 0xc], 0
push 0
lea edx, [esp + 0x410]
push edx
push 0x200
push 0
lea eax, [esp + 0x1c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
je 0x40e32b
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
jne 0x40e32b
lea ecx, [esp + 0xc]
call fcn.00408700
test eax, eax
je 0x40e32b
lea edx, [esp + 0xc]
push edx
push 0x200
push edi
call dword [sym.imp.MSVCR80.dll_wcscpy_s]
add esp, 0xc
lea ecx, [esp + 8]
call dword [sym.imp.MFC80U.DLL_Ordinal_577]
mov al, 1
jmp 0x40e337
lea ecx, [esp + 8]
call dword [sym.imp.MFC80U.DLL_Ordinal_577]
xor al, al
mov ecx, dword [esp + 0x810]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x804]
xor ecx, esp
call fcn.0041d7b2
add esp, 0x814
ret 4