joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4073fd
Capabilities:
Read .ini file
Write file on windows

Disassembly:
push 0x320
mov eax, 0x41100b
call fcn.0040f8dd
xor edi, edi
lea ecx, [ebp + 8]
mov dword [ebp - 4], edi
call dword [sym.imp.Common.dll_public:_bool___thiscall_CTXStringW::IsEmpty_void_const]
lea ecx, [ebp + 8]
test al, al
je 0x407430
or dword [ebp - 4], 0xffffffff
call dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::destructor_void_]
jmp 0x4075c3
mov esi, dword [sym.imp.Common.dll_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const]
call esi
push eax
push edi
push str.UserDataSavePathType
mov ebx, str.UserDataSet
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 0x32c], eax
xor eax, eax
push 0x206
mov word [ebp - 0x318], ax
lea eax, [ebp - 0x316]
push edi
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
lea ecx, [ebp + 8]
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push eax
push 0x103
lea eax, [ebp - 0x318]
push eax
push 0x413664
push str.UserDataSavePath
push ebx
call edi
xor eax, eax
push 0xfe
push eax
mov word [ebp - 0x110], ax
lea eax, [ebp - 0x10e]
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
lea ecx, [ebp + 8]
call esi
push eax
push 0x7f
lea eax, [ebp - 0x110]
push eax
push 0x413664
push str.NewVersion
push ebx
call edi
xor edi, edi
push edi
push 0x80
push 2
push edi
push edi
push 0xc0000000
lea ecx, [ebp + 8]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x324], eax
cmp eax, edi
je 0x407536
xor eax, eax
and dword [ebp - 0x328], eax
push eax
lea edi, [ebp - 0x31b]
stosb byte es:[edi], al
lea eax, [ebp - 0x328]
push eax
push 2
lea eax, [ebp - 0x31c]
push eax
push dword [ebp - 0x324]
mov word [ebp - 0x31c], 0xfeff
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 0x324]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x320]
call dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::constructor_void_]
push dword [ebp - 0x32c]
lea eax, [ebp - 0x320]
push 0x4142d0
push eax
mov byte [ebp - 4], 1
call dword [sym.imp.Common.dll_public:_void___cdecl_CTXStringW::Format_wchar_t_const__]
add esp, 0xc
lea ecx, [ebp + 8]
call esi
push eax
lea ecx, [ebp - 0x320]
call esi
mov edi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push eax
push str.UserDataSavePathType
push ebx
call edi
lea ecx, [ebp + 8]
call esi
push eax
lea eax, [ebp - 0x318]
push eax
push str.UserDataSavePath
push ebx
call edi
lea ecx, [ebp + 8]
call esi
push eax
lea eax, [ebp - 0x110]
push eax
push str.NewVersion
push ebx
call edi
mov esi, dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::destructor_void_]
lea ecx, [ebp - 0x320]
mov byte [ebp - 4], 0
call esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call esi
call fcn.0040f927
ret
Function at 0x407669
Capabilities:
Create directory
Delete file

Disassembly:
push 0xc
mov eax, 0x411045
call fcn.0040f874
xor ebx, ebx
lea ecx, [ebp + 8]
mov dword [ebp - 4], ebx
call dword [sym.imp.Common.dll_public:_bool___thiscall_CTXStringW::IsEmpty_void_const]
mov edi, dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::destructor_void_]
test al, al
je 0x4076a0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call edi
mov eax, ebx
call fcn.0040f913
ret 4
mov esi, dword [sym.imp.Common.dll_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const]
push ebx
lea ecx, [ebp + 8]
call esi
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
push str.testfile
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.Common.dll_class_CTXStringW___cdecl_operator_class_CTXStringW_const___wchar_t_const__]
add esp, 0xc
push ebx
push 0x80
push 2
push ebx
push ebx
push 0xc0000000
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x4076fe
push eax
mov dword [ebp - 0x14], 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40772c
lea eax, [ebp - 0x18]
push eax
push 0x413454
push str.StorageTool
push 2
push str.func
push 0x62
push str.file
mov dword [ebp - 0x18], 0x414990
call fcn.004011f4
add esp, 0x1c
mov dword [ebp - 0x14], ebx
lea ecx, [ebp - 0x10]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], bl
call edi
mov ebx, dword [ebp - 0x14]
jmp 0x40768d
Function at 0x407bd1
Capabilities:
Check if file exists
Create directory
Get file attributes
Move file

Disassembly:
push 8
mov eax, 0x41112c
call fcn.0040f874
mov edi, dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::constructor_class_CTXStringW_const__]
push ecx
xor ebx, ebx
lea eax, [ebp + 0xc]
mov ecx, esp
mov dword [ebp - 0x10], esp
inc ebx
push eax
mov dword [ebp - 4], ebx
call edi
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.Common.dll_class_CTXStringW___cdecl_Util::FS::GetParentDir_class_CTXStringW_]
pop ecx
pop ecx
mov esi, dword [sym.imp.Common.dll_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const]
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x407c2c
push 0
lea ecx, [ebp - 0x10]
call esi
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
push 0xa
lea ecx, [ebp + 0xc]
call esi
push eax
lea ecx, [ebp + 8]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x407c9b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push dword [ebp + 0xc]
lea eax, [ebp + 8]
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push eax
call edi
push str.MoveFileEx___s__to___s__fail_ErrorCode_lu
push str.StorageTool
push 2
pop ebx
push ebx
push str.func
push 0x121
push str.file
call fcn.00407b65
add esp, 0x24
cmp esi, 0x70
jne 0x407c8b
or ebx, 0xffffffff
jmp 0x407c9b
cmp esi, 0x50
je 0x407c9b
cmp esi, 0xb7
je 0x407c9b
push 0xfffffffffffffffd
pop ebx
mov esi, dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::destructor_void_]
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call esi
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0
call esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call esi
mov eax, ebx
call fcn.0040f913
ret
Function at 0x407cc4
Capabilities:
Check if file exists
Copy file
Create directory
Get file attributes

Disassembly:
push 8
mov eax, 0x41112c
call fcn.0040f874
mov esi, dword [sym.imp.Common.dll_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const]
xor ebx, ebx
inc ebx
lea ecx, [ebp + 8]
mov dword [ebp - 4], ebx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push eax
call edi
cmp eax, 0xffffffff
jne 0x407d11
mov edi, ebx
mov esi, dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::destructor_void_]
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0
call esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call esi
mov eax, edi
call fcn.0040f913
ret
mov ebx, dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::constructor_class_CTXStringW_const__]
push ecx
lea eax, [ebp + 0xc]
mov ecx, esp
mov dword [ebp - 0x14], esp
push eax
call ebx
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.Common.dll_class_CTXStringW___cdecl_Util::FS::GetParentDir_class_CTXStringW_]
pop ecx
pop ecx
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
call esi
push eax
call edi
cmp eax, 0xffffffff
jne 0x407d50
push 0
lea ecx, [ebp - 0x10]
call esi
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
push dword [ebp + 0x10]
xor edi, edi
lea ecx, [ebp + 0xc]
inc edi
call esi
push eax
lea ecx, [ebp + 8]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x407dc3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push dword [ebp + 0xc]
lea eax, [ebp + 8]
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push eax
call ebx
push str.CopyFile___s__to___s__fail_ErrorCode_lu
push str.StorageTool
push 2
pop edi
push edi
push str.func
push 0x14b
push str.file
call fcn.00407b65
add esp, 0x24
cmp esi, 0x70
jne 0x407db3
or edi, 0xffffffff
jmp 0x407dc3
cmp esi, 0x50
je 0x407dc3
cmp esi, 0xb7
je 0x407dc3
push 0xfffffffffffffffd
pop edi
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::destructor_void_]
jmp 0x407cf1
Function at 0x407dd5
Capabilities:
Check if file exists
Create directory
Enumerate files on windows
Get file attributes

Disassembly:
push 0x26c
mov eax, 0x411189
call fcn.0040f8dd
mov esi, dword [sym.imp.Common.dll_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const]
xor edi, edi
inc edi
lea ecx, [ebp + 0xc]
mov dword [ebp - 4], edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x407e11
push 0
lea ecx, [ebp + 0xc]
call esi
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
and dword [ebp - 0x260], 0
push 0x24c
lea eax, [ebp - 0x25c]
push 0
push eax
mov dword [ebp - 0x270], edi
mov dword [ebp - 0x264], edi
call sub.MSVCR100.dll_memset
mov edi, dword [sym.imp.Common.dll_class_CTXStringW___cdecl_operator_class_CTXStringW_const___wchar_t_const__]
push 0x414960
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x278]
push eax
call edi
add esp, 0x18
lea eax, [ebp - 0x260]
push eax
lea ecx, [ebp - 0x278]
mov byte [ebp - 4], 2
call esi
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::destructor_void_]
mov dword [ebp - 0x274], eax
cmp eax, 0xffffffff
je 0x407fc2
mov ebx, dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::constructor_class_CTXStringW_const__]
cmp dword [ebp - 0x264], 0
je 0x407fb6
test byte [ebp - 0x260], 0x10
jne 0x407f80
lea eax, [ebp - 0x234]
push eax
push 0x414b5c
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x407f80
lea eax, [ebp - 0x234]
push eax
push 0x414b40
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x407f80
lea eax, [ebp - 0x234]
push eax
push str.CustomFaceRecv.db
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x407f80
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x26c]
push eax
call edi
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x268]
push eax
mov byte [ebp - 4], 3
call edi
add esp, 0x18
push 1
push ecx
lea eax, [ebp - 0x268]
mov ecx, esp
mov dword [ebp - 0x270], esp
push eax
mov byte [ebp - 4], 4
call ebx
push ecx
lea eax, [ebp - 0x26c]
mov ecx, esp
mov dword [ebp - 0x264], esp
push eax
mov byte [ebp - 4], 5
call ebx
mov byte [ebp - 4], 4
call fcn.00407cc4
add esp, 0xc
mov dword [ebp - 0x270], eax
cmp eax, 0xffffffff
je 0x407f9e
cmp eax, 0xfffffffd
je 0x407f9e
lea ecx, [ebp - 0x268]
mov byte [ebp - 4], 3
call esi
lea ecx, [ebp - 0x26c]
mov byte [ebp - 4], 2
call esi
lea eax, [ebp - 0x260]
push eax
push dword [ebp - 0x274]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov dword [ebp - 0x264], eax
jmp 0x407e87
lea ecx, [ebp - 0x268]
mov byte [ebp - 4], 3
call esi
lea ecx, [ebp - 0x26c]
mov byte [ebp - 4], 2
call esi
push dword [ebp - 0x274]
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp - 0x278]
mov byte [ebp - 4], 1
call esi
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0
call esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call esi
mov eax, dword [ebp - 0x270]
call fcn.0040f927
ret
Function at 0x4090b2
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x18
mov eax, 0x4114c7
call fcn.0040f874
push dword [ebp + 0x10]
mov esi, dword [sym.imp.Common.dll_class_CTXStringW___cdecl_operator_class_CTXStringW_const___wchar_t_const__]
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 4], 1
call esi
add esp, 0xc
mov edi, dword [reloc.Common.dll___YCTXStringW__QAEAAV0_PB_W_Z]
mov ebx, 0x414b70
push ebx
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
call edi
push dword [ebp + 0x10]
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
call esi
add esp, 0xc
push ebx
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 3
call edi
mov ebx, dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::constructor_class_CTXStringW_const__]
push ecx
lea eax, [ebp - 0x18]
mov ecx, esp
mov dword [ebp - 0x20], esp
push eax
call ebx
push ecx
lea eax, [ebp - 0x1c]
mov ecx, esp
mov dword [ebp - 0x10], esp
push eax
mov byte [ebp - 4], 4
call ebx
mov byte [ebp - 4], 3
call fcn.00407dd5
pop ecx
pop ecx
mov dword [ebp - 0x20], eax
cmp eax, 0xffffffff
je 0x409226
cmp eax, 0xfffffffd
je 0x409226
push dword [ebp + 0x10]
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x14]
push eax
call esi
add esp, 0xc
push 0x414c44
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 5
call edi
lea ecx, [ebp - 0x14]
call dword [sym.imp.Common.dll_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::destructor_void_]
cmp eax, 0xffffffff
je 0x4091f7
push dword [ebp + 0x10]
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.Common.dll_class_CTXStringW___cdecl_operator_class_CTXStringW_const___wchar_t_const__]
add esp, 0xc
cmp dword [0x4191e8], 0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x10]
je 0x4091b0
push 0x414c3c
jmp 0x4091b5
push 0x414c34
call edi
push 0x414c44
lea ecx, [ebp - 0x10]
call edi
push 1
push ecx
lea eax, [ebp - 0x10]
mov ecx, esp
mov dword [ebp - 0x20], esp
push eax
call ebx
push ecx
lea eax, [ebp - 0x14]
mov ecx, esp
mov dword [ebp - 0x24], esp
push eax
mov byte [ebp - 4], 7
call ebx
mov byte [ebp - 4], 6
call fcn.00407cc4
add esp, 0xc
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov byte [ebp - 4], 5
call esi
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 3
call esi
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 2
call esi
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call esi
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0
call esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call esi
jmp 0x409250
mov edi, dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::destructor_void_]
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 2
call edi
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call edi
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0
call edi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call edi
mov eax, dword [ebp - 0x20]
call fcn.0040f913
ret
Function at 0x40bead
Capabilities:
Delete directory
Enumerate files on windows

Disassembly:
push 0x26c
mov eax, 0x4118ac
call fcn.0040f8dd
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x26c], eax
xor edi, edi
push 0x24c
xor ebx, ebx
lea eax, [ebp - 0x25c]
push edi
inc ebx
push eax
mov dword [ebp - 4], edi
mov dword [ebp - 0x278], ebx
mov dword [ebp - 0x260], edi
call sub.MSVCR100.dll_memset
push 0x414960
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x268]
push eax
call dword [sym.imp.Common.dll_class_CTXStringW___cdecl_operator_class_CTXStringW_const___wchar_t_const__]
add esp, 0x18
mov esi, dword [sym.imp.Common.dll_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const]
lea eax, [ebp - 0x260]
push eax
lea ecx, [ebp - 0x268]
mov byte [ebp - 4], bl
call esi
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x264], eax
cmp eax, 0xffffffff
je 0x40c032
cmp ebx, edi
je 0x40c026
test byte [ebp - 0x260], 0x10
je 0x40c00c
mov ebx, dword [sym.imp.SHLWAPI.dll_StrCmpW]
push 0x414958
lea eax, [ebp - 0x234]
push eax
call ebx
test eax, eax
je 0x40c00c
push 0x414954
lea eax, [ebp - 0x234]
push eax
call ebx
test eax, eax
je 0x40c00c
lea eax, [ebp - 0x274]
push eax
lea eax, [ebp - 0x234]
push eax
mov dword [ebp - 0x274], edi
call dword [sym.imp.Common.dll_Ordinal_34]
pop ecx
pop ecx
cmp dword [ebp - 0x274], edi
je 0x40bfce
lea eax, [ebp - 0x278]
push eax
push dword [ebp - 0x26c]
lea eax, [ebp - 0x234]
push eax
push ecx
lea eax, [ebp + 8]
mov ecx, esp
mov dword [ebp - 0x270], esp
push eax
call dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::constructor_class_CTXStringW_const__]
call fcn.0040b669
add esp, 0x10
jmp 0x40c00c
lea eax, [ebp - 0x234]
push eax
push str.All_Users
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x40c00c
lea eax, [ebp - 0x278]
push eax
push dword [ebp - 0x26c]
lea eax, [ebp + 8]
push ecx
mov ecx, esp
mov dword [ebp - 0x270], esp
push eax
call dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::constructor_class_CTXStringW_const__]
call fcn.0040bbb7
add esp, 0xc
lea eax, [ebp - 0x260]
push eax
push dword [ebp - 0x264]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov ebx, eax
jmp 0x40bf32
push dword [ebp - 0x264]
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp + 8]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x40c07f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ecx
lea eax, [ebp + 8]
mov ecx, esp
mov dword [ebp - 0x270], esp
push eax
call dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::constructor_class_CTXStringW_const__]
push 0x414b88
push str.StorageTool
push 2
push str.func
push 0xa4d
push str.file
call fcn.00407b65
add esp, 0x20
mov esi, dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::destructor_void_]
lea ecx, [ebp - 0x268]
mov byte [ebp - 4], 0
call esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call esi
call fcn.0040f927
ret
Function at 0x40ec32
Capabilities:
Create process on windows

Disassembly:
push 0x14
mov eax, 0x411e64
call fcn.0040f874
mov esi, dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::constructor_void_]
lea ecx, [ebp - 0x10]
call esi
mov eax, 0x104
push eax
xor ebx, ebx
push eax
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], ebx
call dword [sym.imp.Common.dll_public:_wchar_t____thiscall_CTXStringW::GetBuffer_int_]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push eax
lea ecx, [ebp - 0x10]
call dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::ReleaseBuffer_int_]
push 0x5c
lea ecx, [ebp - 0x10]
call dword [sym.imp.Common.dll_public:_int___thiscall_CTXStringW::ReverseFind_wchar_t_const]
push eax
push ebx
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x10]
call dword [sym.imp.Common.dll_public:_class_CTXStringW___thiscall_CTXStringW::Mid_int__int_]
push str.QQ.exe
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::constructor_wchar_t_const__]
mov byte [ebp - 4], 2
cmp dword [0x4191e8], ebx
je 0x40ecb6
push str.TM.exe
lea ecx, [ebp - 0x14]
call dword [sym.imp.Common.dll_public:_class_CTXStringW____thiscall_CTXStringW::operator_wchar_t_const__]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.Common.dll_class_CTXStringW___cdecl_operator_class_CTXStringW_const___class_CTXStringW_const__]
add esp, 0xc
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 3
call esi
mov esi, dword [sym.imp.Common.dll_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const]
push 5
push ebx
lea ecx, [ebp - 0x18]
call esi
push eax
lea ecx, [ebp - 0x1c]
call esi
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov esi, dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::destructor_void_]
lea ecx, [ebp - 0x18]
call esi
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
call esi
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call esi
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], bl
call esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call esi
call fcn.0040f913
ret

Function at 0x40ed29
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push str.explorer.exe
lea ecx, [ebp - 4]
call dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::constructor_wchar_t_const__]
mov ecx, dword [ebp + 8]
mov esi, dword [sym.imp.Common.dll_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const]
push 5
push 0
call esi
push eax
lea ecx, [ebp - 4]
call esi
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 4]
call dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::destructor_void_]
pop esi
leave
ret
Function at 0x40ee57
Capabilities:
Delete file

Disassembly:
push 0x18
mov eax, 0x411e91
call fcn.0040f874
xor ebx, ebx
lea ecx, [ebp + 8]
mov dword [ebp - 4], ebx
call dword [sym.imp.Common.dll_public:_bool___thiscall_CTXStringW::IsEmpty_void_const]
lea ecx, [ebp + 8]
test al, al
je 0x40ee8a
or dword [ebp - 4], 0xffffffff
call dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::destructor_void_]
xor eax, eax
call fcn.0040f913
ret
push 1
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.Common.dll_public:_class_CTXStringW___thiscall_CTXStringW::Right_int_]
push 0x5c
push eax
call dword [sym.imp.Common.dll_bool___cdecl_operator__class_CTXStringW_const___wchar_t_]
mov esi, dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::destructor_void_]
pop ecx
pop ecx
lea ecx, [ebp - 0x18]
mov byte [ebp - 0xd], al
call esi
cmp byte [ebp - 0xd], bl
je 0x40eebf
push 0x5c
lea ecx, [ebp + 8]
call dword [sym.imp.Common.dll_public:_class_CTXStringW____thiscall_CTXStringW::operator_wchar_t_]
push str.temp.tmp
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.Common.dll_class_CTXStringW___cdecl_operator_class_CTXStringW_const___wchar_t_const__]
add esp, 0xc
xor eax, eax
push ebx
lea edi, [ebp - 0x20]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [sym.imp.Common.dll_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const]
push 0x80
push 2
lea eax, [ebp - 0x24]
push eax
push ebx
push 0xc0000000
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x24], 0xc
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
call edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x40ef2c
xor edi, edi
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], bl
call esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call esi
mov eax, edi
jmp 0x40ee84
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x14]
call edi
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor edi, edi
inc edi
jmp 0x40ef14