joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408820
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x414509
mov eax, dword fs:[0]
push eax
sub esp, 0x258
mov eax, dword [0x41e130]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
push 0x24c
lea eax, [ebp - 0x25c]
push ebx
push eax
mov dword [ebp - 4], ebx
lea esi, [ebx + 1]
mov dword [ebp - 0x260], ebx
call sub.MSVCR80.dll_memset
push 0x417bdc
lea ecx, [ebp + 8]
push ecx
lea edx, [ebp - 0x264]
push edx
call dword [sym.imp.Common.dll_class_CTXStringW___cdecl_operator_class_CTXStringW_const___wchar_t_const__]
add esp, 0x18
lea eax, [ebp - 0x260]
push eax
lea ecx, [ebp - 0x264]
call dword [sym.imp.Common.dll_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x4088fb
test esi, esi
je 0x4088f4
test byte [ebp - 0x260], 0x10
je 0x4088df
mov esi, dword [sym.imp.SHLWAPI.dll_StrCmpW]
push 0x417bd4
lea ecx, [ebp - 0x234]
push ecx
call esi
test eax, eax
je 0x4088e2
push 0x417bd0
lea edx, [ebp - 0x234]
push edx
call esi
test eax, eax
je 0x4088e2
add ebx, 1
lea eax, [ebp - 0x260]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov esi, eax
jmp 0x4088a8
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov esi, dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::destructor_void_]
lea ecx, [ebp - 0x264]
call esi
lea ecx, [ebp + 8]
mov dword [ebp - 4], 0xffffffff
call esi
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00412d02
mov esp, ebp
pop ebp
ret
Function at 0x408940
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x414555
mov eax, dword fs:[0]
push eax
sub esp, 0x260
mov eax, dword [0x41e130]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
push 0x24c
lea eax, [ebp - 0x25c]
push ebx
push eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x268], ebx
mov dword [ebp - 0x26c], ebx
lea esi, [ebx + 1]
mov dword [ebp - 0x260], ebx
call sub.MSVCR80.dll_memset
push 0x417bdc
lea ecx, [ebp + 8]
push ecx
lea edx, [ebp - 0x264]
push edx
call dword [sym.imp.Common.dll_class_CTXStringW___cdecl_operator_class_CTXStringW_const___wchar_t_const__]
add esp, 0x18
lea eax, [ebp - 0x260]
push eax
lea ecx, [ebp - 0x264]
call dword [sym.imp.Common.dll_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x408a83
mov ebx, dword [sym.imp.SHLWAPI.dll_StrCmpW]
mov edi, edi
test esi, esi
je 0x408a7a
test byte [ebp - 0x260], 0x10
je 0x408a65
push 0x417bd4
lea ecx, [ebp - 0x234]
push ecx
call ebx
test eax, eax
je 0x408a65
push 0x417bd0
lea edx, [ebp - 0x234]
push edx
call ebx
test eax, eax
je 0x408a65
mov esi, dword [sym.imp.SHLWAPI.dll_StrCmpIW]
lea eax, [ebp - 0x234]
push eax
push 0x417bec
call esi
test eax, eax
jne 0x408a49
lea edx, [ebp - 0x260]
push edx
push edi
mov dword [ebp - 0x268], 1
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov esi, eax
jmp 0x4089e0
lea ecx, [ebp - 0x234]
push ecx
push 0x417be4
call esi
test eax, eax
jne 0x408a65
mov dword [ebp - 0x26c], 1
lea edx, [ebp - 0x260]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov esi, eax
jmp 0x4089e0
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor ebx, ebx
cmp dword [0x41e1c0], ebx
je 0x408ab5
cmp dword [ebp - 0x268], ebx
mov esi, dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::destructor_void_]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x264]
je 0x408abd
call esi
lea ecx, [ebp + 8]
mov dword [ebp - 4], 0xffffffff
call esi
xor eax, eax
jmp 0x408ad0
cmp dword [ebp - 0x26c], ebx
jmp 0x408a91
call esi
lea ecx, [ebp + 8]
mov dword [ebp - 4], 0xffffffff
call esi
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00412d02
mov esp, ebp
pop ebp
ret
Function at 0x408af0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x414555
mov eax, dword fs:[0]
push eax
sub esp, 0x260
mov eax, dword [0x41e130]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edi, edi
mov ebx, 1
lea ecx, [ebp - 0x264]
mov dword [ebp - 4], edi
mov dword [ebp - 0x26c], ebx
call dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::constructor_void_]
cmp dword [0x41e1c0], edi
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x264]
je 0x408b52
push 0x417bec
jmp 0x408b57
push 0x417be4
call dword [sym.imp.Common.dll_public:_class_CTXStringW____thiscall_CTXStringW::operator_wchar_t_const__]
push 0x24c
lea eax, [ebp - 0x25c]
push edi
push eax
mov esi, ebx
mov dword [ebp - 0x260], edi
call sub.MSVCR80.dll_memset
push 0x417bdc
lea ecx, [ebp + 8]
push ecx
lea edx, [ebp - 0x268]
push edx
call dword [sym.imp.Common.dll_class_CTXStringW___cdecl_operator_class_CTXStringW_const___wchar_t_const__]
add esp, 0x18
lea eax, [ebp - 0x260]
push eax
lea ecx, [ebp - 0x268]
call dword [sym.imp.Common.dll_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x408c29
mov ebx, dword [sym.imp.SHLWAPI.dll_StrCmpW]
test esi, esi
je 0x408c22
test byte [ebp - 0x260], 0x10
je 0x408c06
push 0x417bd4
lea ecx, [ebp - 0x234]
push ecx
call ebx
test eax, eax
je 0x408c06
push 0x417bd0
lea edx, [ebp - 0x234]
push edx
call ebx
test eax, eax
je 0x408c06
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x264]
call dword [sym.imp.Common.dll_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x408c18
lea ecx, [ebp - 0x260]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov esi, eax
jmp 0x408bb7
mov dword [ebp - 0x26c], 0
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov esi, dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::destructor_void_]
lea ecx, [ebp - 0x268]
call esi
lea ecx, [ebp - 0x264]
mov byte [ebp - 4], 0
call esi
lea ecx, [ebp + 8]
mov dword [ebp - 4], 0xffffffff
call esi
mov eax, dword [ebp - 0x26c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00412d02
mov esp, ebp
pop ebp
ret
Function at 0x408ca0
Capabilities:
Read .ini file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x414595
mov eax, dword fs:[0]
push eax
sub esp, 0x31c
mov eax, dword [0x41e130]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
lea ecx, [ebp + 8]
mov dword [ebp - 4], ebx
call dword [sym.imp.Common.dll_public:_bool___thiscall_CTXStringW::IsEmpty_void_const]
test al, al
lea ecx, [ebp + 8]
je 0x408cf5
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::destructor_void_]
jmp 0x408e8c
mov esi, dword [sym.imp.Common.dll_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const]
call esi
push eax
push ebx
push str.UserDataSavePathType
push str.UserDataSet
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0x206
mov dword [ebp - 0x328], eax
lea eax, [ebp - 0x316]
push ebx
push eax
mov word [ebp - 0x318], bx
call sub.MSVCR80.dll_memset
add esp, 0xc
lea ecx, [ebp + 8]
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push eax
push 0x103
lea ecx, [ebp - 0x318]
push ecx
push 0x41672c
push str.UserDataSavePath
push str.UserDataSet
call edi
push 0xfe
lea edx, [ebp - 0x10e]
push ebx
push edx
mov word [ebp - 0x110], bx
call sub.MSVCR80.dll_memset
add esp, 0xc
lea ecx, [ebp + 8]
call esi
push eax
push 0x7f
lea eax, [ebp - 0x110]
push eax
push 0x41672c
push str.NewVersion
push str.UserDataSet
call edi
push ebx
push 0x80
push 2
push ebx
push ebx
push 0xc0000000
lea ecx, [ebp + 8]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, ebx
je 0x408df0
push ebx
lea ecx, [ebp - 0x324]
push ecx
push 2
lea edx, [ebp - 0x31c]
push edx
mov byte [ebp - 0x31b], bl
push edi
mov byte [ebp - 0x31c], 0xff
mov byte [ebp - 0x31b], 0xfe
mov dword [ebp - 0x324], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x320]
call dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::constructor_void_]
mov eax, dword [ebp - 0x328]
push eax
lea ecx, [ebp - 0x320]
push 0x417328
push ecx
mov byte [ebp - 4], 1
call dword [sym.imp.Common.dll_public:_void___cdecl_CTXStringW::Format_wchar_t_const__]
add esp, 0xc
lea ecx, [ebp + 8]
call esi
push eax
lea ecx, [ebp - 0x320]
call esi
mov edi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push eax
push str.UserDataSavePathType
push str.UserDataSet
call edi
lea ecx, [ebp + 8]
call esi
push eax
lea edx, [ebp - 0x318]
push edx
push str.UserDataSavePath
push str.UserDataSet
call edi
lea ecx, [ebp + 8]
call esi
push eax
lea eax, [ebp - 0x110]
push eax
push str.NewVersion
push str.UserDataSet
call edi
mov esi, dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::destructor_void_]
lea ecx, [ebp - 0x320]
mov byte [ebp - 4], bl
call esi
lea ecx, [ebp + 8]
mov dword [ebp - 4], 0xffffffff
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00412d02
mov esp, ebp
pop ebp
ret
Function at 0x408f90
Capabilities:
Create directory
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4145d2
mov eax, dword fs:[0]
push eax
sub esp, 0x48
push ebx
push esi
push edi
mov eax, dword [0x41e130]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
lea ecx, [ebp + 8]
mov dword [ebp - 4], ebx
call dword [sym.imp.Common.dll_public:_bool___thiscall_CTXStringW::IsEmpty_void_const]
test al, al
lea ecx, [ebp + 8]
je 0x408ff0
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::destructor_void_]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov esi, dword [sym.imp.Common.dll_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const]
push ebx
call esi
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
push str.testfile
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x10]
push ecx
call dword [sym.imp.Common.dll_class_CTXStringW___cdecl_operator_class_CTXStringW_const___wchar_t_const__]
add esp, 0xc
push ebx
push 0x80
push 2
push ebx
push ebx
push 0xc0000000
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x409049
push eax
mov edi, 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4090b7
mov dword [ebp - 0x14], 0x417c0c
mov dword [ebp - 0x20], str.file
mov dword [ebp - 0x1c], str.func
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x4c], 0x62
mov dword [ebp - 0x48], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x50], 2
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea edx, [ebp - 0x34]
push edx
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], ebx
call dword [sym.imp.MSVCR80.dll__time64]
lea eax, [ebp - 0x14]
push eax
push 0x4164dc
lea ecx, [ebp - 0x54]
push str.StorageTool
push ecx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
call dword [sym.imp.Common.dll_void___cdecl_TXLog_DoTXLogVW_struct_tagLogObj___wchar_t_const___wchar_t_const___char__]
add esp, 0x14
xor edi, edi
lea ecx, [ebp - 0x10]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::destructor_void_]
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], bl
call esi
lea ecx, [ebp + 8]
mov dword [ebp - 4], 0xffffffff
call esi
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x409850
Capabilities:
Check if file exists
Create directory
Get file attributes
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4146ab
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x41e130]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::constructor_class_CTXStringW_const__]
push ecx
lea eax, [ebp + 0xc]
mov ecx, esp
mov dword [ebp - 0x10], esp
mov edi, 1
push eax
mov dword [ebp - 4], edi
call ebx
lea ecx, [ebp - 0x10]
push ecx
call dword [sym.imp.Common.dll_class_CTXStringW___cdecl_Util::FS::GetParentDir_class_CTXStringW_]
add esp, 8
mov esi, dword [sym.imp.Common.dll_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const]
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4098ca
push 0
lea ecx, [ebp - 0x10]
call esi
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
push 0xa
lea ecx, [ebp + 0xc]
call esi
push eax
lea ecx, [ebp + 8]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x40993f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp + 0xc]
mov esi, eax
push esi
push edx
push ecx
lea eax, [ebp + 8]
mov ecx, esp
mov dword [ebp - 0x14], esp
push eax
call ebx
push str.MoveFileEx___s__to___s__fail_ErrorCode_lu
push str.StorageTool
push 2
push str.func
push 0x121
push str.file
call fcn.004097e0
add esp, 0x24
cmp esi, 0x70
jne 0x409928
or edi, 0xffffffff
jmp 0x40993f
cmp esi, 0x50
je 0x40993a
cmp esi, 0xb7
mov edi, 0xfffffffd
jne 0x40993f
mov edi, 2
mov esi, dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::destructor_void_]
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call esi
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0
call esi
lea ecx, [ebp + 0xc]
mov dword [ebp - 4], 0xffffffff
call esi
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x409980
Capabilities:
Check if file exists
Copy file
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4146ab
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x41e130]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [sym.imp.Common.dll_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const]
lea ecx, [ebp + 8]
mov dword [ebp - 4], 1
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push eax
call edi
cmp eax, 0xffffffff
jne 0x4099fa
mov esi, dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::destructor_void_]
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0
call esi
lea ecx, [ebp + 0xc]
mov dword [ebp - 4], 0xffffffff
call esi
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::constructor_class_CTXStringW_const__]
push ecx
lea eax, [ebp + 0xc]
mov ecx, esp
mov dword [ebp - 0x14], esp
push eax
call ebx
lea ecx, [ebp - 0x10]
push ecx
call dword [sym.imp.Common.dll_class_CTXStringW___cdecl_Util::FS::GetParentDir_class_CTXStringW_]
add esp, 8
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
call esi
push eax
call edi
cmp eax, 0xffffffff
jne 0x409a3a
push 0
lea ecx, [ebp - 0x10]
call esi
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov edx, dword [ebp + 0x10]
push edx
lea ecx, [ebp + 0xc]
mov edi, 1
call esi
push eax
lea ecx, [ebp + 8]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x409ab6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [ebp + 0xc]
push esi
push eax
push ecx
lea edx, [ebp + 8]
mov ecx, esp
mov dword [ebp - 0x14], esp
push edx
call ebx
push str.CopyFile___s__to___s__fail_ErrorCode_lu
push str.StorageTool
push 2
push str.func
push 0x14b
push str.file
call fcn.004097e0
add esp, 0x24
cmp esi, 0x70
jne 0x409a9f
or edi, 0xffffffff
jmp 0x409ab6
cmp esi, 0x50
je 0x409ab1
cmp esi, 0xb7
mov edi, 0xfffffffd
jne 0x409ab6
mov edi, 2
mov esi, dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::destructor_void_]
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call esi
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0
call esi
lea ecx, [ebp + 0xc]
mov dword [ebp - 4], 0xffffffff
call esi
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40b120
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x414a78
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x41e130]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0x10]
mov edi, dword [sym.imp.Common.dll_class_CTXStringW___cdecl_operator_class_CTXStringW_const___wchar_t_const__]
push esi
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x1c]
push ecx
mov dword [ebp - 4], 1
call edi
add esp, 0xc
mov ebx, dword [reloc.Common.dll___YCTXStringW__QAEAAV0_PB_W_Z]
push 0x417df0
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
call ebx
push esi
lea edx, [ebp + 0xc]
push edx
lea eax, [ebp - 0x18]
push eax
call edi
add esp, 0xc
push 0x417df0
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 3
call ebx
mov edi, dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::constructor_class_CTXStringW_const__]
push ecx
lea edx, [ebp - 0x18]
mov ecx, esp
mov dword [ebp - 0x10], esp
push edx
call edi
push ecx
lea eax, [ebp - 0x1c]
mov ecx, esp
mov dword [ebp - 0x20], esp
push eax
mov byte [ebp - 4], 4
call edi
mov byte [ebp - 4], 3
call fcn.00409af0
mov edi, eax
add esp, 8
cmp edi, 0xffffffff
je 0x40b296
cmp edi, 0xfffffffd
je 0x40b296
push esi
lea ecx, [ebp + 8]
push ecx
lea edx, [ebp - 0x14]
push edx
call dword [sym.imp.Common.dll_class_CTXStringW___cdecl_operator_class_CTXStringW_const___wchar_t_const__]
add esp, 0xc
push 0x417ec4
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 5
call ebx
lea ecx, [ebp - 0x14]
call dword [sym.imp.Common.dll_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
mov esi, dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::destructor_void_]
je 0x40b28b
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp + 0xc]
push ecx
lea edx, [ebp - 0x10]
push edx
call dword [sym.imp.Common.dll_class_CTXStringW___cdecl_operator_class_CTXStringW_const___wchar_t_const__]
add esp, 0xc
cmp dword [0x41e1c0], 0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x10]
je 0x40b23f
push 0x417ebc
jmp 0x40b244
push 0x417eb4
call ebx
push 0x417ec4
lea ecx, [ebp - 0x10]
call ebx
mov edi, dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::constructor_class_CTXStringW_const__]
push 1
push ecx
lea eax, [ebp - 0x10]
mov ecx, esp
mov dword [ebp - 0x20], esp
push eax
call edi
push ecx
lea edx, [ebp - 0x14]
mov ecx, esp
mov dword [ebp - 0x24], esp
push edx
mov byte [ebp - 4], 7
call edi
mov byte [ebp - 4], 6
call fcn.00409980
add esp, 0xc
lea ecx, [ebp - 0x10]
mov edi, eax
mov byte [ebp - 4], 5
call esi
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 3
call esi
jmp 0x40b29c
mov esi, dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::destructor_void_]
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 2
call esi
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call esi
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0
call esi
lea ecx, [ebp + 0xc]
mov dword [ebp - 4], 0xffffffff
call esi
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x411dc0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4154b4
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
mov eax, dword [0x41e130]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::constructor_void_]
lea ecx, [ebp - 0x10]
call esi
push 0x104
push 0x104
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 0
call dword [sym.imp.Common.dll_public:_wchar_t____thiscall_CTXStringW::GetBuffer_int_]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push eax
lea ecx, [ebp - 0x10]
call dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::ReleaseBuffer_int_]
push 0x5c
lea ecx, [ebp - 0x10]
call dword [sym.imp.Common.dll_public:_int___thiscall_CTXStringW::ReverseFind_wchar_t_const]
push eax
push 0
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x10]
call dword [sym.imp.Common.dll_public:_class_CTXStringW___thiscall_CTXStringW::Mid_int__int_]
push str.QQ.exe
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::constructor_wchar_t_const__]
cmp dword [0x41e1c0], 0
mov byte [ebp - 4], 2
je 0x411e66
push str.TM.exe
lea ecx, [ebp - 0x14]
call dword [sym.imp.Common.dll_public:_class_CTXStringW____thiscall_CTXStringW::operator_wchar_t_const__]
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x20]
push edx
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.Common.dll_class_CTXStringW___cdecl_operator_class_CTXStringW_const___class_CTXStringW_const__]
add esp, 0xc
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 3
call esi
mov esi, dword [sym.imp.Common.dll_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const]
push 5
push 0
lea ecx, [ebp - 0x18]
call esi
push eax
lea ecx, [ebp - 0x1c]
call esi
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov esi, dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::destructor_void_]
lea ecx, [ebp - 0x18]
call esi
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
call esi
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call esi
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0
call esi
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x411ef0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push str.explorer.exe
lea ecx, [ebp - 4]
call dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::constructor_wchar_t_const__]
mov ecx, dword [ebp + 8]
mov esi, dword [sym.imp.Common.dll_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const]
push 5
push 0
call esi
push eax
lea ecx, [ebp - 4]
call esi
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 4]
call dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::destructor_void_]
pop esi
mov esp, ebp
pop ebp
ret