joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408460
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x66be18
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
mov esi, dword [esp + 0x34]
push esi
lea ecx, [esp + 0x10]
call fcn.0060880a
mov eax, dword [esp + 0x38]
mov dword [esp + 0x28], 0
test eax, eax
jne 0x4084ab
push eax
push eax
mov eax, dword [esi + 0x20]
push 0x31
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push eax
call sub.MFC42u.DLL_CGdiObject::FromHandle
push eax
lea ecx, [esp + 0x10]
call sub.MFC42u.DLL_CDC::SelectObject_2
mov ecx, dword [esp + 0x30]
mov esi, eax
lea edx, [esp + 4]
mov eax, dword [ecx]
push edx
mov ecx, dword [eax - 8]
push ecx
push eax
mov eax, dword [esp + 0x20]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
push esi
lea ecx, [esp + 0x10]
call sub.MFC42u.DLL_CDC::SelectObject_2
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call sub.MFC42u.DLL_CClientDC::CClientDC
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 4]
pop esi
mov dword fs:[0], ecx
add esp, 0x28
ret

Function at 0x409ca0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x66bedf
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x24]
mov ecx, ebx
xor eax, eax
shr ecx, 0x10
mov al, bh
mov byte [esp + 4], cl
push esi
lea ecx, [esp + 0x28]
mov dword [esp + 0x10], 0
mov byte [esp + 0xc], al
call sub.MFC42u.DLL_CString::CString_5
mov edx, dword [esp + 8]
mov eax, dword [esp + 0xc]
and edx, 0xff
and eax, 0xff
push edx
and ebx, 0xff
push eax
push ebx
lea ecx, [esp + 0x34]
push str._02X_02X_02X
push ecx
mov dword [esp + 0x30], 1
call sub.MFC42u.DLL_CString::Format_1
mov esi, dword [esp + 0x38]
add esp, 0x14
lea edx, [esp + 0x28]
mov ecx, esi
push edx
call sub.MFC42u.DLL_CString::CString_4
mov dword [esp + 0x10], 1
lea ecx, [esp + 0x28]
mov byte [esp + 0x1c], 0
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x14]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x40b1a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x66c080
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
mov esi, ecx
push str..bak
lea ecx, [esp + 0x10]
mov dword [esp + 0x14], esi
call sub.MFC42u.DLL_CString::CString_6
push 0x738574
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], 0
call sub.MFC42u.DLL_CString::CString_6
push 0x738574
lea ecx, [esp + 8]
mov byte [esp + 0x20], 1
call sub.MFC42u.DLL_CString::CString_6
lea eax, [esp + 0xc]
lea ecx, [esp + 8]
push eax
push ecx
lea edx, [esp + 0xc]
push 0
push edx
mov ecx, esi
mov byte [esp + 0x2c], 2
call fcn.0040b430
lea ecx, [esp + 4]
mov byte [esp + 0x1c], 6
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 8]
mov byte [esp + 0x1c], 5
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0xc]
mov byte [esp + 0x1c], 4
call sub.MFC42u.DLL_CString::CString
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x30]
mov ecx, eax
push edx
mov edx, dword [esp + 0x28]
and ecx, 0x20
mov dword [esi + 8], ecx
mov ecx, dword [esp + 0x30]
push ecx
push eax
push edx
mov ecx, esi
call fcn.0040b2f0
mov ecx, dword [esp + 0x14]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x1c
ret 0x10

Function at 0x40b280
Capabilities:
Delete file
Move file

Disassembly:
push 0xffffffffffffffff
push 0x66c098
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
mov eax, dword [esi + 4]
mov dword [esp + 0x10], 0
push eax
call fcn.0040ca30
add esp, 4
test eax, eax
je 0x40b2d1
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x40b2d1
mov eax, dword [esi + 4]
push 4
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ecx, esi
mov dword [esp + 0x10], 0xffffffff
call fcn.0040b4a0
mov ecx, dword [esp + 8]
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x40c1d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x66c308
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push esi
push edi
lea ecx, [esp + 0xc]
call fcn.006088f4
lea ecx, [esp + 8]
mov dword [esp + 0x30], 0
call sub.MFC42u.DLL_CString::CString_5
mov eax, dword [esp + 0x38]
mov edi, dword [esp + 0x44]
push 0
push edi
mov eax, dword [eax]
lea ecx, [esp + 0x10]
push eax
push 0
push ecx
mov byte [esp + 0x44], 1
call fcn.0040fc40
mov edx, dword [esp + 0x1c]
add esp, 0x14
lea ecx, [esp + 0xc]
push 0
push edx
call sub.MFC42u.DLL_CFileFind::FindFile
mov esi, dword [esp + 0x3c]
test eax, eax
je 0x40c2b9
push ebp
lea ecx, [esp + 0x10]
call sub.MFC42u.DLL_CFileFind::FindNextFileW
lea ecx, [esp + 0x10]
mov ebp, eax
call sub.MFC42u.DLL_CFileFind::IsDots
test eax, eax
jne 0x40c2b4
lea eax, [esp + 0x3c]
lea ecx, [esp + 0x10]
push eax
call sub.MFC42u.DLL_CFileFind::GetFilePath
mov edx, dword [esp + 0x10]
push 0x10
lea ecx, [esp + 0x14]
mov byte [esp + 0x38], 2
call dword [edx + 0x40]
test eax, eax
je 0x40c296
mov eax, dword [esp + 0x44]
test eax, eax
je 0x40c2a6
push edi
push 1
lea eax, [esp + 0x44]
push esi
push eax
call fcn.0040c1d0
add esp, 0x10
jmp 0x40c2a6
mov eax, dword [esi + 8]
lea ecx, [esp + 0x3c]
push ecx
push eax
mov ecx, esi
call sub.MFC42u.DLL_CStringArray::SetAtGrow_1
lea ecx, [esp + 0x3c]
mov byte [esp + 0x34], 1
call sub.MFC42u.DLL_CString::CString
test ebp, ebp
jne 0x40c23f
pop ebp
mov esi, dword [esi + 8]
lea ecx, [esp + 8]
mov byte [esp + 0x30], 0
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0xffffffff
call sub.MFC42u.DLL_CFileFind::CFileFind
mov ecx, dword [esp + 0x28]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret
Function at 0x40c7e0
Capabilities:
Delete directory
Delete file
Move file
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push 1
push esi
call fcn.0040c9e0
add esp, 8
test eax, eax
jne 0x40c7fb
mov eax, 1
pop esi
ret
mov eax, dword [esp + 0x10]
push ebx
mov ebx, dword [esp + 0x10]
push edi
push eax
push 0
push ebx
push esi
call fcn.0040c3a0
mov edi, eax
add esp, 0x10
test edi, edi
je 0x40c856
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp edi, 0xffffffff
push esi
jne 0x40c85c
push str.FileMisc::DeleteFolder__s__delayed_due_to_files_
call fcn.0040db50
add esp, 8
push 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x40c856
push esi
push str.FileMisc::DeleteOnReboot__s__failed_
call fcn.0040db50
add esp, 8
xor edi, edi
mov eax, edi
pop edi
pop ebx
pop esi
ret
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x40c856
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x40c880
mov ecx, eax
and ecx, 0xffff
or ecx, 0x80070000
jmp 0x40c882
xor ecx, ecx
push ecx
push eax
push esi
push str.FileMisc::DeleteFolder__s__failed___dw___08x__hr___08x
call fcn.0040db50
push 4
push ebx
call fcn.0041b640
add esp, 0x18
test eax, eax
je 0x40c856
push 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x40c846
push esi
push str.FileMisc::DeleteFolder__s__delayed_
call fcn.0040db50
add esp, 8
or edi, 0xffffffff
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x40c9b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call fcn.00419060
add esp, 4
test eax, eax
je 0x40c9c8
mov eax, dword [esp + 0xc]
pop esi
ret
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop esi
ret

Function at 0x40c9e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call fcn.00419060
add esp, 4
test eax, eax
je 0x40c9f8
mov eax, dword [esp + 0xc]
pop esi
ret
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x104
jg 0x40ca28
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40ca28
push 0x10
push eax
call fcn.0041b640
add esp, 8
test eax, eax
je 0x40ca28
mov eax, 1
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0x40ca30
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x104
jg 0x40ca65
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40ca65
push 0x10
push eax
call fcn.0041b640
add esp, 8
test eax, eax
jne 0x40ca65
mov eax, 1
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x40cbd0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x66c3cf
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
lea ecx, [esp + 4]
mov dword [esp + 8], 0
call sub.MFC42u.DLL_CString::CString_5
push 0x105
lea ecx, [esp + 8]
mov dword [esp + 0x18], 1
call sub.MFC42u.DLL_CString::GetBuffer
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0xffffffffffffffff
lea ecx, [esp + 8]
call sub.MFC42u.DLL_CString::ReleaseBuffer
mov esi, dword [esp + 0x1c]
lea eax, [esp + 4]
push eax
mov ecx, esi
call sub.MFC42u.DLL_CString::CString_4
mov dword [esp + 8], 1
lea ecx, [esp + 4]
mov byte [esp + 0x14], 0
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x40d330
Capabilities:
Delete file

Disassembly:
mov eax, dword [esp + 8]
push esi
mov esi, dword [esp + 8]
test eax, eax
je 0x40d34c
push 0xffffffffffffffff
push 0
push 3
push esi
call fcn.0040d510
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop esi
ret

Function at 0x40d3a0
Capabilities:
Copy file

Disassembly:
mov eax, dword [esp + 0x14]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x14]
test eax, eax
je 0x40d3db
push edi
call fcn.0040bfa0
push esi
mov ebp, eax
mov ebx, edx
call fcn.0040bfa0
add esp, 8
cmp ebx, edx
jg 0x40d3db
jl 0x40d3d1
cmp ebp, eax
ja 0x40d3db
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileW]
push 1
push esi
push edi
mov dword [esp + 0x30], eax
call ebp
mov ebx, eax
test ebx, ebx
jne 0x40d42a
push esi
call fcn.0040ca30
add esp, 4
test eax, eax
je 0x40d44b
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x40d3d1
mov eax, dword [esp + 0x20]
push eax
push esi
call fcn.0040d330
add esp, 8
test eax, eax
je 0x40d44b
push 1
push esi
push edi
call ebp
mov ebx, eax
test ebx, ebx
je 0x40d44b
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esp + 0x24]
push eax
push esi
push edi
push str.FileMisc::CopyFile__s_____s__took__ld_ms
call fcn.0040db50
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push edi
push str.FileMisc::CopyFile__s_____s__FAILED____ld_
call fcn.0040db50
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x40d470
Capabilities:
Move file

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, dword [esp + 0x1c]
mov ebx, dword [esp + 0x18]
mov ebp, dword [sym.imp.KERNEL32.dll_MoveFileW]
push edi
push ebx
mov dword [esp + 0x18], eax
call ebp
mov esi, eax
test esi, esi
jne 0x40d4c8
mov eax, dword [esp + 0x20]
test eax, eax
je 0x40d4ea
push edi
call fcn.0040ca30
add esp, 4
test eax, eax
je 0x40d4ea
mov eax, dword [esp + 0x24]
push eax
push edi
call fcn.0040d330
add esp, 8
test eax, eax
je 0x40d4ea
push edi
push ebx
call ebp
mov esi, eax
test esi, esi
je 0x40d4ea
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esp + 0x10]
push eax
push edi
push ebx
push str.FileMisc::MoveFile__s_____s__took__ld_ms
call fcn.0040db50
add esp, 0x10
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push ebx
push str.FileMisc::MoveFile__s_____s__FAILED____ld_
call fcn.0040db50
add esp, 0x10
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x40d510
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0xc]
push esi
cmp ebx, 0xffffffff
push edi
jne 0x40d52a
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
mov edi, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
test edi, edi
je 0x40d544
push edi
push ebx
call fcn.0041b640
add esp, 8
test eax, eax
jne 0x40d55e
test esi, esi
je 0x40d556
push esi
push ebx
call fcn.0041b640
add esp, 8
test eax, eax
je 0x40d55e
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret
or esi, ebx
not edi
and esi, edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x40d640
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x66c577
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
lea ecx, [esp]
mov dword [esp + 0x14], 0
call sub.MFC42u.DLL_CString::CString_5
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], 1
call sub.MFC42u.DLL_CString::CString_5
lea eax, [esp + 0x10]
mov byte [esp + 0x20], 2
push eax
call fcn.0040ef10
mov eax, dword [eax]
push 0
lea ecx, [esp + 0xc]
push eax
push ecx
mov byte [esp + 0x30], 3
call fcn.0040bee0
add esp, 0x10
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], 5
call sub.MFC42u.DLL_CString::CString
mov edx, dword [0x73861c]
push 4
push edx
call fcn.0041b640
add esp, 8
test eax, eax
je 0x40d6f2
lea eax, [esp + 8]
push eax
call fcn.0040e190
add esp, 4
push eax
lea ecx, [esp + 4]
mov byte [esp + 0x24], 6
call sub.MFC42u.DLL_CString::operator_2
lea ecx, [esp + 8]
mov byte [esp + 0x20], 5
call sub.MFC42u.DLL_CString::CString
jmp 0x40d792
mov ecx, dword [0x73861c]
push 8
push ecx
call fcn.0041b640
add esp, 8
test eax, eax
jne 0x40d744
lea edx, [esp + 8]
push eax
push edx
call fcn.0040ef30
mov eax, dword [esp + 0x10]
mov byte [esp + 0x28], 7
push eax
call fcn.0040ce50
add esp, 0xc
test eax, eax
je 0x40d736
lea ecx, [esp + 8]
push ecx
lea ecx, [esp + 4]
call sub.MFC42u.DLL_CString::operator_2
lea ecx, [esp + 8]
mov byte [esp + 0x20], 5
call sub.MFC42u.DLL_CString::CString
mov edx, dword [esp]
mov eax, dword [edx - 8]
test eax, eax
jne 0x40d792
lea eax, [esp]
push eax
push 0x7385d4
push 0x1a
call fcn.00410170
mov ecx, dword [esp + 0x10]
add esp, 0xc
push ecx
mov ecx, 0x7385d4
call sub.MFC42u.DLL_CString::Find_1
cmp eax, 0xffffffff
jne 0x40d792
lea edx, [esp + 4]
lea eax, [esp]
push edx
push 1
push eax
call fcn.0040bb70
add esp, 8
mov ecx, eax
call fcn.006088b2
mov ecx, dword [esp + 4]
mov edx, dword [esp]
push esi
push 0x719424
push ecx
push edx
lea eax, [esp + 0x1c]
push 0
push eax
call fcn.0040fc40
mov esi, dword [esp + 0x40]
add esp, 0x14
mov ecx, esi
push eax
call sub.MFC42u.DLL_CString::CString_4
mov dword [esp + 0x18], 1
lea ecx, [esp + 8]
mov byte [esp + 0x24], 2
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x24], 1
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 4]
mov byte [esp + 0x24], 0
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x24
ret
Function at 0x40e190
Capabilities:
Get common file path

Disassembly:
sub esp, 0x210
push esi
push edi
xor eax, eax
mov ecx, 0x82
lea edi, [esp + 0xe]
mov word [esp + 0xc], ax
mov dword [esp + 8], eax
rep stosd dword es:[edi], eax
lea eax, [esp + 0xc]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x40e1c9
lea ecx, [esp + 0xc]
push ecx
jmp 0x40e1ce
push str.C:Temp
mov esi, dword [esp + 0x220]
mov ecx, esi
call sub.MFC42u.DLL_CString::CString_6
mov eax, esi
pop edi
pop esi
add esp, 0x210
ret

Function at 0x40e1f0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x41c
push esi
push edi
xor edx, edx
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x21a]
mov word [esp + 0x218], dx
mov word [esp + 0xc], dx
rep stosd dword es:[edi], eax
mov ecx, 0x82
lea edi, [esp + 0xe]
rep stosd dword es:[edi], eax
lea eax, [esp + 0xc]
mov dword [esp + 8], edx
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x40e282
mov edx, dword [esp + 0x430]
mov eax, dword [esp + 0x42c]
lea ecx, [esp + 0x218]
push ecx
push edx
lea ecx, [esp + 0x14]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x40e282
mov esi, dword [esp + 0x428]
lea edx, [esp + 0x218]
push edx
mov ecx, esi
call sub.MFC42u.DLL_CString::CString_6
mov eax, esi
pop edi
pop esi
add esp, 0x41c
ret
mov esi, dword [esp + 0x428]
push 0x738620
mov ecx, esi
call sub.MFC42u.DLL_CString::CString_2
mov eax, esi
pop edi
pop esi
add esp, 0x41c
ret

Function at 0x40e2a0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x66c705
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x214
push edi
lea ecx, [esp + 4]
mov dword [esp + 8], 0
call sub.MFC42u.DLL_CString::CString_5
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0xe]
mov word [esp + 0xc], 0
rep stosd dword es:[edi], eax
lea eax, [esp + 0xc]
mov dword [esp + 0x220], 1
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
pop edi
je 0x40e325
mov ecx, dword [esp + 0x22c]
mov edx, dword [esp + 0x228]
push ecx
lea eax, [esp + 0xc]
push edx
push eax
lea ecx, [esp + 0xc]
push 0
push ecx
call fcn.0040fc40
add esp, 0x14
push esi
mov esi, dword [esp + 0x228]
lea edx, [esp + 4]
mov ecx, esi
push edx
call sub.MFC42u.DLL_CString::CString_4
mov dword [esp + 8], 1
lea ecx, [esp + 4]
mov byte [esp + 0x220], 0
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x218]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x220
ret
Function at 0x40e450
Capabilities:
Query environment variable

Disassembly:
push 0xffffffffffffffff
push 0x66c748
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
push edi
lea ecx, [esp + 0xc]
call sub.MFC42u.DLL_CString::CString_5
mov esi, dword [esp + 0x20]
mov edi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0
push 0
mov eax, dword [esi]
mov dword [esp + 0x20], 0
push eax
call edi
mov ebx, dword [esi]
inc eax
push eax
push eax
lea ecx, [esp + 0x14]
call sub.MFC42u.DLL_CString::GetBuffer
push eax
push ebx
call edi
test eax, eax
je 0x40e4e2
push 0xffffffffffffffff
lea ecx, [esp + 0x10]
call sub.MFC42u.DLL_CString::ReleaseBuffer
lea eax, [esp + 0xc]
mov ecx, esi
push eax
call sub.MFC42u.DLL_CString::operator_2
lea ecx, [esp + 0xc]
mov dword [esp + 0x18], 0xffffffff
call sub.MFC42u.DLL_CString::CString
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
lea ecx, [esp + 0xc]
mov dword [esp + 0x18], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x10]
pop edi
pop esi
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x40e8d0
Capabilities:
Parse pe header

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x66c7eb
push eax
mov eax, 0x1010
mov dword fs:[0], esp
call fcn.006097e0
lea ecx, [esp]
call fcn.0060892a
mov eax, dword [esp + 0x1020]
push 0
push 0x8040
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 0x1024], 0
call sub.MFC42u.DLL_CFile::Open
test eax, eax
jne 0x40e94b
lea ecx, [esp]
mov dword [esp + 0x1018], 0xffffffff
call sub.MFC42u.DLL_CFile::CFile
or eax, 0xffffffff
mov ecx, dword [esp + 0x1010]
mov dword fs:[0], ecx
add esp, 0x101c
ret
push edi
mov ecx, 0x3ff
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], 0
push 0x1000
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0xc]
stosb byte es:[edi], al
call sub.MFC42u.DLL_CFile::Read
lea ecx, [esp + 4]
call sub.MFC42u.DLL_CFile::Close
mov edx, dword [esp + 0x15]
mov eax, dword [esp + 0x14]
and edx, 0xff
and eax, 0xff
shl edx, 8
or edx, eax
pop edi
cmp edx, 0x5a4d
je 0x40e9ca
lea ecx, [esp]
mov dword [esp + 0x1018], 0xffffffff
call sub.MFC42u.DLL_CFile::CFile
or eax, 0xffffffff
mov ecx, dword [esp + 0x1010]
mov dword fs:[0], ecx
add esp, 0x101c
ret
mov eax, dword [esp + 0x4f]
mov ecx, dword [esp + 0x4e]
mov edx, dword [esp + 0x4d]
and eax, 0xff
shl eax, 8
and ecx, 0xff
and edx, 0xff
or eax, ecx
mov ecx, dword [esp + 0x4c]
shl eax, 8
or eax, edx
and ecx, 0xff
shl eax, 8
or eax, ecx
xor edx, edx
xor ecx, ecx
mov dh, byte [esp + eax + 0x13]
mov cl, byte [esp + eax + 0x11]
mov dl, byte [esp + eax + 0x12]
shl edx, 8
or edx, ecx
xor ecx, ecx
mov cl, byte [esp + eax + 0x10]
shl edx, 8
or edx, ecx
cmp edx, 0x4550
je 0x40ea54
lea ecx, [esp]
mov dword [esp + 0x1018], 0xffffffff
call sub.MFC42u.DLL_CFile::CFile
or eax, 0xffffffff
mov ecx, dword [esp + 0x1010]
mov dword fs:[0], ecx
add esp, 0x101c
ret
add eax, 0xe8
push esi
xor esi, esi
lea ecx, [eax + 8]
cmp eax, ecx
jge 0x40ea70
xor edx, edx
mov dl, byte [esp + eax + 0x14]
or esi, edx
inc eax
cmp eax, ecx
jl 0x40ea63
xor eax, eax
lea ecx, [esp + 4]
test esi, esi
sete al
mov esi, eax
mov dword [esp + 0x101c], 0xffffffff
call sub.MFC42u.DLL_CFile::CFile
mov ecx, dword [esp + 0x1014]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x101c
ret
Function at 0x40f000
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x66c950
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebp
push esi
push edi
mov edi, dword [esp + 0x30]
push 0xffffffffffffffff
push 0
mov ecx, edi
call sub.MFC42u.DLL_CStringArray::SetSize
lea ecx, [esp + 0xc]
call fcn.006089e4
mov ebp, dword [esp + 0x34]
xor eax, eax
cmp ebp, 1
lea ecx, [esp + 0xc]
sete al
push eax
push ecx
mov dword [esp + 0x30], 0
call fcn.0040f0d0
mov ebp, eax
add esp, 8
xor esi, esi
test ebp, ebp
jle 0x40f096
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x30]
mov eax, dword [edx + esi*4]
push eax
push ecx
call fcn.0040e800
add esp, 8
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
mov byte [esp + 0x30], 1
call sub.MFC42u.DLL_CStringArray::SetAtGrow_1
lea ecx, [esp + 0x30]
mov byte [esp + 0x28], 0
call sub.MFC42u.DLL_CString::CString
inc esi
cmp esi, ebp
jl 0x40f05d
cmp dword [esp + 0x34], 2
jne 0x40f0a8
push 0
push edi
call fcn.0041b920
add esp, 8
mov edi, dword [edi + 8]
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call sub.MFC42u.DLL_CDWordArray::CDWordArray
mov ecx, dword [esp + 0x20]
mov eax, edi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x20
ret

Function at 0x40f4a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x66c9c8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
mov esi, dword [esp + 0x30]
lea ecx, [esp + 0x30]
push esi
call sub.MFC42u.DLL_CString::CString_6
push 0x2e
push 0x2c
lea ecx, [esp + 0x38]
mov dword [esp + 0x30], 0
call sub.MFC42u.DLL_CString::Replace_1
lea ecx, [esp + 0xc]
call fcn.006086f6
push esi
lea ecx, [esp + 0xc]
mov byte [esp + 0x2c], 1
call sub.MFC42u.DLL_CString::CString_6
push 0
push 0
lea eax, [esp + 0x14]
push 0x2e
lea ecx, [esp + 0x14]
push eax
push ecx
mov byte [esp + 0x3c], 2
call fcn.00419560
add esp, 0x14
lea ecx, [esp + 8]
test eax, eax
sete bl
mov byte [esp + 0x28], 1
call sub.MFC42u.DLL_CString::CString
test bl, bl
je 0x40f55b
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 0
call sub.MFC42u.DLL_CStringArray::CStringArray
lea ecx, [esp + 0x30]
mov dword [esp + 0x28], 0xffffffff
call sub.MFC42u.DLL_CString::CString
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret
push edi
mov edi, dword [esp + 0x38]
push 0xffffffffffffffff
push 0
mov ecx, edi
call sub.MFC42u.DLL_CDWordArray::SetSize
mov eax, dword [esp + 0x18]
test eax, eax
lea esi, [eax - 1]
je 0x40f59e
push ebp
mov ebp, dword [sym.imp.MSVCRT.dll__wtoi]
mov edx, dword [esp + 0x18]
push 1
mov eax, dword [edx + esi*4]
push eax
call ebp
add esp, 4
mov ecx, edi
push eax
push 0
call sub.MFC42u.DLL_CDWordArray::InsertAt
mov eax, esi
dec esi
test eax, eax
jne 0x40f57d
pop ebp
mov edi, dword [edi + 8]
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 0
call sub.MFC42u.DLL_CStringArray::CStringArray
lea ecx, [esp + 0x34]
mov dword [esp + 0x2c], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x24]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret